Hacker News Reader

Comment by rando444 | Hacker News Reader

Unless the owner is doing something shady (or just doesn't understand the GDPR), the issue is pretty clear.

He's running an unprofitable business (by his own admission), and likely is running it as some sort of sole proprietorship and doesn't want to take the risk on himself.

The solution is to create a company so that the company can shoulder most of the risk so the company goes bankrupt in the event he finds himself unwilling to comply with regulatory requests.

I'm guessing he just doesn't want to dump any more money into a failing project, which is his decision to make.

Is this a failure of the GDPR though, or a success?

Personally I think fly-by-night websites should be the last people responsible for handling personal data. If they're unwilling to attempt to comply with regulations, then perhaps the internet is a better place without these sites.

View on HN

>If they're unwilling to attempt to comply with regulations

This is an obtuse, bordering on malicious misreading of the post. They're not unwilling to implement the necessary features. They're unwilling to shoulder the risk.

> Personally I think fly-by-night websites should be the last people responsible for handling personal data. If they're unwilling to attempt to comply with regulations, then perhaps the internet is a better place without these sites.

This isn't a data broker, a credit reporting agency, someone with a giant sensor fleet, etc. It's extremely straightforward to not share data with a "fly-by-night" website like this.

Yes, they're unwilling to shoulder the risk.. so why should they get to keep people's data? Because it's a small operation? Because the owner doesn't have time to secure it?

Yeah, it's extremely easy to not share your data with them.. if you know they don't care about protecting it.. But what about all of the other people on the internet that don't know this guy doesn't care about your privacy?

Convincing businesses to take your personal data seriously is the whole point, and you shouldn't get a free pass just because you only handle people's personal data in your spare time.

> so why should they get to keep people's data?

Because people voluntarily provide it to them.

> But what about all of the other people on the internet that don't know this guy doesn't care about your privacy?

Governments confront problems with this general shape all the time... the result is usually labeling requirements. Sure, this guy should not be allowed to claim he has a crack team of elite cybersecurity engineers when he doesn't. Regardless, no one is asking him keep secrets for them. It's a niche Craigslist.

>Because it's a small operation?

You're actively campaigning to degrade privacy (and also user freedom, competition, and choice) to a much greater degree by displacing these activities onto large, centralized platforms. Especially those which are monetizing your data to a high enough degree that it's worthwhile to staff a compliance team for the privilege of continuing to do so.

> Because people voluntarily provide it to them.

Voluntary or not, there are some rights that you cannot give up to someone else. In Europe, one of those rights is control over your own personal information.

There's also the issue of information symmetry. Just because I voluntarily bought your product doesn't mean that you should be 100% free from any liability that it may cause.

>In Europe, one of those rights is control over your own personal information.

If that were true, you would not be able to post this comment (the most highly sensitive category of personal data, political views) in a public forum.

If you do not see the differences between collecting PII, and communicating your opinion in public, I'm not sure that a good faith discussion is possible.

But if it's all the same, would you mind sharing your credit card numbers, SSN, and date of birth? I won't leak it, pinky swear.

> PII

The GDPR concerns all information related to people. It doesn't treat PII (i.e. identifiers) separately.

You should read the second paragraph here: https://en.wikipedia.org/wiki/General_Data_Protection_Regula...

> In Europe, one of those rights is control over your own personal information.

Which is a dangerous illusion. You don't control anything you hand over to someone else.

I don't control the money I hand over to my bank, but short of complete societal collapse, Mad Max style, it will be used, and accessible in ways that are very clearly defined. It's not just going to dissapear to the Bahamas one day.

> I don't control the money I hand over to my bank,

You do have control, actually. You and the bank have an agreement as such.

Likewise users in the EU have an agreement with GPDR-compliant companies for control over their data.

And if the bank decides to break that agreement and run off with the cash (Or just lose it), there exists a regulatory framework that will resolve 99% of these sorts of issues.

This is also where GDPR is at. Without it, in theory, you have a shrinkwrap tl;dr agreeement with the service, but in practice, they can do whatever they want with your data, with no repercussions.

