Hacker News Reader

Comment by svennek | Hacker News Reader

Please notice, at all companies (I don't know about AWS) that I have worked for each GDPR request eats up a few man-days of work internally.

Some companies getting hit a lot by GDPR have likely automated it, but even a big company (that I know of) with 100k+ private customers (that all have the right) only receives a few requests a quarter, usually by angry customers..

This AWS thingy might not be GDPR, but it might have the same impact on internal resources..

Just because it is free and your right, please consider if you wanna to be a resource hog..

View on HN

> please consider if you wanna to be a resource hog..

Perhaps the corporations could also consider whether they want to be an information hog in the first place and slurp up people's data.

You know what the easiest way to fulfill a data request is? To not have any data to give.

In Amazons case there are regulatory requirements for keeping around purchase history, tax, etc…

Yes, and? What about all of the data that is kept not owing to legal/regulatory requirements? That's the key issue here, not some trite truism about regulatory record-keeping requirements.

All data they process are required by law, but they have to collate a dozen systems manually and the legal department has to go thru everything and block out data the customer is not allowed to see (also by law)...

No all companies are evil and the GDPR has really made a significant change all the places I know of.

Btw I am not speaking of a FAANG company, but one that has a tiny web presence..

> Just because it is free and your right, please consider if you wanna to be a resource hog..

Oh poor Amazon and Bezos... They must be struggling on the resources. Please think twice about exercising your legal right, as it might affect the profit margins of a monopolistic megacorp.

Rather, poor other customers, as companies always shifts added costs to the customer base..

That argument proves too much [0]. If you accept that reasoning, it's impossible to truly tax or fine Jeff Bezos, he's only going to make his customers pay more, so we should give him a 0% tax rate, shouldn't we?

(I actually sort of like the occasionally-suggested idea of abolishing all taxations on legal entity and collecting taxations only on individual profits, i.e. don't tax Amazon Inc., only tax its shareholders' dividends and capital gains. But that would be a radical restructuring of the economy and very far from what we're talking about.)

[0] https://en.wikipedia.org/wiki/Proving_too_much

Please don’t feel guilty asking what information a company like Amazon knows about you. They have the engineering, human and computing resources to make this as scalable as it needs to be. If anything you’ll be creating more jobs for people who need it. I say this as a stock holder and someone who believes this information should be available.

[edit: very small amount of stock but relevant I suppose]

I agree about Amazon (and the other FAANGs) but not necessarily about any other business..

I think that was implied by "a company like Amazon".

Seriously??? Amazon has huge AI's making strategic business decisions based on agglomerating all this data, sifting it, grouping it, heat mapping it, chewing it up and processing it a 1000 which ways. All AUTOMATED. And you are suggesting accessing the raw data for a single person and zipping it up and sending it in one email might cost them business days?

It doesn't cost much when you allow your customers to do this from the start.

And it helps QA to be able to see raw data.

What if the company was started three or four decades ago? That makes "from the start" quite hard...

Not all data is necessarily allowable to show to the customer (in the EU at least some data is illegal to show to the customer by law).

Sounds like a good reason to do it.

If enough people start making these requests it makes it costly to store and collect this data = companies might stop collecting it.

I would encourage people to do so for the exact reason. Personal data should be managed in a way that such requests can be processed. It is OK if it hurts a bit. It is the idea of the GDPR that companies establish scalable processes that allow things like requests, migration and deletion. The only thing you need to do is to verify that to the best of your knowledge it is complete. What should not happen is that companies process those requests partially to save time.

Do you also check your grocery stores preparedness for fire for the same reason? Or your local banks preparedness for robbery? Hopefully not.

In business all decisions are made based on a risk tradeoff. Like people it never has enough money to do everything it wants.

Not all companies are started 12 months ago and hence cannot (by definition) do this right "from the beginning".

Also some businesses have a requirement (bound by law) and a wish (bound by corporate secrets) of not disclosing too much information. That cannot be easily automated.

Also, all the costs of that just goes to the other customers, so thank you.

Btw. I am not pro facebook(meta)/amazon/spamhosts/ai-driven web3.0 sell-your-customers-data... etc.. I talk about regular, honest businesses that two decades ago had no web presence but have it now and for some reason or another need to handle your data..

My relationship with my neighbourhood grocer is vastly different from the one I have with Jeffrey Preston Bezos and the unfathomably wealthy AMZN shareholders.

I would never burden a small family-owned shop by ordering five things that I may or may not need for the weekend, then leaving four of them un-picked up to get a free refund when it rains. It would be a dick move.

But to Amazon (or Ikea, or Mediamarkt, or what have you), I will glady do that without batting an eye. They're an unfeeling legal entity that thrives by exploiting every letter and loophole of the rules. It is absolutely fair to treat them the same way in return.

If all data can't be handed over to the users, why are they relying on fallible humans to do the filtering? They should be itching to automate it, and have had half a decade to accomplish it by now.

Note that "bound by corporate secrets" is not a legit reason to not hand over or data. There are legit reasons for not handing data over, but just the interests of the company are not it. It sounds like you've been working with bad actors who are not only refusing to invest in regulatory compliance, but are wilfully using bad processes to mask their non-compliance. Why are you making excuses for them?

Recital 63 of the GDPR disagrees with you

"That right should not adversely affect the rights or freedoms of others, including trade secrets or intellectual property and in particular the copyright protecting the software."

Btw. I am not a laywer, but I have worked with this stuff for half a decade..

Also, none of my ccustomers refuse it.

This specific customer spends around two days of worktime (including legal) on every request.

They are unfortunately for them bound by a lot of regulation (and governmental oversight) that normal companies are not and the take the GDPR extremely serious.

If this is true, knowing this makes it your moral imperative to do so. It will excert some pressure on them to streamline the process, or pressure them to store less data as it becomes a liability instead of an asset

A sobering thought. As Robert Burns put it:

  "Many and sharp the numerous ills
  Inwoven with our frame;
  More pointed still, we make ourselves
  Regret, remorse and shame;
  And man, whose heaven-erected face
  The smiles of love adorn,
  Man's inhumanity to man,
  Makes countless thousands mourn."

Reply on news.ycombinator.com