So Your Startup Received the Nightmare GDPR Letter | Hacker News Reader

So Your Startup Received the Nightmare GDPR Letter

jacquesmattheij.com

289 pointsjanvdberg495 comments

We already received one of these for Riot.im; kinda depressing that despite all the GDPR work we’ve done for Matrix (https://matrix.org/blog/2018/05/08/gdpr-compliance-in-matrix... etc) folks think it’s worth burning yet more of our time in proving it to them (but just to them). So much for writing software and actually making Matrix better...

Woke up to my second one today from a user who literally only had their name and email address in one entry in our system.

And now, they still have their name and email in one entry in our system, but it's the record that we deleted the first entry at their request. Thanks for wasting half an hour of my day checking our systems, jerk.

Why don't you just delete all their data and not record it? Then you can legitimately respond that you don't have any of their personally identifiable information.

Also, you're going to either need to suck up the admin time, script it, or block the EU. Take your pick, there's not much point slinging names around. Chances are it's going to happen again and you may as well be ready.

You had two years to sort out a quick procedure for doing this process, and it still took an hour and a half. Didn't you have a script to do that semi-automatically?

It’s the most self-inflicted wound in history, as an industry. Abusive practices, constant leaks, intrusive marketing, have all been building to a hefty backlash. It’s a shame that you’ve been caught up in the riptide, through no particular fault of your own, but this was inevitable. A whole industry can’t dick over the world’s population without blowback. The time for reasonable negotiations and slow change was probably a decade ago, not twenty years of abuse in. At this point nobody outside of the industry cares if people in the industry are hurting, they just want some privacy back.

Really? Most of what I've seen from outside the industry is akin to "GET THIS ING DIALOG OFF MY SCREEN I HATE IT WHEN THE FIRST THING AN APP DOES IS SHOW A ING POINTLESS DIALOG WHEN I JUST WANT TO USE THE APP"

Wouldn't be surprised to see some blackhat services come out that offer to drown competitors with these requests.

I’ve already had my sister send one to the chief competitor of my side project.

Cant see a reason not to honestly, especially if it’s valid. Swings and roundabouts innit

The letters are FUD. Take a look at the process:

https://ec.europa.eu/commission/sites/beta-political/files/d...

Please stop spreading incorrect (and identical) advice all over this thread.

https://news.ycombinator.com/item?id=17178562

The letters aren't even smart FUD. This sort of stuff gets made up by dumb people to validate the fears of other dumb people. It's a kind of self-propaganda. The idea that rando customers can ask for arbitrary information like backup policies and safe-guards or the location of your servers is just silly. The SARs have clear, well-defined limits [1] and the response can and should be automated (once identity has been verified).

[1] https://ico.org.uk/media/for-organisations/documents/2014223....

Would you kindly elaborate on which part of that link is relevant to this kind of letter? The PDF there only relates to what a citizen can do when you don't answer the letter.

How does that make the letter irrelevant? Responding to the letter rather seems to be the first countermeasure against the authorities' involvement...

Then automate the process or hire an administrator to deal with stuff like this. It's not the requester's fault that you can't handle compliance with a law efficiently.

That's what he's doing. And it costs a lot of money to do this.

> It's not the requester's fault that you can't handle compliance with a law efficiently.

No, it's not: it's the government's fault for passing an over-large law.

> It's not the requester's fault that you can't handle compliance with a law efficiently.

You're right, it's the EU's.

I think the ridiculous thing is every mom and pop site and blog and website needs to be gdpr compliant? insane. If the true intent was to make sure large players have their system in check then they should have simply said if you have 50,000 or more users giving you data a month or something to protect anyone interested in software from being afraid of having 2 users because now they need to read every international law. I know someone will fire back at this but what stop the United States from coming up with some law as well on the internet against how logins should be and then filing a lawsuit against every other country company that doesn’t comply. A business should follow the laws of based on the owners location and if other countries don’t like it then that’s for allies to group up and ask that minority country for change. gdpr to me is of reaching on the internet in a scary way.

So how exactly it's O.K. for customers if their privacy is breached by mom&pop businesses but not O.K. if it's breached by businesses that have 50K or more users?

It's common theme here on HN to think that users are just some kind of resource and the regulations are anti-climactic things that slows down the party.

Seriosly, As a user, I don't want my information to be sold to random people that I have no information about even if the seller is a tiny business because my feelings are not against the business but against the practice. The size of the violator is irrelevant to me.

If not breaching my privacy and my rights makes your business unprofitable, then simply you don't have a business.

Users are people, not just pageviews or hits or goals - despite what your analytcs software says.

It's not just small businesses. The serious effort to fullfil this legislation and the constant threat that you still don't is simply too much for small non-profit organizations and personal websites. A lot of one person blogs that are inactive but a valueable source of information have been taken down because of that.

I also stopped hosting demos of my side-projects (just for github or cv links), because following this law for this kind of service is just unreasonable. And I do not even have to cause any kind of harm to be fineable in Germany.

If your demos required storing or using someone else's personal information, taking them down was the right thing to do (assuming you weren't going to put effort in to become compliant). If they didn't, you panicked and took down potentially valuable data of your own volition.

Just adding a legally correct data protection and privacy policy is often too much of a burden. Even for otherwise fully GDPR compliant websites. Especially as I can not be sure if it is legally correct without consulting a lawyer (that's one of the big pain points for non-profit and private websites).

One of my demos required multiple roles for the service and hence had authorization and authentication build in. I.e. it was storing email addresses (though I happily handed out prepared near full-admin accounts to everyone interested). It was on a subdomain with robots.txt set to disallow, so very little chance someone would find it by accident. Still making this GDPR compliant without consulting a lawyer was too much effort and risk for me.

I'm not even sure without consulting a lawyer, if a fully static pure html website would be DSGVO (the German GDPR) compliant without adding a privacy policy to it. After all I could still be tracking users by HTTP/TCP/cookies and would have to inform the visitor, if I do or don't.

The Information Commissioner's Office (the regulatory body in the UK) says:

Who needs to document their processing activities?

There is a limited exemption for small and medium-sized organisations. If you have fewer than 250 employees, you only need to document processing activities that: are not occasional; or could result in a risk to the rights and freedoms of individuals; or involve the processing of special categories of data or criminal conviction and offence data.

GDPR is designed to be easy for small organisations to adhere to. No documentation needed if you have only small, non-sensitive data flows. IANOL, of course.

And, just like that, the tech world suddenly understands the stifling burden of overregulation that affects nearly every other industry.

Just as the world learns the horrible reality of practically criminal underregulation that the tech world has been operating under.

Well, it depends. If you only enable access to the demo without storing any personal information, there is no prblem whatsoever.

If, in order to access the demo, you need to give your e-mail address, and you are harvesting e-mail addresses in this way, you need to inform the users you are doing so, and provide a separate unchecked box "Subscribe to the Newsletter". In this way you are honest with the users, with how you are using their data, and you stick to the letter and the spirit of the law.

> So how exactly it's O.K. for customers if their privacy is breached by mom&pop businesses but not O.K. if it's breached by businesses that have 50K or more users?

One of these has systemic effects, the other does not.

(I don't think small businesses should be totally unregulated. But the administrative burden should be considered, to prevent discouraging new entrants and promoting incumbency bias. GDPR does not take this into account.)

This argument is disturbing for two reasons

1) You claim that GDPR has a big administrative burden to small businesses but that's not the case as long as your business model is not based on invasion of privacy. If it is, well, tough life!

2) It devalues the individual, it's ridiculous. Small restaurants need to follow hygiene standards just as the big chains, despite the fact that your local burger shop won't cause health problems on the same scale of McDonald's. Do you know why? Because individuals matter too. Can't be bothered to clean your kitchen? Don't run a restaurant. Can't be bothered to take care of your visitor's data? Don't run an online business. The society or any individual doesn't owe you a profit or a business.

> You claim that GDPR has a big administrative burden to small businesses but that's not the case as long as your business model is not based on invasion of privacy

Have you ever dealt with a regulatory enquiry? Even if you have done nothing wrong, they are harrowing, time-consuming and--occasionally--costly.

> Small restaurants need to follow hygiene standards just as the big chains

Look at the food codes in most large cities. Multi-location chains have stricter standards than single-venue restaurants. This is because (a) multi-location complexity introduces new vectors for harm (and lets it scale faster) and (b) people are willing to accept greater risks from small purveyors.

> people are willing to accept greater risks from small purveyors.

No they aren't, WTF?

> No they aren't

Everyone isn't. But most people accept home-cooked meals without demanding municipal inspection.

Furthermore, the presence of looser food codes--in the U.S. and Europe--for small-batch and single-location vendors, in comparison to chains, supports the hypothesis that many people see the added risk worth taking for more variety.

I know right? But on the other hand, people are fine to ingest pills sold by a dude that barely can spell his name but will totally freak out if someone opens a hospital with fake doctors :)

How did you manage to deal with a GDPR enquiry? It's been less than a Week since it's introduction.

Something tells me that your reaction is not based on facts but pure ideology, an ideology that assumes that regulations are always bad the businesses will take care of the consumers if left to their own devices.

> How did you manage to deal with a GDPR enquiry?

Pardon me, I did not mean to imply I have dealt with a GDPR enquiry. I was asking if you had dealt with any regulatory enquiry.

> an ideology that assumes that regulations are always bad

Quite the contrary. I like American and European securities regulation. I regularly call my Congresswoman for more privacy protections. (I had some luck getting a law I helped draft through committee in Albany. No further.) I've also consistently been of the position that Facebook should be broken up on antitrust grounds. My opposition to GDPR is purely on the way it is administrated.

