Rubbish, this is just spreading FUD.

From the UK ICO: "It’s true we’ll have the power to impose fines much bigger than the £500,000 limit the DPA allows us. It’s also true that companies are fearful of the maximum £17 million or 4% of turnover allowed under the new law.

But it’s scaremongering to suggest that we’ll be making early examples of organisations for minor infringements or that maximum fines will become the norm."

Look at the track record of the UK ICO - how many small businesses and side gigs have been fined £500k? How many businesses of any type have been fined the current maximum of £500k?

So where does this ludicrous assumption that everyone is always going to be hit with the maximum fine from here on in come from?

Even TalkTalk were only fined £400k for the most ridiculous incompetence leading to 4 breaches in 18 months and failing SQL injection 101. They make profit in the tens of millions yet still didn't hit the maximum (They should have in my opinion). I think at the time that was the largest penalty yet issued.

Same goes for other data protection bodies across the EU - there will be few instances of maximum penalty under current data protection. I'm sure some countries have never imposed the current maximum.

nb It's not a ridiculous law - I'm fully in favour of it, as are many others over here.

That's the most interesting thing about the GDPR. While some developers are picking up their ball and huffing off home, others are actually 100% behind the regulation.

It says something when tech-savvy people agree to sacrifice time and effort and probably profits to protect their users from their own software.

Or the competitors' software.

Consider some business that was doing what GDPR requires already: users could delete their data, they could request a complete copy of it as well as an explanation what it is used for, and it was only used for defined purposes that the user signed off prior anyway.

Sadly, that reduces flexibility somewhat, but they're doing it because they consider it the right thing.

For them, GDPR levels the playing field and makes sure that they never have to stray from this conduct just to remain competitive with companies that aren't so nice to their users.

Nothing about the gdpr solves the problems of companies having insecure systems that _leak_ user data. I also don't believe that data about me is data I own. To me, the gdpr feels ineffective at the real issues causing me harm (leaked info) and also a giant burden on companies that fundamentally changes how the industry has worked, but in a way that quite frankly, doesn't make any sense to me. The data about my order isn't my data to control.

It doesn't directly prevent insecure systems, but discouraging companies from storing information they don't need and transferring it on to third parties for whatever reason they feel like massively reduces most people's exposure to this risk.

>The data about my order isn't my data to control.

If you believe people have a right to privacy, then you believe they have a right to decide who gets to know what information about them.

That's not even remotely true. A right to privacy does not mean I get to control the actions of others.

Nothing restricts what others can do with them, they just have to state it so I can decide whether that's ok for me or not.

The lack of this clearly defies the right to privacy, just consider the extreme case of "I'll dump your data on GitHub next week"

Requiring disclosure of a breach within 3 days of it happening, as opposed to the several months that is commonplace now, is a big help.

"I also don't believe that data about me is data I own."

Everyone disagrees on this point. Right now, Europe says the opposite.

"also a giant burden on companies that fundamentally changes how the industry has worked"

Good. Currently the industry is geared to suck up every last bit of user data like a vacuum, regardless of whether it's actually needed, so they can sell it. This has gone on for far too long, and I'm glad to see the industry hopefully move away from it.

If I place a camera in my house so that it's recording what's going on in your bathroom- is that data you would like to be kept private, or not?

I'm fully behind the GDPR. It might not be perfect, but I've read the law and it's surprisingly straightforward and sane.

Why is it sane to assume data I've sent to a service is my data to control?

GDPR increases maximum penalty to be high enough that it could be a penalty to a Google or Facebook for a serious, wilful, breach of regs, in an environment where the tiniest fraction of reported cases get any fine at all (16 of 17,300 reports for 2017 in the UK) let alone the maximum. Internet now certain that one man software companies and hobbyists with non-commercial regex sites will receive £17m fines, every time and it will be used as a stick to beat one's political enemies with or, most comically of all, pay for local infrastructure improvements.

I don't understand why - the regs seem reasonable and not especially difficult to meet unless your business is built on wilful abuse of personal data. Just a reasonable effort to enhance DPA taking into account new techniques and misuses of data. Deletion for everyone, not just a minority - thanks to FB et al feeling it's fine to never delete, and run shadow profiles on all. The highest penalty will be saved for the most offensive cases involving multi-nationals. It will be interesting in a few years to see how many maximum fines have been levied. My bet is none at all, once or twice if there's an especially egregious breach from an Amazon or Google.

