Is it scaremongering to assume the maximum fine? Of course - years of legal precedent for current DPA clearly demonstrates this. If the track record showed hundreds of small business people rendered destitute thanks to half million fines it wouldn't be, but it doesn't. It's a maximum not a fixed penalty as one would typically get for a parking offence. If they're not fining anyone £500k why are they going to suddenly fine everyone £17m?

Even TalkTalk were only fined £400k for the most ridiculous incompetence leading to 4 breaches in 18 months and failing SQL injection 101. They make profit in the tens of millions yet still didn't hit the maximum (They should have in my opinion). I think at the time that was the largest penalty yet issued.

Same goes for other data protection bodies across the EU - there will be few instances of maximum penalty under current data protection. I'm sure some countries have never imposed the current maximum.

nb It's not a ridiculous law - I'm fully in favour of it, as are many others over here.

>> nb It's not a ridiculous law - I'm fully in favour of it, as are many others over here.

That's the most interesting thing about the GDPR. While some developers are picking up their ball and huffing off home, others are actually 100% behind the regulation.

It says something when tech-savvy people agree to sacrifice time and effort and probably profits to protect their users from their own software.

> It says something when tech-savvy people agree to sacrifice time and effort and probably profits to protect their users from their own software.

Or the competitors' software.

Consider some business that was doing what GDPR requires already: users could delete their data, they could request a complete copy of it as well as an explanation what it is used for, and it was only used for defined purposes that the user signed off prior anyway.

Sadly, that reduces flexibility somewhat, but they're doing it because they consider it the right thing.

For them, GDPR levels the playing field and makes sure that they never have to stray from this conduct just to remain competitive with companies that aren't so nice to their users.

> It says something when tech-savvy people agree to sacrifice time and effort and probably profits to protect their users from their own software.

Nothing about the gdpr solves the problems of companies having insecure systems that _leak_ user data. I also don't believe that data about me is data I own. To me, the gdpr feels ineffective at the real issues causing me harm (leaked info) and also a giant burden on companies that fundamentally changes how the industry has worked, but in a way that quite frankly, doesn't make any sense to me. The data about my order isn't my data to control.

>Nothing about the gdpr solves the problems of companies having insecure systems

It doesn't directly prevent insecure systems, but discouraging companies from storing information they don't need and transferring it on to third parties for whatever reason they feel like massively reduces most people's exposure to this risk.

>The data about my order isn't my data to control.

If you believe people have a right to privacy, then you believe they have a right to decide who gets to know what information about them.

> If you believe people have a right to privacy, then you believe they have a right to decide who gets to know what information about them.

That's not even remotely true. A right to privacy does not mean I get to control the actions of others.

That's not what's grandparent wrote, it wrote that you have a right to know what is done with your data.

Nothing restricts what others can do with them, they just have to state it so I can decide whether that's ok for me or not.

The lack of this clearly defies the right to privacy, just consider the extreme case of "I'll dump your data on GitHub next week"

"Nothing about the gdpr solves the problems of companies having insecure systems that _leak_ user data."

Requiring disclosure of a breach within 3 days of it happening, as opposed to the several months that is commonplace now, is a big help.

"I also don't believe that data about me is data I own."

Everyone disagrees on this point. Right now, Europe says the opposite.

"also a giant burden on companies that fundamentally changes how the industry has worked"

Good. Currently the industry is geared to suck up every last bit of user data like a vacuum, regardless of whether it's actually needed, so they can sell it. This has gone on for far too long, and I'm glad to see the industry hopefully move away from it.

>> I also don't believe that data about me is data I own.

If I place a camera in my house so that it's recording what's going on in your bathroom- is that data you would like to be kept private, or not?

Probably in part because it's exactly those developers that see how easy it is to leak data to third parties that won't respect it at all and will track the everliving shit out of it.

I'm fully behind the GDPR. It might not be perfect, but I've read the law and it's surprisingly straightforward and sane.

> I'm fully behind the GDPR. It might not be perfect, but I've read the law and it's surprisingly straightforward and sane.

Why is it sane to assume data I've sent to a service is my data to control?

With respect but it's you who says it isn't. You need to explain why it isn't.

