Also tired of people thinking that a company not wanting a rule means they were intending to do the exact the opposite of that rule, especially given said rule is incredibly vague and designed to be applied "on principle".

Fortunately for all of us, safety regulation is actually very specific in requirements.

> especially given said rule is incredibly vague and designed to be applied "on principle".

You know, I'm starting to feel that at least some of this contention is based on how Americans interpret the law vs. how Europeans do it. Somehow it seems that Americans (and the UK) has this huge legal corpus but everything has to be nitpicked to the letter, or the common law judges' interpretations may vary wildly, and some people might skate on technicalities, i.e. abuse of the letter of the law.

Whereas in civil law, which the EU is, there's less leeway for interpretation, however, the spirit of the law is also taken into account.

It's the opposite. "In-principle" creates lots of potential for interpretation, depending on who is doing the reading. The spirit of the law is also taken into account all the time in America.

It's really not as simple as you make it out to be and the EU has plenty of argumentative litigation.

Upthread we have the claim that "most early-stage startups use the... best practice of 'delete=1'," pretending to delete user data while actually retaining it. So, the exact opposite of the rule.

Yes, and many things will remain that way with GDPR because of necessity (ie: old invoices and transactions will continue to have your details). Most startups are doing their best to be good stewards of data, and they didn't need big global regulation to force them.

But do let me know when GDPR actually does anything to deal with ISPs, credit unions, medical companies, and plenty of other institutions that have breaches all the time and have endured roughly $0 in penalties.

> Most startups are doing their best to be good stewards of data, and they didn't need big global regulation to force them.

lol

So you work for a big company like Canonical. Glad to know you guys always get it right:

http://www.wired.co.uk/article/canonical-warns-2m-users-of-p...

https://arstechnica.com/information-technology/2013/07/hack-...

Who he works for won't negate the fact how ridiculous the original statement is at just bare face value.

> Most startups are doing their best to be good stewards of data, and they didn't need big global regulation to force them.

If that were true we wouldn't be seeing daily threads here (like this one) that effectively amount to "I don't want to follow the law/protect the data I collect" for months now.

...you just repeated it again. Not wanting regulation does not mean not wanting to follow the law or protect data.

Complying with GDPR can involve a significant cost, but as said multiple times already, the issue isn't data privacy and security but the vast ambiguity of the law. Costs and risk explode when the rules are vague and applied "on-principle".

There are numerous comments on this page that keep saying you need "a good reason" without realizing that is absolutely useless in a legal sense and can open up a large volley of litigation against any business.

If you're a small company and making a good faith effort to acquire express consent from your users for data collection, follow best practices to secure that data, and allow users to delete their data (even if it's a manual customer service driven process) then I don't see why you have any reason to be afraid.

You're not opening yourself up to litigation from random 3rd parties -- they can only file complaints to regulators who will decide how to respond.

Well then, you’ve never been the target of a lawsuit.

Forgive me if it doesn’t make me comfortable that the decision whether to file a lawsuit against me or not is left to some often uneducated and inexperienced regulators.

I think it is an important point about "many things will remain that way with GDPR because of necessity (ie: old invoices and transactions will continue to have your details)". Most people doing business have _very_ legitimate reasons for having sensitive data; invoices, charges, security, etc. all require having personally identifying and sensitive information, and GDPR recognizes that-- but what it means is that companies _will_ and _should_ have customer information. Just because it isn't sitting in their database to improve customer experience doesn't mean it won't be sitting in the billing department for accounting & auditing purposes. So GDPR doesn't actually change much about people having your data, just kind of shuffles it around.

Why is delete=1 a best practice? There are competing concerns here. The government has now decided for everyone. Agree or disagree it is not worth implyng immorality where no immoral intent is present.

I’m not sure that delete=1 is a good idea, because you’re still mutating database records. But, it’s often lot cleaner conceptually to model state as an append-only log of assertions and retractions or via a log-structured system, where you never delete old records but just push a new index record that leaves the appropriate record out.

Sure, but it also leaves a much bigger attack surface, because you still have all the deleted data ready to be leaked, as has repeatedly happened in practice. It's only a cleaner solution if your risk accounting allocates close to zero cost to that, which is what most startups do.

It's hardly only EU bureaucrats who have pointed this out. See Bruce Schneier from a few years ago: https://www.schneier.com/blog/archives/2016/03/data_is_a_tox...

Yeah, my point is just that the way databases have been developing recently has been towards eliminating mutation and deletion. The GDPR’s conception of deletion is fundamentally opposed to these models.

However, you can sort of match the two by storing personal data in a separate key-value map, using the (random) key from that map to link your data to the personal data and then just deleting the map entry when someone asks to be forgotten.

The annoying part is retrofitting data scrubbing into things like data warehouses and other systems of record, without accidentally deleting data you have a legal obligation to retain to satisfy, e.g. anti-money laundering laws or audit requirements.

It is insufficient to only mask PII because behavioural data can in some cases uniquely identify an individual, such as purchasing history. You have to destroy all data from the user.

