What hasn't worked: Expensive bureaucracy that big incumbents can easily afford to navigate but new entrants would be easily crippled by?
Shocked. /s
Shocked. /s
it's 72 pages of extremely dense legal text, where meaning of every singe word is important
https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...
But if what you're saying is so obvious, then GDPR experts should be very cheap. But they aren't. If you're so good at it that it's easy, why don't you just go make your million dollars as a consultant in the next couple of years?
GDPR certainly will have a chilling effect on tech startups. The jury is out on whether it’s a net benefit to society.
That's the entire point of GDPR.
If you just have a user login, that's quite trivial to implement in a GDPR conforming way.
GDPR is vastly more complex than "if you just have a user login it's easy".
To pick just one non-login related problem that has cropped up for me in the past month, a job candidate got upset after a rejection and asked us to "erase him from our database" - probably meaning our recruitment mailing lists. But the recruiters decided this was a GDPR "right to be forgotten" request and proceeded to erase all mention of him from our applicant tracking database. I was then quite confused when he approached me and said he'd been interviewed, because as far as I could tell we'd never talked to him about it. Of course, the whole idea that job candidates can simply make a company "forget" that they interviewed them is absurd to start with but it's the sort of thing that happens due to GDPR.
And then there's the perenially enjoyable question of whether backups are now illegal, or to what extent they're illegal.
Oh, and please don't give me any lectures about how GDPR doesn't require this. GDPR is such a badly written piece of law that it's impossible to say what it does or doesn't require. Anyone who thinks they know just doesn't understand how the regulation works.
Even after I wrote the code to handle DSARs for me, I decided it just wasn’t worth it. In order to be comfortable I would need to hire a lawyer to review things (and continue to pay him to keep on top of changes as things make it through court cases), put together things like an official TOS, worry about whether I could include any analytics services in my product to see if customers were getting frustrated with a particular page... all to launch a free service with no clear path to recurring revenue. And that was on top of the existing worries of having customer data that I want to make sure is secure.
Europe (and increasingly the US) sees corporations as all being huge tax avoiding monoliths of evil. Well, legislation like this will eventually prove them right because only the Googles of the world will still be able to afford compliance.