I've little doubt that just as I feel more should have attracted fines under DPA I'll feel more should have got GDPR fines.

My intuition is that the people who complain are that fraction of developers who actually care about their profits more than their users' privacy.

For us in Europe 20 years of DPA must help - I doubt there's many here would want to go back to pre-data protection.

No, in fact, most people get served with nothing more than a formal caution or a £90 fine. This is normal - this is how the law works in this country. Anyone who doesn't understand this hasn't even been paying attention to the lowest-common-denominator newspapers, which are constantly screeching about how people usually don't get anything close to maximum sentencing.

It’s not complex - we don’t let people away with flouting regulation because it’s burdensome. “It would make me unprofitable” is not a valid reason to ignore health and safety laws, or hygiene laws.

“I just want to run a food truck as a side project but not care about making people sick or not” is obviously ludicrous. Why is personal data somehow fair game?

Someone doing it for love or passion is now faced with GDPR compliance and the risks and hassle that come with it.

Just because you are not making revenue doesn’t mean that you don’t have to abide by regulation. The GDPR is intended to solve a very real and present issue; if you run a side project that deals with personal data, then the fact that it makes no money doesn’t mean that your mistreatment of personal data isn’t harmful!

How do you revoke PII from a distributed information system, like anything using a blockchain or distributed version control? You don't.

If you choose to block all EU IPs instead of implementing the most basic data security and retention policies, then it’s for the best that EU users are not able to use your compromised service.

Once you've got that sorted and you can change/remove identity information, the likes of GitHub have no issue so long as they have GDPR-compliant contracts with any business partners who can access git repos. Obviously, anyone using GitHub who decides to store all identity data forever is, generally speaking, not GitHub's problem, same as someone who noted down the names of all their friends on Facebook isn't Facebook's problem.

Misuse of git isn't a problem inherent to git.

Can you explain why they can cope with PECR but can't cope with GDPR?

The law will be enforced, just as current data protection is.

The law can be enforced without every case attracting the maximum penalty. That's why nearly every law has a range of penalties.

Accidental and minor breaches can attract a minor penalty or a letter asking you try harder. Wilful and repeated breaches affecting many customers will attract harsher penalties.

Same goes for speeding offences - go 40 in a 30 limit, get a fixed penalty ticket. go 140 with the GoPro race footage of you and your buddy posted to twitter expect a much larger fine and a driving ban.

In neither instance is it not enforced, or damaging to the concept of law.

What @megaman22 is saying fully matches my experience as an Eastern European -- piss off the wrong people and the law will fall on you with its full might. Some people would really love to make an example out of you if you give them the chance. And I don't think that only applies to E.E. but have no data either way, it's just an observation from news and hearsay from affected people around here.

I fully support the GDPR and I'll do my utmost to comply with it even for hobby projects.

That was never something I disputed in my root comment that spawned this big sub-thread.

What I said and will continue saying is -- laws like these open even more doors for legal trolls, big players and nasty competitors to exhaust you out of business. The fact that it doesn't happen on a massive scale in my eyes means nothing; or rather, it means that agents used as an example to scare off others isn't something that's done often because usually just a few lawsuits and their aftermath are plenty enough for those many others to get the message.

So IMO using statistics here is not a strong enough argument. I am not trying to alter your thinking. We actually agree on most points but I simply can't agree that past statistics are a good proof that the new law won't be used in a more heavy-handed manner than originally intended.

To me, that remains to be seen yet and none of us can claim with certainty that what seems likely to them will materialize.

> I don't think that people like you and people like me will ever agree in these discussions because you look at statistics and I look at possibilities.

You may be right in our chances of agreement!

I see a judiciary separate from state which is more than happy to put politicians back in their box when they introduce bad or overreaching law. Governments of all colours complain about the judiciary and Lords here in the UK - which I see as proof that the separation basically still works. I see data protection bodies that are separate from government and politics. I see occasional stories of record fines or breaches from mainly Western Europe and talk to friends and conclude small business and solo developers are not being fined or trolled into oblivion in nearby countries either. Yet EU DPA is most of what GDPR is with smaller maximum fines. Why isn't the disaster scenario you foresee already happening with current DPA and other laws? Why are so few fined for breaches and only the most extreme cases getting fines?