By the way it is this stuff that is so maddening about GDPR. The EU steadfastly refused to be helpful by even answering frequently asked questions clearly.

Here's a thought: regulation like this is, along with the heavy-handed ideology that lead to it, is the reason why the EU is still lagging regarding technical innovation. I think this attitude is the primary reason Silicon Valley took hold in the USA and that the EU has nothing comparable. If the EU wants to legislate itself out of the future they're more than welcome to do so -- and I applaud every site who makes the tough decision to stonewall EU users.

I'm not onboard with the idea that Silicon Valley holds a monopoly on technical innovation. Getting people to click on ads on smartphones doesn't capture the entire scope of technology. Europe's economy is roughly as large as that of the United States. Many world-leading companies from the car industry, to chemicals, to biotech reside in Europe.

The US holds one dominating advantage in one subset of technology. Consumer-facing internet tech. While a lot of people employed in this field commentate on this website, it's a marginal part of the tech industry, and it's not worth sacrificing privacy for, Europe does not need Silicon Valley to produce high-value products.

And if adtech is supposed to be the definition of the future, rather than genomics, complex manufacturing and the life sciences than I'm okay with us skipping that part. There are business models that don't rely on sacrificing the attention and privacy of consumers.

That's exactly my point. The EU is built for entrenched institutions. There is no entrepreneurial spirit -- and that's why there's N-number of self driving car companies in the US and zero(?) in the EU, for example.

The EU had self-driving cars in the 1980s (Ernst Dickmanns & Mercedes, demo: https://www.youtube.com/watch?v=I39sxwYKlEE ). The most expensive robot car project was in Europe (https://en.wikipedia.org/wiki/Eureka_Prometheus_Project).

I do agree that the EU has less of an entrepreneurial spirit. Some cultural elements, but also practical: It is difficult to scale an app, since there are such large language and culture barriers between EU member states. There is a decades long brain-drain of highly technical (AI) people. Finally, it is very hard to compete with US companies, as they skirt the rules, winning all network effects with huge VC infusions.

I always suspected some of that was accomplished with military and intelligence support: The American economy and intelligence apparatus stands to benefit a lot with the entire world using Google and Facebook. The other side of this coin is that the pro-privacy anti-surveillance movement may also be supported by foreign intelligence agencies in an attempt to hurt US economic and military interests. https://en.wikipedia.org/wiki/Lernout_%26_Hauspie#History was close to establishing an AI-type Silicon Valley in Belgium in the early 2000's, but was unsuccessful.

All (or most?) of the big European car manufacturers in Europe provide and actively research self-driving technology. Volkswagen's research budget is five times as large (iirc correctly) as Tesla's.

You are succumbing to a lot of stereotypes here, which I might add is fuelled by a cargo cult tendency within Silicon Valley.

No, you see, if it's not a startup, it cannot be innovative.

You think you're being funny, but it took silicon valley to invent a machine to press juice of proprietary only bags of pre-chopped fruit, so I think you look rather foolish now!

But they're all providing that technology to American firms who are implementing the technology rather than developing it at home. See what I'm driving at?

So they do some research and then let some american companies that can't even imagine why you'd create safety regulations do the practical testing which kills American citizens instead of European ones when the inevitable mistakes happen.

Then they get access to the technology through partnerships. This sounds like a win-win for the EU companies

Indeed, it’s a win for the American economy too, when the IP is owned by American companies and the majority of profits go there.

Sounds like the Tesla and Mobileye partnership.

Apple recently gave up their self driving shuttle and told Volkswagen to do it for them. So yeah...cargo cult and tunnel vision.

European car companies sell identical technology to Tesla, it's just they call it lane assist (accurately), not autopilot.

You are mistaken. Lane assist is not the same level as available in a Tesla. No European car has or has ever had the higher autonomous level than the late model Tesla has. https://medium.com/iotforall/the-5-autonomous-driving-levels...

Tesla has ambitious goals, especially when it comes to reusing existing hardware, but right now the software is level 2.

>"There is no entrepreneurial spirit"

That betrays a deep lack of knowledge of what happens in Europe. There are a ton of innovative ideas and services that originated here.

Just off the top of my head, Skype and Spotify are huge and well-known.

Famously French has no word for entrepreneur.

/s

Whereas the US with its ISP, fossile fuel, pharmaceutical monopolies, it’s GM and Apple, Google, Amazon, Apple, and Facebook, Lockheed, and Boeing is obviously a Randian utopia. Yes indeed, no entrenched institutions in the US!

/s In cased you missed it.

> Getting people to click on ads on smartphones

Clicking on ads is how they fund AI research. Not all tech is equally profitable but you need all kinds. Meanwhile EU is still debating whether it's worth getting into the AI game.

>The US holds one dominating advantage in one subset of technology. Consumer-facing internet tech. While a lot of people employed in this field commentate on this website, it's a marginal part of the tech industry, and it's not worth sacrificing privacy for, Europe does not need Silicon Valley to produce high-value products.

