5 ms·

> Well that's sure vague I am currently implementing GDPR for a health related startup. This half sentence sums up the entire regulation pretty well. It's infu

> Well that's sure vague I am currently implementing GDPR for a health related startup. This half sentence sums up the entire regulation pretty well. It's infuriatingly unspecific about what you can do, and full of vague hinting on things that you maybe really should not do. "Can I do this?" "Yeaaaah, not exactly saying that you can't but maybe it would REALLY be better if you don't, maybe" Absolutely disgusting. Lawyers must be thrilled to have it. Edit: My gripe is not at all with privacy protection laws but with laws that are unclear. Apparently I have been unclear.

sterwill 5y ago
Having worked in a US health tech start-up (and done some compliance work there), and now working with GDPR as a US company, I'm similarly frustrated with how imprecisely the regulations are worded. US health information privacy laws are much easier to interpret and follow. Large, important parts of GDPR compliance hinge on wording like "the processing is not occasional." "Occasional" is not defined in the regulations, and different countries' advisory bodies have completely opposite interpretations about what it means.
- wil421 5y ago
  Feel your pain. At my last job I worked with mostly EMEA and mainly EU countries. Worked directly with our lawyers in the EU to makes sense of it all. This was right when the GDPR was looming and it was stressful to figure out how to comply.
joejerryronnie 5y ago
This is by design as most EU data privacy/competition laws are thinly veiled attempts to extract bribe money from large US tech firms. Sadly, the US gov is also following down this road.
- deleted 5y ago
  [deleted]
lovemenot 5y ago
To what extent is your startup's business dependent on violating users' or others' privacy? Will it be uncompetitive if they don't? It's a broad question, not a legal one. If the answer is: it's very important, because our competitors will violate and win, then EU probably expects to apply industry-wide regulation. If the answer is, not much or we don't know yet, then just don't. Please. Law and money are certainly important, but there's other important things too. Look at it from the regulators' perspective. Regulators will always lag nimble startups. But if those companies are violating reasonable and widely-held priciples (perhaps not the law, yet) how should the EU best apply those principles into law? I find the vagueness of the GDPR exactly satisfies this dilemma.
iamacyborg 5y ago
> It's infuriatingly unspecific about what you can do, and full of vague hinting on things that you maybe really should not do. It really isn't that complicated. You can collect and process data assuming you have a valid business reason to do so. You need to collect/process that data in a way that complies with the law based on what you're collecting/processing. Want to collect people's health data? Cool, ask them for consent and you've got the right to collect it. Want to process that data to make decisions about their insurance premiums? Sure, you can do that, but you'll need the user's consent.
- jstummbillig 5y ago
  I envy you for your naiveté but I sincerely hope you don't advice anyone on this topic.
- sterwill 5y ago
  There's a lot of uncharitable talk in this thread, where comments like yours assume bad intent on behalf of businesses who find GDPR compliance challenging. It's a giant body of regulatory law, of course it's complicated! The GDPR probably _isn't_ hard to deal with if you don't actually care about privacy; it's easy to just not follow the law and hope you don't get caught. But if your company respects individual privacy, and collects personal data only with a lawful basis, and needs to make assurances to its customers that all the regulations are being followed, there's a lot of work you have to do to demonstrate compliance, and many specifics (for example, with regards to personal data erasure in backups and archives) are completely unspecified. How uncomplicated is that issue?
  - denton-scratch 5y ago
    The more collecting and processing you want to do, the more complying you're going to have to do, I can see that. With respect to the archives: don't you think that's best left to the company and their legal department? - As far as I'm concerned, an archive is by definition immutable. And if a company caan't protect its own archives, it's got worse problems than GDPR.
dekhn 5y ago
I worked on GDPR for a health related startup and at some point, I had to start explaining GDPR and HIPAA to the lawyers! The lawyers thought the startup was subject to HIPAA, but we weren't a health org or a BAA, and I explained that. They said "well it's probably better if you just follow that law anyway"
izacus 5y ago
Well, on the other hand you have American corporations stealing data from every orifice because they can get away on technicalities of those ultra specific laws. "Well, actually we DID put a 8pt text on a subpage somewhere, the law doesn't define the text size of disclosure, MINE AWAY!". EU seems to have learned the lesson. Heck, even American corporations like Google, Apple and Amazon put vague descriptors in their terms of service and AppStore rules so they avoid rules lawyering.
speedgoose 5y ago
I work in a IT health care company in Europe. The main difficulties are the laws and regulations, not the software development. But I think it's a good thing. Good luck for your work and if you aren't sure if you can do it, don't.
mhitza 5y ago
I'm actually a proponent of GDPR and not a lawyer. I'm pro consumer protection so I might be biased. On the other hand it's an easy to read legislation https://gdpr-info.eu/ https://gdpr-info.eu/
denton-scratch 5y ago
>Absolutely disgusting. Lawyers must be thrilled to have it. Well, if a company's determined not to comply with GDPR, then it's going to be on the lookout for loopholes, and ways around the legislation. And indeed, if that's its plan, and the legislation is vague, it's going to need a much bigger legal department. That's not the law's fault; that's because the company doesn't want to comply. If on the other hand a company wants to comply, then that very vagueness protects it, on my reading. It's hard to imagine being done for GDPR violations, if you've familiarised yourself with the provisions; and if you are affected, have a concrete plan to ensure you are in compliance. I confess that I don't like the vagueness. It gives greater discretion to the judge. I've lived all of my life under UK law, which is more specific and prescriptive than the laws of most EU states, where judges have much more power.
jdlshore 5y ago
I’ve implemented GDPR compliance and found the law and associated guidance quite clear.

