I made this software program that listens on a port on my computer, located in Springfield, IL, USA. I allow other people to connect to this program over the internet, which terminates at a connection I pay Comcast to provide me. I log their IP addresses (on my server that I own which resides in the United States) because I'm curious where my users are coming from. Someone from Europe is claiming that I owe them some of "their" data (which they seem to think is stored on my storage that they never bothered renting from me) or I might have to pay 20 million euros. I tell those users and their government, neither of whom I owe anything, to kindly piss off and then ban all ip addresses from the EU.

To put it another way, I go to Central Park and start to juggle. I don't charge people, I just juggle because I like to juggle. Some people watch; others simply ignore me. I write observations about a couple of the people who watched me perform in my journal. One of those guys was from France. He later looks me up in a phone book and calls me to demand I give him any observations I wrote in my journal. I tell this fellow to piss off. A few months later I get a letter saying I need to pay 20 million euros because I wouldn't give away my personal observations stemming from something I did publicly and for free.

Everyone seems to have latched on to this 20mm € fine part, but missed the surrounding paragraphs that require that fines are proportionate to the offending, and only to be used after, on in conjunction with other methods of enforcement.

It's most certainly not a blanket "Everybody who is not in compliance with the GDPR will get a 20 million Euro fine".

GDPR is not about annoying small businesses at all. First, to file a complaint one has to go through several steps, and the fine will be proportional to the offence. No small business owner will have to pay 20M€ for logging an IP (plus keeping IP logs are actually mandatory). Offenders will first be issued a reminder, then be fined if they don't comply after that. If you're a small business owner and you don't comply, then you can't complain.

Secondly and most importantly, GDPR is not about preventing people to get information, but rather about preventing people to track customer. If I use your example, GDPR would prevent you from following someone after they watched you juggling. It would prevent you from following them home, noting where they work, who are their acquaintances, what kind of food they eat and so on: it's technically legal but incredibly creepy. If someone were doing this to you you would be the one to tell them to piss off. You can perfectly write what are the observations of the passer-bys who watched you, as long as the log is anonymized. Which is easy to do and not harming for your business. You didn't want to track them anyway, did you?

>I wouldn't give away my personal observations stemming from something I did publicly and for free.

No, you'll just sell it to the highest bidder. And enough people do this in such an underhanded way that the EU decides to regulate the shit out of you. So maybe you should have asked permission before recording identifiable people's behavior or otherwise earned their trust. Instead of being shady and myopic about it.

Maybe he should have asked for permission before looking to identifiable people also?

You have to respect the privacy of people in the same way you have to respect their lives. You can not harm or kill random people, you can not do arbitrary things with information about them.

It’s alarming that you don’t realize how insane this argument is. Now murder and keeping notes about someone you see in public are the same? You’re headed towards thought-crime with this; it’s basically murder to continue to hold an opinion of someone that they disapprove of, because “privacy”. Ridiculous.

Of course they are not the same but they share a common principle, i.e. you can not do arbitrary things involving other people. And nobody is talking about your opinions, you are free to think whatever you want, just as you are free to harm yourself or even commit suicide. But if your »thinking« involves information about other people, there are limits just as there are limits if you go from killing you to killing others. If something is ridiculous, then the way you twisted what I said.

Wow. There you go again! So if my thinking involves someone else’s information, they have some right to make me change my thinking or punish me if I don’t??

First, you switched from respecting peoples' privacy to taking notes, thinking, and having opinions. I even responded to your comment before you added the notebook in the park example. You probably also noticed that I put »thinking« in quotes.

Anyway, it is not the act of having the information about other people that is problematic, it is the act of collecting, using, or sharing it. Do you think I should be able to follow you around and write down every step you make? Should I be able to use that information in every way I want? Do you want me to tell your significant other what you actually did on that »business« trip, tell your coworkers what you got from the sex shop? Should your doctor be able to tell everyone about your health status, your bank about your financial status?

It is just naive to pretend that handling information is inherently without any concerns and therefore no rules should apply at all. And it is just silly to pretend that writing down an observation you made in the park in a notebook is the same and should be treated in the same way as systematically collecting information about every website visitor.

I didn’t write the original comment about the notebook in the park, just FYI.

And your examples are not all the same. If you’re in public, you have no reasonable expectation of privacy. So yeah, take all the notes about me you want. That’s entirely different from my doctor sharing my health info.

