GDPR Hall of Shame

Re:GDPR Hall of Shame by jannemann on Thursday May 24, 2018 @08:39AM (#17143333)

My favourite at the moment is sendwithus. They said their service will never be GDPR compliant. But fortunately they have a new "enterprise grade" product called sendwithus dyspatch. Same feature set, new price plus GDPR compliance. This is a price jump from $79/Month to a minimum of $24.000/year. And this is with discount for former sendwithus users. I would consider this to be mafia methods.

[ Parent | on HN ]

Re:GDPR Hall of Shame by lovich on Thursday May 24, 2018 @08:43AM (#17143370)

Why? This seems like good behavior. They're original product is supported by a business model that relies on user data. Now they are offering a similar product that doesn't make money off of user data but instead charges the user. I am all for the GPDR, but the regulations don't say you can't suck up all user data _and_ you still have to provide your service for free/discounted

[ Parent | on HN ]

Re:GDPR Hall of Shame by zbentley on Thursday May 24, 2018 @10:39AM (#17144373)

I work for a competitor to sendwithus, and, while I can't speak to specifics or the industry as a whole, I can definitely say that it is proven possible to run a company whose revenue model is to charge something comparable to sendwithus's previous monthly subscription fees, be profitable, grow steadily, and not make a single dime on the side selling data to advertisers.

[ Parent | on HN ]

Re:GDPR Hall of Shame by ginko on Thursday May 24, 2018 @08:53AM (#17143442)

So you're saying user's data is worth $23052 per year?

[ Parent | on HN ]

Re:GDPR Hall of Shame by lovich on Thursday May 24, 2018 @09:26AM (#17143736)

Maybe, maybe not. If it's not I assume they'll be forced to lower their prices and go out of business. I don't have a problem with a company charging money for their product though.

The GDPR appears to be doing its job here because it's forcing a company out of a business model that is unethical and into one that's better for society, regardless of it's better or not for the company and some of its customers

[ Parent | on HN ]

Re:GDPR Hall of Shame by Kpourdeilami on Thursday May 24, 2018 @09:09AM (#17143580)

User data could or could not be worth that much. Having a team of programmers implementing and maintaining features that make the software GDPR compliant is perhaps the biggest contributing factor the price increase

[ Parent | on HN ]

Re:GDPR Hall of Shame by bobcallme on Thursday May 24, 2018 @09:28AM (#17143747)

No, that is just the cost of compliance.

[ Parent | on HN ]

Re:GDPR Hall of Shame by Sholmesy on Thursday May 24, 2018 @08:49AM (#17143409)

If they are offering the $79/month service in the EU, it doesn't matter that they have a GDPR compliant version.

They won't be able to sell the non-compliant version right?

[ Parent | on HN ]

Re:GDPR Hall of Shame by PeterisP on Thursday May 24, 2018 @09:56AM (#17143988)

If an EU company who holds private data of their customers ("data controller") is buying services from some third party service provider ("data processor"), then it's the data controller's responsibility to ensure that they handle the data responsibly and don't ever give it out to noncompliant processors.

A B2B service can legally offer a non-compliant service in the EU, but then the buyer isn't allowed to put any privately identifiable data in it; GDPR article 28.1 "Where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject."

So in the sendwithus case, GDPR would prohibit an EU company to use its $79/month service for handling private data, since it doesn't come with the required assurances.

[ Parent | on HN ]

Re:GDPR Hall of Shame by jannemann on Thursday May 24, 2018 @08:54AM (#17143460)

The problem is you won't get an Data Processing Agreement (DPA) from them. And since email and names are sent through the service the DPA is mandatory. If someone somehow manages to detect your are sending his data to a non-compliant service you can get sued.

[ Parent | on HN ]

Re:GDPR Hall of Shame by chrisper on Thursday May 24, 2018 @08:43AM (#17143366)

Not sure why I keep reading that as sandwitchus.

[ Parent | on HN ]