Hacker News Reader

Comment by jcriddle4 | Hacker News Reader

About 50% of small business survive their 5th year and roughly 30% survive to their 10th year. The concern is the drip/drip effect of more and more regulation making those numbers even worse. In addition you may be saying to a poor or middle class person that the money costs of starting certain types business are not longer in reach due to much higher costs. A large well established business is in a much better position to weather these costs so the wealthy get wealthier. What are the costs compared to the benefits?

View on HN

You hear the advice for new startups; only recruit the best from the start, cut away the fat from your task lists to only focus on the critical issues that generate business.

Here's another, bake privacy into your company from the start. Create a culture that takes it seriously and threads it through everything it does. Once you have this culture you'll find it costs less than when you try to retrofit it after 3 years.

In terms of the benefits, I can only assume you're American to ask this. In Europe we view our privacy as a human right and that our lawmakers should protect that right, it's that simple.

> bake privacy into your company from the start. Create a culture that takes it seriously and threads it through everything it does.

Replace "privacy" with "security" above, and you'll get the widely accepted best practice approach: "you cannot bolt on security later", etc. Likely it will work for privacy equally well.

It also works for performance, reliability, UX quality, etc. What GDPR does is forcing business to make privacy their core concern. Since time & budgets are inherently limited, this will come at the expense of something else.

As it should.

> What GDPR does is forcing business to make privacy their core concern.

Not really. It will mostly be a problem for companies which use a lot of SaaS services with no on-premise solution and companies in the business of selling their users data. Not gonna shed a lot of tears for those.

What's your beef with using "a lot of SaaS services, with no on-premises solution"? Why waste money by locking it into on-premises hardware?

You missed the entire point.

How do you guarantee that the SaaS you chose is enforcing the privacy of the data you're paying them to process?

In the same way that AWS wasn't originally certified for government work, and then developed GovCloud: they realized there was a lot of money in it.

If supporting GDPRs is a requirement for having European B2B customers, SaaS providers are going to start certifying against and architecting around that.

And AWS is already well on this

https://aws.amazon.com/compliance/gdpr-center/ https://aws.amazon.com/blogs/security/aws-and-the-general-da...

Actually what it did for me was allow me to ignore the EU entirely. This makes my implementation more simple since I don’t have to focus on the GDPR and can ignore the localization crap from having 2 versions of English.

Careful, the EU is a big market. If you exclude the EU, and get big enough, someone can just copy your business, but abide by EU law. Suddenly you have a compeditor who has access to a large market that you don't have access to.

this is extremely true from a network security perspective for new ISP infrastructure as well. It is very "easy" to start forming layer-2 and layer-3 adjacency between things geographically distributed around a city/state sized area without much regard to security. Will create a huge amount of work to come back and fix later. Whereas if you design the architecture from the start with security in mind (how you're going to deal with your management VRFs, monitoring systems, OOB authentication, NOC and neteng access to stuff in private IP space, etc) it will be much easier to scale.

You can't engineer this sort of thing away. A business that gets 1000 of these letters will have to hire someone to handle it, regardless of how good a job they did designing things.

I mean, if those records are being kept, it shouldn't be that hard to make them easily user-accessible, right? Support people that got the letters could just give users the link to the page with the data.

It seems to me that could easily create a privacy issue of its own. Certainly just a link would be terribly insecure, you'd need to authenticate the user. And whatever you do, you've now created a web-facing portal to the private data you're supposed to protect. Seems risky to me.

If you don’t keep the records of your customers, you’d answer those requests in no time.

Aldi has become extremely succesfull without knowing their customer. Ikea probably the same.

What about their employees? Aren't employees, or ex-employees, also entitled under GDPR to be informed about what personal data the company stores or processes? Honest question!

Of course, but they're entitled to this under pre-GDPR legislation as well, as I understand it.

Wrong. Even if I didn’t store anything besides absolutely necessary (does your product involve usernames or emails - bam, personal information) and was absolutely above board, it would take me hours to respond to this.

You see: you should have read the law before assuming that requesting this information from the user is legal. It had to be stored in one, single place. Therefore answering this question shouldn't take more than 5 minutes, if you have anticipated GDPR.

The first answer is long, the other ones should be quick as you already have done the work; and can be automated.

