5 ms·

Some will say "I told you so, they still do not get fined harshly enough to make any difference" while others will say "this is just unfair money grabbing gover

by Dah00n 5y ago

Some will say "I told you so, they still do not get fined harshly enough to make any difference" while others will say "this is just unfair money grabbing governments" and while everyone argues back and forth with the same arguments as the last ten discussions I sit here on the sidelines, a normal internet user, who by the simple mentioning of GDPR have gotten big companies, like Epic, and powerful people, like a CEO of a pretty big company, to actually do something where they before would totally have ignored me. GDPR is not perfect at all but it does do a heck of a difference already. Edit: Downvotes, really? :/

jchw 5y ago
It still basically does not differentiate between Epic Games and me. And I can’t handle the fines. The chilling effect this will have on people is being downplayed pretty harshly by people who are basically suggesting you should just pray that you don’t get put into massive debt because you made a mistake on a side project. For that reason, GDPR will always draw some ire from me.
- sealeck 5y ago
  Don't let people enter their data onto your side projects unless you're willing to treat it responsibly?
  - jchw 5y ago
    Intent doesn’t matter; the fear is the same: life-destroying fines. If that’s the choice, I’d just opt out of taking EU customers.
    - Hamuko 5y ago
      How many examples of life-destroying fines do you have?
      - jchw 5y ago
        So basically, you’re in the “No, it’s fine — this will only ever get used against bad guys!” camp. We had 9/11 here in America and the BS that followed and I don’t humor this line of thinking. (Nor humour.)
        Hamuko 5y ago
        No, I'm in the "prove that the thing you are claiming to happen actually happens" camp.
        jchw 5y ago
        I’m not claiming something happened — do you understand how chilling effects work? The threat of potentially massive fines with very little legal bounds for not following regulations that individuals basically can’t follow means that people who want to follow the rules but aren’t big enough don’t play anymore.
        Hamuko 5y ago
        So no one's life has ever been ruined by the GDPR? But you're still sure that this will happen? What is this based on?
        jchw 5y ago
        I can get fined between 0 and €20 million at any moment because I am an individual and have no means to fully understand GDPR nor hire a DPO for my stupid personal websites. I make no money in ads or otherwise, but I am still treated like Epic Games if I collect sign up emails or logs. I only still run this stuff now because I’ve been running it for over a decade. I can tell you right now I am hesitant to run websites anymore. If you don’t understand how “ambiguous threat of a fine” isn’t calmed by “it hasn’t happened yet,” I can’t help you. What if my site was politically controversial? Should I trust all EU governments to act responsibly and not take advantage of their power ever?
    - tgsovlerkhgsel 5y ago
      Can you show me one example where there was a "life-destroying" fine? Not "a big company was fined an amount of money that would be life destroying if I had to pay it for a personal project", because revenue/economic means are a key factor in GDPR fine calculation.
    - anoncake 5y ago
      Maybe it doesn't in America. Here it does.
- Hamuko 5y ago
  My name, my address, my phone number and my credit card details are the same regardless whether you or Epic Games is storing them in a database.
  - jchw 5y ago
    A data breach alone is not a GDPR violation as far as I know. Your data is just as at risk of being exposed no matter what. As far as I can tell the intent of GDPR is to prevent companies from selling or using your data in ways that you did not consent to. However, the bookkeeping requirements quite literally break the internet that existed where one person could run a website. As it turns out, I do not have a Data Protection Officer for my wiki I started in 2008. Does that mean I am not GDPR compliant?
    - amichal 5y ago
      And you dont need to have one: .... hiring an actual Data Protection Officer is only required by the GDPR if you meet one of three criteria: * Public authority — The processing of personal data is done by a public body or public authorities, with exemptions granted to courts and other independent judicial authorities. * Large scale, regular monitoring — The processing of personal data is the core activity of an organization who regularly and systematically observes its “data subjects” (which, under the GDPR, means citizens or residents of the EU) on a large scale. * Large-scale special data categories — The processing of specific “special” data categories (as defined by the GDPR) is part of an organization’s core activity and is done on a large scale. https://gdpr.eu/data-protection-officer/ https://gdpr.eu/data-protection-officer/
      - jchw 5y ago
        This is good to know. But while I will admit my mistake, the problem points to a bigger issue, which is, as a layperson and not an expert on European law, I simply do not have the expertise necessary to understand the law and its implications. This is of course true of any website under any jurisdiction, but most laws don’t come with such absurdly vicious teeth, and therefore the risk profile is a lot different. So perhaps my example was misinformed. But that’s kind of the problem: you need to have a lawyer to really be sure of these things. I don’t have a lawyer.
- hkh28 5y ago
  GDPR fines are set among other things according to the resources of the entity that broke the rules. As a private person making a side project, you won't be liable for millions. The most recent examples of individuals being fined have been fines around €200 [0] [0] https://gdprhub.eu/index.php?title=ANSPDCP_(Romania)_-_Fine_against_a_natural_person&mtc=today https://gdprhub.eu/index.php?title=ANSPDCP_(Romania)_-_Fine_...
