TBH most food & construction safety laws are way more small business friendly than the GDPR. Food safety has a well defined relatively easy to follow rule set and food inspectors come in and give you a food safety rating, which you can work on and improve. It won't destroy a small mom & pop restaurant with a $million fine.

For construction, you build your building to 'code', an inspector comes in and stamps the building and then your done. If your not code compliant, then you can correct without much penalty at all, not get a $million penalty and you don't have to go to court or get lawyers. Making your own shack in your backyard isn't an arduous process as far as code compliance goes.

Since most software is constantly modified and edited, I don't think the construction model really works. More the food safety one or a data fiduciary one.

>food safety rating, which you can work on and improve

But the GDPR works like this too? The $20 million fine is not automatically applied. Here's a flow chart which details the process of a GDPR breach: https://40uu5c99f3a2ja7s7miveqgqu-wpengine.netdna-ssl.com/wp...

from https://www.i-scoop.eu/gdpr/gdpr-fines-guidelines-applicatio...

If you breach the rules, a simple reprimand without a fine is possible too.

Is the 20M EUR maximum reduced by law, or just by regulatory discretion? The USA is currently demonstrating (with DACA, marijuana enforcement, etc.) the fragility of the latter.

The law explicitly lists factors the regulators have to take into account for determining the fine. If they give a large fine for a small infringement, they're going to have a hard time to claim they took all factors in your favor in account properly.

From what I've seen, it's partially like in the US - each EU member has its own data protection authority which imposes those fines, but they are closer linked than the US states' laws. I can definitely see some EU countries slacking off on enforcing, or being less/more harsh than the others.

But 20 million is possible right? Even for a small offence? Where in the actual text of the law does it say that they will never impose the maximum fine for a trivial or minor offence?

It actually doesn’t say that. This law has the effect of small business essentially needing a 20 million insurance policy to protect against the possible whims of an overzealous regulator? It’s either insure yourself for 20 million or risk losing your entire business over potentially a trivial matter.

When people in the UK have been jailed 8 months over traffic cameras or prosecuted and jailed for speech, I wouldn’t give a European government the benefit of any doubt. Willingly inviting an unelected regulator, accountable to nothing but the letter of a badly written law created by another unelected government body — that’s just foolish.

It’s probably not possible. I wouldn’t map the (EU) GDPR on how a US-like legal system works. E.g. it’s very unlikely that the regulator seeks maximum penalties in the EU, and worst case you could go to court arguing that a penalty is non proportional compared to other cases (and win)

The maximum fine is a cap, not a guideline.

> It’s probably not possible.

That's one of the funniest statements I've read today. Or annoying, I'm not sure. Definitely meaningless.

> Where in the actual text of the law does it say that they will never impose the maximum fine for a trivial or minor offence?

Article 83 (including related recitals)

Don't use people personal data and dont allow others to spy on your users (ads, analytics,..) and you wont need to do anything.

Work in best interest of your users and you will be compliant. I don't think that this is harder than food safety regulations.

By the way, the technology is changing fast and a strictly defined law with "do" and "don't"s would be downplayed in weeks. that's why GDPR is conceptual (and thats why everyone is pissed off, as they can't downplay it - how many sites have you seen that are giving you a fair cookie choice?)

It is not a $million fine: https://www.gdpreu.org/compliance/fines-and-penalties/

And in food or construction if you willfully break the law then that can be criminal and you will face severe fines and/or jail. It's all about your intent.

GDPR isn’t concerned about intent at all — which is why it is a well-meaning, but horribly written law.

it absolutely is, see as an example Art 83, "General conditions for imposing administrative fines" which has at point b "the intentional or negligent character of the infringement".

To me, asking a small developer with a site that gets a few thousands users to implement GDPR is like asking a dad to do full safety test on a toy car he built for his kid, just because a big company like GM had safety issues. The problem EU is trying to solve here are large companies like Facebook making monopolies and syphoning data. So why the hell do they have to impose rules on small hobby websites that run at a loss?