> it's a marginal part of the tech industry

Hilarious

Is it?

Visit Germany sometime. Drive through the countryside. Most parts of the US look like a hollowed out shell by comparison.

That might have something to do with the fact that Germany has 7x higher population density.

You may or you may not have an argument - but you only present the most cliché, most superficial version. You merely divide total population by total area, which is utterly useless and misleading. Why does that keep happening on a supposedly "better" forum like HN? Each time this topic is touched this exact same tired and wrong pseudo-argument is presented as if population follows an equal distribution per area.

Just like in the rest of the world, in the US too the vast majority of people are clustered in and around urban areas. In order to achieve your goal/argument you counted vast stretches of nothingness. At least since the early 20th century migration to cities has been going on, and it still does - large urbanized areas continue to suck in people from the already emptier areas of the country.

https://en.wikipedia.org/wiki/Megaregions_of_the_United_Stat...

> Drive through the countryside. Most parts of the US look like a hollowed out shell by comparison.

In what way do you mean? Wind power?

Basic housing is the thing that stands out most for me. I'm originally an American, and now live in a rural area in Europe. Rural parts of the more affluent Western European countries aren't advanced per se, but they're, I dunno, reasonably modern. Decent housing and decent internet access. The U.S. countryside is just incredibly backward in this weirdly visible way by comparison. Entire swaths of countryside, especially in the southern US, but not exclusively there, are full of a mix of trailer parks on the one hand, and questionably habitable shacks with missing wallboards and plastic-tarp roof patches on the other (parts of Louisiana are seriously shocking). And good luck getting broadband.

I used to live in Europe and have also lived in many parts of the US. Just trying to understand, since I didn't notice much visible difference other than wind power. I'm from a rural area in the US, and it was a great place. I haven't spent much time in rural areas of the south though.

Small and especially medium business is vaporized.

Textiles? Gone

Light industrial? Gone

Regional banks? Dying

Local banks? Dead

Small retail? Dead

Dairy agriculture? Dying

Family agriculture? Dead

I grew up in a small town. 20 operating farms circa 1990. 2 today. 3 agricultural/equipment dealers, today 0. 5 small/medium manufacturers... 1 today, because of a military contract. School enrollment? -25%.

I watched the beginning of decline when I was in high school. There is no anchor businesses that sustain local economies, and no access to capital. Without government spending, either indirect or direct transfer payments, a shockingly high number of US localities would be in a state of complete implosion.

This is an inevitable consequence of globalization and conglomeration (especially of agriculture).

It’s an inevitable consequence of our current economic policy.

Conglomerates are all about capital, not efficiency. We are paying more, not less, by eliminating market participants.

Here's a thought: You don't know what you're talking about and I applaud the EU for protecting me against people like you.

GDPR only has an effect starting from yesterday, I highly doubt it had a retroactive effect up to the early 2000's to wipe out EU startups, that point is moot.

Hey, man, that's totally fine that you don't want those services.

Which is why those services are responding by blocking all EU customers.

Seems like a win win for everyone. Businesses don't have to deal with ounerous laws, and EU citizens don't get to use those services.

Plus it leaves the market open for other businesses who are actually compliant so they can capture a bigger slice of the market than the existing services. There really is a lot to win.

if a preexisting startup doesn't care for the market, its probably because it's too small to be worth it. This is not 1999, most ideas have been tried at least once. And experience shows that "extra privacy" is just not a selling point.

> if a preexisting startup doesn't care for the market, its probably because it's too small to be worth it.

It's not just that. It's that there is no money in cloning unsuccessful startups. Nobody wants to copy you until you're a success, but by then it's too late. By then the first mover has the momentum and resources.

This doesn't change that. By the time a startup becomes successful it will have the resources to pay compliance costs and enter the other market.

The problem is that having to exclude EU users until you're big enough to afford compliance will cause more ventures to die on the vine, before they ever become successful enough for anyone to want to copy them.

It also puts the local EU startups at an obvious disadvantage, because they have to pay the compliance costs up front instead of only after proving themselves in the US market.

>No mechanical engineer would complain about safety regulation

Mechanical engineering projects are too costly to be undertaken casually in the first place. Regulation is unlikely to be the long pole, so do you don't hear them complain about it. It only takes a few minutes and some easily self-teachable skills to start serving HTTP traffic; now it's going to take a few months and some lawyer hours to create the bureaucratic cover for doing so.

> Mechanical engineering projects are too costly to be undertaken casually in the first place.

Yes, because of the implications, as the parent said. Just making stuff is cheap these days, that's not just true for software. You don't have to build a factory, if you want you can even outsource the actual construction entirely if you don't want to go through the trouble and remain flexible, just like "cloud computing" using startups.

> It only takes a few minutes and some easily self-teachable skills to start serving HTTP traffic;

Because people do it without caring for or knowing the consequences.

> now it's going to take a few months and some lawyer hours to create the bureaucratic cover for doing so.

I don't understand your point, it's exactly what the parent said? Yes, this forces the startups to actually care about the consequences of what they are doing.