4 ms·

Yes, the solution is clearer rules. What drives compliance costs up is rarely the compliance itself, it's usually the uncertainty about your being in compliance

Yes, the solution is clearer rules. What drives compliance costs up is rarely the compliance itself, it's usually the uncertainty about your being in compliance or not. That's also true for tax laws, labor laws, environment laws, almost every safety code out there, building zoning...

mlyle 1y ago
Well, compliance itself is costly, but the cost is stuff that society decided it wanted to spend money on. But uncertainty in compliance and time spent navigating compliance is nearly pure waste.
- a4isms 1y ago
  To continue a conversation from another thread on another post, uncertainty, complexity, ambiguity, and out-of-band context required are all costs that just happen to act as moats for entrenched incumbents. And no surprise, such incumbents often have so much influence over politics that they literally write the laws that regulate them. The folksy aphorism goes, The more wild cards and crazy rules, the greater the expert's advantage.
  - mlyle 1y ago
    Yes-- I think most of us are familiar with regulatory capture. But the solution to regulatory capture isn't "no regulation."
    - a4isms 1y ago
      Wild cards and crazy rules versus no regulation is a false dichotomy.
  - marcosdumay 1y ago
    I'm not sure. Complexity is clearly hired by lobbyists all the time, but uncertainty and ambiguity seem to me to be mostly caused by incompetence. It's not even clear if uncertainty benefits incumbents more; it can just as likely destroy a market or benefit new entrants, and you can't predict which will happen at the time you create it (otherwise it's not uncertain). Legislative houses need technocratic QA. And that QA needs to be independent from the law-writing process.
  - zelphirkalt 1y ago
    Easy to not play the card game, by only collecting the data needed for your service.
sothatsit 1y ago
Exactly this. As a recent example, the documents for the new Online Safety Act in the UK are over 2400 pages long! That means that even small businesses that want to comply have no reasonable option other than relying on summaries, and the regulator and big businesses will probably just negotiate on what the details actually mean in practice anyway. I understand that there's nuance when dealing with all the edge cases to regulations. But it seems that the answer should not be extending the regulations to insane lengths to try to cover everything. That way lies insanity.
ergocoder 1y ago
And the answer should be self-served, ideally, with an automated authoritative self-served approval. It could have a lag time of a few days or even a week for a person to approve. Apple App Store review is a nightmare but still better than these regulations. They say yes or no clearly. These EU regulations are more like: if you fuck up, you wouldn't know until the sentence might be really really high.
- oblio 1y ago
  I keep hearing that, but do we actually have stories about small European companies being ruined?
  - zelphirkalt 1y ago
    I bet we don't, unless they ruined themselves due to being very negligent or unwilling to implement even after being reported and found out. The reason is that in the EU fines are usually wrist slaps, compared to the size of the company, not threatening existence. We see this with big tech, who consider violating the law cost of business.
moooo99 1y ago
I totally agree with this view! I understand why the rules are vague to an extent, simply because it is hard to impossible to cover every aspect of data collection. But the GDPR is super vague on some very technical datapoints as well. Is an IP Address PII? Is there a difference between an IPv4 or an IPv6 address being PII? What constitutes as legitimate interest specifically? Can I use data for legitimate interests also for different first party purposes? I‘ve spent more time than I care to admit navigating the compliance landscape of the GDPR and every time I consulted with compliance experts, I got different - partially conflicting - answers.
- zelphirkalt 1y ago
  IP addresses are PII. This has long been determined.
  - einsteinx2 1y ago
    This is a perfect example of uncertainty causing compliance overhead. You say IP addresses are PII and this has long been determined. Literally a week ago I read this reply on HN to someone mentioning IP addresses being PII: > > logging an IP address.... > Untrue. IP is an category of PII but its not PII in itself unless you're a law enforcement. > Separately, if you log IP addresses you're doing it to prevent abuse and to provide security to your server, you're already permitted to do so. > More on that: https://missinfogeek.net/gdpr-consent/ https://missinfogeek.net/gdpr-consent/ So it seems like it’s not so determined, and this kind of uncertainty is exactly what makes compliance expensive.
    - zelphirkalt 1y ago
      They are of course, like everything else context-dependent legitimate interest, or even needed to provide a service to the visitor or user, but that doesn't make them non-PII. There is a reason for things like Google captchas and Google Tags manager to have a flag to not even send an IP address to the backend.
      - 1y ago

mlyle 1y ago

Well, compliance itself is costly, but the cost is stuff that society decided it wanted to spend money on. But uncertainty in compliance and time spent navigating compliance is nearly pure waste.

