I don't run a small business, I make small things on the internet, this is not why I got into tech, I don't want to read 68 pages of yuk. If I made a small site that saves some user data i'd just pull it down too, I don't want the burden of worrying about being sued for some small thing I created, you just wont have it anymore.
FB fucked it up for everyone, ultimately people gota learn that when you give data to someone you implicitly entrust them with it. FB had to go and be evil and now the EU is overreaching demanding everyone spend their time bubble wrapping everything... everyone backing them up are the village people taking to the streets with torches and burning shopkeepers after the king was found doing witchcraft. Go burn the king.
One of the goals of this law and similar efforts is to make it clear that you need to consider the social, ethical, and legal ramifications of the things you crate. You are not creating neutral things in a vacuum; there is no neutral ground in a burning world[1]. That "small thing on the internet" might be reuniting families that were separated by work or politics, or it might be undermining the support structures of an entire industry or community. Maybe you are creating a social space*, which includes a duty to manage that space to keep so it doesn't become a tool of abuse[2]. Maybe your small site stays small. Obviously you cannot be expected to foresee every potential consequence of your creation, but you at least need to make the effort and catch the low-hanging fruit (e.g. the basic privacy features enforced by the GDPR).
[1] http://opentranscripts.org/transcript/no-neutral-ground-burn...
[2] http://www.gdcvault.com/play/1024060/Still-Logged-In-What-AR
One often wonders whether lawmakers heed their own advice here with what they create.
Well, not really: That's the constitutional court's job.
Your points are well argued - especially regarding the ethical and social implications of what we create, and I agree with them, however we have differing definitions of "small" in this context.
Your arguments apply to things that are maturing and are reasonably big already, but big things have small beginnings... and the internet/web is a fantastic place for nurturing those very very small ideas for basically free, this law appears to threaten those small ideas.
I personally find regulation like this abhorrent and against my morals. Sadly I don’t have the money to fight the EU so my creations will be blocked to its citizens going forward.
The end result of this is that EU citizens will be the ones that suffer from lack of access to technology and the smart ones will end up VPNing into non-EU networks to stay on the cutting edge.
Right, because everyone who lives in Europe is too incapable of coming up with technology and businesses themselves (that have the added benefit of being GDPR compliant) and without access to American firms they will surely fall into a technological dark dark age.
Instead of viewing GDPR as some nightmarish spectre coming to ruin everything, why not think of it as a potential opportunity? You're familiar with making money in a borderline no-holds-barred approach, now try and come up with some innovative business ideas that _don't_ rely on scraping and selling as much data as mechanically possible to prop up a business. This is a great for the disruption hackernews loves so much.
Cite one EU startup that you’ll miss if the issue was reversed.
That's the best way to think about it. When the EU started imposing VAT taxes on non-EU companies on internet sales to EU customers, a bunch of businesses sprouted to handle all of that accounting for you. (So instead of me selling my software online directly, technically all of my EU customers now buy from a US company called FastSpring instead. Fastspring remits VAT on EU sales for me so I don't have to deal with EU tax law, just my own Australian tax law.)
There's probably similar opportunity for a GDPR service that stores customer data via API service, that shields small / micro businesses from all the GDPR compliance. (Eg all your personal Wordpress blog comments are actually stored, hosted and served by a service that handles GDPR modal-consent forms and deletion requests on your behalf.)
>... now try and come up with some innovative business ideas that _don't_ rely on scraping and selling as much data as mechanically possible...
The problem is a lot of us who would never scrape or sell data and have no interest in exploiting our customers, are still worried about not being GDPR compliant, and the EU choosing to pursue us an example for something that none of our customers actually care about.
Why would you be worried about being pursued as an example? Is there any data that supports this as a reasonable fear? Isn't this exactly the "GDPR is a nightmarish spectre that can destroy anyone at any time" mentality?
This is a relatively simple regulation that basically required anybody processing user data to do so responsibly. How does one have an ethical objection to that?
Alternatively, hire a lawyer, like you would for any other regulatory requirement.
Far better details? It gives vague info on what might be considered personal data... I would not call it very detailed. In most cases just says personally identifiable information.
If you're making something that stores personally identifiable information outside of what you need, and don't care enough to secure it or offer ways for a user to manage that data then yes, take it down. Good riddance.
Or, just don't store that data in the first place. If you're storing usernames, passwords and the like then you have nothing to worry about.
Absolutely false. Anything pertaining to a person in any way is personal data. All default web server installations are GDPR violations, unless nginx grew an "edit the access.log entries pertaining to you" endpoint recently. (Although you can maybe argue "legitimate interest" for web access logging if you invest the time, and implement the right to erasure).
Something as simple as running Google Analytics without a processing agreement in place is a liability.
1. User profiles can't be sent to GA. For example, hacker news has /user?id=JohnDoe for profiles, and that contains a username, which is personal data that should not be shared with GA. Ok, so I could rewrite my profile URLs before sending them to GA without the usernames.
2. I haven't heard a single source mention referrals. If I'm on a user profile on my site and click a link, that's going to send /user?id=JohnDoe to GA as the referral. I would need to overwrite the referrals before sending them to GA as well.
3. What about 404 pages that I make up? What if I visit https://www.example.com/JohnDoe? That's sending my personal name to GA again. Hmm, ok, the site could exclude GA from 404 pages.