I started writing a lengthy reply, but instead let me ask you this: why would a service be privileged to do anything with your data that they did not ask you for permission to do?

Interesting part for me is the hilarious FUD where we got none when DPA came in. A good part of GDPR is already here with EU Data Protection Acts and what constitutes personal data is much the same. Many of the Kafkaesque and corruption scenarios should be possible under DPA and other laws yet haven't been happening.

GDPR increases maximum penalty to be high enough that it could be a penalty to a Google or Facebook for a serious, wilful, breach of regs, in an environment where the tiniest fraction of reported cases get any fine at all (16 of 17,300 reports for 2017 in the UK) let alone the maximum. Internet now certain that one man software companies and hobbyists with non-commercial regex sites will receive £17m fines, every time and it will be used as a stick to beat one's political enemies with or, most comically of all, pay for local infrastructure improvements.

I don't understand why - the regs seem reasonable and not especially difficult to meet unless your business is built on wilful abuse of personal data. Just a reasonable effort to enhance DPA taking into account new techniques and misuses of data. Deletion for everyone, not just a minority - thanks to FB et al feeling it's fine to never delete, and run shadow profiles on all. The highest penalty will be saved for the most offensive cases involving multi-nationals. It will be interesting in a few years to see how many maximum fines have been levied. My bet is none at all, once or twice if there's an especially egregious breach from an Amazon or Google.

I've little doubt that just as I feel more should have attracted fines under DPA I'll feel more should have got GDPR fines.

>> I don't understand why - the regs seem reasonable and not especially difficult to meet unless your business is built on wilful abuse of personal data.

My intuition is that the people who complain are that fraction of developers who actually care about their profits more than their users' privacy.

I'm sure that's a big part of it when every app wants to do a data grab. I'm also left thinking US law doesn't really do proportionate after a few of these discussions! :)

For us in Europe 20 years of DPA must help - I doubt there's many here would want to go back to pre-data protection.

So you did the research and found out that England probably won't endorse a law to the fullest extent. My point is that a simple tech guy building a company won't know that statistic and how it relates to their specific case.

If I tell you that the maximum sentence in the UK for possession of marijuana is 5 years in prison or an unlimited fine, are you going to tell me that everybody who's ever been caught with marijuana has been thrown in prison for half a decade or bankrupted?

No, in fact, most people get served with nothing more than a formal caution or a £90 fine. This is normal - this is how the law works in this country. Anyone who doesn't understand this hasn't even been paying attention to the lowest-common-denominator newspapers, which are constantly screeching about how people usually don't get anything close to maximum sentencing.

For many, that lawyer for an afternoon is an additional $1000 out of packet expense on a side project website that wasn't profitable to begin with.

Well then your “side project website” is unsustainable.

It’s not complex - we don’t let people away with flouting regulation because it’s burdensome. “It would make me unprofitable” is not a valid reason to ignore health and safety laws, or hygiene laws.

“I just want to run a food truck as a side project but not care about making people sick or not” is obviously ludicrous. Why is personal data somehow fair game?

Why are you assuming that everything on the internet must be a revenue producing business?

Someone doing it for love or passion is now faced with GDPR compliance and the risks and hassle that come with it.

I am assuming no such thing.

Just because you are not making revenue doesn’t mean that you don’t have to abide by regulation. The GDPR is intended to solve a very real and present issue; if you run a side project that deals with personal data, then the fact that it makes no money doesn’t mean that your mistreatment of personal data isn’t harmful!

I'd rather block all EU IPs than bother to break working technology that is operated and maintained freely.

How do you revoke PII from a distributed information system, like anything using a blockchain or distributed version control? You don't.

You can. You just need to think about it and have the correct controls in place.

If you choose to block all EU IPs instead of implementing the most basic data security and retention policies, then it’s for the best that EU users are not able to use your compromised service.

You cannot force peers of any decentralized distributed system to forget data. They can pretend to and appear as compliant peers and yet retain the data.

Then why are you storing PII on them?

Have you ever used git and supplied a username and email as your author? That's PII in a distributed service that cannot be revoked.

