GDPR, China and data sovereignty are ultimately wins for Amazon and Google
techcrunch.com
techcrunch.com
We see with regulation all the time, e.g. Dodd-Frank made it harder for small banks to raise capital.
1/25th of revenue sounds small but if you have a profit margin of 30% that's already 13% of your profit just gone. At 10% margin it's 40% of your profit.
I think large business still very much cares when 40% of annual profit just goes poof.
Meanwhile the large company grudgingly pays their fine and rolls on.
The EU has no interest in bankrupting anyone, there are guidelines setup by the EU for the regulators for this.
Effective, proportionate and dissuasive fines are widely understood under common EU law that the fine may not bankcrupt a corporation, if it does for whatever reason because it's too high, you can seek legal remedies against the authority as per GDPR Art. 78
And that is only the GDPR, there are similar provisions in all EU member countries.
The exception will be, of course, if you caused economic damage to users or others, in which case you'll have a case at the regulator and a court case will be opened too, both of which are independent and the court case can certainly bankcrupt you if the damages far exceed what your company has in assets (in which case your company will be forcefully dissolved and that's that)
This is yet another example of: “the EU regulators are our friends! You can trust them!”
I’ll pass.
I mean, is there any sensible way to prevent regulators from bankrupting a company without some level of discretion and case-by-case consideration?
Moving everything into the legal system also has issues, as you point out.
For now all of the benefits are hypothetical, and some people think they’re feeling the pain, so we’re at the peak of a whining asymptote. This is buoyed by the fact that some people resent regulations on ideological grounds, and others resent anything that in any way restrains their freedom to “hustle” by screwing over people for money.
What are you talking about, it's great.
It's not just fixed costs. Any increase in overhead will have a higher impact on smaller businesses.
If a variable cost increase is passed onto customers it results in lower sales volume. If it isn't it results in lower margins per unit. In either case it can push a smaller business past the point that it can no longer cover its fixed costs, even if the fixed cost amount hasn't changed.
- violate my GDPR rights by requiring opt-out from their tracking, instead of opt-in
- are going to sell my data to hundreds of "partners"
https://gdprhallofshame.com/5-techcrunch-engadget-and-oath-c...
Even if I would bother enough to do this dance from my mobile device, which I don't, there is no way the article can convince me that it's unbiased journalism.
Now, the door's been shut behind them. It's fair to assume that big companies are better equipped to hire experts to navigate the issue of compliance than a random 8-person startup fresh off the press; whereas 10, 20 years ago these exact sort of new ventures are what grew into data harvesting machines that were usually acquired by someone with bigger wallets. This is one of the mechanisms of regulatory capture: even if the law is good for the public, most of the companies that engaged in the now-illegal tactics can pivot to something else or figure out how to stay in compliance, while any new players hoping to use the same mechanism are forbidden from doing so. This is a fairly typical outcome when regulation is first applied in a space where it wasn't before.
The twist is that some of the same players that engaged in the harvesting and trafficking of personal data have also branched out into cloud computing and various value-add SaaS to sell B2B, and they can capture some revenue from other companies that are just going about their everyday business and are looking to stay compliant with the new regulation. This is a boon for the likes of Amazon, Google, Microsoft, who've engaged in both targeted ad tracking and cloud computing. Increased uptake in their cloud offerings will help insulate them from the tightening of the targeted ad space.
The substance of the article is solid. But for those alleging FUD, keep in mind that TechCrunch is owned by Oath, the content subsidiary of Verizon, a content and infrastructure company without a strong story in B2B cloud computing, and whose revenue is chiefly derived from (1) providing bulk telecom interconnect, (2) being an ISP, both wired and wireless, and (3) correlating user behavior across their portfolio of sites and using their network. One can easily make the case that these sorts of companies are among the most vulnerable to this sort of regulation.
If the landscape changes significantly, that is advantageous to startups because they can choose to avoid quagmires entirely. It's really the middle-stage ad tech companies that don't have the cash to comply, but have too much momentum to change course that will really be fucked.
Of course it's true that you can't start another Google or Facebook today, but that is for many reasons among which privacy regulation is merely a footnote. I get that a lot of fortunes were made in ad tech, but innovation will not stop because practices need to change.
