> Most startups are doing their best to be good stewards of data, and they didn't need big global regulation to force them.

lol

So you work for a big company like Canonical. Glad to know you guys always get it right:

http://www.wired.co.uk/article/canonical-warns-2m-users-of-p...

https://arstechnica.com/information-technology/2013/07/hack-...

Who he works for won't negate the fact how ridiculous the original statement is at just bare face value.

> Most startups are doing their best to be good stewards of data, and they didn't need big global regulation to force them.

If that were true we wouldn't be seeing daily threads here (like this one) that effectively amount to "I don't want to follow the law/protect the data I collect" for months now.

...you just repeated it again. Not wanting regulation does not mean not wanting to follow the law or protect data.

Complying with GDPR can involve a significant cost, but as said multiple times already, the issue isn't data privacy and security but the vast ambiguity of the law. Costs and risk explode when the rules are vague and applied "on-principle".

There are numerous comments on this page that keep saying you need "a good reason" without realizing that is absolutely useless in a legal sense and can open up a large volley of litigation against any business.

If you're a small company and making a good faith effort to acquire express consent from your users for data collection, follow best practices to secure that data, and allow users to delete their data (even if it's a manual customer service driven process) then I don't see why you have any reason to be afraid.

You're not opening yourself up to litigation from random 3rd parties -- they can only file complaints to regulators who will decide how to respond.

Well then, you’ve never been the target of a lawsuit.

Forgive me if it doesn’t make me comfortable that the decision whether to file a lawsuit against me or not is left to some often uneducated and inexperienced regulators.

I think it is an important point about "many things will remain that way with GDPR because of necessity (ie: old invoices and transactions will continue to have your details)". Most people doing business have _very_ legitimate reasons for having sensitive data; invoices, charges, security, etc. all require having personally identifying and sensitive information, and GDPR recognizes that-- but what it means is that companies _will_ and _should_ have customer information. Just because it isn't sitting in their database to improve customer experience doesn't mean it won't be sitting in the billing department for accounting & auditing purposes. So GDPR doesn't actually change much about people having your data, just kind of shuffles it around.