As a developer I can understand this point of view, but as a consumer I say it's time to grow up. Internet startups have taken a "move fast and break things" approach that is analogous to early industrial revolution approaches to worker safety, product efficacy and safety, and environmental protection.

You're working in the real world, with real consequences if you end up exposing people's personal data. The party is ending. Either deal with it, or find something else to do.

I feel that you're ignoring the situation of small startups with just a few founders. At this stage, it can really kill your business to spend a lot of your resources on making sure you're complying with GDPR. Usually the 'consumer' of those startups are OK to take some risk, heck a lot might even sign up with dummy emails.

The Poland proposal [1] to limit GDPR compliance to only large businesses was trying to address that. But it's flawed, because a small company (Cambridge Analytics) could still make a lot of damage to users' privacy... but the intent of Poland was good.

I feel there should be an opt-out based on the numbers of users and the age of the company/service: If you can easily prove that you're not handling more than X users and your company is less than 2 years old, then GDPR does not apply yet, as long as you warn clearly on your website that you're not-yet-falling-under-GDPR. If you're still in the GDPR-waiver zone but believe to be GDPR compliant, then you can remove the warning and are subject to GDPR like every other company.

That way entrepreneurs won't be scared to try some MVP here and there. I'm especially thinking of those trying to start a startup in countries that are part of the E.U.. The rest of the world entrepreneurs can just focus on their local userbase.

[1] https://iapp.org/news/a/polands-proposed-gdpr-exemptions-spa...

It's like a small car maker saying that it can't be expected of them to comply with basic road safety regulations.

"We are a startup on a shoestring budget, we can't put safety belts in our cars!!!"

The cost of being in the car business is to build safe cars. The cost of being in the webservice business is to protect userdata.

If you can't, you are not good enough to be allowed on the market.

If you disagree, should the US also stop prosecuting VW for the diesel cheating?

For what it's worth, I'd argue the same should be permitted of a small car maker. If I want to go build my own cars, step 1 should be putting a motor on a chassis and being able to drive forward. Step 1 shouldn't be adding airbags and seat belts to a couple axles.

The safest car is one that can't drive, and the most privacy-friendly software will fail to compile. You should be able to build a functional car before you need to worry about making it as safe as possible, and similarly you should be able to build a functional MVP of your software before you need to worry about compliance with a huge international policy.

Like most car analogies this one has a fatal flaw.

Before you are permitted to use your DIY car you need to comply with safety regulations to avoid harming others. You can keep your unsafe car off the street in your garage, though. Same for software that is not compliant; you just don't get to call it a "product" and let it loose on the public.

you can build a functional car, but you can’t put it on the road. you can build a functional mvp, but you can’t make it available as saas to users.

you can drive your unsafe car on the track, and your negligent mvp on your customers own hardware as in-house software.

Going along that, it's also like 3D printing house startups no complying with fire safety regulations in the name of "oh no, it's too expensive, let's just not deal with that". Actually, thinking about it, such startups would probably start somewhere where regulations are laxer, make money there, then invest in security, and finally expand to western countries where subject to massive regulations. I don't want unsafe houses, I don't want unsafe cars, and I don't want unsafe websites. Some other countries don't mind about that. To each their own, what's so ridiculous about that ?

Great point about VW btw, I forgot about that !

I disagree with the analogy. Trying to use the same analogy: If I were a one person entrepreneur trying an MVP, I would be building a bicycle, not a car. And what I suggest is have the right to put a sticker on the bicycle: "Warning, this is not compliant with the car regulations" to make sure people don't have false expectations. (Because I agree that in the real world, only a fool wouldn't be able to differentiate between a car and a bicycle, but for web services, this isn't an easy task)

A one person entrepreneur might not consider him/herself to be "being in the webservice business". Instead he/she would consider being in the business of [whatever problem the MVP is trying to solve]. It just hapens that in the 21st century, most of innovation happens online.