a4isms 1y ago
To continue a conversation from another thread on another post, uncertainty, complexity, ambiguity, and out-of-band context required are all costs that just happen to act as moats for entrenched incumbents. And no surprise, such incumbents often have so much influence over politics that they literally write the laws that regulate them. The folksy aphorism goes, The more wild cards and crazy rules, the greater the expert's advantage.
- mlyle 1y ago
  Yes-- I think most of us are familiar with regulatory capture. But the solution to regulatory capture isn't "no regulation."
  - a4isms 1y ago
    Wild cards and crazy rules versus no regulation is a false dichotomy.
- marcosdumay 1y ago
  I'm not sure. Complexity is clearly hired by lobbyists all the time, but uncertainty and ambiguity seem to me to be mostly caused by incompetence. It's not even clear if uncertainty benefits incumbents more; it can just as likely destroy a market or benefit new entrants, and you can't predict which will happen at the time you create it (otherwise it's not uncertain). Legislative houses need technocratic QA. And that QA needs to be independent from the law-writing process.
- zelphirkalt 1y ago
  Easy to not play the card game, by only collecting the data needed for your service.

sothatsit 1y ago

Exactly this. As a recent example, the documents for the new Online Safety Act in the UK are over 2400 pages long! That means that even small businesses that want to comply have no reasonable option other than relying on summaries, and the regulator and big businesses will probably just negotiate on what the details actually mean in practice anyway. I understand that there's nuance when dealing with all the edge cases to regulations. But it seems that the answer should not be extending the regulations to insane lengths to try to cover everything. That way lies insanity.

ergocoder 1y ago

And the answer should be self-served, ideally, with an automated authoritative self-served approval. It could have a lag time of a few days or even a week for a person to approve. Apple App Store review is a nightmare but still better than these regulations. They say yes or no clearly. These EU regulations are more like: if you fuck up, you wouldn't know until the sentence might be really really high.

oblio 1y ago
I keep hearing that, but do we actually have stories about small European companies being ruined?
- zelphirkalt 1y ago
  I bet we don't, unless they ruined themselves due to being very negligent or unwilling to implement even after being reported and found out. The reason is that in the EU fines are usually wrist slaps, compared to the size of the company, not threatening existence. We see this with big tech, who consider violating the law cost of business.

moooo99 1y ago

I totally agree with this view! I understand why the rules are vague to an extent, simply because it is hard to impossible to cover every aspect of data collection. But the GDPR is super vague on some very technical datapoints as well. Is an IP Address PII? Is there a difference between an IPv4 or an IPv6 address being PII? What constitutes as legitimate interest specifically? Can I use data for legitimate interests also for different first party purposes? I‘ve spent more time than I care to admit navigating the compliance landscape of the GDPR and every time I consulted with compliance experts, I got different - partially conflicting - answers.

zelphirkalt 1y ago
IP addresses are PII. This has long been determined.
- einsteinx2 1y ago
  This is a perfect example of uncertainty causing compliance overhead. You say IP addresses are PII and this has long been determined. Literally a week ago I read this reply on HN to someone mentioning IP addresses being PII: > > logging an IP address.... > Untrue. IP is an category of PII but its not PII in itself unless you're a law enforcement. > Separately, if you log IP addresses you're doing it to prevent abuse and to provide security to your server, you're already permitted to do so. > More on that: https://missinfogeek.net/gdpr-consent/ https://missinfogeek.net/gdpr-consent/ So it seems like it’s not so determined, and this kind of uncertainty is exactly what makes compliance expensive.
  - zelphirkalt 1y ago
    They are of course, like everything else context-dependent legitimate interest, or even needed to provide a service to the visitor or user, but that doesn't make them non-PII. There is a reason for things like Google captchas and Google Tags manager to have a flag to not even send an IP address to the backend.
    - 1y ago