Comment by ocdtrekkie | Hacker News Reader

Comment by ocdtrekkie | Hacker News Reader

Parent Full thread

After reading a large number of GDPR-related articles and summaries, I've generally come to the belief that if you are doing the right thing with user data, it is unlikely GDPR is going to cause you to suddenly start suffering.

If you aren't selling user's data, you keep it reasonably secure, and they can delete their account, you are probably good. Most of the services you use will already be GDPR (and Privacy Shield) compliant, and it is easy to list your cloud and payment providers and link to their statements of compliance.

And almost everything a user could ask for, if you don't have an automated solution to, you can generally comply with by checking your email and responding accordingly, so for small userbases, this is hardly really even an issue.

Furthermore, as far as actual enforcement goes, the EU is not going to shut you down or put you out of business on a technicality. They are going to take you out if you show flagrant disregard for your users. This is going to hit the Unroll.me's of the world, not your average web forum.

That's just not at all true.

Even if your business is nothing like selling user data -- say you're Dropbox, or Box, or Microsoft, or similar -- your sales and marketing org is going to get walloped by the GDPR. How do you run a compliant cold outbound process? The EU has largely declined to tell people.

> How do you run a compliant cold outbound process?

Perhaps that question itself illustrates the moral ambiguity of cold-calling?

If you rely on a marketing service that depends on buying personal information without the subject's knowledge, in order to catch people by surprise, then perhaps GDPR is doing its job by making that difficult.

Analogy: tax laws take money from me but the EU doesn't give me any hints on tax avoidance schemes

I'd be highly surprised if Dropbox, Box or Microsoft do not have their house in order in time. Unless they are planning to go to court over it.

A dutch proverb says 'high trees catch a lot of wind', if you're a high tree you ensure the wind is not aimed at you unless you explicitly want it that way. At their level there are precious few excuses about lack of resources.

> If you aren't selling user's data

I am curious when people mention this: Who literally sells user's data ?

Usually when people say "selling user data", they usually mean "monetizing user data". There are four levels to doing that:

- Level 1: Monetizing aggregates. Aggregating lots and lots of data, running statistics on all of it, and selling the outcome. Example: An online streaming site that sells TV analytics to TV channels.

- Level 2: Selling proxied access. That's the Twitter/Facebook/Google ads model: Allow interested parties (advertisers) access to an audience, but they never are directly told "Mary Jane is a 33 year old woman with 2 children and an income of $80000/year."

- Level 3: Selling personal data. This is what people think is happening in level 2, but is much rarer than it sounds. For example, let's say you have influencers on your site, you'll sell to potential sponsors data about that influencer. Or sites with personal statistics and insights that will sell access to it to their users' competitions (a known practice in sports services).

- Level 4: Selling confidential data. That's where we're talking the really shady/illegal stuff. Gathering emails/credit cards and selling them to spammers and fraudsters, that sort of stuff.

Great points. It's confusing when people say "selling user data" to refer to 3rd party advertising.

Unroll.me literally sold Uber data about Lyft receipts in people's Gmail boxes.

An innocent. Go watch this video from the Internet Advertising Bureau.[1]

[1] https://www.youtube.com/watch?v=-Glgi9RRuJs

I know how advertising works, but i don't see 3rd party ads as directly "selling the data of the users". You include an ad that is visible inside the page. At most, you are sharing the page view with an ad company, but you are not communicating any of the data you have collected to the ad server. It's up to them to create a profile/track. "Selling access to your audience" is not the same as "selling your own data to an ad company".

Your knowledge of the advertising world is roughly 20 years behind the state of the art.

It's not really. most people just put an ad tag on their page. It's adtech services that profile the user using their own data and trackers. The process remains the same.

Again, you have absolutely no clue how this works. Please start with reading this and branch out from there:

https://www.iab.com/guidelines/real-time-bidding-rtb-project...

Other avenues of interest: location based advertising and programmatic adaptive advertising.

Well every two weeks or so I get unsolicited mails offering to sell me very large databases of contact information. My standard is to just completely ignore these, but when I got nagged for the third time recently I sent them a (very intrusive but still legally entirely legitimate) subject access request to find out what they have on me, who they got it from and who they have sold it to as it was entirely without consent.

There are companies in the PR business that does that. Email addresses to journalists and and other people marketers want to read their press releases.

Some even claim to be GDPR compliant. It will be very interesting to see how that turns out. Personally I wouldn't mind if the whole business segment was burnt down by the regulators.

> "it is unlikely"

Isn't the uncertainty part of the problem?

All laws are subject to some degree of judicial interpretation. Laws are not like software code, but I would suspect much of the hysteria/uncertainty comes from programmers trying to interpret the law like software code.

Why? Are there any laws that are certain? If we held that all laws be 100% certain wouldn't we only allow convictions if they included confessions?

Confessions are far from 100% certain because of coercion.

Reply on news.ycombinator.com