4 ms·

> because they can't afford to get on the wrong side of the law on this aspect. Conversely, some can't afford to get on the right side of the law on this aspec

> because they can't afford to get on the wrong side of the law on this aspect. Conversely, some can't afford to get on the right side of the law on this aspect. In our case, we had ~15 customers in the EU (out of ~2000), totaling $2,000/mo MRR. After talking with our legal counsel, we decided to exit the EU market entirely. Our business model was a simple niche B2B SaaS. We never sold, shared, or traded any data of any kind. When we fired our EU customers, they were very upset! They assumed we were doing something "shady", which wasn't the case at all. The regulatory burden simply wasn't worth the relatively small MRR. The quotes provided for a third-party DPO was higher than our revenue in the market, and the only other option was for me (an overworked founder) to take on that role, and I valued my time higher than that MRR. Those customers lost out, because after we exited, so did every other player in our niche. Nobody wanted to deal with it.

trulyme 6y ago
Cool! Care to share the niche? P.S.: no opportunity is lost. There is always someone else who seizes it. :)
- jariel 6y ago
  "P.S.: no opportunity is lost. There is always someone else who seizes it. :)" I'm sure these corporations want a random person in HN to provide service to 12 customers? It's false to suggest that material barriers to providing services are only contextually relevant. It's a permanent tax and it's real.
newswasboring 6y ago
Is there no open source effort to make this easy? Or is it one of those instances where people want to do it but don't want to take the legal stands (which is completely understandable). Edit: Also if you are not selling/using this data, why can't you remove everything but session cookies? Please note I'm not a web developer so the answer can just be because it's too much work.
- leesalminen 6y ago
  For us, the issue wasn’t a technical one. It was a human one. Our lawyers said we had to appoint a “Data Protection Officer” who’s job it is to respond to requests from EU persons to delete their data. We were a small company and everyone had enough on their plate as it was. Adding more work to keep <1% of revenue wasn’t worth it.
  - lol768 6y ago
    I think I can count on one hand the number of right-to-be-forgotten requests the team I work with has ever received in the last three years (with 15x the users). We've had a couple more subject access requests than that, but we'd already shipped pretty comprehensive self-service tools for retrieving data that met the vast majority of our user's needs. This doesn't seem like an unreasonable thing to expect a service to offer, IMO. I would argue that the duties of a DPO is not more work than a small company could handle and indeed, it's slightly odd to me that a small company would think that a small handful of data erasure requests or subject access requests are a) somehow difficult to do given 30 days notice and b) somehow consume more time than the profit left over on $24k revenue buys? Most companies here in the UK just take it in their stride and have no problems complying.
    - leesalminen 6y ago
      Unsure of how you extrapolated the total number of users from my previous statements. We were a B2B SaaS where our customers each served 10,000s of end users, who also had access to our platform with their data stored within. In aggregate we’re talking 25mm+ total users in my case. At the time, being that the DPO role was new we didn’t know how many requests to expect. And while the law may allow for 30 days, our customers wouldn’t take it well if it took us longer than a couple days (our customer service SLA was 24 hr first resolution time). Their customers would complain to our customer who in turn would complain to us. If we make our customers look bad, we hear about it loudly and clearly. To each their own, I suppose. From my perspective as an overworked founder, with a small team, growing at >200%/yr, we didn’t see the need to take on additional work just to maintain a very small revenue stream I don’t fault companies for wanting to remain in the EU market, but for us, it didn’t make much sense at the time as our real growth opportunity lay in the Us/Canada (mostly due to consumer habits in the region). I have no issue with the spirit of GDPR, and as a human, I support it personally. But, for my business at that point in time, it didn’t make economic sense to comply, so we left.

trulyme 6y ago

Cool! Care to share the niche? P.S.: no opportunity is lost. There is always someone else who seizes it. :)

jariel 6y ago
"P.S.: no opportunity is lost. There is always someone else who seizes it. :)" I'm sure these corporations want a random person in HN to provide service to 12 customers? It's false to suggest that material barriers to providing services are only contextually relevant. It's a permanent tax and it's real.

newswasboring 6y ago

Is there no open source effort to make this easy? Or is it one of those instances where people want to do it but don't want to take the legal stands (which is completely understandable). Edit: Also if you are not selling/using this data, why can't you remove everything but session cookies? Please note I'm not a web developer so the answer can just be because it's too much work.

leesalminen 6y ago
For us, the issue wasn’t a technical one. It was a human one. Our lawyers said we had to appoint a “Data Protection Officer” who’s job it is to respond to requests from EU persons to delete their data. We were a small company and everyone had enough on their plate as it was. Adding more work to keep <1% of revenue wasn’t worth it.
- lol768 6y ago
  I think I can count on one hand the number of right-to-be-forgotten requests the team I work with has ever received in the last three years (with 15x the users). We've had a couple more subject access requests than that, but we'd already shipped pretty comprehensive self-service tools for retrieving data that met the vast majority of our user's needs. This doesn't seem like an unreasonable thing to expect a service to offer, IMO. I would argue that the duties of a DPO is not more work than a small company could handle and indeed, it's slightly odd to me that a small company would think that a small handful of data erasure requests or subject access requests are a) somehow difficult to do given 30 days notice and b) somehow consume more time than the profit left over on $24k revenue buys? Most companies here in the UK just take it in their stride and have no problems complying.
  - leesalminen 6y ago
    Unsure of how you extrapolated the total number of users from my previous statements. We were a B2B SaaS where our customers each served 10,000s of end users, who also had access to our platform with their data stored within. In aggregate we’re talking 25mm+ total users in my case. At the time, being that the DPO role was new we didn’t know how many requests to expect. And while the law may allow for 30 days, our customers wouldn’t take it well if it took us longer than a couple days (our customer service SLA was 24 hr first resolution time). Their customers would complain to our customer who in turn would complain to us. If we make our customers look bad, we hear about it loudly and clearly. To each their own, I suppose. From my perspective as an overworked founder, with a small team, growing at >200%/yr, we didn’t see the need to take on additional work just to maintain a very small revenue stream I don’t fault companies for wanting to remain in the EU market, but for us, it didn’t make much sense at the time as our real growth opportunity lay in the Us/Canada (mostly due to consumer habits in the region). I have no issue with the spirit of GDPR, and as a human, I support it personally. But, for my business at that point in time, it didn’t make economic sense to comply, so we left.