I'm less aware of justice systems further east and yes it's obvious that former Soviet bloc are going to be rightly more sensitive to and concerned about corruption. I'm also not aware how successfully that's been left behind from adopting EU laws and years of membership. That said, reading the pieces that turn up on HN it seems that the US is the one with problems of corruption in the justice system currently. No doubt that's also unrepresentative thanks to what's being shared about a vast nation.

So, the legal trolls - it's going to be registrars and data protection bodies bringing cases or seeking sanctions. Just like happens with current DPA. This does not appear to be akin, or anywhere near, the US DMCA where large media companies massively abuse takedowns via automated software and triggering numerous trivial errors. I don't see the scope to exhaust someone out of business - yet it's clearly easy with DMCA. There's nothing a Sony can abuse to pick on a little guy with GDPR - they can report me to the registrar.

You're right that it remains to be seen, but I sincerely doubt our data protection bodies are suddenly going to break out thumb screws and bring orders of magnitude more cases when they've kept fines for the final, extreme, and rare sanction til now.

I honestly expect that just as I feel more should have attracted fines and sanctions under DPA I'll find that GDPR is also being too lightly applied. We'll see. I've been wrong on the internet before. :)

Because speed limits are not enforced, everyone goes somewhere between 5 and 15 mph over, all the time. But catch a pissy cop, or one in a town that uses speed traps as a revenue source, and you can get pinched for hundreds of dollars arbitrarily. Yeah, the jackhole that burns tire at 110 past a school-zone is most likely to get pinched, but almost everyone on the road could.

and yet

> But catch a pissy cop, or one in a town that uses speed traps as a revenue source, and you can get pinched for hundreds of dollars arbitrarily.

Sounds like enforcement to me.

The solution is also simple. Don't drive over. I don't do it. If the sign says "50 kph", I drive "50 kph" and not more.

Driving over is entirely voluntarily ignoring the limitation set by the law so don't go and be all surprised when somebody CAN FINE YOU FOR THAT.

When a corporation is compliant and only has minor infractions, they will (most likely) write a sternly worded letter.

But if you're constantly and repeatedly or willfully ignoring or breaking the regulation they definitely won't leave it at a simply tap on the fingers.

Plus, I don't think any regulatory body is looking for bankrupting a corporation. They will obviously size the fine according to how much the corporation has in turnover or profit.

If you have minor infractions caused accidentally and you cooperate I have doubts that any regulatory body for the GDPR will go beyond sending a simple letter asking you to fix a problem.

I am not one to say "trust the EU government, it is good". But the intent of the legislator is obviously not to kill businesses willy nilly, it is to punish certain behaviours, they have no reason to willingly cause a business to shut down, which is why the GDPR explicitly accounts for collaboration.

In the end, it is up to you to decide not to abide to the law. There have been local regulations forever, this won't change much.

Note that, in parallel to the EU regulation, the statutory maximums can be enacted(ever since Booker judges can use their discretion again), but in reality most judges rule within the sentencing guidelines.

Yet. Wait until the company is another political organization that is identified as an enemy or competition. Then these laws become tools for shutting down dissenters with selectively applied fines, even to companies outside of the EU.

And unlike you say the law does say the regulatory body for the GDPR has to consider the business needs of smaller businesses and adjust their fines accordingly if they even hand them out.

There is a good flowchart in this thread too, I recommend to study it.

I am hopeful that the US will pass legislation exempting US firms from enforcement of fines under GDPR on US soil, but I am not optimistic. Under current law, it is likely that they can be enforced. Either way, the net result will be that EU residents will have access to a far smaller universe of content and services. Most businesses just won’t take the risk.

We both contributed to a conversation where you made the same point, a few days ago:

https://news.ycombinator.com/item?id=16888026

Back then, I was not convinced that you had a clear idea of how such a money-grabbing scheme could be implemented. I would kindly ask whether you have a clearer understanding of the relevant procedures now.

The people saying how easy it is don’t know what they are talking about.

By "28 different interpretations I assume you mean those of different member states. It would actually be 27 now that the UK is leaving, but even so, the GDPR is a regulation (General Data Protection Regulation) and not a directive, partly in order to eliminate inconsistencies in national laws. To clarify, as a regulation, the GDPR does not need to be passed into national law.

Additionally, this reduces the burden on companies that would previously have to deal with multiple local authorities, in the context of the Data Protection Directive.

Further, there are provisions for the consistent application of the GDPR across all member states, particularly a European Data Protection Board.

