2 ms·

GDPR really isn’t that complicated for most purposes - it boils down to: tell your users what data you store; let them delete their data if they want; let them

GDPR really isn’t that complicated for most purposes - it boils down to: tell your users what data you store; let them delete their data if they want; let them export their data if they want. Which is not exactly unreasonable - the only scary thing was being obligated to do it by law with threats of fines if you didn’t. It wasn’t that hard to put together, particularly if you’re a normal centralised website or app that they were aiming at. Whereas the OSB is: “if you run a service which lets users distribute ‘harmful’ content, then you’ll get pulled up in court. Plus it’s up to you to figure out what ‘harmful’ is; you’ll know it when you see it.”. Which sounds like the opening premise of a Black Mirror episode.

KingOfCoders 5y ago
I would agree in principle, in Germany/EU there is this ongoing discussion about making a carrier ("forum") responsible - which will lead to upload-filter SaaS, the way PWC does audits. Still you can fail for accounting after an PWC audit (too many public examples), but most companies that don't actively try to break the law feel kind of safe with a PWC audit. I would assume it's the same when you let an upload-filter company audit your content (but increases cost, just like PWC). With GDPR on the other hand you can't use any US company with your customer PI data in the US and US companies hosting in the EU is a gray zone [1]. It is a challenge to find equivalent companies in the EU, e.g. good luck finding a equivalent competitor to Unbounce or Webflow. It works for MailChimp (e.g. Sendinblue) and ZenDesk, but not for some other dependencies you might have. [1] https://en.wikipedia.org/wiki/CLOUD_Act https://en.wikipedia.org/wiki/CLOUD_Act rejections by companies need to be tested in court
tweetle_beetle 5y ago
> GDPR really isn’t that complicated for most purposes You're coming at it from a position of knowledge and confidence. The guide produced by the Information Commissioner's Office for organisations has 48 sections/pages [1] and features a toolkit with 7 different self assessment quizes [2], plus an extra one to help small businesses [3]. Even the "What is personal data?" section of the site alone contains dozens of pages [4]. And obviously the regulation itself is pretty verbose [5]. Given the legal ramifications, it's a bit dismissive to say it just boils down to three phrases. Whether or not GDPR is reasonable (and I agree that it is), it's perfectly understandable that sole traders and small businesses are concerned about the resources required to understand and implement it - especially when even many large organisations currently flout it (through ignorance or negligence). [1] https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/ https://ico.org.uk/for-organisations/guide-to-data-protectio... [2] https://ico.org.uk/for-organisations/sme-web-hub/checklists/data-protection-self-assessment/ https://ico.org.uk/for-organisations/sme-web-hub/checklists/... [3] https://ico.org.uk/for-organisations/sme-web-hub/checklists/assessment-for-small-business-owners-and-sole-traders/ https://ico.org.uk/for-organisations/sme-web-hub/checklists/... [4] https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/what-is-personal-data/ https://ico.org.uk/for-organisations/guide-to-data-protectio... [5] https://www.legislation.gov.uk/eur/2016/679/contents https://www.legislation.gov.uk/eur/2016/679/contents
- Arathorn 5y ago
  Okay, fair enough - I agree that GDPR is certainly scary and daunting. But once you get past that, it is still something that can practically be implemented by small businesses, and generally improves things for users. My whole point here is that the Online Safety Bill cannot be practically implemented by anyone other than massive businesses, and even then it implicitly requires massive privacy violations. Which puts in a completely different class of problem to implementing GDPR.
  - KingOfCoders 5y ago
    There will be SaaS companies soon that audit your content for you [1], the same as accounting companies that audit your taxes, because the tax code is too complicated for you to get right. If you do this an executive and not try to circumvent or game this (like with taxes), there should be no jail time for you. [1] not that I do like giving that power to content-auditing-companies.

KingOfCoders 5y ago

I would agree in principle, in Germany/EU there is this ongoing discussion about making a carrier ("forum") responsible - which will lead to upload-filter SaaS, the way PWC does audits. Still you can fail for accounting after an PWC audit (too many public examples), but most companies that don't actively try to break the law feel kind of safe with a PWC audit. I would assume it's the same when you let an upload-filter company audit your content (but increases cost, just like PWC). With GDPR on the other hand you can't use any US company with your customer PI data in the US and US companies hosting in the EU is a gray zone [1]. It is a challenge to find equivalent companies in the EU, e.g. good luck finding a equivalent competitor to Unbounce or Webflow. It works for MailChimp (e.g. Sendinblue) and ZenDesk, but not for some other dependencies you might have. [1] https://en.wikipedia.org/wiki/CLOUD_Act https://en.wikipedia.org/wiki/CLOUD_Act rejections by companies need to be tested in court

tweetle_beetle 5y ago

> GDPR really isn’t that complicated for most purposes You're coming at it from a position of knowledge and confidence. The guide produced by the Information Commissioner's Office for organisations has 48 sections/pages [1] and features a toolkit with 7 different self assessment quizes [2], plus an extra one to help small businesses [3]. Even the "What is personal data?" section of the site alone contains dozens of pages [4]. And obviously the regulation itself is pretty verbose [5]. Given the legal ramifications, it's a bit dismissive to say it just boils down to three phrases. Whether or not GDPR is reasonable (and I agree that it is), it's perfectly understandable that sole traders and small businesses are concerned about the resources required to understand and implement it - especially when even many large organisations currently flout it (through ignorance or negligence). [1] https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/ https://ico.org.uk/for-organisations/guide-to-data-protectio... [2] https://ico.org.uk/for-organisations/sme-web-hub/checklists/data-protection-self-assessment/ https://ico.org.uk/for-organisations/sme-web-hub/checklists/... [3] https://ico.org.uk/for-organisations/sme-web-hub/checklists/assessment-for-small-business-owners-and-sole-traders/ https://ico.org.uk/for-organisations/sme-web-hub/checklists/... [4] https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/what-is-personal-data/ https://ico.org.uk/for-organisations/guide-to-data-protectio... [5] https://www.legislation.gov.uk/eur/2016/679/contents https://www.legislation.gov.uk/eur/2016/679/contents

Arathorn 5y ago
Okay, fair enough - I agree that GDPR is certainly scary and daunting. But once you get past that, it is still something that can practically be implemented by small businesses, and generally improves things for users. My whole point here is that the Online Safety Bill cannot be practically implemented by anyone other than massive businesses, and even then it implicitly requires massive privacy violations. Which puts in a completely different class of problem to implementing GDPR.
- KingOfCoders 5y ago
  There will be SaaS companies soon that audit your content for you [1], the same as accounting companies that audit your taxes, because the tax code is too complicated for you to get right. If you do this an executive and not try to circumvent or game this (like with taxes), there should be no jail time for you. [1] not that I do like giving that power to content-auditing-companies.