Remember the teenagers that were setting up their forums and messing about? You can't do that anymore. The chance that people like that would follow these laws are tiny. The effects of something like this are very hard to predict, because we know that hobbyists gave us many cool things over the years and they ended up transitioning into lucrative careers. This kind of an avenue is severely hampered by this. I'm afraid that this kind of regulation is simply the first step to wrestle control over the internet, and if governments manage to do that then the internet stops being free.
>Also, the chances of regulators coming after hobby projects is nil.
"The regulation is okay, because we're only going to use it against the bad guys." This is not how a society based on justice is supposed to work.
Large corporations thrive in highly regulated environments without fear of competition.
Look at the history of banking or healthcare after it was regulated. Costs spiraling out of control, people dying of preventable diseases because they can't afford health insurance, the housing bubble, too big to fail, etc.
And yet compared to that, many industrialized countries with "socialized medicine" get by rather well, even though that's the epitome of regulation.
On the other hand, when somebody has a rare disease or wants the absolute best healthcare then they are likely going to the US.
And the US isn't the only destination for such medical tourism (anymore)..
The entire US system is a disaster. There are major tax incentives for employers to provide health insurance, so they do. But then it's corporate executives choosing the insurance policy, and the one they choose affects themselves and their families, and is tax-deductible compensation, but they're spending the shareholders' money instead of their own. Meanwhile the insurance company is happy to sell a policy that covers more stuff for higher premiums. And everybody hates it when the insurance doesn't cover something -- it's bad PR for the insurance company, bad employee relations for the company who chose that policy and bad for the employee who is sick and denied coverage.
So all the incentives line up for there to be very expensive insurance policies that cover everything no matter the cost. And once you have a policy like that, the patient has no reason to decline unnecessary tests or choose lower priced alternatives because the insurance is paying for everything.
The insurance company can try to negotiate prices, but that only works in a competitive market. Many things are patented and there is only one supplier, who knows the insurers are captive buyers. Even when there are multiple suppliers, they all have to pass on the same regulatory compliance costs. And the insurance company itself imposes a large amount of bureaucratic overhead on medical providers to try to prevent insurance fraud, but the cost of that overhead then gets built into the price. Plus the cost of the insurance fraud itself, which is hard to detect when the provider and the patient are both in on it.
The way to make health insurance work is for it to actually be insurance, i.e. it only covers major catastrophes with a multi-thousand dollar deductible and everything else is out of pocket. Then the insurance would cost less than half what it does now and the amount paid out of pocket for substantially everyone would be less than the difference in insurance premiums. People would then have the right incentives to compare prices and refuse unnecessary procedures, none of the routine medicine would have to involve insurance paperwork, and less insurance coverage would mean less insurance fraud.
But everything in the US regulatory environment is configured to prevent that from happening.
Health insurance is also cheaper if certain preventative measures are taken, so it's in their best self-interest to cover those, too (and also to make being up to date on them attractive).
For example, German insurance covers annual dental checks and reduces the copay on dental work if you have been up to date on those checks for a number of years because that's cheaper than dealing with the fall-out.
Full socialization is very different from regulatory capture. Regulatory capture looks like what western corporations have traditionally done to third world countries. Full socialization looks like the USSR. They're both terrible, but in very different ways.
It doesn't help when the government gives out bad guidelines either. Eg the lending guidelines given by the Community Reinvestment Act. Suing banks for having too strict guidelines for lending out money coupled with easy money ended up in the 2007/8 financial crisis.
Would it have been better with less regulation? Maybe, maybe not. But it's definitely hard to say that banking would be unworkable with less regulation.
Is the web server software you're using logging network requests? Are those requests possibly considered PII? Congratulations, you now have to care about the GDPR.
Obviously if you were in the business of leaving such data insecure for anyone to obtain or merrily selling it on to reap as much dollar from your visitors as possible then you may be in for a bad time.
Otherwise it's just best practice to do what GDPR says anyway in the example you provide.
""" “Legitimate interest” may be among the most confusing concepts written into the GDPR, which is not helped by the amount of incorrect interpretations available when you search for the term online. """
It's going to be up to individual companies and orgs how much risk they want to absorb trying to sort this dimension themselves rather than hiring a professional; I suspect we agree on that. But I suspect quite a few companies will want to soak the cost of having a professional review this stuff rather than trust their own common sense (especially if their common sense is not European-originated but they plan to have European users).