  - jchw 5y ago
    The maximums however, are absolutely insane. Am I supposed to just hope that in the range of 0 to €20 million, it’s something I can afford?
    - tephra 5y ago
      Getting a maximum fine not only means that your handling of personal data was especially egregious but that you probably didn't cooperate in any ways with the relevant DPA and refused to rectify the problem. I.e the maximum fine is highly unlikely for anyone to get, and if you get it you have done some very bad things.
      - jchw 5y ago
        Yes, and what the GDPR crowd is telling me is that I should just trust the EU to always act fairly and never engage in any kind of politically motivated subterfuge. And not only that, my concerns and dissent regarding GDPR piss people off so much, that at this point, every comment I post just gets downvoted immediately. Now I realize it’s against HN guidelines to discuss this, but when I post a comment and the delay it takes for me to return from the post page is enough for my comment to already have a downvote, I feel discouraged. It’s very clear the person who did that had no good faith intent on a discussion nor intent to even minimally read my comment. And I’m supposed to try to argue my points in good faith despite this. The pro-GDPR crowd may be winning the mindshare but they are inheriting the cancer of something not allowed to be criticized. And if we ever do see an egregious fee driven by political motivations, am I supposed to feel smug for having predicted the possibility or sad that my mere expression that the default maximum fines are so ridiculous that they basically terrorize anyone who is not a multinational corporation turned out to be well-founded? All I ever asked for was for people to recognize the chilling effects that this regulation can have. The internet used to have so many small websites, forums and wikis, and many of these fall under the umbrella of GDPR. And this is basically the treatment I get for trying to represent this dying breed of website: as some corporate shill worth being buried and not considered. It’s not like I care that much about being with the mob, but it pains me that as the open internet gradually dies, people flat out just don’t care. GDPR as it is today is just represents a huge amount of risk for anyone that is not a multinational corporation, and it only gets scarier the further down you are. I’m sorry but just telling people to not worry about how the law is written will not work. Some people will ignore it, some people will try to follow it, and some people will just stop trying altogether deciding the risk simply isn’t worth it. And that latter part is most likely to occur for websites that are more objectionable, since they will likely face harsher treatment just due to cognitive biases alone, since we’re talking about considerations that humans make rather than the word of law.
- t0mas88 5y ago
  The fines are based on your revenue and the impact. So they do differentiate between Epic Games and you. And for me as a user, it sucks if your side project leaks my credit card and SSN, because I'll be dealing with the identity theft and fraud. If you're not competent enough to keep them safe, then use a vendor that is or don't process then at all.
  - jchw 5y ago
    If it were only SSN or credit card data, this would be understandable. But I assume you’re aware GDPR is far broader than this. And as well, GDPR, again, doesn’t guarantee the safety of your data. It just adds fines to some circumstances where your data is misused. But an honest breach doesn’t lead to fines as far as I can tell, so you just have to live with that possibility either way. As best as I can tell, there is no legally binding texts anywhere that limits the fines. The maximums start at €20 million and go higher if you’re huge. In the mindset of “hope is not a strategy,” this maximum fine being the only legally binding limit is enough to make you go home. Maybe small companies can hope for preferential treatment, but as an individual even small fees could do serious harm.
    - jokethrowaway 5y ago
      Work behind a limited company and let it fail. Escape to Mexico in the worst scenario. South America is anyway becoming more and more appealing the more the West progress. That said, not that it changes much but I stopped taking EU customers (I take businesses and not customers) because of vatmoss and gdpr.
      - Aerroon 5y ago
        Vatmoss was so blatantly dumb in its implementation that it makes me wonder whether the MEPs even spent 5 minutes thinking about the implications of it. How can you look at all the VAT systems and not realize that almost all of them have a minimum threshold?! It is a bit ironic that it's probably a good idea for an EU service to not serve EU customers.
  - deleted 5y ago
Hamuko 5y ago
I actually made a GDPR request to my insurance company. Turns out that not only did they have documents about me before I had ever signed a contract with them, they had documents about me before I was even born.
- donatj 5y ago
  > They had documents about me before I was even born Can you elaborate?
  - Hamuko 5y ago
    Turns out that my parents took on some kind of a life insurance policy in an insurance company that no longer exists in the strict sense but the documents have carried on through fusions and when a couple of decades later I got car insurance, a bunch of old medical records and contracts were linked with my account.
- 77pt77 5y ago
  > they had documents about me before I was even born. This needs some explanation. Also, what's stopping them from just lying?
  - Hamuko 5y ago
    >Also, what's stopping them from just lying? Well, hopefully the prospect of fines if they're caught. I'm hoping that the local data authorities won't be lenient if a company is caught outright lying.