Sorry, my fault with that first comment. Then why is your doctor not allowed to share your health information but a website where you search for and read about medical conditions can collect and share what you looked up as they please?

And while you personally may not have any expectations of privacy in the public, that is certainly not true in general for everyone and in every country. Here in Germany the constitutional court ruled just this week that having a dash cam in a car violates the privacy rights of the people you capture.

You are also generally not allowed to take photos of people in the public without their consent. It is not a problem if they randomly appear in a picture you took of a building or whatever, but you are not allowed to take photos were people are the main motive.

Correction, it was of course the Federal Court of Justice, not the Federal Constitutional Court.

Your first two examples are cute, but your third has the unfortunate side effect of undercutting your argument. A car you built yourself (or more often a motorcycle) actually _can_ be driven on roads in the US, as long as it has the appropriate indicators (brake lights, turn indicators, headlights). There's a crazy subculture around building bikes that would never in a million years pass muster as production vehicles. (let's drop a chevy small block into a harley).

Well, the "appropriate indicators" would need to meet the "required standards" mentioned in the parent post. I think the example is ok.

The indicators are a tiny subset of the actual requirements involved in a production vehicle. In fact, there are examples of European production cars that can't be street legal in the US, and the companies involved chose to simply not sell them here. Smart cars were impacted by this for awhile (no crumple zones), they eventually dealt with the problem though, and as I recall there was a production ferrari that couldn't be driven here because ferrari chose to simply not sell in the US rather than conduct two crash tests or something like that. Can't recall the details.

It was a Porsche, and Bill Gates owned one.

"While most Porsches can import quite easily from Europe to the USA, the 959 had complications abound, making it impossible for US citizens to get their hands on one of these supercars. One of the citizens was Gates, who ordered a 959 from Porsche, only to have it impounded at customs. The reasoning provided to justify the impounding was that the 959 had not yet cleared crash-testing requirements and did not meet EPA standards. Gates’ German supercar sat idly by for over a decade."

https://blog.dupontregistry.com/celebrity-cars/bill-gates-am...

Ah yes! That's the one. And he owned it but could never drive it on public roads. Thanks very much.

> A car you built yourself (or more often a motorcycle) actually _can_ be driven on roads in the US

Such a car cannot be driven on the road within The Netherlands without it being validated as safe (plus some other inspections).

For US, same seems to apply. Per https://www.dmv.org/car-registration.php it mentions: "Pass a vehicle safety inspection.". So again you need to deal with paperwork and read what those safety regulations are.

Some rules are decided by state. For example, Idaho has no vehicle inspection process, just registration (i.e., paying a fee and getting a license plate and license plate sticker).

FWIW, dmv.org is not an official government site.

Dmv.org is not associated with any government body. Its advice should be taken with a grain of salt as such matters are not uniform across the US. Moreover their state specific info is often a paraphrased summary that only represents best practices and not the full scope of the applicable law.

Yeah, for "specially constructed vehicles" that safety inspection is extremely minimal. For a production vehicle, the requirements are much more extreme, and cost millions to comply with.

> A car you built yourself (or more often a motorcycle) actually _can_ be driven on roads in the US, as long as it has the appropriate indicators (brake lights, turn indicators, headlights).

They don't do safety inspections in the US?

Doesn't the vehicle need to have brakes, a means to change direction, emission checks and so on?

TIL in some states they do emissions checks (although in a lot of states motorcycles are totally exempt from those anyway). And no, they don't do safety inspections of "specially constructed vehicles". And based on the ones I've seen, I can't imagine a world in which they'd pass. [1]

[1] http://bosshoss.com/supersport-bike/

However, at least some states (probably most) require a minimum level of insurance from a carrier licensed in the state. There's nothing that requires those carriers to provide insurance to vehicles that don't meet their minimum requirements.

They vary wildly. Some states (washington used to be this way when I lived there) don't require insurance for motorcycles at all. But yeah, private companies can often make their own rules.

> However, at least some states (probably most) require a minimum level of insurance from a carrier licensed in the state.

Don't most have a bond alternative to insurance?

Well, kinda. A lot of states will still require your homebuilt car to pass smog, which requires a new, not-built-yourself engine.

You could build and drive a car you built yourself with no regards for your personal safety - it's your car after all, and it's your business if you get injured. But could you sell such a car?