This is from an article I quoted earlier:

Coordination and Consistency

Under the Directive, there has been a certain level of coordination in interpretation and enforcement. Apart from informal contacts among authorities, there has been a succession of non-binding opinions issued by the “Article 29 Data Protection Working Party,” an advisory committee comprised of representatives of the national supervisory authorities (commonly termed “data protection authorities” or DPAs), along with the European Data Protection Supervisor appointed by the European Commission. Under the Regulation, that group will become a more independent and powerful regulatory body called the European Data Protection Board, tasked with ensuring “the consistent application” of the GDPR. An entire chapter of the Regulation (Articles 55-63) is devoted to cooperation and consistency, with procedures for multiple DPAs to coordinate investigations and promulgate consistent decisions and policies reviewed by the Board and reported to the European Commission.

One feature of coordination that should be helpful for multinationals is a provision for companies to work with a “lead supervisory authority” in the country where the company has its “central administration.” That authority will then coordinate with the authorities in other countries where the company operates, attempting to achieve consensus on issues that affect all of them.

https://www.infolawgroup.com/2016/05/articles/gdpr/gdpr-gett...

Generally, I have no idea why you say that the GDPR will be nearly impossible or actually impossible to comply with. Different member states have different regulations for drug use, for instance, but that is never used as an excuse to violate drug laws "becuase they are impossible to comply with" due to different national interpretations.

What would be the mechanics of enforcing the GDPR against a US company with no EU presence? I'd understood the opposite, and that the EU's best options to enforce were probably indirect (via customers, vendors, etc. with EU presence).

If the US court doesn't decide that, the EU will have to resort to indirect measures (Google AdSense will probably stop working since Google doesn't want the EU courts on their butts for making business with someone who violates the EU law and other measures)

https://www.privacyshield.gov/article?id=How-to-Join-Privacy...

So how does that affect companies that don't elect to join Privacy Shield?

Agreed that AdSense will probably start indirectly enforcing the GDPR at some point. Someone will probably make a lot of money picking up the traffic they lose, in exchange for never changing planes in Frankfurt again...

I guess we'll have to wait and see what happens in that case, if the US court system is willing to enforce GDPR fines on their side, that would be a win for the EU (the US has been doing this for ages)

https://community.spiceworks.com/topic/2007530-how-the-eu-ca...

> "While we don’t yet have U.S.-EU negotiated civil enforcement mechanisms for the GDPR (and it is unknown whether we ever will), there is still the application of international law and potential cooperation agreements between U.S. and EU law enforcement agencies, which have been increasing in recent years."

That sounds pretty murky to me, more a statement that she expects regulators to cooperate than one that current law provides a clear path. Not that I can find a more confident article in the other direction, of course...

He wasn't 'almost jailed' - he was fined £800. And the video involved him saying 'Gas the Jews' over and over again to his dog, to which the dog reacted.

[1] https://www.washingtonpost.com/amphtml/news/the-intersect/wp...

https://en.m.wikipedia.org/wiki/Twitter_Joke_Trial?wprov=sfl...

What part of this is a problem for you?

(And for that matter it was his girlfriend's dog).

But yes, I agree with you - you have no control over the Court's decision if found guilty.

There's no good way to frame this for a small business. Are you seriously suggesting that the mere benevolent feelings of a judge or board and how their mood is that day is the only thing standing between a startup and bankruptcy? If you're saying a small business should never be fined that much, why isn't that the letter of the law? Why does the court even have the option to completely destroy a startup like that?

> So where does this ludicrous assumption that everyone is always going to be hit with the maximum fine from here on in come from?

Where are you getting this ludicrous assumption that the law won't apply the maximum fine? If you don't think they should be able to, why isn't the law simply sensible, and should apply a lesser fine?

> Where are you getting this ludicrous assumption that the law won't apply the maximum fine

They have never yet applied the maximum in 20 years of the current DPA, why presume they're itching to start next month? This makes no sense to me.

Under the DPA 1998 the largest fine was issued in 2016, to a multi million pound company. £400k, so still only 80% of the maximum. Look to precedent across the entire EU.

Supposing 100% of the startup's revenue comes from GDPR violations and they've been doing so for, say, 5 years, then the fine should really be 500% of annual revenue. Or even multiply that by 2 or 3 for punitive purposes. It may or may not destroy the startup, depending on how well funded they are. They could be breaching privacy for reasons other than revenue.

The only place and time where the concept of punitive damages and GDPR overlap is the United Kingdom between May 25, 2018 and March 29, 2019.

