5 ms·
Americans like to complain about EU data protection laws because it makes it somewhat harder for your startup to handle customer data globally... But, you know
by pavlov 6y ago
Americans like to complain about EU data protection laws because it makes it somewhat harder for your startup to handle customer data globally...
But, you know, those same laws do a good job of preventing shit like this.
- throwaway894345 6y agoI kind of agree, but it seems like we ought to be able to prohibit at least the covert sale of customer data without going full GDPR. Could Americans at least try out a GDPR-lite before going all in on the more extensive provisions?
- triceratops 6y agoYou should ask your reps for GDPR because it'll be negotiated down to GDPR-lite during passage. If GDPR-lite is your opening position, you're not gonna get jack.
- lovehashbrowns 6y agoI can easily imagine the US "GDPR-lite" being something like an "independent" court that doesn't publish anything publicly except a final verdict, and companies like Facebook magically get a mix of low fines while smaller companies get absolutely fleeced on fines. And this "independent" court will mostly target Google and Microsoft while taking crumbs from Facebook. Coincidentally, Mark Zuckerberg will meet with the "independent" court frequently.
- throwaway894345 6y agoI think corporate power over our legal system is a separate problem. If we can't reign in corporations, then all hope is lost even if we magically pass full-blown GDPR (corporations will find and create loopholes, etc).
- throwaway894345 6y agoGood idea. Thanks for the suggestion!
- einpoklum 6y ago> it seems like we ought to be able to prohibit at least the covert sale of customer data without going full GDPR. The only effect this will have is making the sale of your data more overt rather than covert.
- throwaway894345 6y agoThat seems strictly better to me. If I know that one phone manufacturer sells my data and another doesn't, that makes my choice pretty easily. Presently I want to buy a TV, but I really can't tell which if any manufacturers aren't selling my data.
- einpoklum 6y ago> If I know that one phone manufacturer sells my data and another doesn't, that makes my choice pretty easily. Well if you know your telecommunications services provider sells your data and the only other one also does it (if there even is a second one), that also makes your choice pretty easy - albeit in a null kind of way.
- throwaway894345 6y agoSounds like a market opportunity. Someone gets to be the brand that doesn’t have the “Sells your data” warning sticker on the box, and there are enough people who care about this that Apple is marketing itself as a privacy focused company.
- einpoklum 6y agoI don't know the US telco situation well enough, but I would assume either it is not profitable enough to provide this service, or the physical infrastructure is private, and it is prohibitively expensive and socially-wasteful to install parallel infrastructure.
- yardie 6y agoAmericans have been marketed to by American marketing firms and consultants that the GDPR is difficult and costly to implement. As an American that worked in the EU and had to implement GDPR compliant systems there is so much FUD spread about it. A lot of it is company momentum to not implement the easy stuff, ie. "we've never encrypted our data. What if we forget the passwords?!" And the rest is ease of access, "marketing needs access to billing information. We've always been able to use it so why should we have to ask permission?"
- csunbird 6y agoGDPR is difficult and costly to implement actually. But this should not be a reason to not have it.
- yardie 6y agoParts of GDPR is difficult to implement. And if your business model involves those parts then it would be costly, ie. costing you business. Other parts are infosec best practices, anyone who is security conscious could look at it and say, "yeah, that makes sense."
- jaybrendansmith 6y agoI'm interested to know what parts are costly? I found it relatively easy to implement processes for 'right to be forgotten' and 'emergency breach notification' as well as the default opt-out of personal data and marketing. Not trivial, but not particularly expensive. The rest is exactly as you say, infosec best practice that my industry required in any case. The only expensive part I could see is right to be forgotten, that is if you expect to get a lot of requests for your particular application's use case.
- yardie 6y agoI’m curious to know as well. I don’t know all parts of GDPR, just the parts I worked on. But others keep telling me it’s super complicated so I’m just assuming there are complicated bits I’m unaware of.
- 6gvONxR4sf7o 6y agoI hate that so much. "Complying with your regional laws makes it harder for my business to scale!" As if gigantic jurisdiction spanning global/national firms were desirable things everyone wants. CCPA is a great example. If a company thinks it's hard to deal with California, I'm happy for them not to, and let a local firm pop up that delivers on the terms I want (CCPA compliance).
- marketingPro 6y agoThe issue is that you get less choice and the only winners are large corporations who can handle it. They know the regulations are tough, so they can corner the market and up charge accordingly. (Big) Profits are not made in competitive markets.