> You claim that GDPR has a big administrative burden to small businesses but that's not the case as long as your business model is not based on invasion of privacy. If it is, well, tough life!

There's something I don't get in your argument: How having a business model not based on invasion of privacy is protecting your business from receiving GDPR Subject Access requests requests, the legal fees a small business needed to spend to take care of those, and the handling of those?

In your food example it'd be more like as if a law required you to have an employee meeting with a health inspector daily. And that employee must not be a cook/staff. This seems easier for a big chain to comply than a small business.

Here, to monitor all their email, each social media pages, etc and spend time figuring out if each tweet/post is a subject access request is going to be much easier to scale for a big company compared to a small business.

Also one thing a bit off topic that's not clear to me is if suddenly a business needs to start handling and archiving sensitive information because of GDPR letters (for each request, there must be a proof of identity such as ID, passport scan, etc). You now risk having potentially non compliant businesses handle those. That seems like exposing yourself more to identity theft for each GDPR request you make.

(See "how do we recognize a request" in https://ico.org.uk/for-organisations/guide-to-the-general-da... )

Would you say shoplifting is okay, too?

Damn it, the law shouldn't apply all the way down to individuals, over trifling matters and quantities!

If you're harmed by a privacy leak, do you care whether that was perpetrated by a site that has 50 users, or 500,000?

Oh, it was a small mom and pop site that passed on your personal info, so that made it okay; sorry! Next time, only deal with a big time operator.

If you die in a fire or building collapse it's equally bad whether that building was a large commerical building or a single family.

But we have two sets of building code rules because the regulatory burden is very different. The cost of complying with lots of regulation are fixed, and don't necessarily scale linearly with the size of the company. So to prevent these laws from wiping out small businesses they usually phase on these rules with increasing size.

Which locality are you talking about? Building codes vary quite a bit from one region to another. I'm pretty sure my municipality (Grand Rapids, MI, US) does not have differing commercial building codes based on the size of the organization utilizing the space.

Not the size of the organization using the building but the size of the building.

I wrote organization but I meant to write building

False equivalency.

Explaining why it's a false equivalency would be more helpful and create better discussion.

>If not breaching my privacy and my rights

You can respect everyone's rights and privacy and still be noncompliant, because most of the work of complying with the GDPR for most businesses is in the documentation, customer misinformation, and legal CYA work.

Okay, so add one more caveat—the business has more than 50,000 users OR it sells your data. Perhaps the vast majority of businesses affected by GDPR are not selling your data.

For me, main problem is not the compliance itself, but the legal part of it. If GDPR had clearly stated it ok to dismiss all these "nightmare letters" unless they come a set of official emails that handle it, and if/when such official letters come it would only be required from me to point to my legal pages and/or give access to the code/db to show I'm compliant, it would all be a-okay.

That is exactly the way it should be. people should stop storing user data because they don't do anything to protect it for you.

Keeping user information just became so normal in the past few years. it is not just about ads but also security.

You have all your information all over internet. Websites without minimum security requirements store everything just because it is cheap to do it and they just believe they should store it even they don't need it because maybe they need it in the future.

Hackers can do way more than you can imagine with your data if they want.

Storing user data should be expensive. Companies should only store it, if they accept and understand the responsibility and they must feel accountable for it.

I think the issue here is that GDPR is really broad.

We have had our legal team review it to perform a cost/benefit analysis on whether we should comply with GDPR or block the EU region for the time being.

At the end, while we all agreed that the idea behind this law is reasonable, it would benefit us to ignore the EU region. (We reviewed our database to ensure we don't have any EU users currently on the system before doing this)

That being said, we branched out and started to slowly implement some GDPR requirements that can benefit our existing users privacy and we will certainly remove the EU blockage when the scope of this law becomes more apparent to our legal team.

I strongly believe software is due for some serious regulation, just like all other branches of engineering, we need to take responsibility for the systems we create and I feel like this is a sign that our industry is maturing from it's infancy stage.

Kudos to EU for making an attempt to keep Europeans safe.

>I think the ridiculous thing is every mom and pop site and blog and website needs to be gdpr compliant? insane.

The even more ridiculous thing in my opinion is that these mom and pop sites are not already GDPR compliant. What could they possibly be doing that makes not abusing a handful of user's privacy an insurmountable issue?

> The even more ridiculous thing in my opinion is that these mom and pop sites are not already GDPR compliant. What could they possibly be doing that makes not abusing a handful of user's privacy an insurmountable issue?

You are writing as though not abusing people's privacy is all that is necessary to comply with GDPR. This is incorrect. GDPR has specific requirements for any company handling certain types of data, and extra requirements if it's handling this data "at scale" (though it doesn't actually define what this means). Any data revealing any of the following is considered protected by GDPR:

> racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited.

So, basically any user uploaded images or text can be argued to fall under this category since users might reveal their political, religious, or philosophical beliefs in this text. How about something as innocuous as a heart rate monitor? Well, apparently people have correlated 15-30 minute spikes in heart rates in the evenings to figure out people's sex lives so that's restricted by GDPR.

I could go on. The point is, it's not enough to just not abuse your user's data and cross your fingers to be GDPR compliant.

You would have to go out of your way to collect any of that data.

> basically any user uploaded images or text can be argued to fall under this category

If you run a public forum and people choose to reveal things about themselves in posts, that obviously cannot be what GDPR is about.

Even if it is, it doesn't concern any mom and pop site that isn't running a forum.

> If you run a public forum and people choose to reveal things about themselves in posts, that obviously cannot be what GDPR is about.

Yes it is what GDPR is about, the fact that people voluntarily share this information on a public forum doesn't nullify GDPR. Otherwise, Facebook wouldn't be under so much heat. Much of the data they collect comes from posts, comments, etc. all happening on a public forum.

> Even if it is, it doesn't concern any mom and pop site that isn't running a forum.

Say your mom & pop site has a comment section, where users can talk about blog posts they liked or disliked. Now all of a sudden you have to dedicate resources towards GDPR support.

Facebook is under a lot if heat because they actively try to encourage the user to enter PII and even have policies such as no aliases and all accounts should belong to one person. Can't remember if I even needed a phone nr confirmation or if that was Microsoft. The sole purpose of a Facebook account is to be a one to one mapping to a person, and everything posted or visited is obviously tied to such an account.

Not like hacker news where you don't even need an email address to sign up, creating a throwaway account if you want to post something private takes one minute. Good luck with that on Facebook.

The problem with forums is this: I'm upset with Jane Doe because she dumped me. I make an account called Jane Doe, from which I post some personal things about Jane Doe.

There is no way to police this stuff short of a total clamp-down on free expression.

The site operators must suspect every account is fake, and whatever that account says about itself is actually about someone else.

Since the protected information is extends to areas like political or philosophical beliefs and whatnot, nobody can discuss politics or philosophy.

Whereas before this GDPR thing hit, you had to do no monitoring of the forum all?

Probably not. Definitely not any proactive monitoring. A small website could get away with waiting for users to report posts, and then following up with manual inspection.

> If you run a public forum and people choose to reveal things about themselves in posts, that obviously cannot be what GDPR is about.

The GDPR has explicit provisions for how covered information that is explicitly made public by its subject is treated (for instance, separate consent is not needed for processing such information); outside of those explicit rules for particular effects, though, such information is treated exactly like other personal information of the same subject matter under the GDPR.

> What could they possibly be doing that makes not abusing a handful of user's privacy an insurmountable issue?

Nothing. Doesn't mean they have nothing better to do than respond to letters and regulatory enquiries. (To be clear, I'm not disparaging regulators asking questions. I'm simply observing that such questioning-and-answering has a cost. That cost is reasonable for a large company. It may not balance favorably for something smaller.)

Like TFA describes pretty in depth, that response burden, for sites that have no saved data and process nothing personal can be as simple as a form letter response pointing to a properly detailed GDPR statement.

Or might have to be expanded on a bit, point is the response cost can be scaled as well.

It will likely be years before any small business gets a routine regulatory enquiry, unless there is a complaint. And that is how it should be, isn't it?

So, a pragmatic approach then. Everybody violates the laws a little (maybe without knowing) and regulators pick big violations first. Software developers like to handle each edge case up front - which is not possible on this scale I guess.

GDPR impose a few things to do as soon as you have a single PII, as well as doing this a certain way (opt-out are a no-go, you must be able to prove consent, you probably need a DPO and a DPA), and things that were just not done in practice until now (right to be forgotten for example is not exercised, and thus there is no tool to exercise it).

Just because you absolutely respect the spirit of the law (don't do shitty things with PII) doesn't mean you are GDPR compliant, unfortunately.

I very much agree with GP that small business should have more relaxed obligations, and more proportional fines (the minimum fine exceed the total revenue of non-negligible percent of small business).

Consent is usually not needed, since there are plenty of other lawful reasons for processing data. Small businesses will not usually need a DPO, and neither will many large ones. Small businesses will have proportionate fines, and probably no fines at all for accidental breaches of the law.

And no, there is no minimum fine set by GDPR, only maximum fines. Most companies will just get a warning to sort themselves out, if the past behaviour of the regulatory authorities is anything to go by — their emphasis is on getting compliance, so only egregious failures will attract fines, with others directed to carry out specified improvements to their processes.

The even more ridiculous thing in my opinion is comments like this that conflate a truth and proof of that truth. It’s the difference between saying that every even number greater than 5 is the sum of two primes, and being able to prove it.