That is also PII being used for the purpose it was collected for (identifying a contributor) and I believe falls under Art.6(1)(f) of the GDPR. You would likely have a hard time convincing anybody that you can apply the right to be forgotten to a git repo - especially as that particular processing can be argued to not be requiring consent once you have submitted your commits.

The author details are not necessary for the core function of git; the change itself does not need the PII. Moreover, my concern is general for when PII is in such a distributed system; git is just one example of many.

I've always felt that git is poorly designed for that reason. At the very least, there should be an "identity block" that commits etc point into, rather than embedding names, emails, and other identity information into immutable commits. Under GDPR, that's how it would've been designed in the first place. Of course, this'll never happen without a complete fork of git.

Once you've got that sorted and you can change/remove identity information, the likes of GitHub have no issue so long as they have GDPR-compliant contracts with any business partners who can access git repos. Obviously, anyone using GitHub who decides to store all identity data forever is, generally speaking, not GitHub's problem, same as someone who noted down the names of all their friends on Facebook isn't Facebook's problem.

> I've always felt that git is poorly designed for that reason. At the very least, there should be an "identity block" that commits etc point into, rather than embedding names, emails, and other identity information into immutable commits.

Misuse of git isn't a problem inherent to git.

Putting your name and email into commits is the default behaviour of git, and git will not work until you do so. This is design, not misuse.

No, putting the name and email you give it, if you give it one, is by design.

So the GDPR is entirely irrelevant because we could just give fake details to companies? And giving correct details to anyone, ever, is in fact “misuse”? That’s not how the law works, nor is it how it should work.

This was specifically about git. However, it does appear that you need to at least provide a user identifier for git. I can understand why that would be useful in a distributed system. It could be opaque identifier, but you're points taken in this case.

This was about git in the context of the GDPR, so a company (say, a git hosting provider) is by definition involved. If you're sending commits to other private developers in some way that doesn't involve a company storing the data, the right to be forgotten/right for records to be corrected/etc in the GDPR is irrelevant in the first place.

Can you explain how they managed to cope under the twenty or so years of things like data protection law or eg PECR?

Can you explain why they can cope with PECR but can't cope with GDPR?

Laws that are stupid and not widely enforced because they are stupid are damaging to the entire concept of law. Particularly if they can hang over like a sword of Damocles if you piss off the wrong people.

This is getting silly.

The law will be enforced, just as current data protection is.

The law can be enforced without every case attracting the maximum penalty. That's why nearly every law has a range of penalties.

Accidental and minor breaches can attract a minor penalty or a letter asking you try harder. Wilful and repeated breaches affecting many customers will attract harsher penalties.

Same goes for speeding offences - go 40 in a 30 limit, get a fixed penalty ticket. go 140 with the GoPro race footage of you and your buddy posted to twitter expect a much larger fine and a driving ban.

In neither instance is it not enforced, or damaging to the concept of law.

I don't think that people like you and people like me will ever agree in these discussions because you look at statistics and I look at possibilities.

What @megaman22 is saying fully matches my experience as an Eastern European -- piss off the wrong people and the law will fall on you with its full might. Some people would really love to make an example out of you if you give them the chance. And I don't think that only applies to E.E. but have no data either way, it's just an observation from news and hearsay from affected people around here.

I fully support the GDPR and I'll do my utmost to comply with it even for hobby projects.

That was never something I disputed in my root comment that spawned this big sub-thread.

What I said and will continue saying is -- laws like these open even more doors for legal trolls, big players and nasty competitors to exhaust you out of business. The fact that it doesn't happen on a massive scale in my eyes means nothing; or rather, it means that agents used as an example to scare off others isn't something that's done often because usually just a few lawsuits and their aftermath are plenty enough for those many others to get the message.

So IMO using statistics here is not a strong enough argument. I am not trying to alter your thinking. We actually agree on most points but I simply can't agree that past statistics are a good proof that the new law won't be used in a more heavy-handed manner than originally intended.

To me, that remains to be seen yet and none of us can claim with certainty that what seems likely to them will materialize.

Almost missed this thanks to the incorrectly flagged message up thread.

> I don't think that people like you and people like me will ever agree in these discussions because you look at statistics and I look at possibilities.

