GDPR: Removing Monal from the EU

Every statement issued by EU regulators to date.

> I have always been respectful and even never required emails on signups.

Good.

> I am not 95% there because there is a ton more to do.

Such as?

> In fact i am at 5% because i have a lot of small scale past projects.

You've had two full years to get this done. The law came into effect the 14th of April 2016. It is now May 2018.

> Not everyone is a VC-funded startup.

If you can build it you can also build it in a way that is compliant with the law and if you built it in a way that requires a lot of work to be compliant with the GDPR then you likely were already riding a very fine line with respect to the DPD which has been in effect for much longer.

> That's the kind of emotional reaction that everyone has to GDPR.

Emotions are a bad guide when it comes to legal stuff.

> Yes we like respecting privacy, it's a good thing, but there is a lot that is problematic with this legislation.

Such as?

The 20 years of data protection enforcement we've had.

This has never been true since the internet was international. You have always had to comply with laws of countries you interact with, it's just that most people who ran internet businesses decided to ignore the law (just try hosting some copyright or patent infringing content on the internet and see how long it takes to have legal action applied, even if you aren't a resident in that country). And, despite the ethical questions about censorship, censorship is usually done through the laws of a country (for instance in Germany). So complying with censorship requests (or having your entire site blocked) is actually an example of complying with laws of other countries.

The world is made up of sovereign nations, and businesses that wish to interact with other sovereign nations must obey the restrictions that the both nations place on that interaction. If you don't like it, then don't do business with that nation. I cannot think of another industry where this concept is seen as foreign -- it's a very fundamental part of how the world has been structured for thousands of years. Just because it's much easier to conduct businesses overseas than it was 200 years ago doesn't change the fundamental properties of what you're doing.

If you decide to sell a couch to someone in America, you have to comply with American tax laws, American import and customs laws, American consumer laws, American patent laws, American copyright laws, American trademark laws, and any other laws involved with doing a financial transaction with someone in America. The same logic applies for Australia, the United Kingdom, Germany, Belgium, South Korea, Japan, etc. Pretending otherwise is naive, and if you don't believe me then try to sell something patented in America to an American.

The key question is what happens if you break those laws. In most cases you will be given a fine, and if you don't pay then you will no longer be allowed to sell goods to consumers in that country. If you continue to break the law then you are probably breaking an international treaty on border control or customs, which means that you could be extradited or tried in your own country. Some of the laws I mentioned above are mediated through international agreements, but the fundamental point is that if you break their laws they can place sanctions against you to stop you from doing business with them.

Of course, for a couch business things would probably never reach that level. And for an internet business you probably would just be IP blocked or something similar.

> No other country in the world can just make some "arbitrary" law that affects me. Unless my country agrees.

But it only affects you if you make the positive decision to do business with a country that has those laws. If you don't decide to do that, then you don't have to follow those laws (obviously). You can't have it both ways though (the benefit of having access to a market without having to follow the laws of that market).

In the case of enforcement you're right that they wouldn't have the right to compel to you to pay a fine, but they can in theory place sanctions against you. So if you continue to do business with sanctions in place then there is a process for extradition through international treaties.

every country has the right to enforce it's own laws within it's own borders. you don't get a pass to do whatever you please in another country without their permission.

edit: i noticed "my business exists only in Canada"

if you mean to say you aren't doing business in another country than what you've written isn't speaking to the point of "you are required to comply with the laws of any country you do business with"

Unless you wish to do business with that country, in which case you need permission from that country in order to do business with its residents. If you break their laws they can place sanctions against you, and if you find a way to break those you can theoretically be punished legally through extradition.

If you don't do business with those countries then you're off the hook. Obviously.

Just look at the recent Project Gutenberg copyright lawsuit for an example of how breaking the law of a country you are not in can cause you legal troubles.

This is a ridiculous argument. No, someone in the EU chatting about trade union membership does not magically require him to hire a DPO.

Please.

If you are using only contract basis for the data it's really easy. You tell them that you are using their data for purposes of fulfilling the contract. The great thing about contract basis is they can't object. The only thing you need to do is to inform the customer of any 3rd parties you send their information to in order to fulfil the contract.

