8 ms·

But at least GDPR /is/ tractable to implement at small scale. Whereas for the OSB: if you run a smallish but popular chat/blog/forum/etc service, there literall

But at least GDPR /is/ tractable to implement at small scale. Whereas for the OSB: if you run a smallish but popular chat/blog/forum/etc service, there literally isn’t a solution for moderation which isn’t fiendishly expensive, privacy invasive, or both. The legislation has clearly been dreamt up by folks saying “ah ha! if we threaten the Facebook UK executive mangement team with jailtime unless they do better at filtering self-harm/CSAM/terrorism/etc then they will obviously get their house in order!”. Whereas in practice they crush their own UK-based startups instead. So frustrating.

KingOfCoders 5y ago
GDPR is only tractable because 90% of companies don't implement it. In Germany thousands of companies illegally use Mailchimp for example.
- LeftTriangle 5y ago
  I like how you, with actual concrete real-world experiences you are sharing, are being downvoted by silent armchair enthusiasts who mostly just like GDPR because they get the sense that it’s vaguely bad for Facebook.
  - KingOfCoders 5y ago
    As a private citizen I like GDPR - even if Facebook will find ways around it (but I do not really care, I've left Facebook many years ago because of privacy concerns). As someone who implemented it in several companies, I don't like it because it hits smaller companies much harder than bigger ones, and because it tries to be technology agnostic it is quite fuzzy, compate to something like SOX or PCIDSS (which I also implemented as CTO). In Germany at least data protection agencies declared they will go after companies that use e.g. Mailchimp.
    - tekknik 5y ago
      As both a private citizen, and one who implements it, I hate it. It’s increased regulation around a subject that I was not doing in the first place (I don’t care what you’re doing online, never tracked, etc) that only increased the cost of business. We need more competition, not less.
      - TheManInThePub 5y ago
        > It’s increased regulation around a subject that I was not doing in the first place Maybe you were handling personal data correctly. Very many were not (witness numerous data breaches and private data exploited that was held for no reason). Therefore regulation was needed. > We need more competition Competition is good. A race to the bottom is not.
        tekknik 5y ago
        Where does relaxed regulation and the reintroduction of morality into business mean a race to the bottom? It also could’ve been implemented in such a way where there were no required new positions and the gov spent tax dollars to write a greatly detailed dummies guide to GDPR, how to implement it, etc so that smaller companies without the resources would have just as much of an advantage.
- hrktb 5y ago
  I am curious what about Mailchimp make them illegal to use ? On the face of it they seem to have support for the required stuff: https://mailchimp.com/gdpr/ https://mailchimp.com/gdpr/
  - hyperman1 5y ago
    I was also curious, so I found this: https://edpb.europa.eu/news/national-news/2021/bavarian-dpa-baylda-calls-german-company-cease-use-mailchimp-tool_en https://edpb.europa.eu/news/national-news/2021/bavarian-dpa-... The core: ... transfers of personal data to the U.S.- were not lawful. So the problem is that an US company cannot be GDPR compliant, because that conflicts with US law. Which sucks for mailchimp but makes sense.
    - deleted 5y ago
      [deleted]
    - kjakm 5y ago
      A US company can be compliant. They just have to host EU user data in the EU.
      - hrktb 5y ago
        Judging from this > Mailchimp may in principle be subject to data access by US intelligence services on the basis of the US legal provision FISA702 (50 U.S.C. § 1881) It might not be just a matter of where the data is stored, but also who can get access to it. From my reading, any US based conpany would be affected. This feels like a super huge impact that would have made more waves, but the ruling also seems recent. And perhaps there will be more twists and turns yet ?
        majewsky 5y ago
        There was a contract between the US and EU that was supposed to address this: https://en.wikipedia.org/wiki/EU%E2%80%93US_Privacy_Shield https://en.wikipedia.org/wiki/EU%E2%80%93US_Privacy_Shield As described in the Wikipedia article, the contract has been thrown out by the European Court of Justice for exactly the reasons stated by the parent comment. > [Standard contractual clauses] do not necessarily protect data in countries where the law is fundamentally incompatible with the Charter of Fundamental Rights of the EU and the GDPR, like the US.
- duiker101 5y ago
  What makes Mailchimp illegal? From what I can see they seem GDPR compliant
  - KingOfCoders 5y ago
    They can't be GDPR compliant if they can't prevent US three letter agencies from accessing their data - or more to the point, EU citizien need to be able to get to court with US three letter agencies to administer their rights, which they can't for various reasons, one of them that they don't know because the US has secret courts.
tekknik 5y ago
> The legislation has clearly been dreamt up by folks saying “ah ha! if we threaten the Facebook UK executive mangement team with jailtime unless they do better at filtering self-harm/CSAM/terrorism/etc then they will obviously get their house in order!”. Whereas in practice they crush their own UK-based startups instead. So frustrating. Isn’t that exactly what the GDPR did? I know I pulled my apps for fear of fines and jailtime that might lead to the first country Im not allowed into.
- cutemonster 5y ago
  GDPR is pretty harmless and relatively easy to implement I think
  - KingOfCoders 5y ago
    What was particullary easy implementing GDPR for you? I found some areas particullary hard. Legitimate interest is a minefild and mostly can't be used, except e.g. delivery addresses. Finding GDPR compliant companies - with the US out of question - was also hard. Tracking and deleting data on request when storing in dozens of systems was hard - even returning all the data stored in dozens of external SaaS companies was hard (logging what you send them helps here, but doesn't address their tracking generation). They often don't give you everything you store with them back - deletion is often much easier. Tracking data in backups that needed to be cleaned on restore due to deletion requests was difficult to implement - easy in one, complicated in dozens of systems. Especially hard with AWS. These are the most challenging I had on hand when implementing GDPR.
    - cutemonster 5y ago
      > What was particullary easy implementing GDPR for you? Deleting people's private data upon request, namely when they click a button -- in my case (unlike yours) there's not many places to delete the data from. The most challenging thing is instead writing a DPA, and wondering what to write about inspections and auditing, in a remote only company with servers in the cloud (any thoughts about that?)

