3 ms·

GDPR, or CCPA, isn't all that costly as long as you stop thinking of user data as something for you to harvest, mine, resell and profit from. If you instead tre

GDPR, or CCPA, isn't all that costly as long as you stop thinking of user data as something for you to harvest, mine, resell and profit from. If you instead treat user data like a security liability, system designs and trade-offs will flow from there. They'll help ensure you design systems that minimise collection and anonymise things early, remove data promptly when no longer needed, and make it easy to audit what data you do hold which in turns makes supporting GDPR requests easy. The largest cost of GDPR is making that shift for existing companies. If GDPR ends up killing a few companies because of that, I personally don't mind. And if a startup doesn't end up seeing the light of day because it's not possible for them to operate under the conditions that GDPR imposes, then from my point of view the GDPR is doing what I'd like it to do.

anshorei 5y ago
It's possible for you to be in violation of GDPR without "thinking of user data as something for you to harvest, mine, resell and profit from". If it's "killing a few companies" and "a startup doesn't end up seeing the light" then "GDPR is doing what I'd like it to do." That's a pretty shitty opinion to hold. What did those companies and startups do wrong? I'm as tired of stupid startups as the next person, but I won't cheer for their failure unless they actually do something wrong.
- 3np 5y ago
  How about adding third-party analytics integrations that compromise your visitors, tracks them around the web, and fail to protect that data properly as the analytics company gets acquired by another entity? Stop saving PII for profit/exploitation reasons and you're in the clear.
- account42 5y ago
  > What did those companies and startups do wrong? Well for one, they ignored users and the authorities asking them to stop their illegal data collection. No company is getting "killed" or even fined at all when they are not actively refusing to get compliant.
  - DanBC 5y ago
    Especially in the UK where ICO hasn't taken any GDPR enforcement action for like 6 months.
Permit 5y ago
> If you instead treat user data like a security liability > minimise collection > anonymise things early > remove data promptly when no longer needed, > make it easy to audit what data you do hold These (and others) are the costs I am speaking of. The vast majority of HN commenters will tell you that these costs are worth the upside in user privacy (which is totally fine!). My point here is that the costs are not fixed. Over the decades we will see other, often sensible costs added to this list. While each individual cost may be small, they do accumulate and they influence who can and cannot start a business (or even personal website!) that deals with individuals from the EU. Large companies will always be able to pay these costs. Some small companies may not. What you make of this is up to your personal interpretation, but I will miss the web of 00's where it felt like anyone could build a website or online business with next to no overhead.
throwaway3699 5y ago
My grandma runs an online web store. She wants to know how many customers are converting and what products are popular, so I put Google Analytics on the site. Despite the issues with having to collect data, it's all she can afford to do (and quite frankly, cannot afford not to). The infrastructure to do analytics this easily does not exist - unless you expect a 65 yr old to trawl through Apache logs on the command line? Extrapolate that to everything from audits, logging, anonymization of data and of course it's going to push people to use centralized solutions. From my perspective open source communities seem to have an ideological issue against analytics and business data, so very few solutions exist outside of big tech. What am I to do?

anshorei 5y ago

It's possible for you to be in violation of GDPR without "thinking of user data as something for you to harvest, mine, resell and profit from". If it's "killing a few companies" and "a startup doesn't end up seeing the light" then "GDPR is doing what I'd like it to do." That's a pretty shitty opinion to hold. What did those companies and startups do wrong? I'm as tired of stupid startups as the next person, but I won't cheer for their failure unless they actually do something wrong.

3np 5y ago
How about adding third-party analytics integrations that compromise your visitors, tracks them around the web, and fail to protect that data properly as the analytics company gets acquired by another entity? Stop saving PII for profit/exploitation reasons and you're in the clear.
account42 5y ago
> What did those companies and startups do wrong? Well for one, they ignored users and the authorities asking them to stop their illegal data collection. No company is getting "killed" or even fined at all when they are not actively refusing to get compliant.
- DanBC 5y ago
  Especially in the UK where ICO hasn't taken any GDPR enforcement action for like 6 months.

Permit 5y ago

> If you instead treat user data like a security liability > minimise collection > anonymise things early > remove data promptly when no longer needed, > make it easy to audit what data you do hold These (and others) are the costs I am speaking of. The vast majority of HN commenters will tell you that these costs are worth the upside in user privacy (which is totally fine!). My point here is that the costs are not fixed. Over the decades we will see other, often sensible costs added to this list. While each individual cost may be small, they do accumulate and they influence who can and cannot start a business (or even personal website!) that deals with individuals from the EU. Large companies will always be able to pay these costs. Some small companies may not. What you make of this is up to your personal interpretation, but I will miss the web of 00's where it felt like anyone could build a website or online business with next to no overhead.

throwaway3699 5y ago

My grandma runs an online web store. She wants to know how many customers are converting and what products are popular, so I put Google Analytics on the site. Despite the issues with having to collect data, it's all she can afford to do (and quite frankly, cannot afford not to). The infrastructure to do analytics this easily does not exist - unless you expect a 65 yr old to trawl through Apache logs on the command line? Extrapolate that to everything from audits, logging, anonymization of data and of course it's going to push people to use centralized solutions. From my perspective open source communities seem to have an ideological issue against analytics and business data, so very few solutions exist outside of big tech. What am I to do?