Back to your car analogy, it seems that people on one side argue that all companies "being in the webservice business" are 'car makers'. some people on the other side of the argument might say it's not.

Also, ultimately, it's possible that after spending a lot of time and hours examining the legal requirements of GDPR, a startup realizes it's not technically hard to comply, but the issue here isn't implementing the requirements, it's more about getting all the legal analysis, certification, handling customers requests, etc.

> If you disagree, should the US also stop prosecuting VW for the diesel cheating?

In that case, VW has clearly been in the car business for much more than 2 years, and in my example "X users", a good value for X would be something order of magnitudes less than the number of VW customers around the globe. So no, the US would continue prosecuting VW.

Well it's funny because Uber, a company that actually does seem to have financial resources, is allowed to run their apparently unsafe cars on the streets of some us states.

to be fair though uber also has thousands and thousands of unsafely driven cars on the road that we have no problem with; humans are bad at controlling heavy rolling fast motorised steel boxes

Uber seems to be worse than humans thusfar. Orders of magnitude fewer miles than average before killing anyone, covering up running red light running, misleading videos. A human driver like Uber would've ideally lost their license and faced legal penalties by now.

I feel like starting from scratch GDPR really isn't that hard to handle.

If your business is based around exploiting user data however it might be a lot harder, but then that's the point of GDPR, to prevent people exploiting user data.

GDPR exists because it turns out we can't trust companies to handle personal data with the care it deserves, and I don't see why any company should be excused that proper care.

>I feel that you're ignoring the situation of small startups with just a few founders

It's that the equivalent of starting a new car company and arguing that you shouldn't be required to follow the same safety standard as Volkswagen Group, because you're still a small company?

At it's core the GDPR is simply stating that you're accountable for the data you collect and that you're only allowed to use the data for the purpose is originally collect. Building privacy into your product is much easier for someone designing something from scratch, compared to retrofitting it into the business plans of Facebook and Google.

I get the feeling that most of the people arguing against the GDPR are people who are focused solely in collecting user data as a core business. The people I know who are building actual product, where people pay for a service, are doing fine. Even though that they have to build products in a manner I suggested five years ago, where user data is either not collected or delete when processing is completed.

> You're working in the real world, with real consequences if you end up exposing people's personal data. The party is ending. Either deal with it, or find something else to do.

They are dealing with it... by limiting their liability.

They are avoiding it. Essentially they are voting themselves off the island to avoid having to play nice with the other inhabitants.

They're already on the one big island... they've just decided not to worry about the other big island across the sea yet because the one they're on is big enough for the time being.

I think I'd use the term 'putting it off for later'. Almost like technical debt. I'd probably look more seriously at GDPR compliance at about the same time I start working on internationalization and localization.

These are things I can put off until later, I don't need them to validate my startup concept. If the startup is successful, it might make sense to expand the market.

Companies can choose with whom and where they want to do business. The entire world is not entitled to everything Silicon Valley makes.

Considering Facebook even actively tracks non-users, where's the "users" choice of not participating in that glorious Silicon Valley invention?

As far as I can tell, the "user" doesn't have a whole lot of choice there and Facebook isn't the only company doing that kind of aggregated data collection.

Facebook is based in Ireland ostensibly for tax reasons.

I see them as a very poor example of good things coming out of Silicon Valley...

I'd agree with that if Facebook would be that single outlier nobody wants to emulate.

But Silicon Valley isn't a monolith where everybody is on the same page about everything, I have no doubt there's plenty of people in SC who consider FB a success-model to be followed into a shining future.

Is anyone denying that they have that right?

I mean... there's plenty of other islands where they can still make money, so why should they even bother?

...the other inhabitants who insist on maintaining control over the coconuts.

If “fighting over coconuts” is not on their list of things they wish to do, it’s not a completely absurd choice.

That might be a great point if most of the costs of compliance actually did much good for data subjects.

Insults?

