Hacker News Reader

But we have to process every request even if we do not find any of their data.

A majority of requests are actually this way - people use online services that submit blanket removal requests.

Yeah, that's definitely the case and I see where the hassle is, but to restate my point, those costs are simply a part of overhead and not the business of users. Unless the users are given an opt-out first and foremost, they're owed ownership over their personal data.

Again, the language of the proposed bill is requiring 2 free requests per person.

$100 for an occasional person? No biggie.

Potentially infinite? That's a bit more than normal overhead.

While we haven't seen this sort of DDoS attack through our GDPR process yet, the potential is already there if bad actors or competitors wanted to exploit it.

Reply on news.ycombinator.com