If you can't demonstrate that it's important to your business, then you can mask the IP addresses. This was a very common thing to do even before GDPR.
In other words, compliance in this respect is dead simple. If you need IP address information for a specific reason, then keep them. If you don't need it, then change your log format to omit them or turn on IP masking.
I can create a business model in the US market - in the vast majority of nations in fact - that can't exist in the EU, pay for it with targeted advertising in the US market and give the product away for 'free.' I can scale it with US ad practices, then move into the EU with full GDPR compliance and continue to fund that product with the vast, lucrative, targeted US ad market, doing things with customer data and generating margin that is impossible in the EU. The EU can't project its jurisdiction globally to prevent this approach.
GDPR is a massive win for US companies, it increases the already overwhelming US competitive advantage. The US tech giants can trivially comply with GDPR, and the EU ends up as more of a tech hermit kingdom with every restriction and compliance requirement they put into place.
Starting and building a company like Google or Twitter in the EU was very difficult before, now it's impossible. Every future Google in the West will be born in the US perpetually from here on out.
Being 'GDPR ready', 'privacy first' and putting our users in control of their data was a good selling point and important part of our story. It definitely made it easier for me as a tech guy in founding team to argue for reasonable privacy policy, avoiding data monetising revenue models and attention to security.
For all the criticism of Google, of which I have extensively done, very little negative is said about their security. The fact that you can have 99 character passwords in GMail speaks to this (Paypal and Bank of America’s limit is 20 for example).
Everyone today worships small business, but the 30 years of incredible economic growth was partly achieved by the partnership of Big Business with Big Labor and Big Government.
As Galbraith said at the time: “the entrepreneur, as many see him, is a selfish type motivated primarily by greed, and he is furthermore, unhappy.”
I think entrepreneurs have contributed a lot to society, but I also think new era’s come and go, and the worship today of “innovative startups” will not last forever.
But yes, I suppose in the short term budgets will be fixed and some may try radio etc again
There is no thought control, only data (lots of ads of course) that you yourself receive, think about and shelve.
From my [summed up] European's PoV Obama was very right wing and Trump is veryyy right wing. From an American's PoV that PoV lacks nuance. So I generally refrain from using those simplistic terms when potentially talking to Americans; gets discussion nowhere.
Here's the data on political groups (coalitions) in the EP. [1] Claiming these are "left wing" is.. well.. clearly US centric PoV, but also overly simplistic and bifurcating. Calling Europe left-wing, knowing that Europeans are going to read it and reply is also fuel for a flamewar. Hence why I linked some data to put things in perspective.
[1] https://en.wikipedia.org/wiki/Political_groups_of_the_Europe...
Example: DuckDuckGo had no issues in ensuring people’s privacy for years and I’m fairly sure that they have zero problems with GDPR. And they are not and have never been at Google’s scale.
What happens actually is that privacy-violating companies are trying to keep doing whatever it was they were doing, but then discovering that no sane individual would opt-in to being tracked, without having access blocked of course, which then leads to lost revenue anyway.
So they are trying to game the system, which gets expensive of course. Now you need lawyers and experts in dark patterns. But when your entire business model depends on people's ignorance, you really can't claim the high moral ground.
Such articles are engaging in sponsored FUD.
The vast majority of companies aren't violating privacy in any meaningful way, and the GDPR still imposes large costs on them.
The idea that every tracker and targeted ad is some sort of meaningful privacy violation is pretty silly.
And in any case, the point is that together all those little violations are a meaningful violation of your privacy.
Please don't insinuate that someone hasn't read an article. "Did you even read the article? It mentions that" can be shortened to "The article mentions that."
My understanding, from a friend there, is GDPR imposes significant costs on their operations. The problem isn’t the intent of the law. It’s its implementation. The administrative burdens imposed by the mandated bureaucracy is massive.
The two things that needed to be developed were systems around rights of erasure & access. Both of these are pretty straight-forward systems -- it's a REST API for getting user details from a system, and deleting user details from the system.
I believe people are making GDPR out to be a much worse than it is.
What are you considering 'user details' ?
If you have a database with users in it, that's basically the row in the Users table, along with everything in the database that has a user_id, which depending on the data you're talking about, might be enough to just set the user_id to `null`, but if unsure and if possible, then cascade delete is the safe choice.
