Problem is - a shutdown doesn't really make any difference. Dropping the data would make a difference, but just shutting down access could potentially (very unlikely though) mean additional infractions - the customers' requests for data access, corrections, removals etc. still need to be handled, and this could be seen as an attempt to skirt those rights.

I would say that a shutdown essentially freezes the data and prevents it from being used internally, hacked, misused, disseminated, etc. For all intents and purposes, at the moment it doesn't exist. Once they believe they are back in compliance with the law, it will be "unfrozen" and users will be able to retrieve their data or opt-out completely by cancelling their accounts.

And who's to say that Instapaper did not contact the authorities and discuss a plan such as this to mitigate the problem temporarily?

> And who's to say that Instapaper did not contact the authorities and discuss a plan such as this to mitigate the problem temporarily?

If that's the case, why can't they simply tell this?

I side with the GP: Preventing access doesn't absolve you from complying with the law.

Does GDPR make it illegal to shut a site down for a period of time? While they are shut down, what could be noticeable that they are not complying with?

GDPR doesn't care about your site, it cares about user data.

The big thing with shutting the site down is it might make it impossible for users to request information about their data and/or request to have it deleted. That would violate the GDPR and could land the site in trouble.

> shouldn't following the law be most important?

More or less everyone has given up on following the letter of the law on copyright and has resorted to all sorts of "fair use" ideas that probably wouldn't stand up in court.

Instapaper makes copies of web pages. Does it have permission from the copyright holders for every copy of every web page? No. Are they going to enforce this? Almost certainly not.

Shutting down is not the better alternative because you still are breaking the law, as siblings explained.

Working into getting compliant and have a paper trail to demonstrate how you are progressing in case of control is the only realistic way to do it. That's exactly what a lawyer (in my country of course, perhaps not applicable to other countries) advised me to do. And this lawyer works closely with the public institution doing the enforcing in my country.

From my understanding, I'd be surprised if even 1% of companies were fully compliant today. Yeah, even big ones like Google (I actually spotted something I'm almost certain is non-compliant yesterday on their TestMySite service).

Don't be mistaken, the mails everyone receive about changes of terms for the GDPR and validating consent to receive newsletter are just the tip of the iceberg, they are the easy cosmetic changes.

It's a really old debate.

If I understand correctly what law is, I would say that lawmakers make some laws to express what is moral and what's not (according to them), but not always it's true that our moral standards are completely different from the lawmakers'. If the objective is to be moral, then we should ditch contradicting laws.

Shutting down while still holding the data is still breaking the law.