See: Facebook and CA. Facebook misused my data (Because my friends opted in to sharing it), CA misused my data (Because they weren't even supposed to be given access to it), and the outcome? Nothing of consequence.

GDPR does three things:

1. It makes those repercussions have teeth.

2. It makes sure that you give informed consent to use of your data. (Unsurprisingly, similar laws exist for banks!)

3. It clarifies what has to happen when you stop being a user of a service. (Prior to it, de-facto, your data would be opted into whatever changes of the data usage policy the service made - regardless of whether or not you still had an active account, whether you agreed with the ToS, etc. If you deleted your Facebook account, you had zero leverage of how your data would be used.)

Yes, and as banks are repositories of money (sort of like Dropbox and iCloud are repositories of personal data) that makes sense. But banks are not the only institutions authorized to possess money.

Even at a bank, if you open a joint account (enable sharing) and the other person absconds with the contents, you’re out of luck.

You’re putting Facebook and small websites in the same bucket.

GDPR is a sham. It's a ham-fisted attempt to protect citizens data (which is mostly unimportant even if leaked) due to the transgressions of a few corporate behemoths. In the end it only serves to solidify the market position of said behemoths as it adds another barrier to entry for small innovative startups that are already difficult enough to start without this bs. My main worry related to GDPR is that once implemented it will be near impossible to reverse once we see what a total clusterfuck it actually is.

They said, as their primary point "make a C-corp (or equivalent) so you don't have to pay if you are wrong". That solves the risk problem, unless you think they have positive equity.

Will a court pierce the corporate veil of a single-member company for a GDPR fine? Doesn't seem outside the realm of possibility, but what single-member company has the resources to a pay a lawyer to find out?

> This is an obtuse, bordering on malicious misreading of the post. They're not unwilling to implement the necessary features. They're unwilling to shoulder the risk.

I think your reading of the comment you're replying to is itself obtuse, bordering on malicious. They clearly understood that the core issue with GDPR for the OP is risk, and suggested a reasonable solution to address it:

> The solution is to create a company so that the company can shoulder most of the risk

Further:

> It's extremely straightforward to not share data with a "fly-by-night" website like this.

Not if you're using the site. The €20 million fine OP is worried about is only triggered in case of an actual leak of personal data. If you're seriously worried that you might end up leaking personal data, maybe you shouldn't be storing it to start with?

> The €20 million fine OP is worried about is only triggered in case of an actual leak of personal data.

The author is clear that they are concerned with having to defend themselves in court.

The fine is the bait that draws the true threat.

That's not remotely how this works.

The fines are imposed by the government; in the UK that means the ICO. They cannot be levied as the result of a lawsuit brought by private parties. The ICO also has discretion when levying fines, and they've stressed repeatedly they will not be reaching for maximum penalties.

GDPR offers the prospect of big fines if you screw up badly enough. It also is likely to lead to a lot of lawsuits. But there are totally separate issues, and cannot be conflated as you are doing.

OP might get sued. And he might get fined for €20 million (although realistically...no, of course not). But he won't get sued for €20 million.

> The fine is the bait that draws the true threat.

That's simply incorrect. You're looking at a normal civil case, with normal damages.

So they have a risk of having to defend themselves in front of a regulator instead of in civil court.

The risk remains.

They're...completely different risks?

We started out talking about the risk of an opportunistic civil suit filed by a law firm working on a contingency basis seeking a €2m payout; now that we've established that isn't possible, we're talking about the risk of an actual fine for breaking an actual law levied by an actual regulator (who is on record as saying that large fines would be a weapon of last resort in the most extreme cases).

So other than the risk being much lower, the likely penalties much lower, the chance of an unfair outcome being much lower, and the incentives and mechanisms being completely different...

...sure, the risk remains.

The amount of ad hominem in this thread is hilarious.

They're unwilling to shoulder the risk that they just made up out of thin air, yes.

