3 ms·

I always felt applying the same rules to everyone was a big problem with GDPR. Not just small business, but even non-profits that just keep a list of people in

I always felt applying the same rules to everyone was a big problem with GDPR. Not just small business, but even non-profits that just keep a list of people involved with them are subject to the same rules, even if they only use the information internally and do not buy or sell any personal information. Its not just cookies and websites, its any personal information stored electronically.

MangoToupe 1y ago
I just don't see the issue. The GDPR isn't exactly difficult to comply with, nor does it hamper any of the clear successes of the last 25 years outside of the ad industry. What's the benefit of backing out on it? Is this just an effort to make a homegrown surveillance network?
- graemep 1y ago
  I am not saying privacy laws should be repealed (if you look at my other comments, quite the opposite). I am saying that the same regulations are both too easy for big business to evade (or ignore and treat fines as a cost of doing business) AND too burdensome on small organisations that do not trade information. Something as simple as a membership list can draw you in.
- pembrook 1y ago
  Ughhh here we go again. Every time GDPR is brought up on HN, the same "it's super simple to comply, just read it yourself!" religious incantation gets repeated ad-nauseam. I think it's because people love the idea of what they think GDPR actually represents (the fuzzy abstract idea of "privacy"), without ever diving into any of the implementation details. Almost nobody on this forum has ever talked to a lawyer about this, and even less people have followed the actual court rulings that have determined what GDPR actually means in practice. My favorite example, under GDPR over the last 5 years, regardless of whether you follow the spirit of GDPR to the letter...due to the various schrems rulings, back-and-forth on SCCs, data-transfers, and EU-US political spats...there's been multi-year periods where if you're using any service touching data in any part of your business even remotely connected to the US or any non-EU country (so, almost everything), it's been a violation that exposed you to massive fines should any EU resident have filed a complaint against you. This was recently resolved again, but will continue to go back and forth if GDPR remains as-is. And this is just one of many weird situations the law has created for anyone running a business more complex than "a personal blog."
  - SiempreViernes 1y ago
    I mean, if your domestic legislation makes it impossible for you to ensure the privacy of your customers, why do you insist could be responsible custodians?
    - imperfect_blue 1y ago
      Imagine you're asked with building, say, a train network within your country. Domestic regulations demand that, because other countries are not certified up to your country's safety standards, you're not allowed to import any foreign technology from outside your country. So - in order for you to build that train - you'd need to wait for industries to set up to build every single component up to local standards. And if nobody sets these industries up to manufacture the components you need, you'll have to build it yourself, somehow. You'd rightfully call this out as protectionism. And the worst part is not even the protectionism - the worst part is that you'll likely get no trains, because in practice nobody except a huge incumbent company can build all the components they need themselves, and huge incumbent companies often have no incentive or no agility to do so.
      - SiempreViernes 1y ago
        So you start by asking me to assume the EU can't create IT technology and then give no further argument, much wow! That's was even less persuasive than I expected. BRB, gonna go tell tell Open Office and KDE they don't exist because Europe can't create software.
  - troupo 1y ago
    > but will continue to go back and forth if GDPR remains as-is. Yes, it should remain as is and enforced. Yes, storing your users' data in the US is extremely problematic because the US really couldn't give two shits about privacy, or user data.
    - pembrook 1y ago
      I get it, it's fun to take wildly impractical ideological stances on things and ignore reality. However, this generation is beginning to learn the lesson every generation learns: one has to deal with the world as it is, not as one wishes it were. Scarcity exists. Unfortunately, in globalized economic reality, you will have to transfer data to other countries to conduct business. Unfortunately, in fossil fuel driven reality, you can't just go off fossil fuels by switching to paper straws, you have to actually build viable alternatives first. Unfortunately, in non-world-peace reality, you can't just stop having a military and become pacifist. Turns out you still need missiles and tanks. Unfortunately, in low-birth and low-economic-growth reality, you cannot let people retire at 62 and draw inflation-pegged pensions until death. Unfortunately, in non-0 interest rate reality, governments can't keep deficit spending to prop up a broken socialist economic model. Etc. Etc.
- abigail95 1y ago
  Schrems? - if you think that this legislation is easy to comply with why did all of that happen? The EU can't even agree with itself on how to interpret its own law or what it does. How the hell do you expect everyone else to?