It only gets complicated if you want to use the data for other things. For legitimate interest (which is essentially exactly the same as the laws that are currently on the books) you need to be able to exclude processing the data if someone objects. You also need to make sure that you don't delete their data if they exercise their right of removal (which is completely bass-ackwards, but whatever). Consent is similar actually, but you have to get the consent up front. The other lawful bases are very unlikely to show up in most organisations.

I think the main problem with most organisations (and it's the case with the company I work for at the moment) is that control of private information is very loose. For example, we use several SaaS systems for our marketing. Some of them are clearly unnecessary and so we either have to remove that functionality or get consent. So there's lots of discussions about whether it is worth a huge wad of text thrown at the user in order to have cat emoji's or some stupid thing like that.

The other main problem is that if you want to use something other than contract basis, you need to build something that allows the user to exercise their rights. It can be a manual process, but if you have a lot of users it might threaten the margin.

Anyway, long story short: If you are only gathering the information that you need to do the work you are doing, there is likely very little (or in a lot of cases I bet nothing) to do. If you are gathering the information to use for your own purposes, then there may be a lot that you need to do.

Not to put too fine a point on that, personally I highly approve of this. I really could care less if somebody's business model is destroyed because it is now too expensive to collect information that you don't need to do the job. Even in the company I work for, where we don't actually use the data for nefarious purposes (AFAICT ;-) ), we're finally having some long overdue conversations about what stupid SaaS crap we're using under the hood. Not to be unkind, but I utterly fail to understand how marketing people fall for the same lies that they spew out themselves... "If only we send our customer's data to this service, they will find a way to drive more business our way! And we don't even have to pay them!" Yeah... right...

Let alone full review of every system and legal review of the DPAs you have to sign and or create with every single co and processor.

Anybody that tries to sell you one is full of it.

Your risk in GDPR is similar to your risk in IP law. If you don't comply with the law and someone calls you on it, you might have legal proceedings against you. In most cases it's pretty obvious if you are compliant with the law (Well, to be fair, it's completely unobvious if you are going to get randomly sued for patent infringement, but I digress...) If you are have a very complex situation, then maybe it is worth some legal advice, but it's pretty freaking obvious if you need the data you have collected in order to fulfil the contract or not.

I also have to be compliant with US laws if I deal with US citizens. What's the difference?

> You might be from Europe and to you it may just seem sensible but 1-5 person companies often have to make tradeoffs like this.

Not the ones that want to stay in business.

> It is not right to say just comply with the law - it is so easy!

But it is easy, he's just making it seem as though it isn't. There is so much factually wrong in that blog post that if that's the level of thinking that goes into the decision making then there most likely are other issues.

> The company, here, has decided that the cost is too high and that they are out.

Probably good riddance. But for all the wrong reasons.

OP can just rely on "legitimate interests", and describe the data they're processing and why.

And as for the 'don't insult the monarch' law, we have that law here in NL and I purposefully broke it as a private individual to make a point.

The tax regime of every country in the world has no impact on me, I reside in NL, my businesses are here as well. But when I had several businesses in Canada and one in the USA I complied with the tax laws there too.

> The creator of Monal has decided the easiest way to be compliant with another country's laws is simply not to do business there, and I think you're underestimating the difficulty of the alternative (trying to comply with every country's laws).

He's taking the easy way out because there never was a real business behind this. This is my conclusion because he feels that his holidays are more important than the rights of his users.

And I think this is as it should be. I'm not sure why people think software meant for use by a broad audience, however cheap, should not be subject to basic safety, security and privacy regulations.

What's more, it's pretty clear the author doesn't actually have a lot of GDPR obligation. They need to maintain a contact point which Apple is actually doing for them. They need to forward RTE requests to crashlytics. If they're doing ANYTHING else with personal data, that's shady as hell and I'm glad they're not doing it to EU citizens anymore.

They comply later than everyone else not because they didn’t see it coming or didn’t prepare for it, just that it wasn’t in their interest to do it earlier

That's the price of sitting in your office with your head down though, you can't ignore changes such as these.

This is one of the oldest HN mentions about the GDPR I could find:

https://news.ycombinator.com/item?id=11764073

But it sank without a trace.

Likewise. This idea that the GDPR has been in the works for years so it's somehow implausible that very small businesses have only just heard of it doesn't stand up to scrutiny. No owner-run microbusiness is spending the time necessary to keep up with the vagaries of EU debates.