"Failing" seems a bit harsh. Lots of people run websites that don't make money, and lots of users get value from such sites. Sometimes the operator still hopes to gain from the site (in publicity or whatever), or sometimes it's just a gift.

The GDPR just made that gift more expensive. If he's not doing anything deliberately shady, then the probability that he'll get fined is small; but a small probability times 20M EUR is still a big number.

Maybe I don't understand the GDPR well enough, but the statutory fines seem insane to me. Why do you think 20M EUR is the right number here? Or am I missing details of the law (the law, not how you expect it will be enforced) that mean his actual maximum liability is smaller? Do you just have extraordinary confidence in the regulators to "do the right thing", and thus no qualms about giving them the legal authority to ruin his life?

The gift part is lost on so many.

Perhaps it was unintended to increase the potential burden of monetary cost to running services that were created and provided as hobbies or otherwise as a goodwill gesture to others. Or maybe the regulators didn't care to consider the impact on such services. Or maybe ...

Regardless, thanks to regulators and data/service silos the web we once new or dreamed of is fading from reality. With just the silos to contend with such services could hitherto continue to exist with little concern for the actions of the behemoths; but now such an existence is threatened by regulatory concerns which blanket all regardless of their role and activity.

Perhaps the correct action is to blackhole .EU?

Pretty much any start up starts out as a "fly-by-night website". Maybe this guy's just an idiot, but regulations like this harm small businesses and innovation. You can debate the merit of them, but this is what they cost.

You're being downvoted unfairly. It is what they cost. Those costs can be mitigated though; there's a lot of businesses that make it their goal to solve regulations for small startups.

The question is more on the side of, is the cost worth it? A good and much longer-running example of this is in the medical industry. There are massive regulations around development of new drugs and treatments. Massive regulations around experimentation on humans. This stifles innovation and prevents potentially life-changing drugs from making it to the market faster, or sometimes ever. It also prevents a lot of other things, such as crackpots from entering the mass market and selling poison as an anti-aging drug.

Is it worth it? There's still debate about this today, especially when promising cancer treatments are taking years/decades to reach the market (=> how many lives are lost during that time? What's the tradeoff for someone who is terminally ill anyway? etc). I'm not nearly informed enough to pick a side in that debate, but it goes to show it's not necessarily a bad thing for "fly by night websites" to be heavily impacted by regulations like these.

> Those costs can be mitigated though; there's a lot of businesses that make it their goal to solve regulations for small startups.

Part of my concern is that in order for those regulation-solving businesses to have a working business model, they can't just support every stack under the Sun. Instead, you'll get something like GDPR for Azure™ — which means that it'll be that much more expensive for a startup using an outside-the-box stack to get started.

That's the point of a lot of regulation, really: to insulate firms which already exist from disruption.

The difference here is that the GDPR is widely believed to be aimed at Facebook, Google, and friends, and those companies are a threat to privacy partly because of the enormous scale of their data collection in addition to the intrinsically private nature of the data itself.

The question, then, is whether a small "business" that's closer to a charity or a resume padder needs to be regulated in the same way as Facebook when it doesn't collect data on the same scale. I don't think this applies to medical startups, where human lives are at the same risk regardless of how many customers are using the tech.

Have there been any exemptions for smaller businesses? If not, it seems pretty clear the GDPR is targeted at them too.

The online ad-tech industry is pretty fragmented [1] and widespread data-sharing would certainly be a problem even without the larger companies. It's not like Google or Facebook invented it; this goes back to nearly the beginning of the web. And the offline component goes back even further.

[1] http://static.adweek.com/adweek.com-prod/wp-content/uploads/...

You're spot on with your observation in the medical industry. I've been researching stem cell treatment for a condition i have and the impact regulations (which i fully support btw) have had is that now there are a bunch of hucksters and a bunch of legit businesses offering stem cell treatments and it is practically impossible to separate the two. Despite being well versed in reading scientific papers and internet research in general it is impossible for me to separate fact from fiction. Added to that there is also a significant number of people spreading FUD which adds unwanted noise not only in the marketing side but also on the flip side making it all the more difficult to decipher the landscape.

