Do you have examples of startups where data is not a core business concern, who still find it very onerous to comply with GDPR (and why it is so difficult)?
I'm sorry to come off as unsympathetic, but I feel I've seen a lot of complaints about GDPR, as though the impact on their business is accidental or a side-effect, coupled with apparent denial or inability to understand that their business practices are exactly the problem that GDPR intends to fix.
I have a profitable, bootstrapped SaaS business based in US . It's not based on ads or selling data. I don't even have a freemium plan. Only a limited free trial after which you have to start paying. It's a trivial application that stores mostly already public data. Only email is required to login so that I can send password reset and other such communication.
I've been talking to a very well known giant corporation (also based in US, but has many global offices) for months. The VP and director love my product and want to start using it right away for their department. But their legal team is scared shitless with 4% fines in GDPR. They are putting some draconian clauses (various ISO certifications and such) in the contract that I, as a small company, cannot comply. That's their interpretation of GDPR. It doesn't matter whether it's right or wrong.
The VP and Director are really nice people and I've developed very good rapport with them. But I'm afraid their patience will run out soon and they'll go back to using spreadsheets. A lose-lose situation.
This is the side-effect of GDPR.
I'm all up for GDPR. I have uBlock, have blackholed all Facebook domains, etc. But don't assume that GDPR doesn't affect normal business transactions. Anyone who says, "Oh, how hard could it be?" has no idea what they are talking about.
It strictly lowers the signal/noise ratio of this site, meaning it's just what we don't want here.
My first job twelve years ago was at a company similar to yours in Switzerland. A small bootstrapped SaaS targeted at enterprise and government. Switzerland is quite serious about privacy with strict laws regarding them, but since they have been around for a long time, nobody freaked out about it. It is just part of the daily business for everyone.
I can't remember compliance with such constraints being a serious competitive disadvantage for the company. In fact after Snowden the label "Made in Switzerland" and images of datacenters in mountain bunkers became an advantage internationally.
Their policy office is probably still busy waiting for Y2K.
It sucks, but HIPPA was exactly the same, and I heard exactly the same complaint from tiny companies back then too.
You can get ISO27001 for as little as $5k. My advice is that if you can afford it, suck it up, if you can't, offer ISO27001 on-prem installation for an extra $10k. If they walk. They walk. You can probably get them later (see below).
But see, it's important to understand that you're wrong: This isn't a side-effect of the GDPR.
This is a side-effect of capitalism: With no laws requiring that they keep personal data safe, it is to their benefit to keep the data in as insecure a form as possible.
Look at Equifax[1], who have lost control of perhaps every single american's name, DOB, SSN, and address.
Data Protection laws are designed to protect people. Eventually, people will get used to them; the dust will settle. You'll have an opportunity to explain the actual risk/reward clearly to your potential customer's CIO office because the savings/efficiency you're promising will make it worthwhile.
But right now? Too much fucking hyperbole about the GDPR for anyone to be thinking clearly.
[1]: https://www.sec.gov/Archives/edgar/data/33185/00011931251815...
So wtf are you worrying about then? Only shady companies are afraid of GDRP, the fact that you look at GDPR as a problem is a huge let down in trust for your company
It's not the law itself that matters in this case but the clients' (quite possibly wrong) interpretation of that law. As of now, GDPR unfortunately leaves a lot of room for interpretation.
It's called Data Protection Officer and you only need to appoint one if processing personal data is your core business, which is reasonable.
https://ico.org.uk/for-organisations/guide-to-the-general-da...
And yes, I expect the EU to enforce the consent rules. It's very central to the GDPR.
Article 27 stipulates that data processors outside the EU should designate a representative, a whipping boy, if you will. The representative should be subject to enforcement proceedings in the event of non-compliance by the controller or processor.
In most cases it would probably be the same person fulfilling both the representative and DPO functions but those are actually two separate roles.
Not commenting on the validity of this statement but it's interesting how I can tell from which continent you are from just by you saying that the regulation forcing a business to hire DPO is reasonable.
I say that even though it caused me a lot of work for the past months.
The requirement to hire a DPO is not a new thing, by the way - many countries in the EU already required this. This is true for many provisions in the GDPR - in Germany, for example, very little changes from the way it used to be, their data protection law was strict to begin with.