by Dah00n 5y ago

jchw 5y ago

It still basically does not differentiate between Epic Games and me. And I can’t handle the fines. The chilling effect this will have on people is being downplayed pretty harshly by people who are basically suggesting you should just pray that you don’t get put into massive debt because you made a mistake on a side project. For that reason, GDPR will always draw some ire from me.

sealeck 5y ago
Don't let people enter their data onto your side projects unless you're willing to treat it responsibly?
- jchw 5y ago
  Intent doesn’t matter; the fear is the same: life-destroying fines. If that’s the choice, I’d just opt out of taking EU customers.
  - Hamuko 5y ago
    How many examples of life-destroying fines do you have?
    - jchw 5y ago
      So basically, you’re in the “No, it’s fine — this will only ever get used against bad guys!” camp. We had 9/11 here in America and the BS that followed and I don’t humor this line of thinking. (Nor humour.)
      - Hamuko 5y ago
        No, I'm in the "prove that the thing you are claiming to happen actually happens" camp.
        jchw 5y ago
        I’m not claiming something happened — do you understand how chilling effects work? The threat of potentially massive fines with very little legal bounds for not following regulations that individuals basically can’t follow means that people who want to follow the rules but aren’t big enough don’t play anymore.
        Hamuko 5y ago
        So no one's life has ever been ruined by the GDPR? But you're still sure that this will happen? What is this based on?
        jchw 5y ago
        I can get fined between 0 and €20 million at any moment because I am an individual and have no means to fully understand GDPR nor hire a DPO for my stupid personal websites. I make no money in ads or otherwise, but I am still treated like Epic Games if I collect sign up emails or logs. I only still run this stuff now because I’ve been running it for over a decade. I can tell you right now I am hesitant to run websites anymore. If you don’t understand how “ambiguous threat of a fine” isn’t calmed by “it hasn’t happened yet,” I can’t help you. What if my site was politically controversial? Should I trust all EU governments to act responsibly and not take advantage of their power ever?
  - tgsovlerkhgsel 5y ago
    Can you show me one example where there was a "life-destroying" fine? Not "a big company was fined an amount of money that would be life destroying if I had to pay it for a personal project", because revenue/economic means are a key factor in GDPR fine calculation.
  - anoncake 5y ago
    Maybe it doesn't in America. Here it does.
Hamuko 5y ago
My name, my address, my phone number and my credit card details are the same regardless whether you or Epic Games is storing them in a database.
- jchw 5y ago
  A data breach alone is not a GDPR violation as far as I know. Your data is just as at risk of being exposed no matter what. As far as I can tell the intent of GDPR is to prevent companies from selling or using your data in ways that you did not consent to. However, the bookkeeping requirements quite literally break the internet that existed where one person could run a website. As it turns out, I do not have a Data Protection Officer for my wiki I started in 2008. Does that mean I am not GDPR compliant?
  - amichal 5y ago
    And you dont need to have one: .... hiring an actual Data Protection Officer is only required by the GDPR if you meet one of three criteria: * Public authority — The processing of personal data is done by a public body or public authorities, with exemptions granted to courts and other independent judicial authorities. * Large scale, regular monitoring — The processing of personal data is the core activity of an organization who regularly and systematically observes its “data subjects” (which, under the GDPR, means citizens or residents of the EU) on a large scale. * Large-scale special data categories — The processing of specific “special” data categories (as defined by the GDPR) is part of an organization’s core activity and is done on a large scale. https://gdpr.eu/data-protection-officer/ https://gdpr.eu/data-protection-officer/
    - jchw 5y ago
      This is good to know. But while I will admit my mistake, the problem points to a bigger issue, which is, as a layperson and not an expert on European law, I simply do not have the expertise necessary to understand the law and its implications. This is of course true of any website under any jurisdiction, but most laws don’t come with such absurdly vicious teeth, and therefore the risk profile is a lot different. So perhaps my example was misinformed. But that’s kind of the problem: you need to have a lawyer to really be sure of these things. I don’t have a lawyer.
hkh28 5y ago
GDPR fines are set among other things according to the resources of the entity that broke the rules. As a private person making a side project, you won't be liable for millions. The most recent examples of individuals being fined have been fines around €200 [0] [0] https://gdprhub.eu/index.php?title=ANSPDCP_(Romania)_-_Fine_against_a_natural_person&mtc=today https://gdprhub.eu/index.php?title=ANSPDCP_(Romania)_-_Fine_...
- jchw 5y ago
  The maximums however, are absolutely insane. Am I supposed to just hope that in the range of 0 to €20 million, it’s something I can afford?
  - tephra 5y ago