[edit: and Ireland. They might want to reconsider, given that they host many of the European HQs of US companies.]

As I posted elsewhere, this is NOT true.

>The $20 million fine is not automatically applied. Here's a flow chart which details the process of a GDPR breach: https://40uu5c99f3a2ja7s7miveqgqu-wpengine.netdna-ssl.com/wp...

>from https://www.i-scoop.eu/gdpr/gdpr-fines-guidelines-applicatio...

These rules look at whether your company has infringed before, whether you've notified the state on your own, etc. pp.

The current Information Commissioner Office system has a similar system in place. Out of 17,300 cases reported in 2017, 16 resulted in a fine. Source: https://www.infosecurity-magazine.com/opinions/gdpr-timebomb...

Edit: to those downvoting this (and all of my other comments) - this comment contains only facts. So please show me where it says that there are circumstances under which they must fine you less than the maximum. Otherwise there is nothing to downvote.

Each supervisory authority shall ensure that the imposition of administrative fines pursuant to this Article in respect of infringements of this Regulation referred to in paragraphs 4, 5 and 6 shall in each individual case be effective, proportionate and dissuasive.

Note: proportionate

In the EU you tend to trust your bureaucrats to make a "Fair and Just" application of the law

In the US we tend to expect our bureaucrats to be vindictive, corrupt, petty, and generally impose fines and penalties not based on the law but based on their personal feelings about the target of their "legal action"

Thus such open ended wording like you posted being classified as a "rule" scares the shit out of most Americans

And the differences in the legal systems specifically. I think this is why a lot of HN commentators are finding the GDPR vague. In the US rule based regulations are the norm. For better or worse this tends to allow those with clever lawyers to search for loopholes. UK law is much more principle-based, which means trying to abuse the exact wording is not going to save you from a fine, and equally a technical-breach of wording is not going to get you prosecuted. It's not just the civil servants that we trust with this, it is the judges too.

The big number max fines in GDPR are there to deal with companies like Google and Facebook who can write of $5m as a rounding error.

People who have been fined at all under the existing DPA, being enforced by the very same people as GDPR, have been negligent, repeat offenders. I don't believe anyone has ever received the maximum fine in the existing regulations. That just isn't how UK law works

There's at least twenty years of regulation under existing DPA law, where the maximum fine has never been asked for nor applied.

Some people just accept it when someone says they won’t do something that they totally can.

I know, it doesn’t really make sense. If someone tells me “well it says that we can do that if you go by what’s on paper, but we wouldn’t actually do that”, then change it so that it says on paper that you won’t, or I’m inclined to think that you totally will, because you totally can.

https://techblog.bozho.net/gdpr-practical-guide-developers/

The penalty isn't meant to be something you afford. It's a penalty. (It's a feature, not a bug.) I'm having a really hard time not being sarcastic right now but compliance with the law might also end up being an economical option worth looking into. Cheaper than lawyering-up for being sued by shysters for non-compliance, and cheaper than being penalized for non-compliance.

Mind you, taking whatever-it-is off the internet is fine too. I totally understand. What I don't like is all the whiny sanctimony and martyrdom. "Yes I'm taking my thing off the internet, but first I'm going to make a big deal about what a tragedy it is for the world." Um no. The fact that your thing is a "small business" means few people care about it. (Sad to say. More people care about Facebook than about you. That's why they're the big incumbent.) And it emphatically doesn't mean for example, that you're some hallowed, heroic underdog who deserves protection, especially when you won't even afford the same to your own users and their data.

I'm a hobby developer. I once made a tool mostly for myself, but decided to put it online. A couple thousand people use it, and it runs at a loss but I keep it up mostly because it's useful to some people out there. My tiny website isn't hurting anyone or breaking the internet the way Facebook or Google may be. To claim that having to spend my hobby time implementing a bunch of extra features is just "complying with the law" is bullshit, I'm sorry. In terms of scale, it's basically as if I forced you to do full safety test on a toy car you made for your kid, just because GM cars had safety issues.

And I'm not special. There are plenty of other small devs like me with thousands of small niche web tools out there, most of which are ran purely as a hobby, out of our own pocket. I may not make a blog post and get it to the top of HN, but devs like us have 0 incentive to keep our sites online.

HN loves to complain about things like AMP killing the web, but to me this is orders of magnitude worse.

I really think some people are just completely blowing this up into something it's not, probably because the only thing they've read about it is others scaremongering.

