> like a loose cannon for whatever innovative business might come up if you have your first hire to be "the lawyer who gives legal advice in context of EU regulation".
But loose cannon is better than no cannon.
Also, how about not doing what is forbidden? You don't need to show cookie banner if you don't store cookies that helps to follow your users. You don't need to follow PII storing rules if you don't store PII.
Look, yes this rules are hard to follow sometimes but thats exactly why we have it.
I don't want to every company in the world to store my info without my consent and without possibility to delete it.
Sorry, but companies should deal with it.
If companies are so incapable of not harvesting data en-masse then they deserve to be sued out of existence and shut down for their shenanigans.
Also it's not really my experience having worked for a few EU tech companies. The small guys have 0 issues following the regulations, even without a single lawyer working there, since they're usually not so blinded by the prospect of infinite money and usually just stick to collecting what is necessary and nothing more. My company has 1 or 2 lawyers, but they're more there for things wholly unrelated to GDPR or anything like it, and we've never been on the sharp end of the legislation and likely never will be, assuming the suits don't drop 100IQ points and decide to go for "infinite" growth.
Even a cash-only business with no electronics anywhere would still need nontrivial GDPR compliance efforts because it has employees. Just because you need the data to run your business doesn’t automatically make you exempt without further paperwork. Your lawyers definitely do occasional GDPR compliance work.
https://www.dickinson-wright.com/news-alerts/the-gdpr-covers...
It’s a bit like accounting. You can structure your business operations is ways that make the accounting easier or harder, but unless you shut the business down you will always have done enough somewhere to need to think about (and probably file paperwork for) accounting/GDPR.
Tell that to GitHub for instance: https://github.blog/2020-12-17-no-cookie-for-you/
And for a startup it's trivial to comply with GDPR because:
- you start from scratch, so you know not to collect more data than you need
- you don't need that much data to begin with
Edit: In addition with AI act and its very broad definition of what an AI is and a classification like "Education" you might end up in level "highest risk" just for calculating statistics on your quiz app (no one knows until a court rules). With Cyber Resilience Act and its application of the (physical) supply chain direction, your open source repo from 5 years ago might end up being a footgun with you being personally accountable for other companies using it in their product. And so on...
As a European software engineer I'm calling BS on your statement, Mr Manager. EU legislation might not aim to stifle innovation (in contrast, they're always talking about a "level playing field") but their imprecise and vague regulation texts are like a loose cannon for whatever innovative business might come up if you have your first hire to be "the lawyer who gives legal advice in context of EU regulation".
Now, those people will just quietly move away to find a new home-market for scaling up and then eventually selling to EU countries. This is not "lagging behind" but an economical fiasco since the same laws only help local oligopolies of gatekeeper enterprises and (the ones they initially aimed for) Big Tech who can afford licenses and lawyers.
Two little examples (but there's more):
- What about the safe harbor thing? It's all a grey area now after court rulings decided that pretty much all US-EU IT biz is at least partially violating the EU regulations.
- We're now all happily clicking cookie banners and startups are getting sued by third-rate law firms. Some things were good with GDPR but did it help with Big Tech's (and meanwhile Tiktok's) way of collecting data? Nope.