The flurry of activities is only driven by companies who keep data about their users. Of course "legitimate" will be defined by the courts. That's the price you have to pay now for all the abuses that have been going on for the past two or three decades. History has shown that to define "legitimate" the text of the law is to open the doors to avoidance. Sorry mate, we can't trust you to be honest. It's too late now.
The burden for filing a lawsuit is significantly higher than the burden for making a regulatory complaint.
Of course, just as you mentioned above, responding to complaints is distracting and expensive, which is why all insurance companies folded up the business up here, and there's no more insurance to be bought in Washington.
(I'm kidding of course, insurance companies work here just fine.)
I'm a huge fan of complain-and-respond frameworks. I have complained to my state Attorney General when my cable company change pricing on me mid-contract. I complained to my state Department of Financial Services when a rebate issuer sent me a card instead of a cheque. I complained, the other night, when a construction company decided to run jackhammers on 26th Street at 1:30 in the morning.
Complain-and-respond regimes work. They're also expensive, and cause known incumbency biases. Deploying them should be carefully considered. For insurance and financial services, the tradeoff makes sense. For literally every business that might ever touch a European's data, it's a bit overblown.
That's a fair argument to make. The counterpoint is that before GDPR we had so many problems with companies mishandling data that "a bit overblown" is not something that everyone would agree with. Additionally, some countries (e.g. above-mentioned Poland) had GDPR-like laws (Ustawa z dnia 29 sierpnia 1997 r. o ochronie danych osobowych) for over two decades now, with a corresponding regulatory office (Generalny Inspektor Ochrony Danych Osobowych) that regularly looked into complaints. In practice it turned out to work great, local businesses easily complied with the law, and nobody saw this as a huge hassle in the two decades of the application of the law. I find it hard to believe that it's going to get much worse than that with GDPR. Many companies are just overreacting here really.
GDPR should have had a minimum revenue threshold for the bulk of its requirements. Enforcement should have also been centralized in a single EU enforcer. A simple process for obtaining non-compulsory affirmative compliance certificates, for businesses at or below the revenue threshold, would have also been nice.
> I find it hard to believe that it's going to get much worse than that with GDPR
I see Facebook and Google gaining market share and failing to change their behavior. In addition, Europe is no longer a market one launches in simultaneously with the U.S. and Asia for most foreign businesses.
This whole episode is deeply frustrating as I'm strongly anti-Facebook and pro-privacy rights. The degree to which the EU turned an opportunity to lead into a wholesale boondoggle is jaw-dropping.
Since that's a broad statement, would you care to back it up?
> I see Facebook and Google gaining market share and failing to change their behavior. In addition, Europe is no longer a market one launches in simultaneously with the U.S. and Asia for most foreign businesses.
Are you saying that Facebook and Google are not GDPR compliant, and that furthermore, the EU doesn't care that they are not GDPR compliant?
Yeah, but in this case that "anyone" is not spending a dime of his own, instead the limitless resources of EU will be coming after you. By the time the court decides, virtually any small company will bankrupt.
No, it doesn't. It requires you to answer the questions the regulator asks, and to see if you're currently following the guidance the regulator gives you.
Most companies would--and do--retain lawyers to answer regulators' questions. Particularly when in respect of a new law, and doubly so given the political uncertainty currently present across the Continent. Naturally, one is free to self represent with regulators as one is in a court.
This is not America. We do not regularly put people/companies into bankruptcy just because we can.
You have much, much bigger things to worry about as a small company. You could have your bank cut you off because you’re suddenly deemed too risky - happens every day. You could run into a contractual dispute that drags out for years and costs you tens of thousands of euros. You could violate a patent you never knew about. Your supplier goes bust just after you’ve spent weeks negotiating a large order, and now you don’t have enough inventory. You could perform some action or inaction that results in injury to someone, and your insurance could refuse to pay out. It turns out that one of the products you sell kills people, and the Government decides to take you to court over it. Your customers might fail to make good on any credit you give them. One of your key employees could develop a chronic, life-changing illness. You didn’t realise that some tax or other applied to you, and now you’re not making enough money to stay afloat. As a business owner, have you worried about any of these things as much as the GDPR?
> If a country in the EU choose to make an example of my company for whatever reason would would be preventing them from doing that?
GDPR states all fines need to be proportionate.
Look at all the food serving establishments: almost none of them have a lawyer to check they're compliant with food hygiene regulation.
Look at all the companies who advertise: almost none of them have a lawyer to check if they're compliant with advertising regs.
Forget about violations. Even if you're in perfect compliance, any EU resident can complain to their data authorities if they think you're non-compliant. That then prompts a regulatory inquiry, which requires lawyers to competently respond to, which is distracting and expensive.