> What could they possibly be doing that makes not abusing a handful of user's privacy an insurmountable issue?

Storing their HTTP logs on archived CD-ROMS would be a violation of the GDPR, unless that same mom-and-pop operation offered users a way to request that CDs be replaced with new versions at will.

I don't think that counts as an abuse of privacy, but it is a violation of the GDPR, which makes immutable logs which contain IP addresses illegal.

There is no violation of the GDPR in just holding data, especially data for which you have a legitimate business reason to process. It is probably PII, so look after it as you would other PII.

The GDPR give a number of reasons where the right to be forgotten does not apply, including for archival purposes, or when the controller was not relying on consent for the processing.

> What could they possibly be doing that makes not abusing a handful of user's privacy an insurmountable issue?

Perhaps they're busy running their business and don't have time to comply with baroque EU regulations, regardless of whether they're actually "abusing their user's privacy" or not.

Regulatory costs are a thing. Even if you're not violating the regulation, filing the forms or whatever to assure some bureaucrat that you're not violating it takes time and energy.

There's a reason why the startup scene in Europe is onlly a fraction of what it is in the U.S.

The intent is to give people a way to control the information which will be used to influence their lives instead of being at the mercy of every corporation, start-up or mom & pop operation which is trying to make a buck.

Private life is such an essential part of human nature and our societies, no matter what the "nothing to hide" camp will say. There will be collateral damage and that's unfortunate yet tolerable, given the extensive abuses.

> A business should follow the laws of based on the owners location

This cuts against centuries of sovereign tradition and precedent. GDPR's constraint to users in Europe is reasonable. (As is refusing to do business in Europe by blocking the continent.)

GDPR Art. 2 par 2

This Regulation does not apply to the processing of personal data ... by a natural person in the course of a purely personal or household activity

So I am allowed to collect and store personal data for my toy project without consent?

IANAL As long as there's no connection to a professional or commercial activity it should be outside of the scope of GDPR. This is identical to the previous legislation, directive 95/46 art. 3.2.

Note that any external service processing the data must still abide by GDPR.

I also think the requirement to provide the same service 'without detriment' if a user doesn't want personalized ads - should only apply to companies over 500,000 users. It should only apply to companies that are ubiquitous that people feel they can't live without.

We as the collective tech community brought this onto ourselves. We did not self regulate ourselves. We did not take out customer's privacy serious enough. Therefore, big government stepped in and regulated us.

Equal before the law.

Sigh, you don't get it, do you?

In software, if you want to skirt the law, its easy to do so with small team/companies. Just spin up shell companies under the limit and use that to skirt the law.

It certainly defeats the spirit, but this is capitalism.. No holds barred, and do illegal moves till you get caught.

I updated my web service (solo dev, side project) with a GDPR compliant terms and privacy policy, got this form letter already from a few of my users. I have to tell, it's seriously depressing and I was contemplating shutting the whole side project down over the weekend.

I have a tiny project in closed beta right now I've been working on in my spare time for 7 years I'm considering closing to the EU. The idea is even entirely privacy minded with all data save email address being client side encrypted so we never see it unencrypted.

I never intended to make real money off it except maybe covering server costs if I'm lucky, but the time it would take dealing with requests like this it enough to scare anyone off.

Broadly speaking, and noting that IANAL, etc, etc, ...

I'm not sure what the problem is.

Your obligation is to keep the data secure, and only keep data that you need. Then you need to respond to requests to (a) tell a person what data you hold on them, (b) tell them what you do with the data, and (c) delete it if asked, unless you have a legitimate reason to keep it.

So if someone has given you data for the purpose of you providing a service then all you need to do is treat that data with care, don't do anything your customer doesn't expect you to do, and be able to provide and/or delete it.

Fair do, someone disagrees and has down-voted me. Please, having read the actual regulations[0] several times, including the recitals[1], I'd be pleased to see what's missing from that outline, so I can improve my understanding.

[0] https://gdpr-info.eu/

[1] https://gdpr-info.eu/recitals/

> you need to respond to requests to (a) tell a person what data you hold on them, (b) tell them what you do with the data, and (c) delete it if asked, unless you have a legitimate reason to keep it

Over the course of a few years, doing these things might take up as much time as it would to learn a new language. For a side project, I’m not sure that’s a smart trade-off.

> might take up as much time as it would to learn a new language

How so? Just build yourself a tiny tool that takes an email address or username and sends them their database entries along with the standard explanations about why you need that data.

For my side projects that will be around two hours per project and then 2 minutes for every request.

Or am I missing something?

> Just build yourself a tiny tool that takes an email address or username and sends them their database entries along with the standard explanations about why you need that data

You're assuming automated responses will satisfy requestors and, for the unsatisfied, be seen favorably by each of the twenty-eight national regulators, today and into perpetuity.

In any case, I got curious about your 2 hours / project + 2 minutes / request metric. One can achieve "basic fluency" in a number of languages within 480 hours [1]. We thus find a trade-off hyperbola [2]. For 1 project, after 14,340 requests you could have learned a new language. For 5: 2,820 per project. For 10: 1,380. At one request per day, that's under 4 years. TL; DR, even with optimistic figures, a significant toll is extracted purely for administration.

[1] https://blog.thelinguist.com/how-long-should-it-take-to-lear...

[2] 2 * Projects + (1 / 30) * Projects * Requests = 480

I think most people pro-gdpr never had to run a website.

> At one request per day ...

There is where our expectations diverge. Do you really expect one request per day for a small side-project? Or even for a moderate start-up?

I find that astonishing. I admit I only have a few thousand users, but I've had a total of three requests.

You could have an automated report generator/emailer to deal with a), point the user to your privacy policy for answer to b), and finally again have an automated process for c) as well. This doesn't seem to be in the "learn a new language" effort ballpark to me. If you're handling user data for a side project, then you'd better be serious enough about protecting your users' privacy; if not, either remove the need to store any more data than is required to provide whatever service it is you're providing, or rethink your approach to starting a project in the first place.

And then they spend their entire free-time playing administrator on a service that doesn't make them any money. Time they could've spent on improving the service. The alternative is that if they're outside the EU they just block the EU and if they're inside the EU then they abandon the project.

> And then they spend their entire free-time playing administrator on a service that doesn't make them any money.

Do you really think this is going to be a constant, relentless attack on your time? Do you really think that users of a service will constantly be sending DSARs?

I run a few closed services as side-projects totalling a few thousand users. I've received exactly three DSARs, and those are from people who wanted to see if I had processes in place. I'm very surprised that people think the administrative load will be significant.

But these are the underlying assumptions that can, and perhaps should, be explored. Broadly speaking, how many users will send in DSARs? One in ten? One in 100? One in 1000?

How long will it take to respond to a request?

If the service gets enough users? Perhaps it will. If I annoy the wrong person on Twitter, then I'm fairly certain I will be handling those requests for a while.

Just out of curiosity, how long did it take you to respond to those requests?

>But these are the underlying assumptions that can, and perhaps should, be explored. Broadly speaking, how many users will send in DSARs? One in ten? One in 100? One in 1000?

>How long will it take to respond to a request?

I don't know, but I do know that there are plenty of developers out there that would probably have a lot of trouble adequately responding to these kinds of requests. Particularly the people who might have some trouble with English, especially the type of English in these requests. I have no idea how those people are going to handle these situations.

> If the service gets enough users? Perhaps it will. If I annoy the wrong person on Twitter, then I'm fairly certain I will be handling those requests for a while.

Anyone to whom you are not providing a service should not have any data released to them, so they can get a simple "I'm sorry, you're not a customer, and I hold no data on you." response.

Anyone who is a customer and is sending vexatious requests - I'd refund them if appropriate and terminate their service. Especially for side-projects, you don't need the aggravation.

In my case people were genuinely asking about actual data, and I took the time for the first to respond "by hand" - it took about ten minutes. The second time I documented what had been done the first, and parametrised it. Total time was about 15 minutes.

The third time I ran the script by hand and checked the output. Total time was under three minutes. I'm pretty sure that after another two or three I can just let it run automatically. Time taken for subsequent queries? Probably none.

And I agree that for some people, especially those for whom English is not their first language, would have trouble responding in English. It's not clear that they have to.

But speaking about time taken, I'm now going to bow out. I've made my position and understanding as clear as I can. GDPR is here, and everyone can make their choice about what they do to be seen to comply. I wish you all good luck.

http://www.paulgraham.com/schlep.html

> How long will it take to respond to a request?

We are talking about side projects. You do that as an hobby. Any minute spend on ANYTHING else than what you like to do is a minute lost for no meaningful reason.

(1) that you do it as a hobby has no bearing on your relationship with your users

(2) hobbies already cost time, money and effort, this adds a bit more to the time and effort factor, need not cost any money

(3) if you decide you can't operate your hobby and be legal then you always have the option to shut down

(4) you can shut off your service for Europe after removing all data on EU citizens that you have collected.

This is no different than any other regulation.

The problem is you have to do all that or face fines and lawsuits which is outside the risk envelope of most people's side projects.

Even if you're running a small side-project, you really should (a) not do things people don't expect, (b) be able to provide people with a copy of their data that you hold, and (c) delete their data if you're asked to (and you have no legitimate reason to keep it).

That all seems completely reasonable to me. It's certainly reasonable that a new start-up or side-project should use these considerations as part of their design, and I should think that an existing start-up or side-project that does not comply should look hard at why not.

If you think these demands are unreasonable, I'd genuinely be interested in knowing which, and why.