KingOfCoders 5y ago

GDPR is only tractable because 90% of companies don't implement it. In Germany thousands of companies illegally use Mailchimp for example.

LeftTriangle 5y ago
I like how you, with actual concrete real-world experiences you are sharing, are being downvoted by silent armchair enthusiasts who mostly just like GDPR because they get the sense that it’s vaguely bad for Facebook.
- KingOfCoders 5y ago
  As a private citizen I like GDPR - even if Facebook will find ways around it (but I do not really care, I've left Facebook many years ago because of privacy concerns). As someone who implemented it in several companies, I don't like it because it hits smaller companies much harder than bigger ones, and because it tries to be technology agnostic it is quite fuzzy, compate to something like SOX or PCIDSS (which I also implemented as CTO). In Germany at least data protection agencies declared they will go after companies that use e.g. Mailchimp.
  - tekknik 5y ago
    As both a private citizen, and one who implements it, I hate it. It’s increased regulation around a subject that I was not doing in the first place (I don’t care what you’re doing online, never tracked, etc) that only increased the cost of business. We need more competition, not less.
    - TheManInThePub 5y ago
      > It’s increased regulation around a subject that I was not doing in the first place Maybe you were handling personal data correctly. Very many were not (witness numerous data breaches and private data exploited that was held for no reason). Therefore regulation was needed. > We need more competition Competition is good. A race to the bottom is not.
      - tekknik 5y ago
        Where does relaxed regulation and the reintroduction of morality into business mean a race to the bottom? It also could’ve been implemented in such a way where there were no required new positions and the gov spent tax dollars to write a greatly detailed dummies guide to GDPR, how to implement it, etc so that smaller companies without the resources would have just as much of an advantage.
hrktb 5y ago
I am curious what about Mailchimp make them illegal to use ? On the face of it they seem to have support for the required stuff: https://mailchimp.com/gdpr/ https://mailchimp.com/gdpr/
- hyperman1 5y ago
  I was also curious, so I found this: https://edpb.europa.eu/news/national-news/2021/bavarian-dpa-baylda-calls-german-company-cease-use-mailchimp-tool_en https://edpb.europa.eu/news/national-news/2021/bavarian-dpa-... The core: ... transfers of personal data to the U.S.- were not lawful. So the problem is that an US company cannot be GDPR compliant, because that conflicts with US law. Which sucks for mailchimp but makes sense.
  - deleted 5y ago
    [deleted]
  - kjakm 5y ago
    A US company can be compliant. They just have to host EU user data in the EU.
    - hrktb 5y ago
      Judging from this > Mailchimp may in principle be subject to data access by US intelligence services on the basis of the US legal provision FISA702 (50 U.S.C. § 1881) It might not be just a matter of where the data is stored, but also who can get access to it. From my reading, any US based conpany would be affected. This feels like a super huge impact that would have made more waves, but the ruling also seems recent. And perhaps there will be more twists and turns yet ?
      - majewsky 5y ago
        There was a contract between the US and EU that was supposed to address this: https://en.wikipedia.org/wiki/EU%E2%80%93US_Privacy_Shield https://en.wikipedia.org/wiki/EU%E2%80%93US_Privacy_Shield As described in the Wikipedia article, the contract has been thrown out by the European Court of Justice for exactly the reasons stated by the parent comment. > [Standard contractual clauses] do not necessarily protect data in countries where the law is fundamentally incompatible with the Charter of Fundamental Rights of the EU and the GDPR, like the US.
duiker101 5y ago
What makes Mailchimp illegal? From what I can see they seem GDPR compliant
- KingOfCoders 5y ago
  They can't be GDPR compliant if they can't prevent US three letter agencies from accessing their data - or more to the point, EU citizien need to be able to get to court with US three letter agencies to administer their rights, which they can't for various reasons, one of them that they don't know because the US has secret courts.

tekknik 5y ago

> The legislation has clearly been dreamt up by folks saying “ah ha! if we threaten the Facebook UK executive mangement team with jailtime unless they do better at filtering self-harm/CSAM/terrorism/etc then they will obviously get their house in order!”. Whereas in practice they crush their own UK-based startups instead. So frustrating. Isn’t that exactly what the GDPR did? I know I pulled my apps for fear of fines and jailtime that might lead to the first country Im not allowed into.

cutemonster 5y ago
GDPR is pretty harmless and relatively easy to implement I think
- KingOfCoders 5y ago
  What was particullary easy implementing GDPR for you? I found some areas particullary hard. Legitimate interest is a minefild and mostly can't be used, except e.g. delivery addresses. Finding GDPR compliant companies - with the US out of question - was also hard. Tracking and deleting data on request when storing in dozens of systems was hard - even returning all the data stored in dozens of external SaaS companies was hard (logging what you send them helps here, but doesn't address their tracking generation). They often don't give you everything you store with them back - deletion is often much easier. Tracking data in backups that needed to be cleaned on restore due to deletion requests was difficult to implement - easy in one, complicated in dozens of systems. Especially hard with AWS. These are the most challenging I had on hand when implementing GDPR.
  - cutemonster 5y ago
    > What was particullary easy implementing GDPR for you? Deleting people's private data upon request, namely when they click a button -- in my case (unlike yours) there's not many places to delete the data from. The most challenging thing is instead writing a DPA, and wondering what to write about inspections and auditing, in a remote only company with servers in the cloud (any thoughts about that?)