4 ms·

I don't want to get down-voted but I like this regulation, good job EU!

by m00dy 19d ago

shermantanktop 19d ago
Being in favor of right-to-repair is generally popular on HN, for obvious reasons.
- GJim 19d ago
  Whereas, given a large part of the HN demographic works in the AdTech industry..... Being in favour of the GDPR will bring out downvotes and FUD from the people whose very salaries are dependent on invading your privacy.
  - Ekaros 19d ago
    I really don't get the big deal with GDRP. Consider what you are storing and why you are storing. Decide if those things align. If they do not, well don't implement that in first place. And I suppose LLMs are perfect for the boiler plate documentation so not big effort there either. Somethings are big more challenging like getting the data for customer when asking or deleting it when reasonable. But as user I also like at least having that option. It is least any business can do.
    - graemep 19d ago
      GDPR is reasonable, maybe too weak regulation of big businesses with lots of data. The problem is that it applies to small organisations, even non-profits, that do not trade that information which is proportionately a much bigger burden. Real examples of organisations I have come across who have to comply with GDPR include a local community theatre, a parish church etc. They are keep fairly simple information, and not exchanging it with anyone, but they still have to put effort into ensuring compliance. They are pretty good and ethical anyway - the theatre recently impressed me when I found out that if you give them medical information in case of emergency they put it in a sealed envelope and no one opens it unless there is an actually emergency that requires it (i.e. you keel over there!).
      - mschuster91 19d ago
        > Real examples of organisations I have come across who have to comply with GDPR include a local community theatre, a parish church etc. They are keep fairly simple information, and not exchanging it with anyone, but they still have to put effort into ensuring compliance. Yeah, and that is precisely where you want something like the GDPR to be as well! Large corporations are one thing, they have compliance departments, but so, so many local organizations have gotten hacked or data exfiltrated because "why do software and hardware updates when everything is working" or due to incompetence ("cc all"). GDPR finally gave the younger crowd some leverage to get the old guard to do things at least somewhat decently.
        gmueckl 19d ago
        Well, wait until you are at the receiving end. It can get nasty pretty quickly. What does each one of your systems store exactly? Do they allow configuration of reasonable data retention policies for PII? What do your systems log? How do you make sure that only the minimum amount of PII (including user IP addresses) is logged and that the covered logs are destroyed at the end of a reasonable retention period? How do you handle Data Subject Access Requests? Can you compile all the data related to that person in a reasonable time to send it to them? How do you handle deletion requests? Can you name all the data storage that is affected if a deletion request comes in? Are your systems technically capable of deleting the data? What data is exempt (e.g. billing addresses can't just be deleted before the mandated archival period is over)? Do you maintain backups? Then how do you make sure that data covered by a deletion request is destroyed and stays gone even in the event of a backup recovery? Nobody who wants to bootstrap a business wants to deal with any of this. It's an enormous time sink.
        mschuster91 19d ago
        > Nobody who wants to bootstrap a business wants to deal with any of this. It's an enormous time sink. Indeed but it forces you to answer these questions and to think about them during the development process as well, maybe even enough to write decent unit and regression tests for anything authentication/authorization related before some security "researcher" siccs Claude Code or whatever on your API and pwns it.
    - mitxela 18d ago
      The thing is American businesses try to read the entire thing in excruciating detail and proactively comply with every possibility they can think of while European businesses just make a good faith effort to comply with the spirit, and if an authority tells them they can't do something, they stop doing it. Based on this behavior I'd have to infer American courts are punitive oriented (so you must never slip up) while European courts are resolution oriented (so good faith is enough and stop worrying so much). My inference also explains why American businesses don't listen to European courts until the fines get big. They get some small penalty on their first violation and think "that's all?" and continue the violation, then four or five cases later the penalty gets big enough to make them comply. See Apple with the interop rulings.
graemep 19d ago
Do you like the intent, or the implementation and enforcement? Politicians have a tendency to think that passing legislation fixes problems, where is its only the start of the process.