Similarly, the idea that the GDPR is plainly readable and so that shouldn't be a burden and no-one needs to consult experts makes no sense. The document is many pages long, there are many more pages of guidance and interpretation produced by both the EU itself and the various national regulators, and it's still fundamentally ambiguous on many significant practical points.

It is entirely reasonable for a small business that does relatively little trade with the EU not to want anything to do with this, and it has little if anything to do with how good or bad their practical data protection measures and respect for privacy are. If small businesses are overreacting then that is on the EU for failing to pass better law and provide sufficiently clear, concise and timely publicity and guidance on what it really means.

My business interests are in the UK, so we're stuck with this one. However, if we'd realised ahead of time how much trouble the new EU VAT rules would cause a few years back, we would gladly have sacrificed the modest part of our revenue that comes from other EU member states in order to avoid that mess, and it wouldn't have been a close decision. So I find it very hard to criticise anyone running a small business outside the EU for wanting to avoid the latest round of heavyweight EU regulations if they have a way to put themselves outside of their scope.

Unless you personally know the developer you are making a number of assumptions about their resources and time to deal with this issue.

And no, this is not about demolishing our way of life, the town we live in or the planet, it's about respecting the privacy of your users, which - for a change - is actually a positive thing. Unless of course you weren't going to do that in the first place you should welcome the development, I imagine that in a just world the Vogons would be on the receiving end of it.

Oh, and in this case the plans were not on display in the locked filing cabinet in a basement of a building where the lights had gone off and where the stairs were missing.

A handy URL has been provided for a long long time and all the debates have been recorded in public as well.

* We've known about the GDPR for around 2 years.

* The GDPR text, national regulators' comments, industry opinion, sample docs and a plethora of free resources have been readily accessible on the Internet for about the same length of time.

Having worked on the GDPR docs for a medium-sized business that builds learning management systems for corporate customers (about 100 live systems + dev and testing platforms where we are a processor of their personal data), it took about 3 weeks-worth of time to re-audit our platforms, complete a more detailed risk/impact assessment and write this all up together with some procedures for handling enquiries.

Yes it took time, and we went the extra mile with diagrams and tables because the docs are customer-facing, but handled in a timely fashion, GDPR compliance is not a brick wall to business continuity.

If a business already has in place a baseline level of good information security practice, GDPR compliance is not that hard.

It bans "raw-milk cheese", which is a distinct kind of product, not one way of many to make a particular product ("cheese"). If you ban raw milk, you ban certain types of product entirely, and there is no workaround.

It would be like saying a prohibition on planes does not ban automobiles, and after all, both are a kind of vehicle. True, but not really relevant.

Back to the GDPR case, it's closer to a producer of pasteurized-milk-cheese saying they are going to get out of the cheese business altogether because of the ban on raw-milk-cheese, and labeling their cheese as such and documenting however briefly that the cheese is made out of pasteurized milk is just too much effort, and they are afraid of being sued by people claiming it is raw-milk-cheese.

Whatever.

And why should the French cripple a delicious and traditional product, which is gladly gobbled up by millions of happy consumers to sell their product in the US?

I mean, it never really took off here, very few people prefer it over the original, but better than not being able to sell it outside of the US at all.

EDIT: Turns out the US-style kinder eggs are indeed available outside the US.

I haven't found a single case of a child getting hurt in Germany. Only news reports about them being unhealthy (big surprise).

It takes some special talent, even as an adult, to take such a big bite off of a classic Kinder egg that you'd have any chance of accidentally swallowing the plastic capsule or somehow else hurting yourself on it.

And with the new egg, I'd be concerned that my kids swallowed that plastic spoon. Like, that's something they actively have to put into their mouth and it's not as interesting as the toy for them to be motivated to not swallow it.

It's also small enough for them to realistically pull this off.

Essentially that's it.

I am no lawyer but I am a CPO.

Pro tip: Speak with the regulators they are on your side.

So, for example, he says he is required to appoint a DPO.

The U.K. Information Commissioner has this to say:

>Do we need to appoint a Data Protection Officer?

A> Under the GDPR, you must appoint a DPO if:

> you are a public authority (except for courts acting in their judicial capacity);

> your core activities require large scale, regular and systematic monitoring of individuals (for example, online behaviour tracking);

> * or your core activities consist of large scale processing of special categories of data or data relating to criminal convictions and offences.

