Hacker News Reader

Comment by eadmund | Hacker News Reader

> It's not the requester's fault that you can't handle compliance with a law efficiently.

No, it's not: it's the government's fault for passing an over-large law.

I think it's too early to come to any conclusions about GDPR. It's going to take some time and some litigation before we really know the shape and location of the edges of the regulations.

And meanwhile companies just hope that things go okay for them? That's people's livelihood on the line there.

Companies need to apply the same judgment as they do for basically anything else related to running a business. How much do I need to do to comply with this regulation? How do I respond to that?

I mean, it's not like businesses worry too much about people's livelihoods when they lay them off. It's just a business decision and the laid off person needs to deal with the realities of the situation. Now, business owners need to do the same when it comes to the GDPR decision.

If all they do is hope, then they might be screwed.

If you tally the score today, I think it's a win. A few companies may have folded, but a billion or two users have gained a little more insight and control over how data about them is used. But like I said, it's too early to be very confident about this.

Should be fine... if their business model included farming out PII for profit, those same people can be gainfully employed in shutting those systems down and implementing processes to ensure it doesn't happen again. Net employment change zero.

You're right. Why should I have to spend my money to make sure I'm not polluting the environment? Make my products conform to safety regulations? Provide safe working conditions? Pay my taxes? It's all the governments fault for passing regulations that help consumers. Those fuckers.

many people disagree with preemptive, guilty until proven innocent regulation. many people also disagree with taxation in-so-far as they are not proportionate usage fees. And yes, certain regulations are definitely harmful. "But other regulations exist" isn't a valid excuse for any and all ever-increasing regulation.

Are you saying that there is no reason for GDPR to exist? None at all? It has nothing to do with all the data leaks that have happened, Facebook and Cambridge Analytica collecting information, invasive targeted ads?

I didn't read their comment to be that black and white, but rather to say that the law is overly vague and hard to comply with. Surely not the first such complaint you've heard.

If GDPR was an environment law, it would say, "Hurting the environment means you can be subject to a $20,000,000 fine." Which sounds great! Except the biggest thing most people can do to hurt the environment, by far, is international flights. And everyone is wondering if the law meant to cover flights. And lots of people are saying, "You shouldn't be flying far anyway." And one expert is saying, obviously flights are excluded, and another is saying, fines are very likely. Etc etc.

> subject up to a $20,000,000 fine

Up to 4% or 20Mill. A small startup won't get slapped with that size of a fine. If you are worried about those numbers, you should be able to hire a lawyer and ensure you are in compliance.

It's whichever is higher, not whichever is lower. In other words, the minimum (higher level, lower level is of course lower) fine is €20m.

https://www.gdpreu.org/compliance/fines-and-penalties/

This has been rehashed to death: the maximum fine is 4% or 20M, the minimum is zero.

So the fine is in range(0 ... max(4% gt, 20M))

Ok?

But would you agree that without any history of enforcement to look at yet, it may be prudent to base risk analyses on that maximum number?

No, that would not be prudent. In fact, the opposite.

Why?

Because of the evidence documenting the last 20+ years of enforcement.

Enforcement of which regulations? Do you mean all commercial enforcement in the EU's history, or enforcement of internet related technologies specifically? I'm not trying to be dense, I suspect you know more about this than me, so I'm honestly curious what makes you confident about restraint in enforcement of regulations affecting small businesses on the internet.

If you base all of your business decisions on the worst possible scenario, then you simply aren't going to run a business at all. That is true both before and after GDPR. Some level of risk is inherent in all business activities.

But most risks can be evaluated. How does one evaluate this risk?

No. The law lists the maxium possible fine under the worst situation.

The absolute maximum available is 4% or €20m, whichever is higher, but the actual fine imposed is always going to be less than this. We know this because after 20 years of existing data protection law the maximum fines have never been imposed.

As I cited in another GDPR thread: the data protection authority of Saxony, for example, handed out less than 50 fines in two years, with an average of less than 3000 Euros.

The minimum value possible for the maximum fine is €20m. The minimum fine is €0.

I can't reply directly to lykr0n due to HN reply rules, but it's 4% or 20 mil, whichever is higher, not whichever is lower.

(FYI generally you can reply if you click the time of the post to go through to a page containing only the comment you want to reply to)

There may be a great deal of uncertainty now, but things will eventually be settled.

If you are worried about being subject to a twenty million dollar fine, then you can probably afford to hire a lawyer to respond to the multiple warnings you will get before any fine is levied.

Classic slippery slope. If any one complains of a single law being overly broad it obviously means they want every law repealed, right?!?

Large laws are typical of abuse of power, yes.

Are you saying large laws result from abuse of power by corporation or that large laws are typically abused by the government? Either way, I think I agree.

Yes, both, organizations tend to expand their reach or die, having ambiguous laws is good way to ensure an organization will be here to stay.

Why should I spend money to make sure I keep and delete all your information you gave me correctly? This is affecting a single person, the one that gave the information. He is fully responsible for his information, yet he gave it. It's like saying, well we should protect Tesla owner from using the ludicrous mode toward a wall. Maybe he should just not do it?

The environment affect EVERYONE, it's important to protect it because of that. It's a single entity that affect everyone. It's funny because it's exactly the opposite of GPDR, which is a single entity (the one that gave the information to the company) that affect everyone (every potential customer of a company).

GDPR just shift the blame over corporation instead of the one that gave the information in the first place. It shift the fear toward them instead of the one actually responsible for sharing it in the first place.

I'm happy that GDPR will push company to keep less information, there so many website I avoided because they asked for information I didn't want to give, but that's an issue that many website already solved (because that friction was making less user too). What it did bad is add confusion.

Reply on news.ycombinator.com