So sad to see these businesses go (not)
On the flip side, does anyone know of side projects or community projects that have said "We chatted with a European lawyer, who said we don't have anything to worry about, and we'll keep doing our thing"? I know Debian is having that chat (https://lists.debian.org/debian-devel-announce/2018/04/msg00... - and there are some privacy things I think Debian should change, like not keeping people's support emails from years ago public) but I'm curious about projects that are smaller in scope and are basically not trying to hold personal data at all.
Refusing to protect your users from your own predatory use of their personal data because the ROI isn't there is still shady.
Then there's all the GDPR expert blog posts, blasting the EU for not giving any leeway or transition periods. You were in it!
They may well be shut out of the EU now, which is sad, because I know for a fact there was zero malicious intent.
Why would that be?
I think there's a lot of misunderstanding and/or uncertainty about the scope of the GDPR. The fact itself that you know, for a fact, there is no malicious intent, means that the GPDR will have little to no bearing on you.
If you're having a simple free e-mail raffle of goodies for a list of players that signed up for that, there's nothing that prevents you from doing that. What would change is that if someone asks you what you have on them, you have to mail back "we have your email address in a list of email addresses", and you have to really delete it if they request it.
These are things any decent company would normally comply with regardless. It's only problematic if you would be harvesting data for non-transparent purposes, but that's not something that could reasonable be included with "zero malicious intent".
Why would you think that? Collecting email addresses for an optional contest is a legitimate use case. The company just needs to ensure that these addresses are stored securely and must give users the option to get their data deleted.