As a business owner that cares about privacy, I was basically compliant already - all I had to do was reword my privacy policy a bit to make it more human-readable.

How do you deal with user requests? You need at least somehow be able to gather the data, pack it into an user underdstandable format, and delete database entries, also from your backups.

Regarding backups, realistically you are not going to be required to delete from them as it's completely impractical to delete a single user's data from backup. You just need to be straight with your users - tell them that their data will be removed from your live system immediately, but that some data will remain in archive, securely encrypted, until the end of your defined retention period.

gather data: select * from every table that has userId

pack it into understandable format: every language i have used makes json, xml, csv pretty darn easy

delete: delete from....

backups: i am surprised your hobby project takes backups. perhaps have a table with userIds that were deleted, and when you make your new backup, remove all their data?

Ah yes, and then all of my data has holes in it that I need to deal with. "Hmm, we only have 5 orders for this, but we're missing 6". "hmmm, we charged this credit card, but there's no order for it and I'm not sure if we ever shipped anything?" "hmmm, how do I delete this tracking number from the postal systems' records?"

Will regulators agree with what I "must" keep?

I found the ICO's guide[1] fairly straightforward to understand though.

https://ico.org.uk/for-organisations/guide-to-the-general-da...

Your argument boils down to "I don't want to take special measures to protect your personal data, so I shouldn't have to".

If what you're doing could cause a problem I'm pretty sure I'd rather you didn't without the ability to deal with it.

Essentially, all you have to do is tell your users what data you are collecting and how you will use it.

Also, if a user asks for their data, you give it to them, and if a user asks for their data to be deleted, you delete it. I imagine if either of these things were to happen today, you would do as they wished GDPR or not.

It's not even remotely okay to use random people's blog posts as a compliance strategy.

> It's not even remotely okay to use random people's blog posts as a compliance strategy.

Then use the simple, human friendly guide from the body who will be enforcing it in the UK. I did. I thought it was simple.

https://ico.org.uk/for-organisations/guide-to-the-general-da...

It takes 30 seconds to find out whether your identifier violates a trademark. Your content is trivially not a copyright violation if you created it yourself. Hobby projects are not debating the finer points of fair use and whether the conflicting name is for a sufficiently different kind of business to avoid confusion. But every HTTP server handles personal data, and a web-based tool with a database backend especially so, so all the subtlety of GDPR is in play.

But not all of them have a good reason to log it. /dev/null

How about asking and recording a persons birthday when really all you need to know is if they are the age of majority? A birthday is more information than needed which seems like a violation GDPR when interpreted strictly with my cursory knowledge. Seems unlikely though that any regulator would enforce such a distinction though.

> The CJEU decided that a dynamic IP address will be personal data in the hands of a website operator if:

there is another party (such as an ISP) that can link the dynamic IP address to the identity of an individual; and the website operator has a "legal means" of obtaining access to the information held by the ISP in order to identify the individual. [1]

So once the account info is deleted, that link is broken. This another piece of DP legislation that has been subject to a great deal of FUD since most of the headlines just went with ‘court confirms IP address are PII’ and omitted ‘in some cases’. TBH, this was already pretty explicitly obvious from the legislation defining Personally Identifiable Information (hint: clue’s in the name).

[1] https://www.whitecase.com/publications/alert/court-confirms-...

Makes sense.

Given the above still seems like a potential issue to not delete the ip logs.

1) Bob signs up for a service and is logged

2) Bob than asks for his account to be deleted. Account details are deleted, but the ip logs are retained.

3) Bob signs back up for a new account allowing the data processor to make the link from his new account to his ip old logs with the first account.

Weather the data processor can relink the two records with reasonable probability in step 3 depends on the particulars of the circumstance.

I assume cases like the above will be judged, at least in part, based on the data processor following best practices, and operating in good faith(not actively trying to unmask individuals and actively try to prevent unmasking).

Currently I would not let the GDPR stop me from going forward with any web services plans, however my casual reading of GDPR articles on HN and beyond have not made it obvious how cases like the above will be handled.

Nothing. Anything. This regulation assigns huge amounts of legal and financial risk to any hobbyist and will likely be selectively applied.

100% agree. And your situation applies to millions of hobbyists, personal websites, projects, startups, and small businesses around the world.

GPDR appears to be intentionally burdensome, a classic regulation strategy aimed at protecting large incumbents while stifling small business, innovation, and newcomers, or even side projects like your own.