Does it seem reasonable to you? Let me propose a scenario to you. Let's suppose that you commenting on Hacker News would mean that you must adequately respond to certain messages sent to you. If you don't do that then you can be fined. Does this sound like an environment that would encourage you to share your thoughts on Hacker News? Or does it sound more like an environment, where you would just not say anything and perhaps go elsewhere?

It's unreasonable, because it imposes an administrative cost on anyone that tries to do things on the side regardless whether they have good data handling practices or whether they have any intention of abusing the data. I would bet money on the fact, that JUST the fact that they must respond to a letter is enough to make some people go do something else. And who knows, maybe the side project could've been the next google.

My understanding is that if someone is not a customer, and I hold no data on them, then I can safely ignore any requests. At worst I can automate a response saying "I hold no data on you".

For customers, how many requests would you expect? One in 100? One in 1000? If I store the data securely, and I only use it for the purpose it was intended, I can automate a response that (a) Sends them a copy of their data, (b) points them at the privacy policy saying I don't do anything unexpected with their data, and (c) offer a link to delete their data.

Once set up, these should not place a significant burden on the provider of a service.

I suspect we are arguing about how much work will be required. I'm saying that once set up, the administrative overhead is negligible, you are saying it isn't. Certainly the services I run have seen no increase in administrative load, I'd be interested to know who has seen a significant increase (once already set up) and why.

not to mention that, historically and intrinsically, visiting a site or using someones application is a voluntary activity. no one is forcing the user to do anything and the user shouldn't be able to force the developers to do anything.

Try to build a treehouse without following legal guidelines and see what happens to your side project.

I frankyl don't understand why web site owners are entitled to a wild west, now-law zone?

Treehouse is an odd yet apt choice as the laws vary highly by municipality. None of the treehouses I played in as a child were inspected or up to code. I think the argument to be made here anyway is the level of danger. You could die falling out of a treehouse, whereas the actual damages from mishandling a single users data is several magnitudes less.

> You could die falling out of a treehouse, whereas the actual damages from mishandling a single users data is several magnitudes less.

That's a very dangerous sentiment to have. Identity theft is a very real thing. You can do pretty horrible things impersonating other people, things that will lead to people ending up in jail, things that can ruin whole families and drive people into poverty, desperation, and suicide.

It opens people up to blackmail, manipulation and a whole list of other, rather nasty, tactics.

On the extreme end, there's also the fact that not everybody lives in a "free country". In many places saying the wrong things, even online, can have very final consequences. In such cases, you not taking proper care of your user's data, sharing or leaking it all over the place, can result in people vanishing in some torture dungeon never to be seen again.

Why shouldn't they have that option? You chose to visit that website and input your data. You are completely free to not go there.

Adding legal costs like this de-incentivizes website owners which is now causing websites to shutdown EU access which I don't like.

I don't get why the EU thinks there are entitled to get content from the web while not abiding by the business model for targeted advertising companies.

Is this why nobody actually builds treehouses for their kids anymore?

We still build just tell your kids not to let any EU kids in

> (c) delete it if asked, unless you have a legitimate reason to keep it.

Deleting it if asked might be neither cheap nor possible, depending. What if he has an audit log in his system recording that foo@bar.example attempted registered, baz@quux.example wrote a record &c.? If the audit log is a secure audit log, it's not possible to mutate a record after it's written — but that's exactly what the GDPR requires!

So now he has to either allow his audit logs to be mutable (and thus no longer secure), or he has to e.g. use an opaque identifier for his users, which means he needs another database, his audit-log–viewing system has to perform joins between the logs & that database (which means that it will no longer be straightforward to view with tail(1) & friends), that join has to handle deleted users in some useful way, &c. &c. &c.

That's thought he has to spend on something he didn't have to previously. There's obviously no problem with that in the case of something that's essential (and several provisions of the GDPR are essential). The problem is when the GDPR is mandating something inessential, or — in the case of its mandate that users be permitted to rewrite history — outright wrong. He's being forced by the law to implement a misfeature.

It's somewhat similar to a law mandating key escrow: it imposes engineering cost to achieve a wrong end.

> If the audit log is a secure audit log, it's not possible to mutate a record after it's written — but that's exactly what the GDPR requires!

My reading, and the advice I've seen in multiple locations, is that in the case of immutable audit logs (and backups, for example), being immutable logs (or backups) would count as a legitimate reason to retain the information. It would be required to store the logs and backups securely, but that should be done anyway.

The requirement would then be to delete what's possible (which is what the GDPR says) and then not process whatever remains. In other words, it's mandating what is already good practice.

Question:

Can you not just have a checkbox that says "I agree not to use this service from within the EU." or something like that? Like, I don't even track IP addresses for my dumb side projects. I wouldn't know where to start with this.

This is actually something I've mocked up, but I'm not sure if it flies. I also wonder if blocking by IP actually counts as processing PII... Lol. So many questions.

GDPR impacts all European citizens whether or not they're physically within Euope, so that particular checkbox verbiage is probably not enough.

The scope definition talks about location of the data subject, not citizenship: https://gdpr-info.eu/art-3-gdpr/

The information obligations begin with citizenship:

> One requires transparency in gathering and using data in order to allow EU citizens to exercise their rights to personal data. Therefore, the General Data Protection Regulation sets forth a variety of information obligations.

American citizens don't may or may not have rights under GDPR, or may have rights only where the processing is done within European borders, but European citizens have rights under GDPR regardless of where they are.

"all data save email address being client side encrypted"

If its client side encrypted its not Personaly identifiable information.

Save meaning except. Email address is not encrypted to allow password reset and the like.

Ah true, in the past I have hashed emails with no salt to try and provide some privacy. For password reset I just asked the user for their email when requesting the reset and tested against the hash to make sure its legit.

Can you just put it in your terms of service that you will remove their account and ban them if you get a GDPR request?

Link to the web service? I'm very curious as to why you would be getting these letters

Please don't! GDPR letters are FUD. The only authority that can enforce GDPR is the DPA of your country or your user's country. And then after thoroughly investigation the DPA can implement different measures and the fines are just for the stronger actors and breaks.

No, the letters are - unfortunately - not FUD, they are legitimate DSARs and the letter has been carefully worded to give cover to the writer.

https://ico.org.uk/for-organisations/guide-to-the-general-da...

Is a good starting point. Yes, you can refuse a request if it does not qualify but in this case there is more than enough meat to take it serious.

Please, take a look at the user's rights:

https://ec.europa.eu/info/law/law-topic/data-protection/refo...

Please be more specific in your refutation. In following the link you've provided I see nothing to support your assertions, and it appears to support jacquesm.

He’s all over this thread with this garbage

I think the GDPR is well intentioned and has provoked some important and useful conversations about how we make use of users’ data.

But reading stuff like this makes me that much more inclined to use that Cloudflare option of IP blocking the whole continent. This feels like a very slippery and dangerous can of worms that’s not worth opening.

There's already a tonne of laws every company has to comply with. The GDPR isn't any more onerous than any of those, it's just new. Even the "nightmare letter" doesn't have anything unreasonable in it and the only reason why it might be difficult for a company to comply with would be that their internal systems and processes were already horrifying - something which we have now collectively deemed that permitting is causing more harm than good.

What other laws do I have to comply with right now that are so vaguely defined and carry such horrifyingly punitive fees? I guess we'll have to wait and see how it's actually enforced but no other legal obligations I've had to consider so far when building products feel this threatening to smaller online businesses.

It's bad enough we have to deal with patent trolls. I'm not inclined to add this to my risk profile.

Other laws you had to comply with where the ones the GDPR is replacing. Several EU country had very similar law. Idon't know about the fines about such laws though, since they were not enforced.

Enforcement is what's going to matter, I'm pretty sure you could dig up other laws that are vague and have high fines, that are just not enforced and thus don't seem as threatening as the widely publicized GDPR.

Of course, I'm not a lawyer, and I may very well be wrong on my assumptions.

On the other hand, patent trolls are not part of the risk profile for our industry in the EU, since software is not patentable there.

But anyway, it makes perfect business sense for a US startup to just block the EU (or at least state somewhere that they are not complying and thus EU users shouldn't sign up) and focus on their home market until they are big enough to comply with the terms (or are willing to take the risk).

The DMCA?

If you don't use copyrighted works then DMCA is going to be a much easier problem to deal with. We have plenty of precedents to look at to assess how the DMCA works as well.

> We have plenty of precedents

Did these precedents take place before or after the DMCA was enacted?

> What other laws (...)

You can't sell guns and drugs online.

If you're taking money, you have to make sure you know your customer (KYC).

I would also like to hear other examples.

I feel like I have a pretty clear idea of the rules in the cases you describe. For GDPR I have no such confidence.

It seems like the smart thing for US startups to do right now is ignore EU customers until they’ve validated the business idea enough to justify the engineering and legal expenses of taking this on.

The alternative is to not collect personal information from your customers.

> The alternative is to not collect personal information from your customers

If that worked I'd embrace GDPR. Problem with "any consumer can make a complaint which requires expensive follow-up" regimes is one doesn't have to do anything wrong to incur costs. Someone can mis-interpret something and make a complaint. Now you have to interface with a regulator, which tends to be risky, expensive and time consuming.

> I feel like I have a pretty clear idea of the rules in the cases you describe. For GDPR I have no such confidence.

I seems reasonable, but I would argue it's due to the law being new, not to some intrinsic property of it, no?

> You can't sell guns and drugs online.

Don't care about that sphere of activity, never going to do any of theses.

