Hacker News Reader

Comment by rootusrootus | Hacker News Reader

I don't know about it being low effort to be compliant. We spent most of a year with a significant portion of our software engineering teams devoting time to GDPR even though we are not any kind of data collection company. It's the legal requirements -- we had to audit every last piece of software, make little tweaks if necessary, etc, just to ensure we were demonstrably compliant with the law.

I wouldn't be surprised if 150B is actually a low estimate.

View on HN

> even though we are not any kind of data collection company

Are you collecting data on your customers? If you are, then one of the things your company does is data collection, even if that's not what's in your business plan.

Every single company in the world collects data on their customers.

Every company receives data about their customer, usually leaked by the customers themselves. How they handle it and what they choose to store / delete differs wildly.

Does having a table called "users" with usernames, emails, password hashes, and last logged in timestamps count as customer data?

Yes. Emails are 100% PII. Even user names can be argued to be.

The term "personally identifying information" does not occur anywhere in the text of GDPR; the regulations use the term "personal data", which is defined differently.

I raise this issue in almost every thread about GDPR, because although it might seem pedantic, the error strongly implies that people have not read or understood the legislation. The difference between personal data and personal identifiers is integral to GDPR and the legislation cannot be understood without fully understanding that distinction and the implications that follow from it.

https://gdpr-info.eu/art-4-gdpr/

It counts as personal data, and as such, under the GDPR you have a duty to handle that data sensibly and responsibly.

We store enough identifying data to do business with our customers, we do not collect data for data's sake. Not for metrics, nor for ads, not to sell, etc.

Reply on news.ycombinator.com