It is by far best GDPR presentation and explanation of lots of misconceptions. Please report back what you think about GDPR when you finish, I am curious it you will still feel threatened.

From the presentation: "guilty until proven innocent". How can you NOT feel threatened?!

Guilty... is really not something special, IRS anyone? ;) Did you catch something else? Something useful maybe? About borrowing a car for instance? :)

The GDPR is actually late, I have a few IoT devices and I verify them by isolating them on network and sniff out communication (mitm on wifi and old school 10 port hub (yeah, the one screaming everything to all ports) for wired. It is a sad sight, even if they have absolutely no need to contact outside servers (I would never have a device like Siri in my home) they still do, another case would be broadcom drivers on android calling home. Someone has to stop this madness.

I know a lot of people are pissed off due to GDPR, but I will gladly ask them again in 10 years. I think they will change their mind.

You can continue running all hobby tools you want.

Compliance depends on how well your understanding of of a bunch of fuzzy terms like "legitimate interest," "level of security appropriate to the risk," "necessary in relation to the purposes for which they are processed," "no longer than necessary," etc. align with 28 different regulators and judiciaries. That's as far from "trivial" as it gets. Bozho.net is not a lawyer, not your lawyer, and even if here were your top-tier lawyer specialized in data privacy he wouldn't have a clue what courts were going to take these things to mean in the context of GDPR, because there aren't any judgements yet. Security and minimization standards are also about "taking into account the state of the art" - do you know what the state of the art is, and is your organization capable of implementing it? An entirely plausible outcome here is that only the most advanced engineering organizations have technology that meets these standards.

Horeshit. There is nothing advanced about storing only the data you need. However, if you've been hoarding like crazy and weighed down with technical debt, and haven't used the last two years, then yeah, might be hard.

Yes, it's a new law, yes, in practice it will be defined by judgments. How is this different from any other new law, other than this one impacts IT harder?

And let me guess what the alternative is: do nothing.

Consider also that European law is different to US law. We draft laws and contracts in a conceptual/abstract way, whereas in the US where everything has to be exhaustive, explicit, and over-worked; just in case anybody dare sues.

GDPR recognises one-size-fits-all won't work. Yes, that means it has some vague terms. Yes, you might have to show you thought about the implementation, and that you erred on the side of privacy.

It's funny how everybody always talks about the maximum fines, not the other sanctions that the GDPR can impose. Guess that's just more sensational.

Isn't that besides the point?

You can be 100% compliant and still be sued by somebody. And you'd have to pay some lawyer a lot of money to make it go away.

That risk already existed before the GDPR (anybody can sue anyone for whatever reason they can come up with), but GDPR is high profile enough to make people scared.

About a decade ago, I ran a website that made heavy use of user uploaded GPS data. I didn't sell any data. The only ad income was Adsense.

If I had bothered to restore the server from backups after a HD crash, I'd probably take it down now. Just not worth the potential trouble.

I fail to see how GDPR makes that new. You can be sued for any reasons already, being in the right or not.

E.g. 99% of useful websites violate some patents (that shouldn't ever have been issued), actual predatory suing about this issue happens, yet no one closes his website because "the patent situation makes it too uncertain".

No, someone can report you to a member state's compliance organisation.

Indeed it is: the first 100 pages of the text detailing what compliance means are a manual for how to read the remaining 5000 pages, and a warning that there will be per-country variants of the law, which I'm sure will all be very clear, made easily available and not at all weird or objectionable, or require being well-versed in the legal intricacies of said member state at all !

/sarcasm

Here is a set of (easily available) interactive tools, explainers and guidelines from ICO in the UK which explicitly outline what compliance looks like and what steps you can take to achieve and demonstrate it [2]. It’s available as a 162 page PDF, if you insist on counting pages, but much of it relates to the processing of sensitive data or data relating to children which the majority or orgs can skip.

[1] http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX...

[2] https://ico.org.uk/for-organisations/guide-to-the-general-da...

We won’t take our services off the Internet. We’ll simply block you and your overbearing friends in the EU from accessing them. You might not miss one of us, but you’ll likely miss hundreds of thousands of us. Enjoy Facebook. That may be the only site you still have access to when the dust settles.

Compliance is trivial

Since you are saying that, I can guarantee that you haven’t actually read the law or been in charge of trying to make a website compliant. That is an absurdly incorrect statement. Billions are being spent around the world on attempts to comply with it.