> If you're taking money, you have to make sure you know your customer (KYC).

Can you be more precise? What are the laws about that and should'nt it be Paypal job to support that? Never wanted to compete with Paypal either..

Data is literally everywhere... that means GDPR apply to almost everything. Which is why you may see some people complains about being able to sell guns online but you will see much more people complains about GDPR.

> Don't care about that sphere of activity, never going to do any of theses.

> Can you be more precise? What are the laws about that and should'nt it be Paypal job to support that? Never wanted to compete with Paypal either..

So what you're saying is you couldn't care less unless it affects you. Got it.

This is part of my point though. You're a perfect example of what I'm talking about. Who the hell doesn't know about KYC? You just woke up to the world and realized "oh shit, regulations exist! Unacceptable!". Yes, regulations exist, and this is just another one.

> Data is literally everywhere... that means GDPR apply to almost everything.

This isn't about data, it's about PII. And PII isn't everywhere, unless you're collecting it.

> Which is why you may see some people complains about being able to sell guns online but you will see much more people complains about GDPR.

No, that's not why. The reason why is that one has been around for a long time and people got used to it.

> The GDPR isn't any more onerous than any of those, it's just new

It’s different. “Complain and investigate” regulatory regimes are expensive to comply with. That is irrespective of whether one is doing anything wrong.

These regimes aren’t inherently faulty. They’re quite good in the American securities business. But they create a palpable incumbency bias, as well as one towards those who can afford lawyers and make a useful phone call.

Such a regime would have been ideal if constrained to large companies. Rolling it out for everyone means anyone mis-interpreting something could trigger a regulatory investigation. Even if found innocent at the end, that process is harrowing, expensive and distracting.

Every jurisdiction has its costs and benefits. Europe is still a huge market. But if one doesn’t see enough revenues to justify a dedicated compliance person, it’s a market which may now make sense to delay going into.

How about we just try it? Are you from the EU? File a complaint against my website and I’ll ignore it.

>Even the "nightmare letter" doesn't have anything unreasonable in it and the only reason why it might be difficult

How about another reason: it simply increases administrative costs. If you have enough users firing these letters off then you could end up spending a significant amount of time simply responding to these letters. Something has to pay for all of that, and it's not like this cost is going to go away at some point, so the entire business model has to be set up in a way where it can just eat this cost.

The problem is that there is a lower floor of a $20m fine. Big corps can risk a 4% hit, but for anyone struggling to get a small startup off the ground the fine is too onerous.

As far as I'm concerned the process should be like this:

1. EU issues warning and cuts off traffic to the domain after 30 days.

2. Startup fixes GDPR compliance.

3. EU unblocks startup.

Only after the company breaks GDPR after getting unblocked should they be hit with this massive fine. For those of us that don't give a shit about Europe it's so frustrating having to worry about how we have to comply.

And before someone says something about "it's only for companies targeting the EU" that isn't as clear as people make it out to be. An errant ad, or a single conference talk, or even engagement on social media can be construed into requiring GDPR compliance.

But of course the reason the EU didn't want to block corporations flouting the GDPR technically is because they saw the arms race happening in China and decided that they didn't want a second firewall. So instead they went the lazy route and they pushed the whole mess on small startups that aren't the problem in the first place. Large corporations are the problem. The fundamental design of the internet and web is the problem.

> The problem is that there is a lower floor of a $20m fine

I don‘t believe that you truly believe that, after it has been refuted a dozen times in every single GDPR discussion.

There is no lower floor. There is not even an obligation to hand out fines.

There is nothing stopping them from doing so though. Maybe they're having a bad day or simply don't like you very much. Some of the data protection authorities have like one to two dozen people working at it total.

There is a lot stopping them, namely the law itself and the courts.

But that is irrelevant in this thread.

There is no lower floor. That was a lie!

The authorities can easily fine someone a thousand Euros or a million Euros.

Oh the law. Good one.

The same law that fined me $1,800 because a posted notice fell off my door in a blizzard? The same law that allowed the judge to uphold the fine by saying "I don't believe you". Bureaucracy sucks, and the second it gets its tentacles on you, no amount of cheek clenching is gonna delay the inevitable.

You mention the law here. Where in the law does it indicate that the DPA can't assign the maximum fine on the first offense even if it is trivial?

It's not a 20m / 4% floor, the fines will be discretionary and most importantly are likely to be incremental. EU regulatory authorities do not usually operate in a "shut your service off for non-compliance" mode: assuming they receive a tip-off about your business not being compliant with GDPR 1) they send you a notice and ask for proof of compliance. If you produce evidence, the case is likely closed. 2) assuming you can't produce that evidence, they will give you a warning and a deadline by which to become compliant. A small fine may be levied at this time 3) if the deadline passes without you having done anything, they will eventually get round to giving you a new date, issue a sterner warning and increase the fine for non compliance. To get a $20m fine you'd have to be a massive corporation and be caught repeatedly flaunting the regulation in an outrageous and damaging way (for the consumer); any idea of closing off your small service / website / whatever to EU users because of the perceived risk of a fine is a massive overreaction.

The max fine is 4% with a $20m floor.

People play games with language and try to pretend that just because judges have discretion that this isn't somehow ridiculous.

It is not mandatory that the EU issue a warning. What the EU should have done if they didn't want small startup owners to freak out is they should have made the process clearer and if the $20m level is only aimed at massive corporations then why make it $20m at all? Why not just make it 10% of revenue? I'm not from the EU, I have no idea how the EU court system works. They did not make this easy for small startups.

Let's read the actual document then shall we? It's written in plain enough language for anyone to understand: http://ec.europa.eu/newsroom/just/document.cfm?doc_id=47889 20m is one of the two ceilings (the other being 10m) for fines, and in several paragraphs in the document I linked the principles of discretionality, effectiveness and proportionality are stated. If a regulator tried to levy a $20m fine against a startup for a first offence, there would be a strong case to appeal the ruling at an EU court

> But reading stuff like this makes me that much more inclined to use that Cloudflare option of IP blocking the whole continent.

Excellent. Then maybe some competitors will arise with products that are built with privacy in mind from the ground up.

This fake new competitors are called unemployment, low innovation, and low growth. Bureaucracy never created jobs.

I'd love to hear by what mechanism you think eliminating foreign competition will cause unemployment, low innovation, and low growth in European countries.

Unfortunately those competitors will crash and burn when their users get pissed off at the opening dialog.

You think that an opening dialog will annoy users more than having a service entirely blocked in their country?

So the rest of the world should get annoyed with the opening dialog, so that the EU doesn't have to get blocked? Sounds like this could be solved by a proper solution, which the GDPR is not.

> So the rest of the world should get annoyed with the opening dialog, so that the EU doesn't have to get blocked?

Nope. Surely you can think of a technical solution to this problem.

Maybe a competitor can do their business according to the GDPR then?

it is the opposite.

established companies have no issues with fees, or legal requests.

gdpr is to protect the established companies from competition.

it is basically a reverse china ban. because china-style banning of competition is still considered bad in the eu.

I imagine you could apply this same logic is applied to taxes, employee rights, not discriminating while hiring or firing, and hundreds of other similar laws under which your company must operate? What makes the GDPR so much worse?

Yes, it is. It’s the reason why low regulation locations do much better than heavy regulation ones.

to follow up: https://www.wsj.com/articles/eus-strict-new-privacy-law-is-s...

"GDPR, the European Union’s new privacy law, is drawing advertising money toward Google’s online-ad services and away from competitors that are straining to show they’re complying with the sweeping regulation."

So you consider it a big burden to a startup, to do business according to the GDPR? I'm no expert on the matter.

Yes. Besides for the administration costs incurred (which is probably the real killer), the list of death points are:

1. Adding a dialog as the first step in an onboarding funnel that's already difficult to get users through

2. Handling non-consent. WTF! So if the user doesn't give consent to something that 99% of the population doesn't understand, I'm not allowed to prevent them from using the app. And so my engineering team needs to waste critical hours figuring out things like how to deal with crashes, or maybe how in the fuck we're supposed to fallback to not using services that we're built on (e.g. Firebase)!

3. Dealing with the fallout of #1 in the form of bad reviews that are the kiss of death to startups

Handling non-consent. WTF! So if the user doesn't give consent to something that 99% of the population doesn't understand, I'm not allowed to prevent them from using the app.

This is like a living, breathing example of why GDPR had to be written the way it was, so that arrogant techbros couldn’t rationalize their way around to screwing everyone over for a quick dollar. It’s also a perfect example of why you get zero sympathy. “But maaaa, it’s hurting my funnel!” Good.

Did you read any further? If I can't prevent them from using the app, then I have to solve an impossible problem. Namely providing a fallback for core services that the app is built on.

imagine a random person with a game since 10 years, perhaps not maintained anymore, suddenly need to comply with eu regulation, which is aimed at something completely different (data harvesters).

this is likely a big and unnecessary burden to most startups.

i believe in less regulation in general so my opinion could be biased.

That argument could just as well be reversed: New startups can build their business from the ground up in such a way that it conforms with GDPR to give them a competitive edge.

While bigger businesses, with very established monetization models that don't comply with GDPR, are now in a pretty unfavorable place and have to scramble looking for alternative monetization models, forcing much bigger changes.

this is totally illogical and false with a basic understanding of economics. by definition the new startup is DOA without capital for compliance/proof of compliance/mandated features whereas the bigger business has capital.

Note, I think, you also need to be GDPR compliant for EU users when they are not in the EU. So I don't think IP blocking actually works for 100% of cases.