There's a huge chunk of the web that is filled with niche web tools, mostly made as a hobby, running for free. I myself own 2-3 such sites. Now, I'm forced to spend my hobby time adding a bunch of new features on a site that already loses money? I'm sorry but the couple thousand people that depend on this tool will have to find someplace else I guess.

HN sure loves to worry about AMP killing the internet, well to me this is far more dangerous. Can't wait for larger troll companies bullying small devs with lawsuits and killing all their competition using GDPR.

> Now, I'm forced to spend my hobby time adding a bunch of new features on a site that already loses money?

What new features do you think you need to implement to comply with GDPR?

Dealing with missing user records. Deleting all records pertaining to a user, which may break a well-normalized database. Keeping track of any analysis you did and why (e.g. scanning server logs to see country of origin to see if you may want to seek out a translation of your UI?)

In practise, 'it depends'. It may be that it's simple enough to delete everything, or it may be that you anonymise, rather than actually delete. E.g. if you have a `users` table with:

`id, name, email_address`

You could simply blank out everything apart from `id`.

Regarding logs, it might be worth thinking about whether you actually need them to contain personally identifying information (e.g. IP addresses, usernames) - if not, just don't log them.

Just replace deleted user's data with "Mr. Deleted 1234, [email protected]".

presumably you have laws that require street vehicles have a valid license before they can go on the road. Do you remember the police arresting someone because of a toy car they built?

If not, then why do you expect the EU to go after the equivalent site with a few thousand users?

> Do you remember the police arresting someone because of a toy car they built?

Does this apply? [1]

[1] http://fortune.com/2017/07/21/five-year-old-fine-lemonade-st...

since

* the fine has been cancelled and the council has apologised

* this is such a rare occurrence to be worth news reports

I'm going to say it validates the point.

Sure. Going back to your question

> why do you expect the EU to go after the equivalent site with a few thousand users

You are saying that they DO that, but then will (probably) apologize afterwards. Some website owners consider that an unacceptable risk.

Logically, it's very unlikely. Realistically, seeing the risk of a $20m fine, I sure as hell won't take the chance and will take down my site until the dust settles and the kinks gets ironed out.

> But what is the alternative?

Status quo? Baby steps? Enforcement of existing statutes? Consumer education? Promotion/support of preferred alternatives? Codified small business leniency? Objective enforcement clarity?

I don't dispute the goal of GDPR -- I support it fully. My worry is that it could be abused by legal trolls. They are a fact of life.

GDPR violations aren't something a troll can sue you over. All a troll would be able to do would be to raise a complaint with their national entity responsible for it, who analyzes the complaint and then takes action themselves if deemed appropriate.

But legal trolls have an array of legislation to attack you with. GDPR is just the latest one.

GDPR is an easy one because it's fairly ambiguous and doesn't yet have precedent

GDPR is for the most part making explicit things were implicit in the pre existing EU legislation, many of which have been subject to EU court rulings. There is a ton of precedent.

yes but the argument is that one hit from the gdpr can kill you and maybe even most likely will even if you're in reasonable health, and most other legislation you can survive a few hits if you're not already critical.

No. The first hit from GDPR violation will be from the regulator, asking if you actually are in violation, and giving you advice about how to come back into regulation.

I didn't say the argument was correct, but people probably also don't want to deal with the regulator for their little side gigs even if it's only the regulator asking questions.

Agreed. GDPR simply made me aware of that once again. I still feel the trolls should have minimal amount of attack vectors to small businesses, though.

Why would legal trolls use GDPR? What's in it for them?

>>But what is the alternative? Is business creation the final goal of our society? Or there are things more important?

The alternative is to let consumers fend for themselves, and if government is going to help, limit that help to investigating and punishing fraud, enforcing contract law, and providing free information resources to help consumers make better informed decisions.

Yes business creation should be the highest goal of society. New businesses are what counteract income inequality and drive innovation.

We need innovation to solve the already existing problems in society, that claim tens of millions of lives every year. There is no zero risk path open to society.

I'm not sure what GDPR is protecting me against that wasn't already covered by PCI-DSS and existing cybersecurity standards. Not being financially defrauded is the only thing i care about. For everything else is easy to avoid sharing personally identifiable data if it's really a concern.