Yeah but what they actually do is removing themself from market place. If I were looking for a startup, I would check for someone banning EU users, with prospective idea and copy what they have done, but GDPR oriented and voila, I am first on the market, slowly taking over the original site bussiness in EU and later the world. EU is a huge marketplace and you really need to be extremly short minded to avoid it due to some stupi legislation, not to mention that as a US cityzen I would abandon any site not going for GDPR compliancy as they are saying to me, between the lines, "we are bastardising my data". Like seeing a laser pointer on your forehead.

Will that work if noncompliant company is offering its service for FREE* by funding everything selling data and you have to charge/use less valuable static ads? Just having a larger market doesn't automatically make you're product more successful, especially when that larger market needs more mundane localization efforts that the average startup probably won't invest in for a couple years GDPR or not

Plus, blatently ignoring regulation is cheaper in the short term, and if you successfully leverage that advantage into revenue than you can start throwing money at the problem once the regulators finally do get around to prosecuting you.

Worked for Uber.

For my money, it hasn't worked for Uber until they start generating bucket-loads of cash.

I do agree with your overall point though.

People already copy successful startups for international markets all the time, it's just the nature of the business.

Only if your audience doesn't give a fuck about originality and community. You can't copy those. Even people in the EU care about who's fake and who's real.

I agree that exposing personal data is serious, and companies should be held responsible if they violate the terms of their privacy policy. I think companies should follow the law of the land.

The thing about GDPR that I disagree with is how it aims to have global jurisdiction. If it was a US law (as a US-based developer), perhaps I'd protest it, but I'd still follow it if I wanted to work in software.

But just because it requires changes affecting companies outside of EU that doesn't make the jurisdiction global. It's the same as with any other product that you are selling - if you want to sell it in EU, it has to satisfy EU's rules, irrespective of where it's being assembled / produced.

So if you "sell" to EU residents, follow EU's rules.

> So if you "sell" to EU residents, follow EU's rules.

Surely this will just result in the development of the reseller model?

As long as the reseller doesn't collect data, they're protected and as long as the US company doesn't maintain a presence or ideally market to the EU, they're untouchable due to the lack of any EU-US enforcement agreement for the GDPR.

Part of the length/complexity of the GDPR text is to deal with "cool hacks" like this to avoid having to spend money on IT security or to respect user preferences.

I think that's fair, but I don't think it's necessarily fair to put the responsibility on foreign websites to do the blocking and vetting. If the EU wanted to block websites that aren't compliant, that would make more sense IMO.

But you're not the only consumer, and your dollar is your biggest voice. Other consumers may be voicing a different concept of maturity than yours.

If a company does not understand GDPR it's fair to say I don't want them handling my personal data. And it's not like this is new, there was a 2 year period to prepare for this.

"Most startups will fail": I do not see that happening. You will first receive a warning. The EU won't really care if you are a tiny startup. Unless you are running a shady business, there's not much to worry about.

The problem is not with the spirit of GDPR. I am totally with that. The problem is the liability of it - as a small startup it is seriously scary to think that all it takes is one insane customer to pull the fire alarm and we'd have regulators and fines raining down on us even if we believe with all of our hearts we are doing it right.

Hence, the blocking of the EU - its better to block at the beginning and then expand to the EU once we have revenue to support someone handling this as an employee.

> as a small startup it is seriously scary to think that all it takes is one insane customer to pull the fire alarm and we'd have regulators and fines raining down on us even if we believe with all of our hearts we are doing it right.

You know this is not what would happen, right, that you'd be given advice and the opportunity to towards an amicable resolution?

That's an optimistic view of dealing with government, that they would actually be reasonable and helpful. Many in the US have a decidedly pessimistic view of dealing with regulations and bureaucracy.

Uber versus Night School is an example of this. Uber: Ignore taxi regulations, get tons of VC, get rich while being awful people. Night School: try to work with government and play by the rules, fail, get used as a cautionary tale.

