Think of the typical consumer of web apps, like people who run Wordpress and Shopify sites and click their backend together with tools like Zapier and the like. How can they comply without an universal protocol embedded into all the tools they use, without losing the advantage of automation? They have to delete stuff manually, and hope that the marketing tools they use provide options to delete it.

What GDPR does is that it makes starting your own business less attractive, and funnels people back into the traditional work environment. And by doing that they also reduce the amount of potential customers for smaller startups aiming at small business and these people.

I would claim the opposite. If you're starting a business you'll research how to click your backend together in a way that doesn't leak all of your user's data in all directions. Than you'll build a backend that never had these problems to begin with.

It's much more of a pain for companies that already have a tried and true stack but didn't use the two full years of warning to replace the parts of the backend that isn't compliant. No rest for the wicked.

Ohm that's if you're starting a business, which will now carry a much higher cost.

And if you have a business running, bad news, costs will increase significantly.

As someone trying to start a business : boo frickin hoo. This is not kindergarden, this is adults trying to run a business. The deal of private property and capitalism is: private person figures out how to do things within the law, profitable, and then gets to keep said profits, minus the subscription fee for the society that enabled that business ( taxes). If the law is nonsensical, private person can try to change it. This law is not that. It is what everyone wants for their data, if they can get it. So i'll gladly deal with the headaches, because at least my data is protected by the same law

The more noise I see some people making about how hard it will be to comply with GDPR, the more likely I think it is that they or their employer are abusing the hell out of their users' private data.

The "this will help <evilcorp>" line of arguing seems to be an attempt to play on the hatred privacy advocates have for Surveillance Valley at the moment, and trick them into arguing against their own best interests.

And how will your costs increase when you have to provide data to dozens, hundreds, or thousands of letters like the one the OP posted, each one asking for different things?

Managing the data is easy, managing the compliance and reporting will be the hard and costly part.

Don't be all gloom and doom. I agree with your parent comment that it's a reasonable law, and the general sentiment that it's manageable both when you're small (not a lot of overhead in collecting one user's stuff and shipping it) and when you're large (automate all the things). And I don't think that many requests will come in, even while the new law is still hot.

Also, 99% of the law already exists in the Netherlands. I did my first request last week actually, after I discovered a company did WiFi tracking on me. I got a reply today, very professionally and complete (and fast, I should add: they had 4 weeks). I was impressed and it gave me a lot more confidence in the company. And it didn't look like it cost them a lot of time, either.

maybe show what you got under profile settings somewhere or button which will email you report with all or frequently requested information.

Its probably safe to assume that the person you're recommending this to has absolutely no idea about the general concepts of software development, or the rough orders of magnitude of information that is reasonable to store and serve with modern infrastructure available to nearly any small business.

Its reminiscent of the willful ignorance displayed by the Cuyahoga County Recorders Office, in Ohio. The office responded to FOIA requests by demanding $2 per photocopy, even though the documents were already stored on CDs. They hoped they could simply make freedom of information too expensive. Their legal argument was that the files could be semantically thought of as photocopies of the documents.

Here's a verbatim reenactment of a deposition in the case where a county employee puts on a charade of not knowing that a photocopier is.

https://www.youtube.com/watch?v=PZbqAMEwtOE