Related to GDPR i can definitely see a similar situation developing where large entrenched player leverage it to gain an unfair competitive advantage against startups who could threaten then in their market, using the same FUD tactics. This is a silent killer which will wipe out grass roots innovation in Europe.

I get what you’re saying, but I’m not sure it’s fair to compare PII management to the medical industry. Personally I think the new regulations are rather ham fisted, with so many edge cases that it looks more like a denial of reality than an attempt to regulate it.

I also think it’s going to be pretty harmful to startups, and that we’ll see more businesses just trying to avoid Europe at all costs. Regulation like this can either be easy to comply with, or they can be effective, you can’t really have both at the same time. Even then it just boils down to the old tension between security and compliance. I work with a lot of PCI orgs, all of them have AoCs, very few of them are actually what I would view as compliant. They all managed to satisfy the box checkers, but the DSS doesn’t do much to protect the consumers in most situations. The reality is that the DSS is just a mechanism of shifting accountability around, which is what I see the GDPR as. A bunch of politicians using poorly written regulations to shift accountability on to the market.

The medical industry is a decent analogy though. Highly regulated, high barrier to entry. Which is bad. Overall though, probably better than a free-for-all (e.g. Theranos), as we've learned from several millennia of humans being awful or incompetent.

God forbid we try and apply some of those ethics to IT. (Europe is big on privacy, again a somewhat hard-learned lesson.)

Except that approach ignores the nature of risk. The impact of getting a drug wrong is catastrophic, the impact of disclosing some PII is far less. This impact also decreases proportional to the size of the organisation, unlike the regulatory burden.

To compare PII to medicine is trying to invoke an emotional reaction, not a reasoned one. I don’t think this regulation is well designed at all, I don’t even think it’s going to achieve half of what it’s trying to do. But it will achieve increases compliance costs to pretty much every company, costs that will put startups at a serious disadvantage to established companies. Europe thinks they’ll have some protection by claiming every company in the world must comply, but only time will tell how that will work out for them.

First, European law works differently, and the way we write laws is different. You can't interpret them in the context of the US law system, where everything must be ultra-explicit and overworked. Also, only regulators can levy the fines/sanctions, they don't result from law suits from individuals.

Second, Europeans take privacy serious, and it's a right for us, similar to free speech in America. Also, while not as bad as some medical risks, identity theft is not fun. But, yeah, the risks are different, and the GDPR is pretty mild compared to medical laws, no? I mean in Europe, you can't advertise prescription drugs.

Third, Europe is not claiming every company in the world must comply.

But if you're mad at governments overreaching, maybe you could sort out the requirements FATCA/US tax law puts on foreign banks, or the US attempting to extradite "cyber criminals" before you get to the GDPR?

I am not personally the federal government of the US, so I’m not sure why you’re directing that whataboutism at me. However, comparing identity theft to death or permanent disability is not equivalent no matter which way you look at it.

In any case, none of that responds to any of the points I made. The EU does think this regulation applies to every company in the world (unless you can somehow prove you don’t handle any EU data subjects data - which almost no company could do). One of the reasons being that they don’t want to only hamstring European company’s with it, as that would be a very poor strategic move for their markets. How enforceable this ends up being is entirely unknown at this point, and you can bet there’ll be a lot of legal challenges ahead regarding this.

I'm making the point government "overreach" or whatever you feel it is happens daily, and IMO, GDPR is the least inappropriate of those.

I would imagine it's incredibly easy for many US companies, like e.g. a restaurant or a tire-repair shop to prove they don't explicitly go after EU subjects.

Since I was elaborating on how the EU and EU nationals feel like the GDPR is appropriate in addressing the risk of privacy violations - which part of that did you feel like didn't address your comment of "Except that approach ignores the nature of risk"?

I think you’ve misunderstood how GDPR works. If you handle the PII of a single EU data subject, then you are in scope for it, regardless of whether you intentionally solicit EU customers or not. Even a small restaurant or auto shop is likely to have a mailing list, or a CRM, or other records containing PII. It would be almost impossible to prove they don’t have a single piece of EU PII.

