Hacker News Reader

Comment by xtracto | Hacker News Reader

The GDPR has always amazed me. It changed the playing field from "you can use our free app as long as you give us data for marketing or not use it" to "you can provide a free service in the EU as long as you dont collect data for marketing or dont provide it"

Without making a judgement on the merits of the approach, as a user/individual I appreciate the power this gives to protect my data. As a company/developer the conplexity of navigating the landmines that this poses makes me understand why a lot non EU companies decide to just block EU users. Is it "good riddance " in both cases? Maybe, but still the fact that innovating becomes more expensive sits there.

View on HN

As a company/developer starting from scratch, there is really no complexity nor landmines : Do as you say, Say what you do, Give the user options.

You can offer the user the choice between targeted advertising or non-targeted. You can offer the user the choice between paid subscription or advertising.

Cant get enough users to pay or consent ? Then you did not find market-fit in the real world.

Oh but GDPR is more than "don't do marketing". There´s stuff like "Right to be forgotten" that implementing controls for it would require a company starting from scratch to spend resources in "getting it right", and then you have things like backups, that may or may not fall in scope. And this is only one of the 8 rights that the GDPR provides.

First of all, it's not "don't do marketing", it's don't do "user-tracking-and-profiling based advertising". Marketing is so much more, like actual market research to provide a service users actually want.

You have to handle a "right to be forgotten" query within a month, surely this is enough time for one sysop to run a prepared query. If your database is so byzantine that you cant find all reference to a given customer, you are either google or in need of a new architect.

Backups do not need to be deleted immediately, they should however expires and be destroyed in accordance to your data retention policy (Say what you do, do as you say).

This fear mongering is absurd. You won't get fined millions just because you didn't delete something by mistake. You will get fined however if you do this repeatedly and deliberately.

I see this as a "it's so hard to run a business with all these rules" argument.

We both know rules are extremely clear and simple. They get complicated when companies try to go around them.

Same whining in finance. Every loophole is ruthlessly exploited, shady tactics employed, malicious compliance or borderline fraud are commonplace. The legislature changes to address that => the actors kvetch about red tape.

But but but, what about my boilerplate frontend code to add zillions of trackers. Do I have to stop copy-pasting those? Too hard, GDPR sucks. :))

> As a company/developer the conplexity of navigating the landmines that this poses makes me understand why a lot non EU companies decide to just block EU users.

The only places I've seen actually do this are local newspapers in the US. Are there many other substantial companies doing this?

In general, dropping the EU is an expensive game: it's 450 million people, including many rich developed countries. GDPR doesn't mean you can't advertise or do other freemium upselling, it just means you can't precisely track people's personal data to do so, and the rules for that are fairly common sense & clear imo. It's not difficult for most businesses to make good money and stay inside the rules.

Also, privacy is an international trend. Many countries are enacting national GDPR equivalent. Even California enacted the Consumer Privacy Act.

I'm not even sure why GDPR is so foreign to the US. Think HIPAA for everyone, not just healthcare providers.

There are definitely a couple of big one. They get posted on here every now and then but I can't remember them because I'm in Europe and if they don't want me, I don't want them.

I'd rather not interact with a company that disrespects my privacy and it's rather helpful they have to tell me this up front.

What you and many others are missing is the fact that major part of GDPR is about collecting unnecessary data, specifically PII, personally identifiable information. If your web/app/whatever has legitimate reason why it needs the data, GDPR is fine with that. For example it's perfectly OK for a dating app to collect information about person's eye color and height or for medical app to have access to your heath-related information, even though it could be used (with other data) to identify specific individual.

Reply on news.ycombinator.com