Hacker News Reader

Comment by ainiriand | Hacker News Reader

Please folks, GDPR investigations are only undertaken by the EU. No single actor can try to 'sue' you for infringment. The maximum they can do is to complain to the GDPR office in your country. And then, maybe, the office is gonna undertake an investigation. This whole is process can be a matter of years. Don't be afraid, if you receive one of those letters just ignore it.

View on HN

> Don't be afraid, if you receive one of those letters just ignore it.

You probably should not be making such blanket statements. Keep in mind that the companies that receive such requests may have substantial assets in the EU (or may even be based entirely in the EU).

This is akin to telling people to break copyright law because the courts are too busy to go after everybody and it could take years before it is your turn.

Take a look at my comment above.

Disclaimer: We are a GDPR model company in Ireland. This means that we are implementing the mechanisms that the country is going to take as default for every other company. We had EU folks over here for months.

> Take a look at my comment above.

I'm assuming everybody responding to you did just that so this is a null statement.

> Disclaimer: We are a GDPR model company in Ireland. This means that we are implementing the mechanisms that the country is going to take as default for every other company. We had EU folks over here for months.

So it's do as I say, not as I do.

You know the concept of FUD. We saw it many times before.

Please take a look at the full enforcement process:

https://ec.europa.eu/commission/sites/beta-political/files/d...

You don't have to take my word for it, this is not legal counsel, it is just reading the law before jumping to extreme conclusions.

I'll happily bet that I spent more time reading the GDPR than you did (such as: for the last year as a part of my day job) and you are spreading some pretty dangerous information in this thread up to and including telling people to ignore legitimate requests under the law.

If you give out that kind of advise and in such an unqualified manner you should not then follow up by saying that 'this is not legal counsel'.

A DSAR is a legitimate request under the law if you feel that this particular letter is not a legitimate request then you should address that with specifics.

Do you think that a request from a user to access backup data is legitimate? If so, please take another read at the user's rights: https://ico.org.uk/for-organisations/guide-to-the-general-da...

The user made no request to access backup data, I don't know where you got that but it was not in the letter.

The user requested to know if there were backups and if so how they are handled, which is a perfectly legitimate question, if only because quite a few breaches start with 'we've lost a backup and it wasn't encrypted'.

This could - but does not necessarily - fall under 'other supplementary information' but would require more context.

see:

https://ico.org.uk/for-organisations/guide-to-the-general-da...

Now, some of the requests in the letter are over the top but there is no harm in answering them. Not answering the whole letter is extremely dumb because you can't ignore a legitimate request because it asks for one thing that is not legitimate. Then you should just answer the remainder and lay out your reasons for not wanting to answer the questions you feel are not within the scope of such a request.

Well, for the full enforcement process: if your answer is not satisfactory, I will forward my letter (together with the notice of non-answer, or the notice of unsatisfactory answer) to my national data protection agency. Believe it or not, it's just an email. From there on, you have bureaucrats (who are paid for this & motivated to write fines) that will take up the legal process. The whole setup is similar to the consumer protection agency - and I hardly ever have to do anything after notifying that agency, I just receive a later with the resolution after a few months.

Fines are just the last resort. There are many mechanisms that the DPA office can take. Take a look at the user's rights here:

https://ec.europa.eu/info/law/law-topic/data-protection/refo...

As you can see, the letter clearly extralimitates the user's rights. So you can forward as many letters as you want but that's not gonna work.

Depends on what you mean but "not gonna work". I presume that all my questions will have satisfactory answers, either directly by the company or via the DPA. Either way, it's just an email for me. I'm pretty sure it's more than "just an email" for someone who does business in the EU but chooses to ignore my original request.

> The maximum they can do is to complain to the GDPR office in your country. And then, maybe, the office is gonna undertake an investigation. This whole is process can be a matter of years.

Years of regulatory investigation sounds expensive. Furthermore, willfully ignoring regulators is a good way to piss them off. The only winning strategies here are (a) lawyer and lobbyist up and (b) block users in countries where you don't have (a).

Take a small look a the overall process here:

https://ec.europa.eu/commission/sites/beta-political/files/d...

First you should receive an enquiry about yor DPA asking for the information they need and your processes, if they deem it necessary they will do an in-depth investigation. After that, they can reach a conclusion. Then if you are still not GDPR complaint, you will be fined.

Each of the EU's twenty-eight members will have their own interpretation of the process.

In any case, the fines aren't the problem. It's the cost and distraction of going through this process. That cost is imposed irrespective of whether one is doing everything correctly. Responding to DPA requests, investigations, et cetera is a reasonable burden for a company like Facebook. For many start-ups, it may make sense to partition and/or delay their European roll-outs.

But as the PDF says, fines are an exception. There are other machanisms to protect the users.

> In any case, the fines aren't the problem. It's the cost and distraction of going through this process.

>> fines are an exception. There are other machanisms to protect the users

Fines aren’t the problem. It’s the cost and distraction of going through this process. Those “other mechanisms” are still costly and distracting, even if you did nothing wrong.

If your failure to comply with the GDPR has cost someone damages, they can recover those damages in civil court by suing you, though.

But, unlike the US, in most (all?) of the EU, the most you can sue for damages is the total damages incurred (plus court expenses).

What's "damages"? Does "emotional distress" count?

Emotional distress isn’t a thing in the EU in general, and definitely not out of proportion to actual damages. If someone incurred costs as a result of your failure to comply with the GDPR, those would be damages. If, for some reason, they wound up in therapy as a result of your failure to comply and had to pay money/take holidays from work/etc for that, that’d be the closest thing to emotional distress we have.

Fines are not always incurred for GDPR infringements. Sometimes you can be asked to delete the data, to block dealing with EU customers, etc...

Sure, and in fact that’s meant to be the primary enforcement mechanism. But fines aren’t what I’m talking about there - civil lawsuits without a regulator involved are possible under the GDPR, although their potential damage is limited to actual damages and the cost of hiring a lawyer.

The first enforcement mechanism is going to be a letter detailing the complaint and asking for information about how you deal with user's data. If they think you are not handling it properly, you are asked to change it, that's it.

I think that the primary target for GDPR investigations is going to be the big actors like Facebook, Google and Advertising networks who's single business model is profiting from user data.

Big online marketing companies are looking at a variety of technologies to turn their user's into buying customers of their advertising customers both online and in-store.

Look at Facebook as an example with their dreadful user interface attempt to trick EU customers into opting-in to facial recognition technology.

https://venturebeat.com/2018/04/18/facebook-engages-in-priva...

But there's a good reason for this. The ability for stores to know who their customer is, what they buy and re-market to them is powerful, and incredibly creepy.

https://www.pymnts.com/facebook/2017/facebook-patent-facial-...

http://www.thedrum.com/news/2017/12/01/facebook-reportedly-d...

I now turn my phone into flight mode before I enter a high street store.

https://www.kaspersky.com/blog/offline-tracking-ads/16510/

GDPR is a good reminder to all companies that the individual user owns their data, not the company. I personally like this shift, which will over time make companies think about the business models they implement, encouraging us to have customers rather than users.

Reply on news.ycombinator.com