I would suggest not getting too hung up on this, it is showing you the worst outcome and assuming you have made a good effort to be compliant I should think things would be fine even then. No doubt you have Ts and Cs, that document is full of clauses put in place because of things like this, and any of them could probably result in a worse letter from a customer wanting to sue you over something. But I image also that hasn't happened to you yet either?

> I think, you also need to be GDPR compliant for EU users when they are not in the EU.

What you think does not align with my understanding of the GDPR, what makes you say this?

Fair enough, I did read this somewhere but it is obviously wrong now I check it out. Thanks!

> Note, I think, you also need to be GDPR compliant for EU users when they are not in the EU.

No, location is what matters. Of course one could argue if IP is a reliable indicator of location, given VPNs, potentially faulty GeoIP databases, ...

Geoblocking EU users makes it fairly clear you don't intend to serve[0] them, at least in my opinion. If the only reason you could be in scope is offering your service in the Union, and you do your best to avoid that, you should probably be out of scope.

We'll see what the regulators think.

[0] From Recital 23: "[When deciding whether processing is in scope under Article 3(2)], it should be ascertained whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member States in the Union."

I'd agree with that. Someone somewhere is probably going to complain about an instance where it failed, but I honestly would be surprised if regulators made a big deal out of it.

What worries me most is how little is being said about private-operated sites. I am little Joe running internet forum about space battles with maybe 5 active users right now and no more than 100 active members historically. Should I sign data processing agreement with Google because I am using Gmail to send E-mails? Should I hire DPO? Am I risking my house being taken from me to cover multimilion fine because user posted their photo or e-mail 5 years ago and I’ve missed it because I don’t delete user-posted content together with their account?

> What worries me most is how little is being said about private-operated sites.

If you want I can research the matter in more detail, someone else came up with federated sites like Mastodon nodes and that's another pretty gray area.

> I am little Joe running internet forum about space battles with maybe 5 active users right now and no more than 100 active members historically.

Ok.

> Should I sign data processing agreement with Google because I am using Gmail to send E-mails?

No. You could try to stretch the law to include that particular example but from my reading of it this is perfectly acceptable.

> Should I hire DPO?

No, but you are the de-facto DPO, so if you receive a DSAR then you probably should answer it, though with your user counts I think the chances of that are very small.

> Am I risking my house being taken from me to cover multimilion fine because user posted their photo or e-mail 5 years ago and I’ve missed it because I don’t delete user-posted content together with their account?

No.

But if a regulator should tell you that you should remove a users data (because you refused to for some reason or other) you probably should. The EU does not 'fine first and ask questions later', they will investigate first, warn and then when ignored they will fine. And for a small entity like yours which is more of a hobby than anything else I highly doubt regulators would even bother but you can't rule it out completely. Better increase you comet insurance as well if that's your main worry :)

Thanks for answers!

> You could try to stretch the law to include that particular example but from my reading of it this is perfectly acceptable.

But I should still note about the fact in my privacy policy, shouldn't I?

Couple other things I've noted when working on GDPR compliance for my forum:

- It may be good idea to write in your forum rules that you don't allow users to embed their data outside of forum profile. - Forums accumulate tons of lurker accounts (users that register account but don't post or browse anything) that could be automatically deleted - Forums like to log IP's used by users when they, say, post messages. Those could be overwritten to 0.0.0.0 for items older than X days.

I've also been working on privacy policy template for people in my position that I have on GitHub and would love to have any feedback:

https://github.com/rafalp/misago-privacy-policy-examples/blo...

>No, but you are the de-facto DPO, so if you receive a DSAR then you probably should answer it, though with your user counts I think the chances of that are very small.

I think that we might have this view about it right now, but I could easily see a scenario, where somebody targets you for "harassment" through something like this. Maybe you say something somebody else doesn't like on Twitter and they do that to you.

> No, but you are the de-facto DPO

The GDPR requires that the DPO must be independent from the organisation, so you can't be 'your own DPO'.

On the other hand the DPO is only required when sensitive or large quantities of data are concerned.

I have to confess, it's a guilty pleasure of mine to respond with a variant of the Nightmare GDPR letter to SOME companies who sent me the classic "we're sure that you want to access all the amazing benefits of our data processing so if you REALLY want to opt-out you'll need to click on this link and manually remove consent from a couple hundred 3rd party providers" email. I'd never do that to any company (big or small) with whom I have legitimately interacted, but a lot of this drivel has come from random recruitment companies that must have scraped my details from my CV or Linkedin or wherever.

If you're not legitimately concerned then you are actually devaluing the GDPR by abusing it. If you have a legitimate concern with a particular company I'd send them a custom letter rather than a form letter and I'd try to work with them in order to achieve the desired effect (for instance: for them to delete my data once and for all) rather than to get a bunch of information that I have no further use for.

Anywhere that has made my acceptance an "opt in" I have then sent a polite email asking for my details to be removed. I'm happy to continue to use any services that follow GDPR and use them with the minimum of fuss; but anywhere that feels like they're trying to worm their way around the law feels like the kind of organisation the GDPR is designed to protect us against.

Thankfully the responses I've had thus far have been equally amicable.

Any company I didn't give my data to directly and have never heard of is a concern. Many companies sending out GDPR emails need to learn that processing data is a liability they should avoid if possible.

We may wish for spherical users in a vacuum, but there are a lot of people out there looking to fuck their enemies over and who care little about the collateral damage to the commons.

Don't worry. The GDPR does a bang up job of devaluing itself.

Alright, let me rephrase: I am interested in such companies that somehow have my details on record despite me never contacting them, and who show no understanding of the principles of GDPR; in particular I want to know what they hold about me and what the source of their data is, which is why I send the letter (which I have modified to remove the stuff I am not concerned about). Some of them have since replied with "we've gone ahead and deleted all your data", which could be interpreted in many ways I guess

It seems like a lot of the comments are about one issue:

- do you believe generally, even for an “upstanding” company you’ve done business with for a while, that commercial entities can be trusted with your data?

If yes, you’ll see the template as overbearing and needlessly aggressive outside the context of some specific incident when a company proved to be untrustworthy. Especially if you operate a side project or business of your own, and believe you personally would not abuse consumer data collection, you’ll see it as rude in the best case, trollish resource wasting in the worst case.

If you’re a consumer with a general mistrust of all commercial entities, even “upstanding” ones, when it comes to data practices, or if you just happen to believe that the potential risks for data abuse or harm are too high to be offset by anyone’s good intentions or past good behavior, then you’ll see this as a reasonable template, perhaps needing a few modifications for differing contexts, and that jumping straight away to legalese boilerplate just has to be assumed necessary when dealing with self-interested commercial entities.

Sending boilerplate almost guarantees that a regulator will put your request at the bottom of the pile if you decide to take it to the next level unless the company responds in a way that shows their contempt for the law.

I think that will depend on how seriously GDPR non-compliance is treated.

I’m hopeful some big corps will be heavily fined to set precedent and to ease concerns that GDPR is a mild form of regulatory capture intended to be misused (regardless of its wording) to asymmetrically inhibit new entrants and small firms.

What? That doesn't make any sense. The regulator would only care that you sent a valid request.

I just want to note how non-obvious compliance with GDPR is. Two experts on GDPR and privacy in this thread (Jacquesm and Ainiriand) have been disagreeing throughout the thread on just the basis of whether one should reply to GDPR complaints like this. Imagine how much up for interpretation the more gritty parts of the law will be.

And Jacquesm is saying don't be alarmed in some comments while in other comments he admits there could be problems with people trolling with this letter. So I'm even more skeptical of allowing any EU users.

It's a very consistent position: no need to be alarmed, yes you will have to answer a letter like this, even if it is trolling. But if a letter like this alarms you then you probably have bigger problems.

I think it would be best if people like you would just go ahead and block all EU users. There's so much "well I might just block them then!" going around these days, when you should just do it if you think it's the best approach.

There are no experts on the law, even lawyers arent. The only one who can authoritatively produce interpretations of the law is the european Court of Justice. For that to happen a country's Supreme court must refer a case to them for consultation which is then binding throughout the EU. In the meanwhile, 28 different privacy regulatots can independently try to interpret it. Most of the regulators are not staffed yet and not up to the task.

At the monent the law is unenforceable

I've said it many times, GDPR is such a waste of time and resources for startups unless your market is really EU.

GDPR is super expensive to remain compliant, simply because of the broadness of the terms used, leading to undefined scope of liability.

The cheapest way to stay compliant with GDPR is to completely block access to EU customers. In fact, this is what I did with my business. I redirect to a generic text file (not even a HTML that could trigger a GDPR clause by itself) explaining my stance.

What? How does HTML trigger a GDPR while text file does not?

"Sorry, this site is for non-EU users only" something to that effect. A HTML can execute scripts (ie., collect data) while a text file does not, atleast that's my understanding.

It would probably be a problem if Google or MS did this, because lots of other companies and institutions (foolishly) depend on them instead of using OSS. I would be disappointed if Apple did it, but I have the feeling this law is an advantage for them. :)

The rest of the companies threatening to block the EU are seriously overestimating their importance.

My approach for my startup is that if anyone sends me a Subject Access Letter that I thank them for being a customer, cancel their account, and delete their data. I note this in the terms of service up front to be transparent and totally comply with GDPR.

Sadly, I think this is the lowest cost approach to dealing with the law, and removes the ability of an insane customer from causing us millions in liability.

