News for hackers. Stuff that matters.
Re:Article by article, how Big Tech shaped the EU's roll-bac... by wizzwizz4 on Monday January 19, 2026 @11:35AM (#46680965)
I'm specifically criticising the claim that GDPR was among the most burdensome requirements. Very little of GDPR is additional to what you need to do anyway, apart from DSARs (which aren't burdensome: you may charge a fee if someone's abusing the process), appointing a DPO (optional for most organisations), and the third-country restrictions (which are partly necessary, and article 45 reduces the burden). I don't dispute that regulations can be silly and a waste of time (e.g. PCI compliance requiring the removal of effective security measures, as directed by incompetent auditors, because the legal requirement is "passes an audit"), but I do dispute the use of GDPR as an example.

I'll note that of the three regulatory acronyms you gave, two of them (HIPPA and FDA approvals) are American.

Re:Article by article, how Big Tech shaped the EU's roll-bac... by loorke on Monday January 19, 2026 @02:02PM (#46683024)
> two of them (HIPPA and FDA approvals) are American

I specified all three via comma to highlight that we had quite some history in compliance, in different jurisdictions.

HIPPA covers only medical devices, GDPR covers everything. FDA approval process is convoluted and expensive, especially for new types of devices, but it's still much easier than European MDR.

Also, I mentioned FDA because we didn't even try to get a proper compliance in the EU, because it's impossible for a startup without huge support.

Re:Article by article, how Big Tech shaped the EU's roll-bac... by wizzwizz4 on Tuesday January 20, 2026 @12:07PM (#46694464)
> HIPPA covers only medical devices,

No, HIPPA covers only medical information. Perhaps with your organisation, this was restricted to devices, but within a hospital environment there's a lot more covered by HIPPA than just medical devices.

> but it's still much easier than European MDR

While MDR doesn't cover everything, it's still only 123 articles long: https://eur-lex.europa.eu/eli/reg/2017/745/2026-01-01. I'm guessing the burdensome parts are in SECTION 2: Conformity assessment – but I haven't found the unreasonable bit yet. So far it just seems like "do actual science to determine safety" and "if there's no 'intended medical purpose', also do actual science to demonstrate efficacy". There obviously are problems, as described in https://ec.europa.eu/info/law/better-regulation/have-your-sa..., but I don't see how the law-as-written results in these problems. (Maybe they didn't grandfather existing devices in? But that shouldn't affect a new device.)

Could you give us a run-down of the problems you faced before giving up, or link to a representative write-up, please?