> especially given said rule is incredibly vague and designed to be applied "on principle".

You know, I'm starting to feel that at least some of this contention is based on how Americans interpret the law vs. how Europeans do it. Somehow it seems that Americans (and the UK) has this huge legal corpus but everything has to be nitpicked to the letter, or the common law judges' interpretations may vary wildly, and some people might skate on technicalities, i.e. abuse of the letter of the law.

Whereas in civil law, which the EU is, there's less leeway for interpretation, however, the spirit of the law is also taken into account.

It's the opposite. "In-principle" creates lots of potential for interpretation, depending on who is doing the reading. The spirit of the law is also taken into account all the time in America.

It's really not as simple as you make it out to be and the EU has plenty of argumentative litigation.

Upthread we have the claim that "most early-stage startups use the... best practice of 'delete=1'," pretending to delete user data while actually retaining it. So, the exact opposite of the rule.

Yes, and many things will remain that way with GDPR because of necessity (ie: old invoices and transactions will continue to have your details). Most startups are doing their best to be good stewards of data, and they didn't need big global regulation to force them.

But do let me know when GDPR actually does anything to deal with ISPs, credit unions, medical companies, and plenty of other institutions that have breaches all the time and have endured roughly $0 in penalties.

> Most startups are doing their best to be good stewards of data, and they didn't need big global regulation to force them.

lol

So you work for a big company like Canonical. Glad to know you guys always get it right:

http://www.wired.co.uk/article/canonical-warns-2m-users-of-p...

https://arstechnica.com/information-technology/2013/07/hack-...

Who he works for won't negate the fact how ridiculous the original statement is at just bare face value.

> Most startups are doing their best to be good stewards of data, and they didn't need big global regulation to force them.

If that were true we wouldn't be seeing daily threads here (like this one) that effectively amount to "I don't want to follow the law/protect the data I collect" for months now.

...you just repeated it again. Not wanting regulation does not mean not wanting to follow the law or protect data.

Complying with GDPR can involve a significant cost, but as said multiple times already, the issue isn't data privacy and security but the vast ambiguity of the law. Costs and risk explode when the rules are vague and applied "on-principle".

There are numerous comments on this page that keep saying you need "a good reason" without realizing that is absolutely useless in a legal sense and can open up a large volley of litigation against any business.

If you're a small company and making a good faith effort to acquire express consent from your users for data collection, follow best practices to secure that data, and allow users to delete their data (even if it's a manual customer service driven process) then I don't see why you have any reason to be afraid.

You're not opening yourself up to litigation from random 3rd parties -- they can only file complaints to regulators who will decide how to respond.

Well then, you’ve never been the target of a lawsuit.

Forgive me if it doesn’t make me comfortable that the decision whether to file a lawsuit against me or not is left to some often uneducated and inexperienced regulators.

I think it is an important point about "many things will remain that way with GDPR because of necessity (ie: old invoices and transactions will continue to have your details)". Most people doing business have _very_ legitimate reasons for having sensitive data; invoices, charges, security, etc. all require having personally identifying and sensitive information, and GDPR recognizes that-- but what it means is that companies _will_ and _should_ have customer information. Just because it isn't sitting in their database to improve customer experience doesn't mean it won't be sitting in the billing department for accounting & auditing purposes. So GDPR doesn't actually change much about people having your data, just kind of shuffles it around.

Why is delete=1 a best practice? There are competing concerns here. The government has now decided for everyone. Agree or disagree it is not worth implyng immorality where no immoral intent is present.

I’m not sure that delete=1 is a good idea, because you’re still mutating database records. But, it’s often lot cleaner conceptually to model state as an append-only log of assertions and retractions or via a log-structured system, where you never delete old records but just push a new index record that leaves the appropriate record out.

Sure, but it also leaves a much bigger attack surface, because you still have all the deleted data ready to be leaked, as has repeatedly happened in practice. It's only a cleaner solution if your risk accounting allocates close to zero cost to that, which is what most startups do.

It's hardly only EU bureaucrats who have pointed this out. See Bruce Schneier from a few years ago: https://www.schneier.com/blog/archives/2016/03/data_is_a_tox...

Yeah, my point is just that the way databases have been developing recently has been towards eliminating mutation and deletion. The GDPR’s conception of deletion is fundamentally opposed to these models.

However, you can sort of match the two by storing personal data in a separate key-value map, using the (random) key from that map to link your data to the personal data and then just deleting the map entry when someone asks to be forgotten.

The annoying part is retrofitting data scrubbing into things like data warehouses and other systems of record, without accidentally deleting data you have a legal obligation to retain to satisfy, e.g. anti-money laundering laws or audit requirements.

It is insufficient to only mask PII because behavioural data can in some cases uniquely identify an individual, such as purchasing history. You have to destroy all data from the user.

By the way it is this stuff that is so maddening about GDPR. The EU steadfastly refused to be helpful by even answering frequently asked questions clearly.