sterwill 5y ago

Having worked in a US health tech start-up (and done some compliance work there), and now working with GDPR as a US company, I'm similarly frustrated with how imprecisely the regulations are worded. US health information privacy laws are much easier to interpret and follow. Large, important parts of GDPR compliance hinge on wording like "the processing is not occasional." "Occasional" is not defined in the regulations, and different countries' advisory bodies have completely opposite interpretations about what it means.

wil421 5y ago
Feel your pain. At my last job I worked with mostly EMEA and mainly EU countries. Worked directly with our lawyers in the EU to makes sense of it all. This was right when the GDPR was looming and it was stressful to figure out how to comply.

joejerryronnie 5y ago

This is by design as most EU data privacy/competition laws are thinly veiled attempts to extract bribe money from large US tech firms. Sadly, the US gov is also following down this road.

deleted 5y ago
[deleted]

lovemenot 5y ago

To what extent is your startup's business dependent on violating users' or others' privacy? Will it be uncompetitive if they don't? It's a broad question, not a legal one. If the answer is: it's very important, because our competitors will violate and win, then EU probably expects to apply industry-wide regulation. If the answer is, not much or we don't know yet, then just don't. Please. Law and money are certainly important, but there's other important things too. Look at it from the regulators' perspective. Regulators will always lag nimble startups. But if those companies are violating reasonable and widely-held priciples (perhaps not the law, yet) how should the EU best apply those principles into law? I find the vagueness of the GDPR exactly satisfies this dilemma.

iamacyborg 5y ago

> It's infuriatingly unspecific about what you can do, and full of vague hinting on things that you maybe really should not do. It really isn't that complicated. You can collect and process data assuming you have a valid business reason to do so. You need to collect/process that data in a way that complies with the law based on what you're collecting/processing. Want to collect people's health data? Cool, ask them for consent and you've got the right to collect it. Want to process that data to make decisions about their insurance premiums? Sure, you can do that, but you'll need the user's consent.

jstummbillig 5y ago
I envy you for your naiveté but I sincerely hope you don't advice anyone on this topic.
sterwill 5y ago
There's a lot of uncharitable talk in this thread, where comments like yours assume bad intent on behalf of businesses who find GDPR compliance challenging. It's a giant body of regulatory law, of course it's complicated! The GDPR probably _isn't_ hard to deal with if you don't actually care about privacy; it's easy to just not follow the law and hope you don't get caught. But if your company respects individual privacy, and collects personal data only with a lawful basis, and needs to make assurances to its customers that all the regulations are being followed, there's a lot of work you have to do to demonstrate compliance, and many specifics (for example, with regards to personal data erasure in backups and archives) are completely unspecified. How uncomplicated is that issue?
- denton-scratch 5y ago
  The more collecting and processing you want to do, the more complying you're going to have to do, I can see that. With respect to the archives: don't you think that's best left to the company and their legal department? - As far as I'm concerned, an archive is by definition immutable. And if a company caan't protect its own archives, it's got worse problems than GDPR.

dekhn 5y ago

I worked on GDPR for a health related startup and at some point, I had to start explaining GDPR and HIPAA to the lawyers! The lawyers thought the startup was subject to HIPAA, but we weren't a health org or a BAA, and I explained that. They said "well it's probably better if you just follow that law anyway"

izacus 5y ago

Well, on the other hand you have American corporations stealing data from every orifice because they can get away on technicalities of those ultra specific laws. "Well, actually we DID put a 8pt text on a subpage somewhere, the law doesn't define the text size of disclosure, MINE AWAY!". EU seems to have learned the lesson. Heck, even American corporations like Google, Apple and Amazon put vague descriptors in their terms of service and AppStore rules so they avoid rules lawyering.

speedgoose 5y ago

I work in a IT health care company in Europe. The main difficulties are the laws and regulations, not the software development. But I think it's a good thing. Good luck for your work and if you aren't sure if you can do it, don't.

mhitza 5y ago

I'm actually a proponent of GDPR and not a lawyer. I'm pro consumer protection so I might be biased. On the other hand it's an easy to read legislation https://gdpr-info.eu/ https://gdpr-info.eu/

denton-scratch 5y ago

>Absolutely disgusting. Lawyers must be thrilled to have it. Well, if a company's determined not to comply with GDPR, then it's going to be on the lookout for loopholes, and ways around the legislation. And indeed, if that's its plan, and the legislation is vague, it's going to need a much bigger legal department. That's not the law's fault; that's because the company doesn't want to comply. If on the other hand a company wants to comply, then that very vagueness protects it, on my reading. It's hard to imagine being done for GDPR violations, if you've familiarised yourself with the provisions; and if you are affected, have a concrete plan to ensure you are in compliance. I confess that I don't like the vagueness. It gives greater discretion to the judge. I've lived all of my life under UK law, which is more specific and prescriptive than the laws of most EU states, where judges have much more power.

jdlshore 5y ago

I’ve implemented GDPR compliance and found the law and associated guidance quite clear.