It's especially funny when small to medium German companies suddenly panic because of the GDPR and when you look at their situation all you can say is "yeah, you should have implemented that 15 years ago, it's already been German law that long".

In Germany not much will change, but at least companies like Facebook can no longer just move to another country with worse privacy laws (like Ireland) and call it a day. For us the GDPR means that protecting user data will no longer be a competitve disadvantage. But if you're a small company and handling data reasonably, the GDPR won't hurt you anyway.

Can you hint me to one of those German laws which do require one of the above?

It literally translates to "federal data protection law" and has been German law since 1978. In certain conditions it has also mandated a DPO (https://de.wikipedia.org/wiki/Datenschutzbeauftragter) since then, but in fact the first DPO position in Germany was created in 1971.

The right to be forgotten is mandated by article 35 BDSG (https://www.gesetze-im-internet.de/bdsg_1990/__35.html).

The right to a data export is mandated by article 34 BDSG (https://www.gesetze-im-internet.de/bdsg_1990/__34.html). It has always been common use this law to get a free copy of the data which our credit reporting agencies have about you, I've done that multiple times.

However, if you do that, good luck ever getting a mortgage, credit card or other post-paid services ever again if all credit report requests come back with the reponse "no data available". So I wouldn't recommend that.

How does that work for people who never had a Schufa history? If for instance I decided to move today from Brazil to Germany, would I be unable to do all these things there, since they would have "no data available" on me?

Any business that is shut down by GDPR is, to me, a good business to shut down.

Compliance. It doesn't matter if you delete your logs, if you had them in the first place you're subject to compliance.

Like the example in the article. Not sure why people are still thinking this doesn't happen, this is exactly what is happening in the article.

You're required to have a fire safety officer at these companies too, but it's not a full-time position.

AFAIK, most of the "safety committee" regulations usually have waivers for small companies.

I’m fairly left leaning for a US citizen & find the idea that the default should be big companies abhorrent.

But I recognize my bias & am not st all convinced it’s in any way objectively correct.

I'm not arguing for or against it, just pointing that the resulting unintended consequence is protecting large companies. Exactly the opposite of the original intent.

Nonsense. I look at another high tech data driven start-up every week and not a single one has stated that the GDPR costs are 'prohibitively high'. Sure, there are some that need to do more work than others (medical, ad tech). But on the whole companies that were already doing their best to not fuck up with their customers data have very little to do in order to get to where they should be and the remainder has a bit more work but will mostly likely be more-or-less compliant by the 25th and what work remains will be done long before the eye of Sauron will turn their way by virtue of their size.

The cost is strongly related to the size of the organization and the amount of sensitive data you hold as well as whether or not you were a bad steward of the data in the past.

There is a correlation between the number of GB you store and eg. how many DPOs you require?

A small business or a startup should have a relatively limited amount of data capture, and that data should be stored in a relatively limited number of places. In most cases, it should be straightforward to make sure that this is documented and appropriate controls are in place.

On the other hand, large companies have vast quantities of uncontrolled data gathering that nobody is responsible for.

If I want to put an open source app in the App Store, that’s not a business model for me. It’s more just personal expression.

Try convincing a regulator of that.

But it doesn't matter, you're still logging PII. GDPR doesn't make any distinction of profit vs. non-profit vs. personal ownership. You're as liable as an individual as an organization.