If you want to weaken this regulation, abuse it like this.
Honestly, it's crazy—HN is the only place I see this kind of anti-GDPR stuff. Everyone I have talked to about it sees it as a huge positive. I include myself in that by the way—being able to get (and delete) my data from providers reliably is a huge positive, and it has clearly improved the way my data gets handled a lot of the time. The cost is relatively small.
1) People who think any sort of government regulation is pure evil
2) People who read the opinions of the first group and assume that because it was said on HN it's correct
3) Adtech startup devs
4) People who really hate not being able to hoard personal data for no reason
5) People who think money is significantly more important than privacy
It's not... You cannot enforce GDPR on any person / company who doesn't have a presence in the EU.
That annoys me, because _although I'm willing and do comply_ many people reach out to me regarding their personal data with a lot of arrogance. However, my company isn't based on the EU and I don't have to comply (which I cleared with a lawyer already). Their method of their approach makes me not want to comply.
Not true, I am not required to not offer to EU citizens. They simply can choose to visit my U.S. servers and use U.S. dollars.
Laws aren't global. Laws are based on jurisdiction. EU doesn't have said jurisdiction, unless I am hosting services or have a presence in the EU. Customers from the EU effectively travel to the U.S. (via the internet) to get to said service. The U.S. could force us to follow EU laws, then sure. However, that's not the case today.
You can think of it as: if I call a vendor in China to purchase some widgets. The vendor in China is not required to validate you're following the laws of your land - that's your job. The Chinese vendor just needs to make sure they are following China's laws.
Read this article for more details http://www.mjilonline.org/fines-under-eu-gdpr-in-non-eu-juri...
There is a difference between a 5 person biz like bear notes who would be totally cool in deleting your login info on request / sending whatever small amount of data they have on you, and what they actually have to do be properly compliant with GDPR. They are probably not and they, like many small EU software business, are a liability waiting to happen.
Also this kind of legal DOS is almost definitely against the spirit of the law and I’d be surprised to see any real company use significant resources to respond.
Small businesses are still, for example, subject to abusive SARs of the kind used for illustration here. They're still required to write documentation like privacy policies according to the new standards. And unlike large organisations, where there is the 4% cap on fines, a small organisation faces an existential threat if regulators decide to impose heavy fines, which they have considerable powers to do.
Defining a surveillance capitalist company without BS is difficult although, so in the end, I would probably just wholesale exempt private small businesses that are not subsidiaries of larger ones. The small businesses would need to be arms length from larger ones too.
A lot of the danger of surveillance capitalism come from concentrated power, and many small businesses are by definition the opposite of that.
The data is the same, regardless of who collects it. Leaking it is equally dangerous.
You know what makes it really easy to comply with the GDPR?
Stop spying on your users.
Just stop.
It infuriates people precisely because it threatens the ad surveillance economy this whole website and most of its users have come to rely on. Consistently, the sites I've gone to with the most intrusive and aggressive complaints and reactions to GDPR ... are also the sites that are riddled with spyware and tracking.
It is very much a case of "methinks thou dost protest too much."