I also have to be compliant with US laws if I deal with US citizens. What's the difference?
> You might be from Europe and to you it may just seem sensible but 1-5 person companies often have to make tradeoffs like this.
Not the ones that want to stay in business.
> It is not right to say just comply with the law - it is so easy!
But it is easy, he's just making it seem as though it isn't. There is so much factually wrong in that blog post that if that's the level of thinking that goes into the decision making then there most likely are other issues.
> The company, here, has decided that the cost is too high and that they are out.
Probably good riddance. But for all the wrong reasons.
OP can just rely on "legitimate interests", and describe the data they're processing and why.
Also you are responsible for downstream guarantees of legitimate interest.
He is right that open P2P protocols like XMPP, such as NNTP, IRC, bitcoin, ethereum, etc are not handled clearly.
It is a headache for him I can sympathize.
Are you expecting GDPR (or any law for that matter) to define an exhaustive list of every definition, that holds true now as well as for the future? Have a rethink about that statement...
Just as companies need to be specific about how they use data now the legal-judicial system needs to be specific about what it means and intends.
It is a double standard because the legislators are not interested in the commercial impact.
It's easier just to say "this tool blocks Europeans" and problem avoided.
You might be from Europe and to you it may just seem sensible but 1-5 person companies often have to make tradeoffs like this. It is not right to say just comply with the law - it is so easy! The company, here, has decided that the cost is too high and that they are out.