Source: https://psmag.com/economics/night-school-failed-because-it-f...

I think something akin to GDPR is necessary and good, but GDPR as written probably isn't it. I look forward to seeing how it works out in practice, and how it develops/is replaced, and in the meantime feel bad for the developers and customers that suffer through the unintended consequences and misfeatures of it.

After the law gets clarified some, I think you're right that it won't be bad for small players. But I wouldn't want to be one of the test cases.

> That's an optimistic view of dealing with government

Calling the data protection agencies "government" may be correct in some very legalistic sense, but is utterly wrong under any colloquial meaning of the word.

Perhaps in Europe, but "government" has meant "the state" in the US for most of two centuries.

If they’re set up pursuant to legislation and paid for by taxes they’re the government.

Can you point me to where in the GDPR it talks about being given "advice and the opportunity to towards an amicable resolution"? (I'm not being facetious, I'm genuinely curious to read about it, if it exists)

Article 83 in general and specifically Art. 83 (2) state that "the degree of cooperation with the supervisory authority, in order to remedy the infringement and mitigate the possible adverse effects of the infringement" should be taken into account when determining penalties. We'll have to see what this means in practice though.

I wonder if their definition of 'should' is in line with RFC 2119 https://www.ietf.org/rfc/rfc2119.txt

I know nothing about European legal systems though

The GDPR doesn't use "should"; it states that "[w]hen deciding whether to impose an administrative fine and deciding on the amount of the administrative fine in each individual case due regard shall be given to" that factor. Basically, if you can show that they _didn't_ take that into account, or that you tried to cooperate and were stone-walled, you will have good grounds for having the fine overturned.

My understanding is that the measures taken against GDPR infringements will very much depend on the good will of the relevant national authority.

And as a member of a EU country that for the last year has been constantly bending (when not breaking) the rules to repress and attack legitimate political reivindications, the relativism in the application of GDPR is something that I find very worrying.

No, he doesn't know that. And you don't either, although you might believe you do.

>> You know this is not what would happen

You don't know this.

We have 20+ years of dealing with tons of national and regional DPAs following national rules. Now these DPAs play by a single rule book, but other than that, little changes.

How many $300kEUR fines (the maximum in Germany until yesterday) served by a German DPA (we have 17: one federal, one per state) have you heard about in the last 5 years?

I haven't found the statistic about fines levelled by the Hamburg DPA that I read recently, but just found something about the Saxony DPA:

From April 2015 to March 2017 there were 124 proceedings, with 47 leading to fines.

The aggregate sum of all those 47 fines was... 174.226 Euros.

You mean like [1] or [2]?

[1] http://www.dw.com/en/germany-fines-man-208000-for-stealing-c... [2] https://www.thelocal.de/20170405/germany-to-fine-social-medi...

The first one was handed out by a court based on criminal law. This is not comparable to administrative fines. He got fined 260 days of his income (which is the basis on which such fines are assessed). He had two previous, very recent convictions. I'd say this is not a very harsh sentence but your opinion might vary.

The second one is a law very much like GDPR (notice the little words "up to"?). Not a single fine has been given based on that, not even a small one.

The challenge is absolutely not technical, so 2 years makes no difference. The challenge is that GDPR is essentially impossible to comply 100% with, and absolutely impossible to comply without incurring extra costs.

GDPR is the PCI of the privacy world, 99% of companies will be non compliant if audited, but 99% of companies wont be audited. The difference is unlike PCI anyone can launch claims against companies, including for malicious reasons like taking out a competitor, and political reasons like a eurocrat taking a disliking to a particular company.

What are these companies doing that makes it so hard to comply?

I've been involved in GDPR efforts at work and all the policies seem fairly straight forward to me. If you're not doing shady shit and you're upfront with your users what you are collecting the data for, how long you keep it and what access policies you have set up.

Not a problem if you ask me.