Basically that's nothing that a normal RDBMS doesn't do efficiently already. If you are using a RDBMS, you should have had a sane deletion policy on your foreign keys already.
It gets more complicated with NoSQL databases of course, but you knew already that by using a NoSQL that's essentially technical debt you're postponing. But having worked on many such systems in the past, it's not a tragedy and certainly not something that couldn't be solved in the last 2 years since the GDPR was adopted.
Honestly, GDPR was adopted 2 years ago and people now act all surprised that it came into effect.
thank you for your response. I've been trying to find this in GDPR docs but i can't seem to find a clear definition. Can you link me to the definition if you have it handy by any chance.
I can tell you couple of examples where simple delete from database is not enough.
One example is a analytics pdf report that was sent to management with geo diagram with number of purchases dotsizes/zipcode in a city.
It's neat that DuckDuckGo was able to find a business model through showing ads based on what you search into the search box. For me personally, I don't see much of a difference between being shown ads on what I searched at that moment and having a cookie stored in my browser and getting showed ads based on that later on.
None of this disproves what the article is saying anyway - Google & Amazon will be the best equipped to handle the nuances of any data laws and as bureaucracy increases, they will benefit the most, storing more data.
You're missing the point of the danger then.
Facebook isn't doing anything "nefarious" with the data either. And yet Cambridge Analytica happened.
Fact of the matter is, it's not what you do with the data that counts the most, the biggest problem being that the data gets collected in the first place without users being aware of it, or aware of implications.
How many users do you think are aware that Facebook follows them around the web and that this might affect their credit score, or the price they pay for their health insurance in the future? How many people in a minority, e.g. of a certain religion or of a certain sexual orientation, do you think are aware that their habits can be used to precisely identify their identity and preferences, which could put many such individuals in life threatening situations?
Of course, you might be a responsible company, you might actually do good by your users and customers, but if the users don't expect tracking to be part of the service and if making them aware makes those users to not opt-in, then you are doing something nefarious by definition.
Which is what GDPR is about.
Do they comply with right to be forgotten etc?
If, right now, there was made a law that fairly charged for all externalities on environmental damage of their products, then the companies that do things "right" with regards to environmental practice would be some of the most profitable.
The GDPR is the similar type of law, but for data hoarding of PII. If you're doing privacy and handling user data that preserves users' rights, you likely wont have much anything to change. Sure, you'll have to put together 5 documents how you do use data... but everyone does in the EC.
If you're a hoarder, spread PII everywhere it shouldnt be, or otherwise do bad things your users would find unconscionable, it's going to be a very rough time.
As an American, I try to buy sustainable products.. But the GDPR makes it easy to see which tech maintains my privacy of my data.
Yet, I have to believe that lawmakers aren't able to stop billionaires from screwing up the small guy without making complex regulations that impede progress and innovation, regulations that in the end make the rich and the bureaucrats a lot of money and sink hopes for the honest entrepeneur. I have to believe they're making the laws in good faith because they really have no alternative. Of course. I totally believe it.
A great example recently in the United States was in the Consumer Product Safety Improvement Act passed in 2008. It was in response to large toy makers using lead paint in their toys coming from China. It wasn't small toy makers doing this, it was the Mattels. As a result of what these large companies did with their disregard to product safety, a regulatory safety framework was put into place that Mattel could easily absorb into their operating costs, while small mom and pop makers suddenly had a very expensive process to go through, even if they were not the cause of how this law came into effect.
We can all agree on respecting privacy, toy safety, etc. It's a good thing. But just remember that usually these things are passed to protect large companies, not necessarily for the benefit of the consumer, and definitely not for young competitive companies trying to break into a market space that now has a huge initial cost that may be insurmountable. The result sold to the consumer is normally just a side effect used to promote it.
You can pay for safety explicitly with regulation or implicitly with poisoned children. Regulation hits small businesses harder; rather than concluding that regulation sucks, maybe we should try something else like providing some publicly-funded office to provide compliance help to small businesses.
That doesn't mean it's impossible to start a business, but it does mean you'll get a lot less of them. A lot less of them also means less successful ones and less jobs.
Regulations may or may not be necessary for certain things, but to fold everything in the market under some kind of regulatory framework where you need to go to government to get approval and navigate a burdensome bureacratic process basically just ensures that you will harm innovation, destroy small business, and protect legacy companies in the space.