You could build and use a service with no regards for your personal privacy - it's your service after all, and it's your business if your data gets leaked. But could you offer such a service?

Yep. You could totally sell it, and in fact that's exactly what Boss Hoss motorcycles does. I believe each vehicle has to be unique, or something. Not sure where the line is between these custom vehicles and "production" cars, but it involves the scale of the production. Exactly the kind of exemption people are suggesting for the GDPR.

He is meeting the required standards... by not having an EU users.

In doing that he's as equally compliant as any company who has jumped through the various GDPR hoops.

And has made his business that much less viable, and opened himself up to competition from a company with a comparable product that does comply with the law.

And maybe one day the USA will pass some privacy legislation...

I'm not actually sure he is running this as a business? It seems open source? He even suggests people download and build their own?

So all he's done is save himself the time and effort of dealing with the GDPR and cost himself nothing.

The fact that it is open source does not mean it isn't a business.

And yes, he has saved himself the time and the effort of dealing with the GDPR, has also managed to position himself as someone who pays lipservice to privacy but who does not care to actually be compliant with privacy legislation when it matters. I wouldn't want my data in his hands after that anyway (not that that would ever happen because I don't have a smartphone in the first place).

From my POV, he definitely positioned himself as someone that doesn't give a damn about user privacy

That's ridiculous, and the same non-logic as "anyone who declines to let the police search their home without a warrant is trying to hide something illegal". In both cases there is no upside and a chance of a large downside, even when you're completely innocent.

> opened himself up to competition from a company with a comparable product that does comply with the law

I'm sure another free and open source product will seriously impact his profit.

Your point is clear, but this is internet software all having to comply with the same regulations regardless of actual industry. I'm having to close my small construction company because the FDA passed harsher food safety requirements.

No, you don't have to close at all. You just need to comply with the law, just like everybody else. You also need to file your taxes, keep the books in order, ensure that you do not pollute the environment, in some cases you need to be licensed in order to be able to practice your trade and so on.

Why would this particular regulation suddenly cause you to close your business unless you were doing something really shady?

Perhaps it costs money to do so, and the company does not have enough working capital + lines of credit to make the payments necessary?

I feel like your statement here is basically "you are a business, therefore it is impossible for you to run out of money", which -- superficially -- seems very naive.

Obviously it might cost money (or time, which might mean money). Argument is still the same, it's not out of the ordinary to comply with regulations and laws.

It seems more like a cultural difference, whereby some one-man shops from US find privacy not important.

No there's no cultural difference (or perhaps there is, but it's not on display here). It's not out of the ordinary to comply with regulations and laws -- businesses often change to do so. However, it's also not out of the ordinary for businesses to go out of business due to legal situations. Both are signs of a functioning regulatory environment.

At that level it doesn't have to cost anything other than your time. And if it's not a business it is a hobby and those cost time (and usually also money).

The GDPR is not going to cause any but the weakest businesses to close shop, in fact if the GDPR causes a business to close (which I highly doubt other than people voluntarily throwing in the towel because they can't be bothered) then I am not sure if I'm going to shed tears over that because it likely means that that business was so weak already that other things besides GDPR compliance were suffering as well (such as security).

The comment I responded to cited environmental regulation. These are oftentimes costly to implement. All regulation costs money to implement. Even if each regulation by itself is cheap, these things add up -- it's death by a thousand cuts.

> These are oftentimes costly to implement.

Yes, but then again: if you don't implement them society as a whole will end up holding the bag. Polluter pays is a very good principle.

> All regulation costs money to implement.

Yes. But that's called the cost of doing business. And most software based businesses have insane margins anyway because of their ability to scale.

> Even if each regulation by itself is cheap, these things add up -- it's death by a thousand cuts.

That's one way of looking at it. Another way of looking at it is that it levels the playing field between those that ride roughshot over their users rights and those that try to be nice.

I'm not sure what it is you are arguing about. I am in 100% agreement that regulation is necessary for a functioning society. However, the natural result of introducing new regulation is that some businesses will choose to leave the market. This is the cost of doing business. If a society can bear the loss of the business from the market, then things are good. That's about all there is to it.

> Another way of looking at it is that it levels the playing field between those that ride roughshot over their users rights and those that try to be nice.

Neither of those viewpoints are in opposition. You can both believe that more regulation kills some businesses through a 'death by a thousand cuts' and that these regulations level the playing field.