It literally translates to "federal data protection law" and has been German law since 1978. In certain conditions it has also mandated a DPO (https://de.wikipedia.org/wiki/Datenschutzbeauftragter) since then, but in fact the first DPO position in Germany was created in 1971.

The right to be forgotten is mandated by article 35 BDSG (https://www.gesetze-im-internet.de/bdsg_1990/__35.html).

The right to a data export is mandated by article 34 BDSG (https://www.gesetze-im-internet.de/bdsg_1990/__34.html). It has always been common use this law to get a free copy of the data which our credit reporting agencies have about you, I've done that multiple times.

Nonsense. I look at another high tech data driven start-up every week and not a single one has stated that the GDPR costs are 'prohibitively high'. Sure, there are some that need to do more work than others (medical, ad tech). But on the whole companies that were already doing their best to not fuck up with their customers data have very little to do in order to get to where they should be and the remainder has a bit more work but will mostly likely be more-or-less compliant by the 25th and what work remains will be done long before the eye of Sauron will turn their way by virtue of their size.

The cost is strongly related to the size of the organization and the amount of sensitive data you hold as well as whether or not you were a bad steward of the data in the past.

A small business or a startup should have a relatively limited amount of data capture, and that data should be stored in a relatively limited number of places. In most cases, it should be straightforward to make sure that this is documented and appropriate controls are in place.

On the other hand, large companies have vast quantities of uncontrolled data gathering that nobody is responsible for.

Try convincing a regulator of that.

But it doesn't matter, you're still logging PII. GDPR doesn't make any distinction of profit vs. non-profit vs. personal ownership. You're as liable as an individual as an organization.

You could be breaking the law in any number of countries. What steps are you taking to comply with the laws of Saudi Arabia or North Korea?

However, this cases will be fought with the Googles & Facebooks, not with 5 person companies.

https://gdpr-info.eu/art-12-gdpr/

"The controller shall provide information on action taken on a request under Articles 15 to 22 to the data subject without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests."

What this gives the EU is the hammer to hit persistent abusers of user data. They want you to be careful with user data and not treat it like you own it; you do not. It is not yours to sell or share or publicize.

Edit; note as well that every country has a compliance office; if they know you are in complaince as in you are ‘good people’ (best effort, no giant holes etc; just best practice in our field which you should do anyway) they will not bother you with every (or any) user complaint after that. I have good experiences with this with far grave (and potentially criminally punishable) matters in a few EU countries.

The regulator is the effective judicial remedy.

In the UK there's also a First Tier Tribunal and probably an upper tribunal. These are when the regulator has made an error in law.

Please, don't take my words as granted but talk to an actual lawyer. You'll probably even find a free session for startups somewhere in your city, at least in Europe.

https://ico.org.uk/for-organisations/guide-to-the-general-da...

https://ico.org.uk/global/contact-us/advice-service-for-smal...

Database backups are only a problem if you save them forever, though it sounds like you are. GDPR generally requires that you regularly archive, rotate out, and clean up old data.

http://blog.quantum.com/backup-administrators-the-1-advice-t...

"The GDPR is open to interpretation, so we asked an EU Member State supervisory authority (CNIL in France) for clarification. CNIL confirmed that you’ll have one month to answer to a removal request, and that you don’t need to delete a backup set in order to remove an individual from it. Organizations will have to clearly explain to the data subject (using clear and plain language) that his or her personal data has been removed from production systems, but a backup copy may remain, but will expire after a certain amount of time (indicate the retention time in your communication with the data subject). Backups should only be used for restoring a technical environment, and data subject personal data should not be processed again after restore (and deleted again)."

You do need to have a documented and implemented backup retention policy and communicate this if you receive a request to delete a user's data.

You can still log accesses and aggregate them into statistics, just don't keep the IP addresses. You can still log IP addresses to detect DOS attacks or whatever, just delete the log when you don't need it anymore, after a day or so. There's no need to get backups from glacier, because you know there is no personal data in them.

Or the could be completely legitimate small businesses doing this device for anyone.

It's not 0, but large corps already do this. https://en.m.wikipedia.org/wiki/Double_Irish_arrangement

"protecting people's rights is expensive, therefore we shouldn't do it".

That's your argument? Really?

The GDPR is not going to cause any but the weakest businesses to close shop, in fact if the GDPR causes a business to close (which I highly doubt other than people voluntarily throwing in the towel because they can't be bothered) then I am not sure if I'm going to shed tears over that because it likely means that that business was so weak already that other things besides GDPR compliance were suffering as well (such as security).