4. What about search boxes? What if I use the search field on a blog? https://www.example.com/posts?search=JohnDoe. Hmm, that's my personal data being sent again. Ok, we need to make sure any data from search boxes is now stripped and not sent to GA.
5. What if I manually add a query parameter or modify one? A homepage might have https://www.example.com/?page=2, but what if I change it to https://www.example.com/?page=JohnDoe. Hmm, yes, that's personal data being sent again. I guess I need to validate the page parameter to ensure it's an integer before sending the URL to GA. What if I then type in a personal phone number as the page number?
Nah, just for companies that trade personal information as if it was cattle feed. As an individual, I have no problem with the GDPR.
If you won't handle my personal information with proper care, you should shutdown or get sued out of existence.
Cheers.
Do you find yourself accidentally including data sales SDK's? Do you finish your website or app and realise you've accidentally set it up to fingerprint the user, scrape everything you can from them and sell it?
If your business is just a tool supported by wanton data scraping are you actually doing anything innovative and worthwhile or are you just making an MVP to pack full of advertising and jump on that bandwagon?
If you aren't doing that, then it's just a matter of checking what data you are harvesting and thinking about why you have it and if you really need it. Because if it's actually critical to the running of your business then GDPR does allow you to keep it. If it's not, why waste space, effort and now risk in bothering to harvest and keep it in the first place.
For example, an online shop might collect customer addresses, even if the sale is purely digital. If the shop ever decides to expand to physical goods, those addresses will be very useful to find an optimal location.
However, GDPR prevent the shop from collecting (or more accurately, raises the cost of doing so), since the use, and value of, said data only becomes apparent in the future. So the shop makes the best choice now to remove the collection, and then suffer the future disadvantage.
Maybe show a notice just below the address input fields that "we remember your address for a while, this is why" and link to the relevant section in the privacy policy.
There’s no damage that GDPR protects you from, and it doesn’t add any liability for stolen, hacked, or misused data.
Facebook can do the same shit they were doing under GDPR!
> (83) In order to maintain security and to prevent processing in infringement of this Regulation, the controller or processor should evaluate the risks inherent in the processing and implement measures to mitigate those risks, such as encryption. Those measures should ensure an appropriate level of security, including confidentiality, taking into account the state of the art and the costs of implementation in relation to the risks and the nature of the personal data to be protected. In assessing data security risk, consideration should be given to the risks that are presented by personal data processing, such as accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed which may in particular lead to physical, material or non-material damage.
also:
> Section 2, art. 32, Security of processing:
> Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate: [..]
Then you already had a ton of legal obligations, you were just not aware of them, since only now everyone is talking about the GDPR.
"FB fucked it up for everyone"
A lot of the things people are complaining about right now were already illegal, before the GDPR. People were just not caring about it.
What you call overeaching other's call protecting the interests of consumers.
Actually I think that's a good thing then.
Questions without answers in the GDPR:
* how to carry out a legitimate interest balancing test
* who is your lead regulator (do you have a lead regulator?)
* When do you need a DPO (large scale is left undefined, as is systematic)
* How reasonable will any particular regulator be towards inadvertent violations
* what precisely counts as the required technical and organizational measures in art24
* how do you define what is one purpose and what is two purposes?
Painful when needing to implement? Absolutely (not my favourite either, I want definite answers). The way it is? Yes.
Not all laws, nor all legal systems, are equally vague. It would be really helpful if the regulations had been accompanied with a large set of 'example applications' demonstrating how EU members should be expected (or required) to implement the law in specific scenarios.
Uncertainty is a real cost too.
1 page or 1,000 pages, most people are not in a position to accurately interpret it and understand what does or does not comply.
I run a small business and I like this. Just about anybody can read it and understand what rights and requirements are being set out in it.
The GDPR specifically refers to the concept of "micro, small and medium-sized enterprises" [GDPR 40p1 and 42p1 use this text; they direct member states about the spirit of the law, referring that the needs of such businesses need to be taken into account].
GDPR 58p2 sets out that regulatory bodies in a member state have the power to issue warnings. As in, if you mess up, unless the mess-up is malicious or excessively negligent, you get a written warning and reasonable time to fix the problem. My government (The Netherlands) has taken the effort, as have a significant number of third parties, of creating a legal document of 3 to 10 pages covering some details, and they generally set out more explicitly that you grant yourself a week or so to fix problems without penalty. Whilst the GDPR is intentionally ambiguous in order to try to be somewhat futureproof and remain short enough to read back to back in an afternoon, it's fairly clear this is perfectly fine.
The most strenuous sections of the GDPR involve requests from those whose data you store. If they ask you to supply what data you have of them, and whom you've shared it with, you have to comply. Within reasonable timeframes, and you cannot lie about it. If they ask that you delete this data, you must be capable of doing so, and you must do so within a reasonable timeframe. However, the GDPR is nice enough to grant you exceptions for reasonable measures which nevertheless make it hard to comply. Things like a backup tape are specifically called out. It's okay if data that's been requested to be removed, stays on those. You would have to show that this data is pseudonimized (GDPR-ese for encrypted, pretty much).
Any service which has a hard time supporting requests to explain what data you store and where you've stored it, or which cannot delete it from the main service on demand... should indeed just call it a day and shut down. I don't think a service like streetlend would have a hard time supporting such requests, however.