4 ms·

I'd guess HN isn't big enough for basically any privacy law to apply. Some parts of GDPR at least call out company size explicitly, other parts allow for "cost

I'd guess HN isn't big enough for basically any privacy law to apply. Some parts of GDPR at least call out company size explicitly, other parts allow for "cost of implementation" to be considered, which for HN would probably be "prohibitively high" regardless of triviality, considering the team size.

thwayunion 4y ago
Seems like a risky gambit; AFAIK YC owns HN and would have a hard time arguing that that they're a small business incapable of following GDPR regs.
- matai_kolila 4y ago
  It's not a general "we can't do this" argument, it's got specific criteria, one being company size for certain regs to apply. But honestly YC probably doesn't even think about any of this, for good or bad. Most companies are super duper behind the ball on privacy regulations, despite the negative consequences.
  - thwayunion 4y ago
    Right. IDK how the size of YC gets calculated for the purposes of GDPR. It's a weird edge case.
    - matai_kolila 4y ago
      I actually operate in this space right now, and you wouldn't believe the number of companies who don't care about privacy, screw it up, get fined hugely, and then... just keep on not caring. It's unreal.
      - thwayunion 4y ago
        Interesting. Care to guess why? Cost of fines < cost of compliance? "not my job" syndrome? Incompetence? All 3?
        matai_kolila 4y ago
        It’s this idea that if nobody is doing it, or if they handle it poorly, then nobody will care if you also handle it poorly. CEOs are just writing it off as pesky lawyer shit, even though it’s 100% preventable…
- mattbrewsbytes 4y ago
  The other way to look at it is that HN is too small to go after as in it would cost more in lawyers than they could recoup, possibly.
  - jeroenhd 4y ago
    The GDPR doesn't allow people to start lawsuits. The law is upheld by government agencies, which usually give small companies a chance to fall in line before starting a lawsuit. They're also mostly focused on European businesses and most likely won't act until they receive enough complaints. When it comes to lawyer fees, governments seem to have quite a pool of money when it comes to enforcing the law.
    - blibble 4y ago
      > The GDPR doesn't allow people to start lawsuits. it most certainly does the national authorities should be the first avenue, but if they don't agree with you you can go after the company directly
      - jeroenhd 4y ago
        I suppose, but it'll take months before you can even start taking action by yourself, and you'll have to find a good reason to disagree with the DPA's lawyers. The DPA declaring your case unenforceable certainly doesn't help your chances; maybe if the DPA doesn't have time for your complaint do you have a chance. Even then the recouped damage is minimal if you win. The GDPR is not like many other laws that give way to massive civil suits.

thwayunion 4y ago

Seems like a risky gambit; AFAIK YC owns HN and would have a hard time arguing that that they're a small business incapable of following GDPR regs.

matai_kolila 4y ago
It's not a general "we can't do this" argument, it's got specific criteria, one being company size for certain regs to apply. But honestly YC probably doesn't even think about any of this, for good or bad. Most companies are super duper behind the ball on privacy regulations, despite the negative consequences.
- thwayunion 4y ago
  Right. IDK how the size of YC gets calculated for the purposes of GDPR. It's a weird edge case.
  - matai_kolila 4y ago
    I actually operate in this space right now, and you wouldn't believe the number of companies who don't care about privacy, screw it up, get fined hugely, and then... just keep on not caring. It's unreal.
    - thwayunion 4y ago
      Interesting. Care to guess why? Cost of fines < cost of compliance? "not my job" syndrome? Incompetence? All 3?
      - matai_kolila 4y ago
        It’s this idea that if nobody is doing it, or if they handle it poorly, then nobody will care if you also handle it poorly. CEOs are just writing it off as pesky lawyer shit, even though it’s 100% preventable…
mattbrewsbytes 4y ago
The other way to look at it is that HN is too small to go after as in it would cost more in lawyers than they could recoup, possibly.
- jeroenhd 4y ago
  The GDPR doesn't allow people to start lawsuits. The law is upheld by government agencies, which usually give small companies a chance to fall in line before starting a lawsuit. They're also mostly focused on European businesses and most likely won't act until they receive enough complaints. When it comes to lawyer fees, governments seem to have quite a pool of money when it comes to enforcing the law.
  - blibble 4y ago
    > The GDPR doesn't allow people to start lawsuits. it most certainly does the national authorities should be the first avenue, but if they don't agree with you you can go after the company directly
    - jeroenhd 4y ago
      I suppose, but it'll take months before you can even start taking action by yourself, and you'll have to find a good reason to disagree with the DPA's lawyers. The DPA declaring your case unenforceable certainly doesn't help your chances; maybe if the DPA doesn't have time for your complaint do you have a chance. Even then the recouped damage is minimal if you win. The GDPR is not like many other laws that give way to massive civil suits.