Hell of a way to defend the most absurd and overreaching displays of censorship we see on the modern web.

That is easily one of the more absurd statements I've seen this month.

> Well meaning regulation like this written by people who have never created anything pratical in their lives

And websites whose customers advertising agencies, and whose product is people, create something? Attempting to track and then monetize everything everyone does online is _creating_ something now?

This is snarky, and intentionally simplifies things down to a dumb level. Here's a list of things that "create something" while relying on an advertisement model for revenue: - Gmail - Facebook - YouTube - StackOverflow - Reddit (to some extent) - Yahoo - Miniclip - Neopets

I can find a hundred other examples that are ad-revenue supported by create immense value.

It's a difficult balance to strike, and while not perfect, this model has allowed us access to so many good services that would otherwise not exist. Saying that none of them "create something" is just wrong.

With the amount of creativity observable for inventing tax-avoiding business structures, I'm sure if the minimum clause weren't there, big players would quickly find a way to spread their revenue over dozens of small entities, each looking like a "small business" on paper.

So I'm not sure it would be even possible to make a regulation "with teeth" that explicitly exempts small players.

https://news.ycombinator.com/item?id=16909945

No, it is not.

"Well meaning regulation like this written by people who have never created anything pratical in their lives other than regulations illustrates why entrepreneurship in modern Europe is nearly impossible."

No, it doesn't. It demonstrates that far too many "entrepreneurs" are people who want to play fast and loose with regulations, and not be held accountable for anything.

The higher you turn the knob, the harder it becomes to (compliantly) do things. Also (if the regulations are working as they should), the less the things that people do produce bad side effects. But the "harder to do things" part mean that fewer things get done - fewer new products and services get created. As the knob goes higher, not all of the things that don't get done are things that the regulations are designed to prevent. Some are perfectly fine things, but the burden of proving it is too much for the single person tinkering in their apartment to ever try to turn their idea into releasable reality.

And you prefer China's policy of censorship over the EU's policies of protecting consumer's privacy. Well that's interesting.

I am pro small business, and I am against censorship.

I see however historically opposite trends over the last 20 years: China is getting more free speech and is getting more pro small business, and Europe is the opposite. And it's not a coincidence. I think eventually the censorship curves of China and EU will cross. Small business friendliness curves crossed perhaps 15 years ago.

That's just not true. The West hoped that would be the case when Xi took charge, but it's gone in the opposite direction since then. How many chat apps can you use where the CCP isn't listening in on your conversation? They practice wide scale censorship on their own social media, Western social media sites are blocked, and important sources of information like Wikipedia and the New York Times are blocked too.

https://freedomhouse.org/report/freedom-world/2018/china

> China’s authoritarian regime has become increasingly repressive in recent years. The ruling Chinese Communist Party (CCP) is tightening its control over the media, online speech, religious groups, and civil society associations while undermining already modest rule-of-law reforms.

The GPDR might end up being bad regulation, but we we're already getting bad results for the average citizen. If the industry wasn't going to regulate itself, and it's hurting citizens, are governments supposed to just stand back and hope it works out for the best? Maybe in a libertarian paradise, but no national government is currently running on that paradigm

Edit: also free speech != No regulations. Companies aren't people and they shouldn't be getting the same rights as people. You can't just do whatever you want to make a dollar and then try and claim free speech protections

Should a union be denied freedom of speech? Because a union is a corporation as well. What about the Sierra Club? Should they be silenced? They too are a corporation. Should a teachers union be allowed to speak, but Khan Academy denied the same right? Should organizations advocating free WiFi be allowed speech, but Comcast be denied the same right?

The “companies are not people” tripe being parroted since Citizens United is a naïve and dangerous road down which people are attempting to travel. At the core of the issue is the right of free association. Free association is fundamental to free speech and a free society. Profit motive is irrelevant because profit is just as valid of a goal as “better schools” or “better public policy” or whatever the cause might be.

Governments are people who have joined together for the common purpose of governing. Does that make a government indistinguishable from an individual person, which is basically just a cell?

Is there a difference between one kid running across your lawn and 10,000 kids organized for the purpose of running across your lawn?

A corporation is a piece of paper registered for $100 that can be destroyed without penalty. It is a tool for achieving an objective, just like a computer. Many people join together to make Wikipedia, but we don't grant that website free speech...

I upvoted you and I am seeing this on HN more often now. That people would use downvote as a signal of disagreement.