Hacker News Reader

Comment by impulser_ | Hacker News Reader

I would bet over 95% of companies don't comply with GDPR. I know some startups don't serve EU because of this. Facebook is under the microscope of the EU, they probably aren't risking getting fined until they can scale the product and implement the thing they need to lower the fine they would get and make being fined worth it. They are going to get fined most likely, but again 95% of the companies in the world could be fined as well if they were under the spotlight like Facebook is. GDPR compliance is NOT easy at all ask anyone who works in compliance they knows this.

View on HN

It’s exceptionally easy: one just has to not do shitty things with personal information. Complying if you are doing shitty things with personal information is, by design, impossible - and that is good.

Of course it’s not easy, unless you are saying the European Parliament is doing shitty things with personal information:

https://www.europarl.europa.eu/portal/en

This is an exceptionally charitable interpretation of how easy it is to comply with the GDPR, even if your intentions are good.

Ok, what if you do a database back up daily and someone requests you to delete their information. You're telling me you go through all those back ups and delete that person's information? If you don't you aren't complying with GDPR.

You don't even have to bet, you can just sample random websites and see how many make it more difficult to deny cookies than to accept. This is already a GDPR violation.

At some point it was definitely more than 95% of websites being shady with their cookie coercion banners.

I would say that no company or person is immune to arbitrary legal attacks. Complaining 100% with law is difficult if not impossible for companies or people with few resources. Laws could ge contradictory and/or inconsistent if you dig deeper.

That is why it is important to have sandboxes and/or laws that are based on size, number of consumers, etc. one thing is to ask for a full GDPR compliance to a bank and much different is for small companies.

What's interesting about the GDPR is that it's ambiguous and vague and it seems like "we're ok with that", whereas in the U.S. ambiguity works against the legislators because a court is supposed to rule on the side of the defense if a law is too vague.

In the EU, it's basically expected that the courts will apply the law on a case-by-case basis, which opens the door to inconsistent application of the law and ultimately to selective prosecution.

In the case of Meta, it definitely seems inconsistently applied (even though I hate Meta and would never trust them again). They simply choose the seemingly worst offender (Meta) and try to kick it out of the EU, while leaving alone the actual worst offender (ByteDance). Prosecution becomes a case of politics rather than justice.

What I don't understand is why products like Facebook and Google Analytics (up to 3?) ship PII to US. The owners have data centers in EU and should be able to process the data enough for it to be OK to send to US.

It is not that difficult for most startups to be mostly GDPR compliant. At least not in comparison with trying to fix it later. In some business areas local law and GDPR clashes though which can be a pain.

I mean, given that this site itself almost certainly doesn't comply with GDPR, yeah, I think you're right.

Reply on news.ycombinator.com