I don't want to get down-voted but I like this regulation, good job EU!

by m00dy 19d ago

I don't want to get down-voted but I like this regulation, good job EU!

shermantanktop 19d ago

Being in favor of right-to-repair is generally popular on HN, for obvious reasons.

GJim 19d ago
Whereas, given a large part of the HN demographic works in the AdTech industry..... Being in favour of the GDPR will bring out downvotes and FUD from the people whose very salaries are dependent on invading your privacy.
- Ekaros 19d ago
  I really don't get the big deal with GDRP. Consider what you are storing and why you are storing. Decide if those things align. If they do not, well don't implement that in first place. And I suppose LLMs are perfect for the boiler plate documentation so not big effort there either. Somethings are big more challenging like getting the data for customer when asking or deleting it when reasonable. But as user I also like at least having that option. It is least any business can do.
  - graemep 19d ago
    GDPR is reasonable, maybe too weak regulation of big businesses with lots of data. The problem is that it applies to small organisations, even non-profits, that do not trade that information which is proportionately a much bigger burden. Real examples of organisations I have come across who have to comply with GDPR include a local community theatre, a parish church etc. They are keep fairly simple information, and not exchanging it with anyone, but they still have to put effort into ensuring compliance. They are pretty good and ethical anyway - the theatre recently impressed me when I found out that if you give them medical information in case of emergency they put it in a sealed envelope and no one opens it unless there is an actually emergency that requires it (i.e. you keel over there!).
    - mschuster91 19d ago
      > Real examples of organisations I have come across who have to comply with GDPR include a local community theatre, a parish church etc. They are keep fairly simple information, and not exchanging it with anyone, but they still have to put effort into ensuring compliance. Yeah, and that is precisely where you want something like the GDPR to be as well! Large corporations are one thing, they have compliance departments, but so, so many local organizations have gotten hacked or data exfiltrated because "why do software and hardware updates when everything is working" or due to incompetence ("cc all"). GDPR finally gave the younger crowd some leverage to get the old guard to do things at least somewhat decently.
      - gmueckl 19d ago
        Well, wait until you are at the receiving end. It can get nasty pretty quickly. What does each one of your systems store exactly? Do they allow configuration of reasonable data retention policies for PII? What do your systems log? How do you make sure that only the minimum amount of PII (including user IP addresses) is logged and that the covered logs are destroyed at the end of a reasonable retention period? How do you handle Data Subject Access Requests? Can you compile all the data related to that person in a reasonable time to send it to them? How do you handle deletion requests? Can you name all the data storage that is affected if a deletion request comes in? Are your systems technically capable of deleting the data? What data is exempt (e.g. billing addresses can't just be deleted before the mandated archival period is over)? Do you maintain backups? Then how do you make sure that data covered by a deletion request is destroyed and stays gone even in the event of a backup recovery? Nobody who wants to bootstrap a business wants to deal with any of this. It's an enormous time sink.
        mschuster91 19d ago
        > Nobody who wants to bootstrap a business wants to deal with any of this. It's an enormous time sink. Indeed but it forces you to answer these questions and to think about them during the development process as well, maybe even enough to write decent unit and regression tests for anything authentication/authorization related before some security "researcher" siccs Claude Code or whatever on your API and pwns it.
  - mitxela 18d ago
    The thing is American businesses try to read the entire thing in excruciating detail and proactively comply with every possibility they can think of while European businesses just make a good faith effort to comply with the spirit, and if an authority tells them they can't do something, they stop doing it. Based on this behavior I'd have to infer American courts are punitive oriented (so you must never slip up) while European courts are resolution oriented (so good faith is enough and stop worrying so much). My inference also explains why American businesses don't listen to European courts until the fines get big. They get some small penalty on their first violation and think "that's all?" and continue the violation, then four or five cases later the penalty gets big enough to make them comply. See Apple with the interop rulings.

graemep 19d ago

Do you like the intent, or the implementation and enforcement? Politicians have a tendency to think that passing legislation fixes problems, where is its only the start of the process.