3 ms·

Though the intentions of GDPR were good, Following the GDPR to the letter is not feasible for any company that isn't a monopoly. We're in a situation where no o

Though the intentions of GDPR were good, Following the GDPR to the letter is not feasible for any company that isn't a monopoly. We're in a situation where no one is following it all the way as it's not even clear what that means. More of the same will continue and the GDPR will only be used coercively as an attack against competition or companies others don't like. It's really a major blow for small businesses that want to work in the EU. EU desperately needs more small tech business so it's quite sad. I would love a law that said what people think GDPR says. That you have to tell people if you were selling their data to third parties and to please not do that. This is simply not what GDPR is in practice. The road to hell is paved with good intention.

iso1631 4y ago
In the UK it's illegal to pay a bribe to allow your company to operate, despite it being normal behaviour in many areas [0], I assume other countries have similar laws. In the same way, just because normal behaviour in some countries is to misuse customer data, it doesn't mean it should be legal for an EU company to operate in that way. [0] https://www.bbc.co.uk/news/business-13977221 https://www.bbc.co.uk/news/business-13977221
- throwaway13337 4y ago
  When you make common practice illegal, you invite corruption into your system because selective enforcement of the rules becomes the new normal. Laws need to understand the environment that they are made in or will never be effective and oftentimes counter productive. As is the case here. GDPR goes even further than would be reasonable for any small business that handles email addresses. Requiring a salaried data protection officer is not feasible. Unless you want to make small businesses illegal to operate online, you either are for selective enforcement or you do not want the GDPR.
  - dmitriid 4y ago
    > When you make common practice illegal, you invite corruption into your system because selective enforcement of the rules becomes the new normal. Child labor. Drugs and radioactive substances in medicine. Water pollution. The list of practices that used to be common is extremely long. And yet here we are. > GDPR goes even further that would be reasonable for any small business that handles email addresses. Of course it doesn't go "even further". Don't sell user data left and right, and boom! Your poor small business is in the clear. > Requiring a salaried data protection officer is not feasible. The law doesn't require a separate salaried DPO. > Unless you want to make small businesses illegal to operate online, you either are for selective enforcement or you do not want the GDPR. The one thing I want is for people to stop saying fantastical bullshit about GDPR that has no basis in reality.
    - jansan 4y ago
      >. Don't sell user data left and right, and boom! Your poor small business is in the clear. And the article shows that this is not true.
      - dmitriid 4y ago
        That's not what the article shows. The article shows the use of third-party solutions none of which are GDPR compliant: not the cookie banners, not the data storage, not CDNs. And every step of the way the authorities explained all the issues and waited for solutions (quote, google translate, "There was neither a court judgment nor a fine actually imposed.") As a business you are responsible for user data. You can't use some third-party business, point at them and say "it's them who are responsible, not me". The responsibility of properly handling user data is yours. GDPR was adopted in 2016, 6 years ago. You'd think this was enough time to learn it by heart by now, or at least not make mistakes about the simple core things of the law. It's not as big, or as hard, or as ambiguous as people who have never even read it make it out to be.
    - JoshuaRogers 4y ago
      > Don't sell user data left and right, and boom! Your poor small business is in the clear. It’s possible that I just misunderstand the landscape, I suppose. For my particular case though I work at a small business in the US that uses AWS cloud services for deployment of our application. One of the dependencies of our tech stack is an industry standard application (it’s ubiquitous in our space and has no accepted alternative in our industry) whose per-instance licenses cost are nearly half my yearly salary. After factoring in a second instance for HA, it’s a full engineer‘s pay. In order to make sure that we have a cloud offering that can be used without any data leaving the EU or talking to a US company, our overhead increases to the point that we’re running with one less engineer than if we could all use the same stack. We do not collect any PII for longer than is needed to fulfill requests and we have no other revenue stream (no ads or connection to ads) other than customer subscriptions. So, for my team, the impact of compliance has been painful. If it turns out that I misunderstand some aspect of compliance here, I’m happy as that is good news for me.
  - iso1631 4y ago
    > Requiring a salaried data protection officer is not feasible Requiring a salaried health and safety officer is not feasible. Except it is. It doesn't need to be a dedicated officer, it needs to be someone (Company Secretary, the owner, whatever) who is accountable for it.
lmkg 4y ago
This ruling is about the US CLOUD Act moreso than GDPR. The CLOUD Act says US law enforcement can get anyone's data from a US company, with no safeguards. GDPR is just calling a spade a spade.
- jansan 4y ago
  What ruling? There was not court ruling in the case described in the article.
  - lmkg 4y ago
    All of these movements by both regulators and personal lawsuits over the use of US-based cloud providers stem from the Schrems II case. This is what established as a practical fact the fundamental conflict between GDPR and the CLOUD Act.
jansan 4y ago
I could not agree more. It is absolutely insane who much intellectual capacity the GDPR is binding, which could otherwise be used to innovate. It is a good thing to force companies to think about how their data is used, just as it is a good thing to make them think about network and website security. But the GDPR is more problem than solution.