One of they key things to me is increased fines that are available. I've likely had my data and families data lost through a variety of terribly insecure services having breaches.

TalkTalk lost 150k peoples information (including bank account numbers, sort codes, dates of birth, etc - people who later then received scam phone calls with people who knew their details) due to extremely basic security failings. They were fined £400k (a record fine). They then did it again and paid £100k.

Properly securing the site and the data over many years could easily cost more than that, added to the chance you'll not get hacked or fined and it is perhaps even a financially sensible position to not put the effort in.

I think being responsible for negligence in security practices and GDPR are not the same. GDPR is overreach. There is a saner middle ground, for example in Australia new laws coming in mean executives can go to prison for the negligence in your example. That makes more sense as it doesn't invalidate 90% of standard tools processes in technical marketing for example.

I think it's interesting you find a fine to be overreach but imprisonment not.

> That makes more sense as it doesn't invalidate 90% of standard tools processes in technical marketing for example.

Can you explain in more detail?

I'm not talking about the fine/prison. The overreach is that they dictate how you have to handle data. In Australia you are only obligied not to get hacked and are trusted to figure it out for yourself. In Europe they have all this right to be forgotten BS and reams of compulsory opt ins etc etc

I don't really have a problem with requiring consent to work with personal data. Right to be forgotten is restricted and I can't think of obvious cases within the restrictions here: https://ico.org.uk/for-organisations/guide-to-the-general-da... that I disagree with.

Stronger restrictions on what data you can hold without good reason or consent means that inevitable breaches become less important.

Do you prosecute your friend and aqaintances for uploading pictures of you to Instagram/fb etc? Block all tracking script/pixels on the Web? Avoid using the phone in order to not generate meta-data?

I'm not sure how it's "easy to avoid sharing identifiable data"?

For the most part no (i block ads because I'm not interested in them not for privacy concerns) but I'm also not irrationally paranoid about such things. I've lived in a world where I'm photographed hundreds of times a day by cctv etc for most of my life. Im not really sure what difference a few photos on social media will make

The difference is the size of the aggregated dataset on you and those you are associated with, and how it might be sold, augmented etc. Granted, some places it might be legal to sell cctv footage too - but it will also fall under the GDPR (not the GDPR alone, there are surveillance bills and "ant-terror" provisions... But there's one remedy for government overreach (throw the government, through elections or protest) another for private overreach: government regulation/laws).

I understand the risk of aggregate data etc and do think we need to hold companies accountable however I disagree with the fundamentals of how GDPR tries to achieve this. It’s the wrong abstraction. I also value what free services, indie apps, small scrappy startups and general maker world productions provide society and life in general way more than I value absolute privacy.

PCI-DSS is essentially about credit/debit card data. GDPR is about personal information is general, such that you need to let your users know what you are collecting, what you will do with it, and how long you will hold it.

A point of fact though — PCI isn’t a law, it’s a voluntary standard.

Yes however i can choose to not interact with non compliant service. The ignorant need to be educated rather than the informed punished.

There are almost no companies that respect the customer's privacy because of the lack of regulation so you can't in fact choose anything.

Companies have failed to regulate themselves since the dawn of time, this is how the world works.

You won't get PCI-DSS accredited without an audit.

Only Level 1 compliance requires an audit. Below that a remote scan of public IPs and a self-assessment is sufficient.

Are people dying from data being collected for website analytics?

It’s a false dichotomy to compare the risk of DEATH from bad food safety to the annoyance of getting a targeted ad whilst enjoying an online newspaper article for which you didn’t have to pay.

Elevating data obtained while surfing the internet to the level of food safety or building codes is ridiculous.

The attitude you have here is exactly the reason why GDPR is required.

Companies worldwide have consistently failed to safely store and process personal data. There are new data breaches every day. Irresponsible processing of data has a direct negative effect, and that’s not related to the idea that it’s misused for advert targeting.

Minimising the incompetence we’ve seen worldwide by treating it as “just some data collected while surfing” is baffling to me.