The big difference is that companies would just ignore the laws in, say, Germany since they were operating from Ireland, and would claim that the German courts had no jurisdiction. Now, it's the same everywhere in Europe, which makes it much easier to enforce.
Good for those countries? I'm not going to be happy with the idea of hiring some idiot to sit around and do nothing all day.
But it does frustrate me that you all believe that GDPR will somehow be good for you. I've seen it said multiple times that when a massive American media company decides to pull out of the EU that a European alternative will emerge that is GDPR compliant and replace it.
Do you actually believe that if the economics of GDPR compliance did not work for a large American business that it will somehow work out for a small EU startup? The only way I can see it work out is if GDPR is selectively enforced against American business which it seems obvious to me that will be the case.
The winners of GDPR continue to be the big five. Hopefully, they will adjust their behaviors (after paying some painful fines) in spirit of this regulation. Despite he GDPR, these companies will stay the technology and innovation leaders they are today. This will not change by that. This regulation will hopefully just enforce them to consider data privacy as something a lot of people really value.
Why judge at all? Europe has an extremely troubled history when it comes to abuse of private data - WW2, Franco, the Stasi, infiltration of moderate left-wing groups when the RAF was active, communism in East Europe. So, can you blame us for being protective of our privacy?
But it does frustrate me that you all believe that GDPR will somehow be good for you.
Why not? Many countries already had strong privacy protections, but non-EU companies could retract itself in various ways. So, it hasn't been a level playing field for a long time, since EU companies had to provide these protections. So, it is good for EU companies. It is exceptionally good for European citizens - they have a choice in how their data is used. US companies will eventually come around, Europe is a large and wealthy market. And complying with regulations is a walk in the park compared to e.g. China, Russia, or India.
The only way I can see it work out is if GDPR is selectively enforced against American business which it seems obvious to me that will be the case.
Please let this myth die for once and for all. The largest fines handed out by the EC affect European companies:
https://www.cnbc.com/2017/06/27/the-largest-fines-dished-out...
Firstly, the EU is not the same thing as Europe. Yes EU officials and supporters love to use the word "Europe" when they mean EU - I find it nasty and manipulative.
Secondly, I'm from an EU country, now live in Europe but not in the EU, and I think GDPR is absurd. A great example of the general malaise and decline of the continent. As I have pointed out elsewhere, GDPR is not even remotely an important topic to people in the EU. Actual opinion polls run by the EU Commission have shown for years that the top concerns of the citizenry are immigration, terrorism and the economy, in that order.
Data protection simply doesn't feature in it at all. It's a dog and pony show put on by the EU to distract people from its failings.
> As I have pointed out elsewhere, GDPR is not even remotely an important topic to people in the EU.
Just pointing out the irony...
I can't speak on behalf of anyone except myself, but I can confirm that, while it's not the #1 thing people are concerned about, people do worry about privacy. Especially in Germany and the neighboring countries.
I am referring to opinion polls. By pointing out what opinion polls say, I am not "speaking for all of Europe". That would be me giving my personal opinion as if it was commonplace or standard in Europe.
It would be prudent for these companies to spend an afternoon creating a list of all the places where data is being stored about a user. That would just help if it ever becomes necessary to actually delete data.
See elsewhere in these comments for information on appointing an EU representative. It is not required in most cases.
"Bespoke permissioning" is also required if you have tiers of users with different feature sets (free, basic, premium). So just treat whatever private-data-requiring-thing as a feature that needs consent.
Incidently, the evolution of smartphone permissions has also gone in this way, allowing fine grained allowing/disallowing. You have to expect that you wont have all the permissions you want. The GDPR just makes it so that you don't get to say "all or nothing" for the things that don't need permission. But, the good apps were already doing this anyways.
What seems like something aimed to protect the consumer may have unintended consequences further consolidating information into the hands of a few large behemoths.
Only for large-scale behaviour tracking operations. It's quite unlikely that this applies to a 1-3 person startup.
appoint, not hire.
User can file a complaint against you, resulting in a ruling. Whether you ever see an "invoice" or see police officers is another topic. But you violate the regulation/law in another country.
I’d be interested to hear how problematic this is for new startups who are building GDPR complianance into the systems from scratch. It would seem to amount to needed bespoke permissioning for every user because forced consent is not permitted (although being widely used).