You may be right in our chances of agreement!

I see a judiciary separate from state which is more than happy to put politicians back in their box when they introduce bad or overreaching law. Governments of all colours complain about the judiciary and Lords here in the UK - which I see as proof that the separation basically still works. I see data protection bodies that are separate from government and politics. I see occasional stories of record fines or breaches from mainly Western Europe and talk to friends and conclude small business and solo developers are not being fined or trolled into oblivion in nearby countries either. Yet EU DPA is most of what GDPR is with smaller maximum fines. Why isn't the disaster scenario you foresee already happening with current DPA and other laws? Why are so few fined for breaches and only the most extreme cases getting fines?

I'm less aware of justice systems further east and yes it's obvious that former Soviet bloc are going to be rightly more sensitive to and concerned about corruption. I'm also not aware how successfully that's been left behind from adopting EU laws and years of membership. That said, reading the pieces that turn up on HN it seems that the US is the one with problems of corruption in the justice system currently. No doubt that's also unrepresentative thanks to what's being shared about a vast nation.

So, the legal trolls - it's going to be registrars and data protection bodies bringing cases or seeking sanctions. Just like happens with current DPA. This does not appear to be akin, or anywhere near, the US DMCA where large media companies massively abuse takedowns via automated software and triggering numerous trivial errors. I don't see the scope to exhaust someone out of business - yet it's clearly easy with DMCA. There's nothing a Sony can abuse to pick on a little guy with GDPR - they can report me to the registrar.

You're right that it remains to be seen, but I sincerely doubt our data protection bodies are suddenly going to break out thumb screws and bring orders of magnitude more cases when they've kept fines for the final, extreme, and rare sanction til now.

I honestly expect that just as I feel more should have attracted fines and sanctions under DPA I'll find that GDPR is also being too lightly applied. We'll see. I've been wrong on the internet before. :)

The speed limit analogy is terrible. Or maybe perfect, for my point.

Because speed limits are not enforced, everyone goes somewhere between 5 and 15 mph over, all the time. But catch a pissy cop, or one in a town that uses speed traps as a revenue source, and you can get pinched for hundreds of dollars arbitrarily. Yeah, the jackhole that burns tire at 110 past a school-zone is most likely to get pinched, but almost everyone on the road could.

>Because speed limits are not enforced

and yet

> But catch a pissy cop, or one in a town that uses speed traps as a revenue source, and you can get pinched for hundreds of dollars arbitrarily.

Sounds like enforcement to me.

The solution is also simple. Don't drive over. I don't do it. If the sign says "50 kph", I drive "50 kph" and not more.

Driving over is entirely voluntarily ignoring the limitation set by the law so don't go and be all surprised when somebody CAN FINE YOU FOR THAT.

The GDPR gives authorities various ways to deal with corporations that are breaking the regulations.

When a corporation is compliant and only has minor infractions, they will (most likely) write a sternly worded letter.

But if you're constantly and repeatedly or willfully ignoring or breaking the regulation they definitely won't leave it at a simply tap on the fingers.

Plus, I don't think any regulatory body is looking for bankrupting a corporation. They will obviously size the fine according to how much the corporation has in turnover or profit.

So we are just supposed to hope that they will be nice to us when inevitable violations occur under one of the 28 unique interpretations that this law will be subject to?

I don't think I've heard of many EU regulatory bodies that will immediately go for the maximum punishment the moment anyone does a minor infraction. First you get a letter, then a sternly worded letter, then a tap on the finger, a hard tap on the fingers and if you still refuse to learn the lesson then they break your knees.

If you have minor infractions caused accidentally and you cooperate I have doubts that any regulatory body for the GDPR will go beyond sending a simple letter asking you to fix a problem.

Perhaps it's a cultural difference but here in the US we interpret all laws literally, fully expecting maximum penalties. And yet they are trying to apply this law to American startups who can barely afford a lawyer here, let alone a EU counsel.

laws are interpreted literally in Europe too, or they wouldn't be laws. But most laws have a range of penalties, and often account for intent and attitude. E.g. in US law you have "manslaughter" (voluntary or not) and "murder", for example. And you have different penalties for first offense and repeated offence.