I did some quick searching, and my gut feeling would appear to be correct: It is not legal to delete user data in order to avoid fulfilling a subject access request. It is okay if data has been routinely modified or deleted, but it must not be a result of the access request.

Quoting the Information Commisioner's Office:

    Q: We have received a request but need to amend the data before sending out the
       response. Should we send out the “old” version?
    
    A: It is our view that a subject access request relates to the data held at the
       time the request was received. However, in many cases, routine use of the
       data may result in it being amended or even deleted while you are dealing with
       the request. So it would be reasonable for you to supply information you hold
       when you send out a response, even if this is different to that held when you
       received the request.

       However, it is not acceptable to amend or delete the data if you would not
       otherwise have done so. Under the DP Bill, it is an offence to make any
       amendment with the intention of preventing its disclosure.

I think you should ask a lawyer about this approach.

I would very much consider this to be non-compliant, as this is a form of transparency evasion. If it isn't directly addressed, it might be covered by whether the data handed out should be the data available at the time of the request, in which case it would be prior to you having a chance to delete it.

I was having trouble visiting the article so I used a web archive link, in case it’s useful to anyone else https://web.archive.org/web/20180529120012/https://jacquesma...

I like how the article starts with "the nightmare letter is clearly a troll attempt we need to deal with"

and closes with "actually, those are are all valid and reasonable questions that you should have answers to if you were not breaking the law in the last five years. Answering them automatically should be easy

If you, no matter what company size, are not dependent on illegally and immorally profiting from personal data, then GDPR may even be good for you."

hehehehehehehe

The letter is clearly a troll attempt because it is engineered to inflict maximum damage even if the claimant has no use for a lot of the information they are requesting.

Even so, in isolation and moderation the questions make good sense and answering them properly using an automated system and an updated privacy policy should not be a huge burden.

The law was engineered to inflict maximum damage.

Look, we all know that you think the GDPR is a great idea, but a law which can't be used to its full extent is IMHO not a great law. I agree with the goals of the GDPR: they're laudable. But its details & its implementation are, quite simply, wrong.

You don't install a self-destruct mechanism which can be triggered by just pushing a single un-guarded button. Likewise, you don't pass a law which can inflict grave economic harm just by sending a letter.

> even if the claimant has no use for a lot of the information they are requesting.

It's not about wether the information is useful or not, it's about seeing what a company has.

If I get some unsolicited comms from a company then I'm going to want to get information about all the data they hold on me, preferably including where they got it from and where they sent it to.

I don't agree that this is trolling, even if it is a fishing expedition. The primary purpose appears to be to probe for GDPR compliance, which is a valid expectation of customers and prospective customers (Europeans at least).

If you're allowed to use the smartest engineers and the cleverest algorithms to process as much data about me as possible to create perfect ads, and if that's not trolling... then neither is it trolling to ask what you've been up to.

I saw this letter quite a while ago (maybe a month ago) in the context of "When you are preparing for GDPR, you should be able to answer these questions". In other words, it was a self test to help you determine whether or not you were fooling yourself about being ready for GDPR. If people are actually using them as data requests, it's very unfortunate.

I've been involved in the GDPR-proofing of the company that employs me in the UK, and find that the questions are the same that our consultants put to us when identifying where we stood. Based on my experience (medium sized manufacturing company) I think that the letter really becomes a nightmare when the company receiving it has not looked into it at all, or when their business model relies on being able to ignore consent from users for their processing; in other cases, and especially for any company that sells to businesses rather than individuals, GDPR compliance is really not that bad IMO.

I've described how I'm preparing for GDPR as a solo developer running commercial side projects without a legal team to back me up: https://pawelurbanek.com/gdpr-compliance-blog-rails

What's the worst that can happen if you reply to this letter with incomplete information?

I imagine the client will then send you another letter, to which you reply that you've already sent the information. And so on.

In the end, the client may sue you. But in that situation, you make the effort of deleting the information you said you didn't have, and you win the case.

The client will report you to their local regulator who will then prod you for more.

The claimant could report you to the authorities but a partial answer is better than no answer and you could always accompany the partial answer by an estimate when you think you will have the remainder of the information requested.

I'd say it would boil down to the client providing evidence the company had such and such information at the time of the request.

Had the company had the information at a time in the past doesn't mean they would do now.

Is there amy regulation about how the data has to be formatted? Say I send a json string like "this is LITERALLY the data we use", but the avergae Joe is left irritated and annoyed, am I in trouble?

From the ICO: (the UK regulator)

How should we provide the data to individuals?

If an individual makes a request electronically, you should provide the information in a commonly used electronic format, unless the individual requests otherwise.

The GDPR includes a best practice recommendation that, where possible, organisations should be able to provide remote access to a secure self-service system which would provide the individual with direct access to his or her information (Recital 63). This will not be appropriate for all organisations, but there are some sectors where this may work well.

However, providing remote access should not adversely affect the rights and freedoms of others – including trade secrets or intellectual property.

Ref: https://ico.org.uk/for-organisations/guide-to-the-general-da...

JSON or XML would be an excellent way to answer, alternatively you could format it for easier human consumption.

Going out of your way to make the response useless is probably not a good idea.

You should probably also encrypt the data.

This makes me wonder: what if you encrypt using a proprietary tool, and sell a decryption tool through another company? You could actually make money from GDPR requests.

The vagueness of the meaning of "processing" PII is one of my handful of problems with GDPR. Is the mere act of having a unique index on an email address column a form of processing? I'd argue it is. It's can be construed really far.

Processing is defined in Article 4(2):

> 2. ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction

https://gdpr-info.eu/art-4-gdpr/

- BUT -

Article 2(1) limits the whole GDPR to personal data "processed" in the context of a filing system, whether electronic or physical.

In other words (in my non-lawyer reading): If I have your business card in my pocket, or I leave it on the table, or throw it away, I'm not "processing" your data in a covered way—even though I have it. If I put it in my stack of business cards or add you to my CRM, I am.

https://gdpr-info.eu/art-2-gdpr/

> retrieval, consultation, use

These three words can mean everything and nothing. It will take years to see how each of the EU's twenty-eight members' regulators take to interpreting them.

> organisation, structuring

So having a database index would almost certainly be covered.

I'd almost go as far as to say having the email address itself is processing. You validated the address right? Maybe sent it a confirm-you-exist email

Apparently there is some BGP related issue, if you can't reach the site directly here is a google cache link:

https://webcache.googleusercontent.com/search?q=cache:QSStS_...

I'm beginning to highly doubt that anyone defending the GDPR has ever had any responsibilities that included:

1. Running a tech company

2. Funnels, conversions, and retentions

3. Writing software

Either that or they just want to watch the world burn.

I have a general question about this. If you have a privacy policy which discusses (amongst other things) the answers to these questions, would it be sufficient to just reply directing the customer to that privacy policy? i.e. let him dig out the answers he "needs" from there.

In part this form letter seems to assume that all the burden is on the company, whereas if the company has already answered these questions in a public medium you could (1) take that as a signal that the claimant is a troll (otherwise they would have read your privacy policy) and (2) that they probably don't care about the answer, they're just looking for a reason to stir the pot, so any deficient answer will be used to contact the regulator.

The best way to deal with that is to answer the request in detail (which makes it very unlikely that a regulator would follow up if there was a complaint) and to refer to public resources such as your privacy policy because that's something that indicates that the claimant didn't do their homework, which is something a regulator will use to weigh whether or not to follow up on the complaint.

> The best way to deal with that is to answer the request in detail

I keep hearing this but I think in reality the volume of troll requests will dictate whether that is practical or not for any given company. Small startups might have problems if that volume is not proportionately small.

Yes, that would be sufficient (if you also have a tool that lets the customer download and/or delete his own data).

Can someone tell me is it legal (or even viable) to just automatically completely remove all the information on the person sending those letters? Certainly beats banning whole EU by IP.

Please folks, GDPR investigations are only undertaken by the EU. No single actor can try to 'sue' you for infringment. The maximum they can do is to complain to the GDPR office in your country. And then, maybe, the office is gonna undertake an investigation. This whole is process can be a matter of years. Don't be afraid, if you receive one of those letters just ignore it.

> Don't be afraid, if you receive one of those letters just ignore it.

You probably should not be making such blanket statements. Keep in mind that the companies that receive such requests may have substantial assets in the EU (or may even be based entirely in the EU).

This is akin to telling people to break copyright law because the courts are too busy to go after everybody and it could take years before it is your turn.

Take a look at my comment above.

Disclaimer: We are a GDPR model company in Ireland. This means that we are implementing the mechanisms that the country is going to take as default for every other company. We had EU folks over here for months.

You know the concept of FUD. We saw it many times before.

Please take a look at the full enforcement process:

https://ec.europa.eu/commission/sites/beta-political/files/d...

You don't have to take my word for it, this is not legal counsel, it is just reading the law before jumping to extreme conclusions.

> The maximum they can do is to complain to the GDPR office in your country. And then, maybe, the office is gonna undertake an investigation. This whole is process can be a matter of years.

Years of regulatory investigation sounds expensive. Furthermore, willfully ignoring regulators is a good way to piss them off. The only winning strategies here are (a) lawyer and lobbyist up and (b) block users in countries where you don't have (a).

Take a small look a the overall process here:

https://ec.europa.eu/commission/sites/beta-political/files/d...

First you should receive an enquiry about yor DPA asking for the information they need and your processes, if they deem it necessary they will do an in-depth investigation. After that, they can reach a conclusion. Then if you are still not GDPR complaint, you will be fined.