It includes liability for any and all data handed off or handled by 3rd parties. In other words, google analytics, facebook ads, salesforce customer data, mailchimp, constant contact, that really useful startup. How can you guarantee they are in compliance? If they aren't, you are now liable.

Enforcement guidelines are ill-defined, and the definition relies on vague terms. For example, is retaining an IP critical to running your business? What if you're getting DDos'd? Now it is up to someone else to make that distinction, and you're dependent on them "being reasonable."

And if IP is the only PII you keep and if you destroy IP logs after let's say 6 month and write something about that in your TOS, you're good. And even if you're not, if hey contact you and are not happy with your way of handling data, they will warn you then offer solution.

You can even self-report if you're not sure you handled the privacy well, and they will point you the stuff you have to work on (and give you month to do that).

I Understand Americans are afraid of fine and lawsuits, but please don't be afraid. Read GDPR statement from regulatory instances, they are here to help business too.

> I Understand Americans are afraid of fine and lawsuits, but please don't be afraid.

I think GDPR is short-sighted from a game theory perspective and will short-change European citizens.

When I sold software online, Europe was < 5% of my sales. Why take on business-ending liability risk for that amount of sales? Sure, maybe I'd do these things anyway, but once you open that pandora's box, you're relying on favorable interpretation and the goodwill of regulators.

Having seen what happened in the US with civil asset forfeiture, well-meaning laws can have their purpose bent, and goodwill can be perverted. Why take on that exposure?

>It includes liability for any and all data handed off or handled by 3rd parties.

Why would you hand of the data of your customers to someone that won't/can't prove to you that they will be in compliance with the current legal requirements?

Honestly that is the entire point of the GDPR, don't misuse customer data and don't hand it over to 3rd. parties unless the customer allows you to.

> It includes liability for any and all data handed off or handled by 3rd parties.

Good. Outsourcing violations, ethical or legal, shouldn't get you off the hook for them.

Besides which, what are you doing handing off stuff that's important to your business without knowing what's being done with it? Not a recipe for success. And if it's not important, then...

Take a look at article 82, a DPA and legitimate interest legal basis.

The policies required for PCI compliance are all straightforward too. But enforcing large sets of policies across an organization is a challenge, no matter how simple the actual policies are.

it’s a problem cos the regulation is vague and what you just said is Your interpretation of it... that doesn’t mean it would stand up in court of law...

It's not possible for a financial institution to exist without incurring 'extra costs' for SOX and KYC compliance. And yet they all do. That pesky regulation seems to be useful.

Actually this has been a big problem in the cryptocurrency space. It's entirely too onerous to comply with the rather extreme regulations in the finance space so exchanges had to ignore them for the longest time. Some exchanges even have to move countries because it would be nearly impossible to operate "legally". Yet their services are still needed and if they didn't have this freedom and flexibility then the cryptocurrency space might not have had the tools it needed to grow and innovate.

But isn’t SOX for publicy traded companies only?

Yes, but some of it applies to privately held companies as well.

Most large banks and insurance companies are listed.

Oddly, Sarbanes-Oxley also had implications if you were a 501(c)(3) non-profit.

We had two major expenses: liability insurance for meetings and SOX insurance for the officers. Everything else was in the noise.

> political reasons like a eurocrat taking a disliking to a particular company

Are you just making this stuff up, or has this actually happened?

It's not 2 years though. European countries have had variations of the law for decades. If you ever bothered to comply with those, you'd have had literally decades and very little cost to comply with GDPR.

You didn't (as hundreds of others), so now the EU forces you to. So now you have an opportunity to become a better company: https://medium.com/tsengineering/the-gdpr-blog-post-9a571b13...

Not wanting to use non-GDPR compliant services is completely fair. I think it should be the user's choice.

I think assuming the EU won't care about tiny startups is irrelevant - I want to follow the letter of the law, it's why I'd opt to block EU users instead of just ignoring the existence of the law.