4 ms·

People keep saying this and yet it’s never happened despite the GDPR being in place for 5 years now. As a tech manager for an EU company, I can honestly say th

People keep saying this and yet it’s never happened despite the GDPR being in place for 5 years now. As a tech manager for an EU company, I can honestly say that it isn’t that hard to be GDPR compliant. Even when I worked for a company that did need to collect customer information, we pretty well understood what we could and couldn’t do under GDPR. This whole “GDPR is dangerous” meme needs to die because businesses aren’t being dragged in court over trivial things because of it. The only people moaning are those who were abusing peoples data to begin with. And those are exactly the types of companies this law is protecting people from.

esperent 3y ago
> As a tech manager for an EU company, I can honestly say that it isn’t that hard to be GDPR compliant It's pretty easy for a business to be GDPR compliant unless their business model or processes in some way involve collecting and processing or selling personal data of their users. Before GDPR a lot of businesses used this as a nice little second income stream, or just grew used to being able to freely analyze every aspect of their users private data that they could get a hold of. Suddenly they can't do this anymore, and what's actually difficult is not being compliant with GDPR, it's reconciling their business to a new way of working where they have to be considerate of their user's right to privacy. For example, you have a deeply entrenched analytics system that you base a lot of your decisions on. Suddenly you have to basically gut it, or even throw it out entirely. No matter that's there's plenty of GDPR compliant systems to replace it, they don't feel as effective and it's easy to see why a business would make these changes begrudgingly and with a lot of complaining about how unfair it all is.
- jen20 3y ago
  > Suddenly you have to basically gut it, or even throw it out entirely. Good.
- jacquesm 3y ago
  That looks to me as though the system is working exactly as intended. When I do business with company 'A' I do not expect or consent to them passing that data on to company 'B'.
- hnlmorg 3y ago
  That’s the point I’m making though. The law isnt a problem. It’s companies who abused user data that’s the problem. It’s also worth noting that you can still using customer data for analytics under GDPR. GDPR doesn’t prevent legitimate analytics from happening. It just gives consumers power to be excluded from analytics and to force companies to be transparent about their usage of personal data.
murderfs 3y ago
> As a tech manager for an EU company, I can honestly say that it isn’t that hard to be GDPR compliant. > This whole “GDPR is dangerous” meme needs to die because businesses aren’t being dragged in court over trivial things because of it. Ah, yes, the one weird trick of GDPR "compliance" by being a smaller, less appealing target to the enforcers. The "GDPR is dangerous" meme needs to stay alive because it's massively ambiguous and different country's interpretations vary wildly. The types of companies the law is "protecting people from" are non-European ones. It's just economic protectionism in the guise of privacy.
- hnlmorg 3y ago
  Even if that were true, it isn’t but for the sake of the discussion I’ll humour you, America is far more open and aggressive with its protectionism policies. As is China. So I don’t understand the complaint. You’re either in favour of laws that promote the growth of local economies or you’re not. But to be clear, the GDPR is not about protectionism. If it feels that way then perhaps you need to have a hard look at whether the bigger problem is the companies that you feel are being persecuted by GDPR and whether the countries they originate should have done more to regulate them to begin with.
  - murderfs 3y ago
    I'm neutral on protectionism: I'm in favor of laws that are precise and unambiguous, and not up to the interpretation of whatever courts and enforcement agencies wish to impose. For example, which of the following statements are true according to the ECJ's interpretation? American companies cannot run datacenters in Europe, because the CLOUD act might compel them to give up data to American authorities. Canadian companies cannot run datacenters in Europe, because Canada might pass legislation that compels companies to give up data to Canadian authorities. American citizens cannot work at datacenters in Europe, because they're subject to U.S. law, and the U.S. might pass legislation to compel them to steal data. Germany cannot host datacenters, because they lack an independent nuclear triad, meaning that they're subject to U.S. invasion to seize the datacenters.
    - 3y ago

esperent 3y ago

> As a tech manager for an EU company, I can honestly say that it isn’t that hard to be GDPR compliant It's pretty easy for a business to be GDPR compliant unless their business model or processes in some way involve collecting and processing or selling personal data of their users. Before GDPR a lot of businesses used this as a nice little second income stream, or just grew used to being able to freely analyze every aspect of their users private data that they could get a hold of. Suddenly they can't do this anymore, and what's actually difficult is not being compliant with GDPR, it's reconciling their business to a new way of working where they have to be considerate of their user's right to privacy. For example, you have a deeply entrenched analytics system that you base a lot of your decisions on. Suddenly you have to basically gut it, or even throw it out entirely. No matter that's there's plenty of GDPR compliant systems to replace it, they don't feel as effective and it's easy to see why a business would make these changes begrudgingly and with a lot of complaining about how unfair it all is.

jen20 3y ago
> Suddenly you have to basically gut it, or even throw it out entirely. Good.
jacquesm 3y ago
That looks to me as though the system is working exactly as intended. When I do business with company 'A' I do not expect or consent to them passing that data on to company 'B'.
hnlmorg 3y ago
That’s the point I’m making though. The law isnt a problem. It’s companies who abused user data that’s the problem. It’s also worth noting that you can still using customer data for analytics under GDPR. GDPR doesn’t prevent legitimate analytics from happening. It just gives consumers power to be excluded from analytics and to force companies to be transparent about their usage of personal data.

murderfs 3y ago

> As a tech manager for an EU company, I can honestly say that it isn’t that hard to be GDPR compliant. > This whole “GDPR is dangerous” meme needs to die because businesses aren’t being dragged in court over trivial things because of it. Ah, yes, the one weird trick of GDPR "compliance" by being a smaller, less appealing target to the enforcers. The "GDPR is dangerous" meme needs to stay alive because it's massively ambiguous and different country's interpretations vary wildly. The types of companies the law is "protecting people from" are non-European ones. It's just economic protectionism in the guise of privacy.

hnlmorg 3y ago
Even if that were true, it isn’t but for the sake of the discussion I’ll humour you, America is far more open and aggressive with its protectionism policies. As is China. So I don’t understand the complaint. You’re either in favour of laws that promote the growth of local economies or you’re not. But to be clear, the GDPR is not about protectionism. If it feels that way then perhaps you need to have a hard look at whether the bigger problem is the companies that you feel are being persecuted by GDPR and whether the countries they originate should have done more to regulate them to begin with.
- murderfs 3y ago
  I'm neutral on protectionism: I'm in favor of laws that are precise and unambiguous, and not up to the interpretation of whatever courts and enforcement agencies wish to impose. For example, which of the following statements are true according to the ECJ's interpretation? American companies cannot run datacenters in Europe, because the CLOUD act might compel them to give up data to American authorities. Canadian companies cannot run datacenters in Europe, because Canada might pass legislation that compels companies to give up data to Canadian authorities. American citizens cannot work at datacenters in Europe, because they're subject to U.S. law, and the U.S. might pass legislation to compel them to steal data. Germany cannot host datacenters, because they lack an independent nuclear triad, meaning that they're subject to U.S. invasion to seize the datacenters.
  - 3y ago