    Getting a maximum fine not only means that your handling of personal data was especially egregious but that you probably didn't cooperate in any ways with the relevant DPA and refused to rectify the problem. I.e the maximum fine is highly unlikely for anyone to get, and if you get it you have done some very bad things.
    - jchw 5y ago
      Yes, and what the GDPR crowd is telling me is that I should just trust the EU to always act fairly and never engage in any kind of politically motivated subterfuge. And not only that, my concerns and dissent regarding GDPR piss people off so much, that at this point, every comment I post just gets downvoted immediately. Now I realize it’s against HN guidelines to discuss this, but when I post a comment and the delay it takes for me to return from the post page is enough for my comment to already have a downvote, I feel discouraged. It’s very clear the person who did that had no good faith intent on a discussion nor intent to even minimally read my comment. And I’m supposed to try to argue my points in good faith despite this. The pro-GDPR crowd may be winning the mindshare but they are inheriting the cancer of something not allowed to be criticized. And if we ever do see an egregious fee driven by political motivations, am I supposed to feel smug for having predicted the possibility or sad that my mere expression that the default maximum fines are so ridiculous that they basically terrorize anyone who is not a multinational corporation turned out to be well-founded? All I ever asked for was for people to recognize the chilling effects that this regulation can have. The internet used to have so many small websites, forums and wikis, and many of these fall under the umbrella of GDPR. And this is basically the treatment I get for trying to represent this dying breed of website: as some corporate shill worth being buried and not considered. It’s not like I care that much about being with the mob, but it pains me that as the open internet gradually dies, people flat out just don’t care. GDPR as it is today is just represents a huge amount of risk for anyone that is not a multinational corporation, and it only gets scarier the further down you are. I’m sorry but just telling people to not worry about how the law is written will not work. Some people will ignore it, some people will try to follow it, and some people will just stop trying altogether deciding the risk simply isn’t worth it. And that latter part is most likely to occur for websites that are more objectionable, since they will likely face harsher treatment just due to cognitive biases alone, since we’re talking about considerations that humans make rather than the word of law.
t0mas88 5y ago
The fines are based on your revenue and the impact. So they do differentiate between Epic Games and you. And for me as a user, it sucks if your side project leaks my credit card and SSN, because I'll be dealing with the identity theft and fraud. If you're not competent enough to keep them safe, then use a vendor that is or don't process then at all.
- jchw 5y ago
  If it were only SSN or credit card data, this would be understandable. But I assume you’re aware GDPR is far broader than this. And as well, GDPR, again, doesn’t guarantee the safety of your data. It just adds fines to some circumstances where your data is misused. But an honest breach doesn’t lead to fines as far as I can tell, so you just have to live with that possibility either way. As best as I can tell, there is no legally binding texts anywhere that limits the fines. The maximums start at €20 million and go higher if you’re huge. In the mindset of “hope is not a strategy,” this maximum fine being the only legally binding limit is enough to make you go home. Maybe small companies can hope for preferential treatment, but as an individual even small fees could do serious harm.
  - jokethrowaway 5y ago
    Work behind a limited company and let it fail. Escape to Mexico in the worst scenario. South America is anyway becoming more and more appealing the more the West progress. That said, not that it changes much but I stopped taking EU customers (I take businesses and not customers) because of vatmoss and gdpr.
    - Aerroon 5y ago
      Vatmoss was so blatantly dumb in its implementation that it makes me wonder whether the MEPs even spent 5 minutes thinking about the implications of it. How can you look at all the VAT systems and not realize that almost all of them have a minimum threshold?! It is a bit ironic that it's probably a good idea for an EU service to not serve EU customers.
- deleted 5y ago

Hamuko 5y ago

I actually made a GDPR request to my insurance company. Turns out that not only did they have documents about me before I had ever signed a contract with them, they had documents about me before I was even born.

donatj 5y ago
> They had documents about me before I was even born Can you elaborate?
- Hamuko 5y ago
  Turns out that my parents took on some kind of a life insurance policy in an insurance company that no longer exists in the strict sense but the documents have carried on through fusions and when a couple of decades later I got car insurance, a bunch of old medical records and contracts were linked with my account.
77pt77 5y ago
> they had documents about me before I was even born. This needs some explanation. Also, what's stopping them from just lying?
- Hamuko 5y ago
  >Also, what's stopping them from just lying? Well, hopefully the prospect of fines if they're caught. I'm hoping that the local data authorities won't be lenient if a company is caught outright lying.