MangoToupe 1y ago

I just don't see the issue. The GDPR isn't exactly difficult to comply with, nor does it hamper any of the clear successes of the last 25 years outside of the ad industry. What's the benefit of backing out on it? Is this just an effort to make a homegrown surveillance network?

graemep 1y ago
I am not saying privacy laws should be repealed (if you look at my other comments, quite the opposite). I am saying that the same regulations are both too easy for big business to evade (or ignore and treat fines as a cost of doing business) AND too burdensome on small organisations that do not trade information. Something as simple as a membership list can draw you in.
pembrook 1y ago
Ughhh here we go again. Every time GDPR is brought up on HN, the same "it's super simple to comply, just read it yourself!" religious incantation gets repeated ad-nauseam. I think it's because people love the idea of what they think GDPR actually represents (the fuzzy abstract idea of "privacy"), without ever diving into any of the implementation details. Almost nobody on this forum has ever talked to a lawyer about this, and even less people have followed the actual court rulings that have determined what GDPR actually means in practice. My favorite example, under GDPR over the last 5 years, regardless of whether you follow the spirit of GDPR to the letter...due to the various schrems rulings, back-and-forth on SCCs, data-transfers, and EU-US political spats...there's been multi-year periods where if you're using any service touching data in any part of your business even remotely connected to the US or any non-EU country (so, almost everything), it's been a violation that exposed you to massive fines should any EU resident have filed a complaint against you. This was recently resolved again, but will continue to go back and forth if GDPR remains as-is. And this is just one of many weird situations the law has created for anyone running a business more complex than "a personal blog."
- SiempreViernes 1y ago
  I mean, if your domestic legislation makes it impossible for you to ensure the privacy of your customers, why do you insist could be responsible custodians?
  - imperfect_blue 1y ago
    Imagine you're asked with building, say, a train network within your country. Domestic regulations demand that, because other countries are not certified up to your country's safety standards, you're not allowed to import any foreign technology from outside your country. So - in order for you to build that train - you'd need to wait for industries to set up to build every single component up to local standards. And if nobody sets these industries up to manufacture the components you need, you'll have to build it yourself, somehow. You'd rightfully call this out as protectionism. And the worst part is not even the protectionism - the worst part is that you'll likely get no trains, because in practice nobody except a huge incumbent company can build all the components they need themselves, and huge incumbent companies often have no incentive or no agility to do so.
    - SiempreViernes 1y ago
      So you start by asking me to assume the EU can't create IT technology and then give no further argument, much wow! That's was even less persuasive than I expected. BRB, gonna go tell tell Open Office and KDE they don't exist because Europe can't create software.
- troupo 1y ago
  > but will continue to go back and forth if GDPR remains as-is. Yes, it should remain as is and enforced. Yes, storing your users' data in the US is extremely problematic because the US really couldn't give two shits about privacy, or user data.
  - pembrook 1y ago
    I get it, it's fun to take wildly impractical ideological stances on things and ignore reality. However, this generation is beginning to learn the lesson every generation learns: one has to deal with the world as it is, not as one wishes it were. Scarcity exists. Unfortunately, in globalized economic reality, you will have to transfer data to other countries to conduct business. Unfortunately, in fossil fuel driven reality, you can't just go off fossil fuels by switching to paper straws, you have to actually build viable alternatives first. Unfortunately, in non-world-peace reality, you can't just stop having a military and become pacifist. Turns out you still need missiles and tanks. Unfortunately, in low-birth and low-economic-growth reality, you cannot let people retire at 62 and draw inflation-pegged pensions until death. Unfortunately, in non-0 interest rate reality, governments can't keep deficit spending to prop up a broken socialist economic model. Etc. Etc.
abigail95 1y ago
Schrems? - if you think that this legislation is easy to comply with why did all of that happen? The EU can't even agree with itself on how to interpret its own law or what it does. How the hell do you expect everyone else to?