If your failure to comply with the GDPR has cost someone damages, they can recover those damages in civil court by suing you, though.

But, unlike the US, in most (all?) of the EU, the most you can sue for damages is the total damages incurred (plus court expenses).

Fines are not always incurred for GDPR infringements. Sometimes you can be asked to delete the data, to block dealing with EU customers, etc...

What's "damages"? Does "emotional distress" count?

I think that the primary target for GDPR investigations is going to be the big actors like Facebook, Google and Advertising networks who's single business model is profiting from user data.

Big online marketing companies are looking at a variety of technologies to turn their user's into buying customers of their advertising customers both online and in-store.

Look at Facebook as an example with their dreadful user interface attempt to trick EU customers into opting-in to facial recognition technology.

https://venturebeat.com/2018/04/18/facebook-engages-in-priva...

But there's a good reason for this. The ability for stores to know who their customer is, what they buy and re-market to them is powerful, and incredibly creepy.

https://www.pymnts.com/facebook/2017/facebook-patent-facial-...

http://www.thedrum.com/news/2017/12/01/facebook-reportedly-d...

I now turn my phone into flight mode before I enter a high street store.

https://www.kaspersky.com/blog/offline-tracking-ads/16510/

GDPR is a good reminder to all companies that the individual user owns their data, not the company. I personally like this shift, which will over time make companies think about the business models they implement, encouraging us to have customers rather than users.

Won't this DoS the regulators as well as the companies? Carpet-bombing everyone with DSARs is not just annoying but self-defeating. Even though the basic ideas behind GDPR seem pretty reasonable to me, the implementation so far is almost enough to make me join the "regulation is evil" crowd.

Yes it will, which is why if you are serious sending a form letter is a bad decisions.

I'm waiting for the first time a GDPR DSAR deletion/retrieval portal is breached. Mass exfiltration or mass deletion are both great attack vectors.

That's a legitimate concern.

So the lawyer provided a letter which demonstrates what would happen in the worst case due to the GDPR. How does that make him dumb?

The author of the nightmare letter didn't even claim that his nightmare letter was aimed at data subjects (AKA users), but specifically to companies that are trying to be compliant. Like, "if you can answer this letter, you're compliant".

The author of this piece just twisted the meaning of the letter completely.

That's not how it was spread around.

The blog post is a response to this Ask HN:

https://news.ycombinator.com/item?id=17161718

Because people then use that letter to increase the burden on companies 'just for kicks', it creates an asymmetry that the law did not intend. It forces attention away from the positive effects of the law and gives companies reasons to say 'see, this is what you get'. It's irresponsible.

I know I’ve posted this before but the law does not intend anything. The law is written, and then stuff happens. People intend and make broad laws that then more precisely get to intent after legal battles / precedent.

This is allowed under the law! If you don’t like it, change the law!

The reason people have been complaining about GDPR this whole time is exactly this. Things take on a whole new meaning when complied with at scale when all you need to send is an email. This seems worse than FOIA (the US Freedom of Information Act) and Europe placed it on their entire private sector.

EDIT: clarity.

The same happens unfortunately with FOI requests. I've seen a case of someone explicitly stating they're sending FOI requests to a municipality just to spite them, which led to that municipality having to hire four (!) people to process them and find the documents. This in turn led to a restriction of that law, which is a real shame.

There are plenty of well intentioned laws which actually suck (such as the Cookie law). Surely you agree that it's important to point these out?

This kind of thing is inevitable though. Within a month there will be online services that auto send an even more annoying version of this letter to every company on your contact list.

Am I right that the only risk for a small, side project for non-compliance are the EU legal sanctions should they grow to a significant enough size as to open an EU office? Other than they, why shouldn't a US side project ignore the DSARs?

How do I know someone didn’t just steal someone’s username and password? I assume I should be asking for personally identifying information such as a password or ID? There is some irony here.

The lawyer who published the nightmare letter is not dumb at all, just ambitious and selfish. They're making a name for themselves and do not care about massive externalities.

Jacques, thanks a million for your work on this topic. It makes me feel much more confident about being able to efficiently handle such a nightmare letter if it one day comes.

The only response this would get is 'you have been confirmed in our systems and your right to be forgotten has been processed. Thank you.'

If only non-Europeans could do these requests. There are a few companies I'd love to know what they are doing with my data.

When you’re doing shitty work to comply with this shitty law, perhaps you can find some comfort in the fact that people have suffered more from stupid government policies, and that misbehavior of foreign governments is a persistent risk of international business. This is one place where the EU is vexingly successful — if it was just, say, France doing this, most companies under $1 billion would have no trouble just giving France the finger and blocking their users.

Here's an idea: how about charging more for European users to access your site. If it is a cost issue, how about reflect that cost in the price of your service. So, if your web app is free for North American users, put it behind a paywall for Europeans. It's not ideal, but maybe if enough sites/services did that, it would help reflect the reality of the situation. Consider it a European service tax.

“GDPR is great and will cost nobody anything”

Step 1: be an American company with no European offices or accounts.

Step 2: Ignore letters about GDPR.

Alternatively, set up a form response to autosend whenever you get an email with some of those keywords.

So anyone outside of US should ignore DMCA I believe? Just an example.

So you wouldn't have an issue implementing Chinese regulations?

Considering the DMCA is harmful and should never have passed?

There's an ethical and moral aspect here you're ignoring.

Are you suggesting that countries outside of the US care about US copyright law? The Russian video streaming site I use sure doesn't.

What about the pharma companies in India that copy American drugs (to the great benefit of humans worldwide)? US law does not rule in other sovereign nations.

I feel like I'm missing something - the site/article/page hasn't loaded for me for the last 40 minutes or so, and yet people are upvoting it.

Am I missing something? Is it just me? "Is It Up"[0] says it's up ...

Maybe I'll try via a different IP address.

Edit: The number of upvotes (twelve and counting) shows it's not just me. I've now changed my IP address and it loaded almost instantly.

Jacques - FWIW the IP address that's not working is 92.18.56.74 - it's been failing to load your site for at least the past hour, I have no data from before that.

[0] https://isitup.org/jacquesmattheij.com

Got the same here, Netherlands.

https://webcache.googleusercontent.com/search?q=cache:QSStS_...

Strange how spotty the problem is. Anyway, I'm sure the guys at my hosting provider are on top of this.

Use a proxy, for example:

https://us.hideproxy.me/go.php?u=xRv6FweyJ5wXueEdkahRiAzzGVM...

If he intends it to be working and accessible, and if he doesn't know that it's not working, then simply using a proxy is good for me, but bad for him.

I like to provide value to people who write articles worth reading. Jacques is definitely one of them.

Doesn't load in Canada either, at least for me.

Not just you. VPN to Romania worked for me. It was worth the effort I think.

Doesn't load for me either from several different IPs in France. Downloaded the HTML from a server in the US. Really weird.

I've mirrored it here in case it may help: http://blogs.intellique.com/so-your-start-up-receive-the-nig...

It loaded up just fine for me.

My comment has two upvotes (now five) almost immediately, so I'd guess I'm not the only one.

It is not just you. I had to access it from a proxy. I assume that means he is blocking certain parts of the US, if not the US in its entirety.

> I assume that means he is blocking certain parts of the US, if not the US in its entirety.

On what basis do you make that assumption?

It is still the internet, routing issues can and do occur. There is absolutely nothing in the configuration of my server(s) that would block anybody from any nation.

I'll alert my hosting provider to make sure they know about it just in case it's a novel thing and their monitoring didn't pick it up yet but it could easily be further upstream.

Your site has been offline, at least for me, since Saturday.

Interesting. Ok. I have passed on the info, thank you for the heads up.

I experience the same, UK based.

I'm in the UK and had no problems accessing it (Sky)

Yes, but I'm in the UK.

I am too and can access it.

... and I can't.

Or couldn't. I changed IP address and can now.

Many/most people have dynamic IP addresses, and I wonder if Jacques' provider has aggressively blocked addresses that have been abused in the recent past.

There is a chance that they have some automatic DDOS protection mechanism kick in, I know they have some pretty aggressive counter measures in place to protect their links.

Anyway, the server is definitely 'open to all takers', nothing there that could cause this. Also, last Saturday ABN-AMRO (one of the bigger Dutch commercial banks) went offline for many hours due to a huge DDOS, this may be related but I never thought my lonely blog would be in the line of fire.

I've added the non-working IP address into the original reply in case that's of value.

Hey @dang, the article was updated to remove the typo in the heading. Maybe edit the HN title too?

Receive => Received

Updated. Thank you!

Thanks Scott!

Nobody expects the Spanish Inquisition

Website is blocked for pretty much everyone but the US? Just accessed from Nepal, blocked.....oh dear...

Edit: apparently not blocked, but still can't connect apart from via VPN.

No, there appear to be some connectivity issues of the non-obvious kind (apparently BGP related), the hosting provider is working on it and there are several work-arounds posted in this thread.

The fact that you have to respond to an information request letter under the GDPR makes the legislation tyrannical.

The idea that information about someone belongs to that person, no matter where it is stored, is a philosophically flawed perspective that if fully implemented, would lead to total global tyranny, by obligating people to do the work of disclosure and information deletion on demand, and ironically, by eradicating all privacy in relation to information people have about other people.

You have no moral right to dictate what I remember about you, to compel me to disclose what I know about you, to compel me to disclose what steps I took to disremember you, or to restrict who I may relay the information I remember about you to. The GDPR empowers you to do all of these to me in the context of a web service.

Reply on news.ycombinator.com