I'm sure such businesses exist. But this isn't one of them, the article writer is leaving his EU users for reasons all his own, as in: he made them up.

People are allowed to make up their own opinions, even ones not based in fact, and take actions on things they own regarding them. That is a fundamental human right, last time I checked.

As is calling them out for it (e.g. if they are not based in fact), which is all jacquesm does. That's also a "fundamental human right"

Please don't misinterpret my comments as telling jacquesm to keep quiet. It's a fundamental right to make a fool of yourself. Please continue!

If you abstract away the industry specific details of my examples, you are not supposed to physically endanger, harm or kill people regardless of the actual industry. So I would say it is exactly the same but instead of physical harm we are talking about harming peoples' privacy.

Maybe one could argue that there is something to be gained by differentiating the rules based on the industry but, at least to me, it is not obvious that the result would be better and not just more complex. Also there are already rules and laws for specific industries and how they have to handle personal information, think for example medical or financial data.

> I'm having to close my small construction company because the FDA passed harsher food safety requirements.

Is your creative reuse scheme for sawdust and broken drywall bits no longer allowed?

I built a small shed in my backyard. I didn't follow any building codes. I cooked a meal at home, I didn't follow any food safety standards. I build a gokart from scratch and ride it around my own property.

Should any of these be banned? Now if I tell my friend, 'Hey, you can store stuff in my shed/grab a plate of food/take the gokart for a spin', should any of it be banned?

I think you'll find recording a video of your neighbors from your home without their permission will be seen as quite different from your other examples by most people.

In many jurisdictions in the US, you can give away free home-cooked meals to homeless people without the requirement for a certified kitchen.

Some of my friends fought for the right to do so in Connecticut with Food Not Bombs, in fact.

the laws you refer to preexisted. Did they tear down all the houses that don't comply with contemporary building standards? I dont think so. GDPR is enforced retroactively on everything since the beginning of the internet.

> GDPR is enforced retroactively on everything since the beginning of the internet.

That is not allowed. GDPR is only enforced for things which do not comply after in goes into effect. Further, it's not specific to the internet.

yeah i don't mean the violations. i mean it's a regulation that must applies to all software equally regardless of when it was written.

GDPR is already in effect. Enforcement has been deferred until 25 May to allow companies to comply with the legislation.

> Did they tear down all the houses that don't comply with contemporary building standards?

No, they fined everyone that owns homes commercially that did not upgrade the homes to comply. And then fined them again. And again, until they complied.

For what it's worth, this is not generally done in the US.

Where did that happen? There were earthquakes recently in Italy that tore down super-dangerous but not illegal houses.

In fact the construction sector is a very bad example here, because old buildings are usually covered by separate regulations , thats not true for software.

In Germany for example with the new environmental regulations. Everyone selling their house, renting it out, etc had to comply.

This is not even remotely in the same realm.

Why not compare it with heart surgery while you are at it.

Building codes vary vastly in quality.

Some prevent loss of life.

Some are pointless or even harmful to society. HN complains constantly about insufficiently dense housing....a situation caused by none other than building codes.

When possible, build in places with good codes, not bad ones.

If you see nothing wrong with moving websites into the category of buildings, aircraft, medical devices, etc... what are you doing on HN? The entire ethos of this community is free and casual, sometimes entrepreneurial experimentation with networked software. It may be necessary to end that for the greater good, but that’s not something to take lightly.

US law has surprising respect for the hacker ethos, so that even in highly regulated activities, there is a much less rigorous licensing regime for small-scale practitioners. . Experimental aircraft certificates, private pilot licensing, amateur radio licensing, etc. You can build yourself a car, cook food for a party, etc. without being subject to the laws about those activities under corporate mass manufacture.

No need to be snarky - you do have a good point that can stand on its own. However the issue is not black and white. And just because you think the GDPR is a step forward, some people disagree. Even the Monal guy might agree with you - he just doesn't think it is worth it. And why wouldn't we expect strictly enforced food safety regulations to prevent meals being shared? It might be worth it, but it doesn't mean there won't be collateral damage.

My comment is not intended to be snarky. I am aware that it sounds otherwise and I thought about adding a few more sentences to counter that, but there is just not much I have to add, it would just make the comment longer. So I decided to keep it short even if it might sound a bit snarky hoping that everybody is able to infer that I wanted to say that this is not some unique burden thrown at software developers but that we were some kind of exception not having to deal with that much regulation as other industries.