This does completely ignore the nature of risk, because it does not consider impact at all, which traditionally accounts for 50% of total magnitude. A SaaS company with 50 customers has to comply with exactly the same set of regulations as Google does, and faces €20,000,000 fines, regardless of the fact that the small company poses a quantifiably smaller risk to PII. There’s also an argument to be made that the small company is less likely to become the target of a sophisticated attack, as an adversary is much less likely to invest huge amounts of effort into breaching a small set of PII.

Here's a quote, directly out of the GDPR [0]:

> In order to determine whether such a controller or processor is offering goods or services to data subjects who are in the Union, it should be ascertained whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member States in the Union. Whereas the mere accessibility of the controller's, processor's or an intermediary's website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention, factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union.

So it's simply not true that "you are in scope for it, regardless of whether you intentionally solicit EU customers or not." I could continue, but I suggest you actually read it if you're going to argue about it.

So spare me with all this "risk" bollocks. You're just another person willfully misunderstanding our laws, and spreading FUD to try and impose your culture and your rules on our society.

[0] http://data.consilium.europa.eu/doc/document/ST-5419-2016-IN...

ergo why big corporations push and even lobby for government regulations

I think there's stigma around GDPR among some entrepreneurs because of a complete refusal from some people to see personal data as something they need to treat carefully.

Let's look at an alternate universe for a moment, where online shopping developed with very barebones regulations, PCI-DSS isn't a thing and fraud is far more rampant. Now the EU introduces new regulations much like PCI-DSS with heavy fines attached to it.

Suddenly you would have every small business coming out of the woodwork, claiming PCI compliance is a huge hassle, the fines are unreasonable, etc. Yeah, PCI compliance is a hassle (which is why we have companies such as Stripe taking care of it for you). But to protect and empower the users, it's needed. This isn't about your business, it's about your users and how they can, today thanks to PCI-DSS, generally trust that their credit card is safe to enter online (which is a net good for any industry that needs online payments).

But that universe is crazy because, who wouldn't treat credit card numbers as extremely sensitive data? Well, many companies who today aren't actually PCI-DSS compliant. Sometimes devs just don't know why, when or even how to encrypt the data and nobody audits that until there's a breach.

So my opinion is this is a success of GDPR. Clearly nobody in this comment section thinks the person in question would really have had a hard time complying with it, and probably wanted to shut down anyway. Either its users are better off because the service is a data vampire that doesn't care about compliance, or it's a no-op because it would have shut down either way. Make room for competition that does care, I'm all for that.

> PCI-DSS isn't a thing and fraud is far more rampant. Now the EU introduces new regulations much like PCI-DSS with heavy fines attached to it.

That would be amazing! Then we'd actually have to adopt a push-based or one-time-use transaction model, rather than living under the fantasy (disproven on a daily basis) that merchants should be in the business of keeping secrets, or are even capable of it. It's hard for me to take anything someone says seriously after they express admiration for the credit card number security model.

That wasn't the point of my post but what you're thinking about is actually in progress! Google PSD2 for more info :)

The point of your post was that companies should treat all data like credit numbers. The point of my post is that the need for a large number of parties to keep secrets is indicative of a fundamental design issue, not a caller for stricter secret-keeping standards.

I've not expressed any particular admiration towards PCI-DSS (and if you perceived any, I didn't mean to give that impression). Furthermore, the point of my post was certainly not to treat PII/Pseudo-PII like credit card numbers.

Payment card data is secret information, that's a given of the industry. If you disagree with that, I welcome you to share your credit cards in a reply here. Is it a design flaw? Yeah, you could say that; there's much better models and PSD2 will fix many things (not all) at the core of your complaints.

In the mean time, having to treat credit card numbers as highly sensitive is a fact of life, and when you're trying to protect users, you have to be pragmatic, you can't live in an ideal world with theoretical technology; you have to regulate what's there.