It seems more like a cultural difference, whereby some one-man shops from US find privacy not important.

"While most Porsches can import quite easily from Europe to the USA, the 959 had complications abound, making it impossible for US citizens to get their hands on one of these supercars. One of the citizens was Gates, who ordered a 959 from Porsche, only to have it impounded at customs. The reasoning provided to justify the impounding was that the 959 had not yet cleared crash-testing requirements and did not meet EPA standards. Gates’ German supercar sat idly by for over a decade."

https://blog.dupontregistry.com/celebrity-cars/bill-gates-am...

And yes, he has saved himself the time and the effort of dealing with the GDPR, has also managed to position himself as someone who pays lipservice to privacy but who does not care to actually be compliant with privacy legislation when it matters. I wouldn't want my data in his hands after that anyway (not that that would ever happen because I don't have a smartphone in the first place).

If you have a site where users can make posts, I'd say they pretty much give you consent by signing up. IANAL, though.

No

> It rightfully belongs to the webmaster.

No, you are completely wrong here. The basic point of the legislation (and other privacy legislation in the EU that came before GDPR) is that a users personal data absolutely does not belong to the someone else once collected.

I think most people agree that unless those pictures are gathered with very specific consent, subject to many restrictions, they are not "my data". This is obviously an extreme example, but the reasoning extends to more data that is considered sensitive. The point being that "data ownership" is a complicated issue.

Apart from the fact that people named Jane aren't more likely to eat ice cream, you seem to criticize that it gets harder to target ads?

Oh no, that's a real pity. Oh no, poor webmasters.

They don't have that right. GDPR only applies to business. If you mean you wrote it in your house for some business reason then yeah they have the right to know you've done so and why and the right to ask you to remove it if you don't need to have that information.

In no situation do they have the right to come into your house. That's a touch too far into the absurd.

Surely anyone who disagrees with your feelings on this matter must be a sociopath, though.

Sociopath is a tough word, but in the original non insulting meaning of deviation from the common society, I think the word is right.

Being the sole owner and manager and being the DPO is clearly a conflict of interest.

> The absence of conflict of interests is closely linked to the requirement to act in an independent manner. Although DPOs are allowed to have other functions, they can only be entrusted with other tasks and duties provided that these do not give rise to conflicts of interests. This entails in particular that the DPO cannot hold a position within the organisation that leads him or her to determine the purposes and the means of the processing of personal data. Due to the specific organisational structure in each organisation, this has to be considered case by case.

> As a rule of thumb, conflicting positions within the organisation may include senior management positions (such as chief executive, chief operating, chief financial, chief medical officer, head of marketing department, head of Human Resources or head of IT departments) but also other roles lower down in the organisational structure if such positions or roles lead to the determination of purposes and means of processing. In addition, a conflict of interests may also arise for example if an external DPO is asked to represent the controller or processor before the Courts in cases involving data protection issues.

In summary, if you have power to decide how or for what purposes the processing of the data is to be carried out you're probably not allowed to serve as DPO. Of course in the end it's the company's decision who to give that role to, but not following the guidelines increases the chance of non-compliance.

1: http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_...

He's not handling sensitive personal data.

He doesn't need a DPO.

See also the derogation for micro companies:

https://gdpr-info.eu/recitals/no-13/

> To take account of the specific situation of micro, small and medium-sized enterprises, this Regulation includes a derogation for organisations with fewer than 250 employees with regard to record-keeping.

Sounds to me like they are not a) processing b) collecting message data.

The kind of law making you’re implicitly advocating is tantamount to despotism. Drafting a law that outlaws islam might well be clear in it’s wording, but it needs to be tested against the law that allows freedom of religion, freedom from persecution, and a ton of other laws no doubt. The claritiy of language with which a ban on islam is articulated is all for nought if it’s contradicted by, and incompatible with other laws.

Although, GDPR has been explained very clearly. And we’ve been given a loooong time to digest, understand, implement, and question it. I don’t think any reasoable person can make a compelling case against GDPR. But unreasonable people can, and as we’re seeing, they will.

As you correctly note, the GDPR is an EU regulation that will be enforced by national regulatory bodies through warning letters and fines. Unlike for criminal offenses, there simply is no way for it to be enforced by a police force or through arrests.