For the longest time companies have been able to market something as 'free' when they have been the ones who have been trying to hide the fact that users' data was being sold, etc. So I would argue that if someone is 'stealing', it is actually the companies themselves.

The "stealing" is because they are trying to get companies to give their content out for free without paying the cost which requires targeted advertising (and no, generic ads pay shit which is why tons of companies are blocking all the EU because they now aren't worth the server costs).

If you're sick of people using your product and not giving anything in return, Charge. A. Fee.

The GDPR specifically forbids giving users the option of paying with data. (In that you can't deny access if the user doesn't agree to the data usage).

Charge. A. Fee.

It turns out that a whole lot of users don't want microtransactions for everything they do online, and would rather allow providers to monetize their data in exchange for access. You not liking those agreements is not a reasonable justification for forcibly banning them.

After all, if someone exhibits a certain attitude towards their users' data that is a good indicator that there is more that isn't done properly.

It's funny that you think that it's totally ok to do this.

You don't need to create a specific feature for European users if you don't want to, just as European users don't need to do business with you if you don't value their privacy. Economic exchanges are voluntary. If you think ignoring European customers is something that pays off for you, go for it.

If we would not care about privacy to a greater degree than other regions we would presumably not pass legislation that protects private information and cuts into ad-revenues.

What's really being affected on the backend side of things is bulk data collection and storage and sharing with 3rd parties without consent.

"I want to use your free service without participating in your monetization model. K thanks" -- EU citizens

"I want to use your free service and to participate in your monetization model only after you explicitly tell me how you are going to do with my data. If you can't tell me this, and get me to accept the trade off, why should I trust you?" -- EU citizens"

So it's more like "if you can't do this according to the whims of my government regulators, I'll still be using your service, AND prepare for a large fine."

I think we’re perfectly fine with telling you we use your data for ML training, internal analytics or showing you relevant ads. That is standard stuff you consent to in a TOS.

If you can't easily delete or export my data, it means that you don't have a coherent, legible record of exactly how my data is being processed. You can't be sure if my data has been leaked or stolen. You can't guarantee that you'll be able to notify me in the event of a breach. You can't prove that my data was lawfully collected. I can't check the data you hold on me to ensure that it is accurate.

The GDPR is easy to comply with if your data protection policies and processes were decent to begin with. If you have read the text of the GDPR and can't see how you could bring your business into compliance, then you are almost certainly doing something seriously negligent or seriously shady.

What we can do, is set a little deleted flag on your profile to treat you as "deleted".

> ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

So not a database query itself, but the thing that drives the database query. It also extends to things like logs - aka don't keep a log full of SQL queries that are full of peoples personal information. Don't ship that log off to some third party, or make it available to random people.

For web apps it's mostly the storage and retrieval aspects that are important. Don't store too much PII. Don't allow anybody to access it at the DB level. Implement appropriate access restrictions at the web-app level.

It is perhaps a bit too abstract, but that's because it's covering a highly complex topic, but I don't think it's too vague on this: If it contains PII, protect it. Which, of course, you should be doing already.

No one is asking.

Rather, the right question is whether the entity demanding (the EU government) has the right to do so on the basis that their jurisdiction extends to anywhere that a citizen of theirs can reach via the Internet. I argue no.

You probably disagree, which is fine, but this ultimately comes down to enforcement. And for now at least, I win on that front.

My take is that consumers need to be aware of what 'free' really means for each service that advertises it. What are the real implications - not just something hidden in doublespeak in a ToS or privacy policy.

Everything spelled out in the GDPR is a great thing for users and should have been there from the very beginning - being able to erase all their data, see all their data, export their data, and get notified when data is accessed.

I hate this "empowering users" philosophy of the EU. It's reminiscent of "right to be forgotten" type regulation where EU believes users should be in control of "their" data, when it reality it isn't "theirs" to begin with. Once data is "public" you can't ever "erase" it because it's not "yours". I'm sorry, if you shoplift in my store (online or no), I'm keeping track of you no matter how much you demand that I erase "your" information.