The GDPR's definition of PII is broad and contains many things which aren't secrets. I can tell you my full name, it's easy to figure it out from my profile, that's not a secret but it's still PII and GDPR asks that you treat it as such. Same for usernames, which are most often publicly visible on websites.

GDPR, more than dictating what you should encrypt, gives the users a set of rights over a class of data they share with companies in order to give (european) users more trust and comfort when choosing whether to share data with those companies. Things like "I should be able to know what a company has on me, and I should be able to download it and delete it".

I can't tell you the number of websites I've seen that don't let you delete accounts properly. That don't let you edit your real name (even if you get married or you legally change it!). That don't allow you any insight into where your email address ends up after you sign up with it. This is the problem that GDPR is trying to solve.

>In the mean time, having to treat credit card numbers as highly sensitive is a fact of life

It's a fact of life because the payment card industry found a legal way to externalize the risk of its idiotic architecture onto others. The networks are as motivated as can be to continue having transactions to intermediate, and had the technology for what I describe 20+ years ago. Smart cards are a 1990s technology. (Magstripes are a 1960s technology). They continue to drag their feet on the migration because we've made it cheaper to implement "security" through the legal system. Fraud losses are low enough for the industry to prefer the status quo, but high enough that credit card fraud is still a fact of life, because we have allowed it to create liability around data security.

> I can't tell you the number of websites I've seen that don't let you delete accounts properly.

So? Why should you be able to delete an account?

> That don't let you edit your real name (even if you get married or you legally change it!).

This seems like an issue for the company and one they should fix for their own good, not yours.

> That don't allow you any insight into where your email address ends up after you sign up with it.

I also don't have control over who my friends give my email or phone number out to, or if they sign up for facebook and facebook slurps that data (even if facebook becomes 100% truly gdpr compliant which I doubt they will even if they claim it). Why should I be able to control what other people do with something I gave them? If they breach my trust, maybe I should look elsewhere.

In the US, as a sort of general non-lawyerly rule of thumb, incorporation shields owners from contract liability, but not from tort liability, which is what they'd face from GDPR screwups.

Depends on the screwup. If he were directly involved in doing something malicious or extremely negligent towards his customers he could be liable. If he can't trust himself not to be in this category though, I would argue that shutting down is still the desired result.

The owner is just focusing on their startup, as they should be. It's up to the owner to decide their tolerance of risk against regulations which hold them to account.

A defensive piece you've made completely misunderstands how a business works in terms of the decisions made regarding risk, especially to an individual who lacks bandwidth/resources.

According to your post, you only expect well endowed individuals/large businesses to be compliant, which is precisely the problem.

sounds like you are willing to eliminate hobby websites and nights and weekends startups, forcing every new idea to incorporate first. that's the sort of thing that the internet was supposed to route around.

When I was reading about the GDPR today, I read that email address and IP are considered private data as well. This means any website with an email login or subscription or that even logs hits with the request IP must take action.

I fully support protection against physical locations and personal information (name, address, etc), but to include email and IP address seems a little excessive.

Friend works in data law and says that it's ambiguous. One of the problems is that people use personal information in their email. Also, you have no idea if it's actually personal information or just a nickname they've given themselves. For these reasons it looks unlikely that emails will be considered personally identifiable information.

That's unlikely to be true. And people are stupid, and will use their email address - just look at e.g. the Ashley Madison hack. So for most people, it's personal information, and the law will probably treat it as such.

I get and somewhat agree with your point, but on the flipside, excluding certain types of data means that companies will focus on abusing them to skirt regulations. I can see why they just went all-in on the types of data that are considered PII, because in different contexts, different data are possibly PII.

It's not a perfect solution, but I'm not sure there is one.

My email address and IP address ARE personally identifying. I am delighted that websites should protect this information.

While creating a company does shield you from some level of personal liability, you're (a) still exposed to directors' duties and similar obligations that attach to a director personally, and (b) still at risk of having your name attached to a company that has gone into liquidation.

> The solution is to create a company

Single member LLCs allow piercing of corporate veil pretty easily.

Reply on news.ycombinator.com