The answer is going to be automation. You don't hire a person to physically handle each of those 1000 requests, just like you don't have someone typing in each employee's pay stub and calculating their tax withholdings.

My company (Aptible) makes a product called Gridiron that does this. All of the data that a requester is entitled to can be pre-structured and organized in a source of truth. That's what Gridiron is.

When the EU bans telemarketing or sending me junk mail without my consent, then I might think the EU cares about my privacy.

Neither of those represent threats to "privacy" in a typical legal sense. Both suck, but you're saying that you'll think the EU cares about car safety when they ban juggling.

It already does. Go figure.

My mailbox (the physical one) disagrees with your claim. There are mechanisms to opt-out (at the cost of uglyfying my mailbox with highly visible label), but they are not banned.

In practice, no. The legislation has major loopholes, such as allowing unsolicited business-to-business marketing. And spammers still send junk to individuals with a disclaimer such as "This message is addressed to a business, if this is in error click here to opt out". And they seem to get away with it.

Your logic applies to fire codes and food sanitary rules just as well.

Doing the right thing is a burden, that’s why it’s called the right thing and not the convenient thing.

Yes you are correct. What are the costs compared to the benefits? Is the additional privacy going to be worth it? If we discover a few years from now that European companies are sharing roughly the same amount of data with other companies as their American counterparts, just documenting it better, have you gained anything?

Yes, because I can request it and ask for deletion.

Are you willing to pay more for products and services? Because ultimately you will.

If hiring one person changes the calculus that much, it's nonetheless easy to afford if profitable companies paid their workers more instead of sending it to shareholders or doing stock buybacks. The proportion of wealth held by the managerial class exceeds the Roman Empire at its height. https://persquaremile.com/2011/12/16/income-inequality-in-th... For reference, the gini coefficient of the united states in 2016 was 0.48. Rome at its population peak was between 0.42-0.44 according to the article. A gini coefficient of 0 is a perfectly equal society and a coefficient of 1 is perfectly unequal.

Small startups also often get the benefit of reduced regulatory burden, which is fitting because they have less overall impact on society. Once they become large, it is fitting that they play by rules that benefit the majority.

How is a gini coefficient relevant to higher priced products due to regulatory overhead?

It seems you have an axe to grind and derailed the conversion to compare the US with ancient Rome. Please provide a citation showing a correlation between increased privacy regulations and reduced gini coefficients.

I was responding to the claim that increased privacy would lead to possibly unacceptable price increases. I accept as axiomatic that increased privacy reduces profits, because, for one, you can't sell data that is private let alone the regulatory burden. My position is that these vociferous critiques of even minor bequests to the public are ill founded.

You already are paying with your privacy. If you value it for $0 then you're going to pay more...

Yes, yes I am.

Another legitimate question is: is the fact that you are willing to pay more a good enough reason to force me to pay more? What if I don't care about privacy as much as you?

That's the real issue here. You can either decide that privacy is a basic right that everyone has and cannot be negotiated away, in which case this law makes sense.

Or you can decide that it's a decision each person makes, and let the market take care of providing options that are more vs. less privacy-respecting.

> You can either decide that privacy is a basic right that everyone has and cannot be negotiated away, in which case this law makes sense.

> Or you can decide that it's a decision each person makes, and let the market take care of providing options that are more vs. less privacy-respecting.

Or, collectively, a group of people can agree on a government that supports privacy protection for goods sold under its remit. Which is what's happened here. I get that it's not popular in the US, but privacy controls are quite popular in Europe, and the EU is in this case following the mood of its people.

Yes, "a group of people" acting through the government to support privacy protection is what my first sentence meant. Clearly that's what's happened.

Not sure why you phrase it "or"? I think we agree that that's one sensible approach to take (treating it as a basic right that can't be negotiated away, much like other things).

Nobody dies from Google Analytics. People die from failing to follow fire codes or food safety laws.

This is a false equivalence.

Most people don't die from food safety violations, they just have a really bad day. I would say this is equivalent to the harm done by something like the Equifax breach.

> they just have a really bad day

And those who end up in hospital, in the US, possibly without insurance? I guess that, and the ensuing bills is "just" an _extremely_ bad day then?