iso1631 4y ago

In the UK it's illegal to pay a bribe to allow your company to operate, despite it being normal behaviour in many areas [0], I assume other countries have similar laws. In the same way, just because normal behaviour in some countries is to misuse customer data, it doesn't mean it should be legal for an EU company to operate in that way. [0] https://www.bbc.co.uk/news/business-13977221 https://www.bbc.co.uk/news/business-13977221

throwaway13337 4y ago
When you make common practice illegal, you invite corruption into your system because selective enforcement of the rules becomes the new normal. Laws need to understand the environment that they are made in or will never be effective and oftentimes counter productive. As is the case here. GDPR goes even further than would be reasonable for any small business that handles email addresses. Requiring a salaried data protection officer is not feasible. Unless you want to make small businesses illegal to operate online, you either are for selective enforcement or you do not want the GDPR.
- dmitriid 4y ago
  > When you make common practice illegal, you invite corruption into your system because selective enforcement of the rules becomes the new normal. Child labor. Drugs and radioactive substances in medicine. Water pollution. The list of practices that used to be common is extremely long. And yet here we are. > GDPR goes even further that would be reasonable for any small business that handles email addresses. Of course it doesn't go "even further". Don't sell user data left and right, and boom! Your poor small business is in the clear. > Requiring a salaried data protection officer is not feasible. The law doesn't require a separate salaried DPO. > Unless you want to make small businesses illegal to operate online, you either are for selective enforcement or you do not want the GDPR. The one thing I want is for people to stop saying fantastical bullshit about GDPR that has no basis in reality.
  - jansan 4y ago
    >. Don't sell user data left and right, and boom! Your poor small business is in the clear. And the article shows that this is not true.
    - dmitriid 4y ago
      That's not what the article shows. The article shows the use of third-party solutions none of which are GDPR compliant: not the cookie banners, not the data storage, not CDNs. And every step of the way the authorities explained all the issues and waited for solutions (quote, google translate, "There was neither a court judgment nor a fine actually imposed.") As a business you are responsible for user data. You can't use some third-party business, point at them and say "it's them who are responsible, not me". The responsibility of properly handling user data is yours. GDPR was adopted in 2016, 6 years ago. You'd think this was enough time to learn it by heart by now, or at least not make mistakes about the simple core things of the law. It's not as big, or as hard, or as ambiguous as people who have never even read it make it out to be.
  - JoshuaRogers 4y ago
    > Don't sell user data left and right, and boom! Your poor small business is in the clear. It’s possible that I just misunderstand the landscape, I suppose. For my particular case though I work at a small business in the US that uses AWS cloud services for deployment of our application. One of the dependencies of our tech stack is an industry standard application (it’s ubiquitous in our space and has no accepted alternative in our industry) whose per-instance licenses cost are nearly half my yearly salary. After factoring in a second instance for HA, it’s a full engineer‘s pay. In order to make sure that we have a cloud offering that can be used without any data leaving the EU or talking to a US company, our overhead increases to the point that we’re running with one less engineer than if we could all use the same stack. We do not collect any PII for longer than is needed to fulfill requests and we have no other revenue stream (no ads or connection to ads) other than customer subscriptions. So, for my team, the impact of compliance has been painful. If it turns out that I misunderstand some aspect of compliance here, I’m happy as that is good news for me.
- iso1631 4y ago
  > Requiring a salaried data protection officer is not feasible Requiring a salaried health and safety officer is not feasible. Except it is. It doesn't need to be a dedicated officer, it needs to be someone (Company Secretary, the owner, whatever) who is accountable for it.

lmkg 4y ago

This ruling is about the US CLOUD Act moreso than GDPR. The CLOUD Act says US law enforcement can get anyone's data from a US company, with no safeguards. GDPR is just calling a spade a spade.

jansan 4y ago
What ruling? There was not court ruling in the case described in the article.
- lmkg 4y ago
  All of these movements by both regulators and personal lawsuits over the use of US-based cloud providers stem from the Schrems II case. This is what established as a practical fact the fundamental conflict between GDPR and the CLOUD Act.

jansan 4y ago

I could not agree more. It is absolutely insane who much intellectual capacity the GDPR is binding, which could otherwise be used to innovate. It is a good thing to force companies to think about how their data is used, just as it is a good thing to make them think about network and website security. But the GDPR is more problem than solution.