The nightmare letter is bogus scaremongering bullshit. THe forum owner should just i) post a link to the privacy policy (which surely explains things like legitimate needs) and ii) supplies a copy of the data being held.

This is so incredibly tonedeaf: do you honestly think that small hobby-scale websites have a privacy policy?

Do you believe that hobbyists must not follow laws & regulations when they interact with the public?

Do you believe that anyone who has a hobby website with a forum needs an official privacy document, presumably vetted by a lawyer.

Why do you think the document needs to be vetted by a lawyer?

The regulation makes repeated reference to proportionality.

> Taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation. 2Those measures shall be reviewed and updated where necessary.

For a simple forum this is a simple privacy policy.

And forums should already have something like this if they're complying with EG US COPPA or similar.

What if a forum owner receives a DMCA letter, or a letter from NSA? You do not really need to consult a lawyer to remove copyrighted material or something else that is illegal.

A single DMCA notice is relatively easy to deal with. Even though a startup owner probably "should" consult with a lawyer, you don't need to if the take-down request is clear and the material is either clearly infringing or not. There are gray areas, but they are rare.

A letter from the NSA is a completely different story. You definitely need to hire a lawyer, probably an expensive one. One NSA letter could easily shut down a small startup.

Private and general aviation have a different set of regulations. Small and large aircraft have a different set if regulations.

I’ll let you figure out the rest.

GDPR is not applicaple to personal or household activities

https://gdpr-info.eu/recitals/no-18/

> This Regulation does not apply to the processing of personal data by a natural person in the course of a purely personal or household activity and thus with no connection to a professional or commercial activity. 2Personal or household activities could include correspondence and the holding of addresses, or social networking and online activity undertaken within the context of such activities. 3However, this Regulation applies to controllers or processors which provide the means for processing personal data for such personal or household activities.

How are they complying with eg US COPPA, which carries a penalty of $40,000 per infringement?

Yes. because it's a legal requirement when you collect personal data.

What? So just because you're small scale you can ignore people's privacy?

There’s a big difference between ignoring somebody’s privacy and having an official lawyered document that spells them out.

I’m sorry that this is a distinction you weren’t able to make.

It doesn't have to be lawyered.

Excuse me? How in the world am I supposed to know if it is sufficient for GDPR without a lawyer?

The context is a small forum that doesn't gather much user data and doesn't do weird things with it.

The forum owner should create a simple privacy policy that details what information is gathered; why it's gathered; how long it's kept; and how to correct mistakes.

If someone does report the forum to the regulator all that'll happen is that a letter will be written asking the forum to come back into compliance, and giving advice about doing so.

GDPR makes many references to proportionality. It also mentions standard practice.

EG here: https://gdpr-info.eu/art-24-gdpr/

> Taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation. 2Those measures shall be reviewed and updated where necessary.

> Where proportionate in relation to processing activities, the measures referred to in paragraph 1 shall include the implementation of appropriate data protection policies by the controller.

> Adherence to approved codes of conduct as referred to in Article 40 or approved certification mechanisms as referred to in Article 42 may be used as an element by which to demonstrate compliance with the obligations of the controller.