GDPR really isn’t that complicated for most purposes - it boils down to: tell your users what data you store; let them delete their data if they want; let them export their data if they want. Which is not exactly unreasonable - the only scary thing was being obligated to do it by law with threats of fines if you didn’t. It wasn’t that hard to put together, particularly if you’re a normal centralised website or app that they were aiming at.

Whereas the OSB is: “if you run a service which lets users distribute ‘harmful’ content, then you’ll get pulled up in court. Plus it’s up to you to figure out what ‘harmful’ is; you’ll know it when you see it.”. Which sounds like the opening premise of a Black Mirror episode.

> GDPR really isn’t that complicated for most purposes

You're coming at it from a position of knowledge and confidence. The guide produced by the Information Commissioner's Office for organisations has 48 sections/pages [1] and features a toolkit with 7 different self assessment quizes [2], plus an extra one to help small businesses [3]. Even the "What is personal data?" section of the site alone contains dozens of pages [4]. And obviously the regulation itself is pretty verbose [5].

Given the legal ramifications, it's a bit dismissive to say it just boils down to three phrases. Whether or not GDPR is reasonable (and I agree that it is), it's perfectly understandable that sole traders and small businesses are concerned about the resources required to understand and implement it - especially when even many large organisations currently flout it (through ignorance or negligence).

[1] https://ico.org.uk/for-organisations/guide-to-data-protectio...

[2] https://ico.org.uk/for-organisations/sme-web-hub/checklists/...

[3] https://ico.org.uk/for-organisations/sme-web-hub/checklists/...

[4] https://ico.org.uk/for-organisations/guide-to-data-protectio...

[5] https://www.legislation.gov.uk/eur/2016/679/contents

Okay, fair enough - I agree that GDPR is certainly scary and daunting. But once you get past that, it is still something that can practically be implemented by small businesses, and generally improves things for users.

My whole point here is that the Online Safety Bill cannot be practically implemented by anyone other than massive businesses, and even then it implicitly requires massive privacy violations. Which puts in a completely different class of problem to implementing GDPR.

There will be SaaS companies soon that audit your content for you [1], the same as accounting companies that audit your taxes, because the tax code is too complicated for you to get right.

If you do this an executive and not try to circumvent or game this (like with taxes), there should be no jail time for you.

[1] not that I do like giving that power to content-auditing-companies.

I would agree in principle, in Germany/EU there is this ongoing discussion about making a carrier ("forum") responsible - which will lead to upload-filter SaaS, the way PWC does audits. Still you can fail for accounting after an PWC audit (too many public examples), but most companies that don't actively try to break the law feel kind of safe with a PWC audit. I would assume it's the same when you let an upload-filter company audit your content (but increases cost, just like PWC).

With GDPR on the other hand you can't use any US company with your customer PI data in the US and US companies hosting in the EU is a gray zone [1].

It is a challenge to find equivalent companies in the EU, e.g. good luck finding a equivalent competitor to Unbounce or Webflow. It works for MailChimp (e.g. Sendinblue) and ZenDesk, but not for some other dependencies you might have.

[1] https://en.wikipedia.org/wiki/CLOUD_Act rejections by companies need to be tested in court

It's very easy to make a checklist for GDPR compliance.

For the proposed content moderation it is pretty much impossible.

It's kinda like making a law that says you cannot make inappropriate jokes in front of the police. Who the hell gets to decide what is inappropriate? It's intentionally left vague to make everyone guilty and allow for selective enforcement.

GDPR is pretty harmless and relatively easy to implement I think

What was particullary easy implementing GDPR for you?

I found some areas particullary hard. Legitimate interest is a minefild and mostly can't be used, except e.g. delivery addresses. Finding GDPR compliant companies - with the US out of question - was also hard. Tracking and deleting data on request when storing in dozens of systems was hard - even returning all the data stored in dozens of external SaaS companies was hard (logging what you send them helps here, but doesn't address their tracking generation). They often don't give you everything you store with them back - deletion is often much easier. Tracking data in backups that needed to be cleaned on restore due to deletion requests was difficult to implement - easy in one, complicated in dozens of systems. Especially hard with AWS.

These are the most challenging I had on hand when implementing GDPR.

> What was particullary easy implementing GDPR for you?

Deleting people's private data upon request, namely when they click a button -- in my case (unlike yours) there's not many places to delete the data from.

The most challenging thing is instead writing a DPA, and wondering what to write about inspections and auditing, in a remote only company with servers in the cloud (any thoughts about that?)

I think auditing is an unsolved problem for now, I haven't heard of any implementation that works.

I would assume special companies will arise that do the auditing for you - and that work with AWS and GCP for you.

> special companies will arise that do the auditing for you

I think so too -- I had a look at Google's DPA and it seemed to me that when one agrees to Google's DPA, one agrees to trust some Google approved companies to do the auditing for everyone (for all Google cloud customers). Maybe there's not any other way to make it work (it'd be crazy with random people in their datacenters "auditing" things)