I am not one to say "trust the EU government, it is good". But the intent of the legislator is obviously not to kill businesses willy nilly, it is to punish certain behaviours, they have no reason to willingly cause a business to shut down, which is why the GDPR explicitly accounts for collaboration.

In the end, it is up to you to decide not to abide to the law. There have been local regulations forever, this won't change much.

This does not resonate with my experience. In the US, reporters will often describe sentences as "up to 1024 years", but the actual sentences are different. See https://www.popehat.com/2013/02/05/crime-whale-sushi-sentenc...

Note that, in parallel to the EU regulation, the statutory maximums can be enacted(ever since Booker judges can use their discretion again), but in reality most judges rule within the sentencing guidelines.

> I don't think I've heard of many EU regulatory bodies that will immediately go for the maximum punishment the moment anyone does a minor infraction

Yet. Wait until the company is another political organization that is identified as an enemy or competition. Then these laws become tools for shutting down dissenters with selectively applied fines, even to companies outside of the EU.

Could you provide an example of such a thing happening? Preferably for minor regulatory infractions in startups since that is the topic here.

That’s not what the law says they have to do. All reasonable businesses have to assume the worst case, not the best case. These governments have a built-in financial incentive to not be lenient in any way, shape, or form.

That's the US, yes. EU regulatory bodies are generally rather lenient when you attempt to follow the regulation.

And unlike you say the law does say the regulatory body for the GDPR has to consider the business needs of smaller businesses and adjust their fines accordingly if they even hand them out.

There is a good flowchart in this thread too, I recommend to study it.

But they have never had the extraterritorial reach that they are claiming under the GDPR either. This could easily be used to suck money out of foreign countries. I don’t think they’ll play nearly as nice with people that don’t vote in their own countries.

I am hopeful that the US will pass legislation exempting US firms from enforcement of fines under GDPR on US soil, but I am not optimistic. Under current law, it is likely that they can be enforced. Either way, the net result will be that EU residents will have access to a far smaller universe of content and services. Most businesses just won’t take the risk.

>> This could easily be used to suck money out of foreign countries.

We both contributed to a conversation where you made the same point, a few days ago:

https://news.ycombinator.com/item?id=16888026

Back then, I was not convinced that you had a clear idea of how such a money-grabbing scheme could be implemented. I would kindly ask whether you have a clearer understanding of the relevant procedures now.

It’s a very simple procedure. Make accusation, get judgment, domesticate it in the US, get paid.

But why would you "get judgment" if you are not in violation?

It is nearly impossible to fully comply, and may actually be entirely impossible, based upon how much conflict there is between the 28 different interpretations that this will be subject to.

The people saying how easy it is don’t know what they are talking about.

>> It is nearly impossible to fully comply, and may actually be entirely impossible, based upon how much conflict there is between the 28 different interpretations that this will be subject to.

By "28 different interpretations I assume you mean those of different member states. It would actually be 27 now that the UK is leaving, but even so, the GDPR is a regulation (General Data Protection Regulation) and not a directive, partly in order to eliminate inconsistencies in national laws. To clarify, as a regulation, the GDPR does not need to be passed into national law.

Additionally, this reduces the burden on companies that would previously have to deal with multiple local authorities, in the context of the Data Protection Directive.

Further, there are provisions for the consistent application of the GDPR across all member states, particularly a European Data Protection Board.

This is from an article I quoted earlier:

Coordination and Consistency

Under the Directive, there has been a certain level of coordination in interpretation and enforcement. Apart from informal contacts among authorities, there has been a succession of non-binding opinions issued by the “Article 29 Data Protection Working Party,” an advisory committee comprised of representatives of the national supervisory authorities (commonly termed “data protection authorities” or DPAs), along with the European Data Protection Supervisor appointed by the European Commission. Under the Regulation, that group will become a more independent and powerful regulatory body called the European Data Protection Board, tasked with ensuring “the consistent application” of the GDPR. An entire chapter of the Regulation (Articles 55-63) is devoted to cooperation and consistency, with procedures for multiple DPAs to coordinate investigations and promulgate consistent decisions and policies reviewed by the Board and reported to the European Commission.