Not a worry in most other developed countries.

of course they do! what magical kingdom of the future do you think you're living in, where economic ends have no bearing on survival?! your business on the brink succeeds or fails; a personal relationship blossoms or sours. sure, we mustn't rely too much one any one thing going a certain way on these kinda things that data sharing or Google Analytics can impact. but in aggregate these factors have significant bearing on one's access to medical, nutritional, & fitness resources & technology, even will to live, thus they do drive life or death outcomes all the same.

Google and Facebook analytics get people like Trump elected. Which is a far more dangerous situation than food poisoning or a building fire due to its long term impact.

People like Trump have been elected since there were elections. Keep the lame political statements elsewhere.

I find it quite worrying that 1) you are all over this discussion downplaying/minimizing the value and importance of privacy, and 2) you are the "founder of iCouch, a platform for psychologists, therapists and counselors".

Nobody died from detailed records of peoples religion and ethnicity in Germany 70 years ago either.

Such were held and enforced by the state, not by local businesses. Say, more or less the same people who run network-scale intercepts and tracking nowadays, and collect/access/process a lot of real-word records about you. Do you really think that as a EU citizen I can go ask TSA all data they have on me and why they opened my bag last time I flew out of the US?

Intersting question. How far into state agencies does the GDPR apply in the same way it does for businesses? Can i make a GDPR request to my city library, hosptial, police or secret service? Or maybe even to the state as a whole?

Yes, you can and you should. Every government should be able to respond. Nobody is bared on Data subject request

I wouldn't be at all surprised if it's actually cheaper for smaller businesses to properly handle personal data than it is for big ones. Big ones tend to have much bigger, more complex data systems that require complicated oversight and governance, and are presumably much more likely to engage in risky behaviors like dumping stuff into a data lake.

This might have an outsize impact on startups that deal primarily in data about people. I'm actually pretty OK with that. Some kinds of activities really should have high barriers to entry.

If a business cannot afford to properly handle and audit customer data then it should avoid any sort of collection. Businesses that produce value from customer data should be able to pay for necessary protections.

> The concern is the drip/drip effect of more and more regulation making those numbers even worse.

There are industries, like construction, that have a lot more regulations that this one. And small companies survive.

> What are the costs compared to the benefits?

Benefit: Citizens have the right to protect their privacy, to not be tracked without reason, to be notified when a data breach put their safety at risk, etc.

Cost: Companies need to have reasonable data governance that will increase short-term cost, but probably have a long-term positive impact on cost as bad data governance is just technical debt.

I don't give a fig about startup survival rates. I care about the fact that they're currently making money by externalizing costs.

Yes, it makes it harder to get into some areas. If that means a net positive for society, I'm surprisingly OK with that. There's no intrinsic reasons why we should care how many companies survive.

In general I strongly agree that regulations can be one of the slow drip/drips that crush a society over time.

However there are two forms of complexity at war here; complexity for business (regulation) and complexity for ordinary people (having data about you everywhere, about everything, forever). So we have to decide which kind of complexity is worse, or how to strike the right balance.

I usually register on non essential websites with a custome address like website.com@domain. Over the years I experienced several hidden data breaches as I look once in a while into my spam folder. This regulation gives me as a customer a good feeling as businesses are required now to think hard about their data protection strategy. As a business owner I have no problem answering these requests as I designed my software with data protection from the get go. Now it’s at least a requirement for all businesses which is good. This is a huge benefit for the consumer.

Yes, this also gives great insight on who's selling data.

If you have taken GDPR into account from the start, the costs are trivial, it only means you will organize data differently so this "startup worrying" thing is a nonsense. Those worries are trying to do PR from companies/developers that are used to capture as much as possible from customers (potentially also sell those data) and are basing their bussiness model on that.

The real cost comes in "old" companies. Those should complain, but those are also responsible for need for GDPR.

Everything there might be true. Everything might also be false. It might be cheaper to start a business because PPI information will be handled properly from the start and not be a cost centre. This might increase new business viability.

Maybe there are no "costs". Just benefits and benefits?

The benefits are to me as a consumer, of course. Just because companies would prefer to treat data and security as burdensome doesn't mean that I should let them. As an argument to reverse this regulation, this seems unconvincing.

Of those small businesses how many had business in Europe? You can aggregate or split by success/failure.

Reply on news.ycombinator.com