Hacker News Reader

Comment by rrdharan | Hacker News Reader

> I wouldn't care about GDPR until I have a somewhat strong EU userbase. Try to respect the spirit sure, but it's not like it will be enforced on a small business within its first few years of existence.

This seems ethically wrong -

1. Even if your user base is not “strong” the privacy of the users you do have still matters

and

2. It should be about protecting them not just calculating enforcement risk like a Ford Pinto engineer.

View on HN

I will NOT comply with authoritarian demands imposed on me by the EU. My users, MY data. I clearly state how and why I share user data with brokers and users choose of their own volition to use my services. This is NOT unethical.

Even when accepting users' choice to submit personal data as a justification for retaining the data (which is illegal in more than just the EU, by the way), you may still receive personal data about someone which was not submitted by them voluntarily. This can happen in situations ranging from the normal course of business to customers actively attempting to use your product illegally.

You have a duty to deal with a situation like that, and since the GDPR already makes provision for third-party processing of personal data, there is little reason not to go one small step further and extend your process for personal data deletion to users directly.

Maybe it is ethically wrong to launch in EU without complying with GDPR. But if that is the case, then launch somewhere else first and build towards a more secure product in the meantime while you raise money and gather more insights. Don't forget it is a MVP ffs, and that you can be completely open about it (i.e. just say it is in beta or early access phase).

Reply on news.ycombinator.com