One feature of coordination that should be helpful for multinationals is a provision for companies to work with a “lead supervisory authority” in the country where the company has its “central administration.” That authority will then coordinate with the authorities in other countries where the company operates, attempting to achieve consensus on issues that affect all of them.

https://www.infolawgroup.com/2016/05/articles/gdpr/gdpr-gett...

Generally, I have no idea why you say that the GDPR will be nearly impossible or actually impossible to comply with. Different member states have different regulations for drug use, for instance, but that is never used as an excuse to violate drug laws "becuase they are impossible to comply with" due to different national interpretations.

> I am hopeful that the US will pass legislation exempting US firms from enforcement of fines under GDPR on US soil, but I am not optimistic. Under current law, it is likely that they can be enforced.

What would be the mechanics of enforcing the GDPR against a US company with no EU presence? I'd understood the opposite, and that the EU's best options to enforce were probably indirect (via customers, vendors, etc. with EU presence).

That and privacy shield (or equivalent). The EU courts could simply go the the US courts and tell them that under privacy shield, the company violated the EU law. Then the US court could decide that, yes, the company did indeed violate EU privacy law and enforce the fine on their side.

If the US court doesn't decide that, the EU will have to resort to indirect measures (Google AdSense will probably stop working since Google doesn't want the EU courts on their butts for making business with someone who violates the EU law and other measures)

> While joining the Privacy Shield is voluntary, once an eligible organization makes the public commitment to comply with the Framework’s requirements, the commitment will become enforceable under U.S. law.

https://www.privacyshield.gov/article?id=How-to-Join-Privacy...

So how does that affect companies that don't elect to join Privacy Shield?

Agreed that AdSense will probably start indirectly enforcing the GDPR at some point. Someone will probably make a lot of money picking up the traffic they lose, in exchange for never changing planes in Frankfurt again...

Without privacy shield, I guess the EU might still try to go through the US court system to have a foreign claim enforced in the US.

I guess we'll have to wait and see what happens in that case, if the US court system is willing to enforce GDPR fines on their side, that would be a win for the EU (the US has been doing this for ages)

Apparently, existing treaties that the US has allow for the domestication of EU civil judgments in US courts. The prevailing logic right now is that nothing new would need to be passed to allow for that to include judgments issued under the GDPR. Here is one article, there are many more:

https://community.spiceworks.com/topic/2007530-how-the-eu-ca...

From that article:

> "While we don’t yet have U.S.-EU negotiated civil enforcement mechanisms for the GDPR (and it is unknown whether we ever will), there is still the application of international law and potential cooperation agreements between U.S. and EU law enforcement agencies, which have been increasing in recent years."

That sounds pretty murky to me, more a statement that she expects regulators to cooperate than one that current law provides a clear path. Not that I can find a more confident article in the other direction, of course...

Yes, because that will certainly be the case, like any GDPR lawyer or consultant will tell you.

> After all, England almost jailed something for training their dog to give the Hitler salute or for posting something mean on Facebook. reply.

He wasn't 'almost jailed' - he was fined £800. And the video involved him saying 'Gas the Jews' over and over again to his dog, to which the dog reacted.

The real crime here that it wasn't funny at all. But imposing fines for telling bad jokes and spending tens of thousands of GBP of tax payers money is just wrong, wrong, wrong.

I don't know how close he was to being jailed, but Washington Post (MSM) wrote "Now it will probably land Meechan in prison." [1]

[1] https://www.washingtonpost.com/amphtml/news/the-intersect/wp...

Typically the law in this country has been to impose relatively small fines for malicious communications, and even these are sometimes dropped on appeal, as with the Twitter Joke Trial. The WaPo has it wrong in this instance - Britain isn't Thailand.

https://en.m.wikipedia.org/wiki/Twitter_Joke_Trial?wprov=sfl...

This is usually how laws work. They specify minimum and maximum punishments for various offenses.

What part of this is a problem for you?

Scotland actually, (and Scottish Law, not English).

(And for that matter it was his girlfriend's dog).

But yes, I agree with you - you have no control over the Court's decision if found guilty.