Comment by no1youknowz | Hacker News Reader

Comment by no1youknowz | Hacker News Reader

> The legislation is far from perfect. At nearly 100 articles long, it is too complex and tries to achieve too many things. The compliance costs for smaller firms, in particular, look burdensome.

Not here, but I have seen many comments on other sites that imply this will be a burden on small companies implementing this and worrying about whether they are compliant with some rules that can be interpreted in different ways. Also answering requests for information which range from the benign and can be automated to the letter which caused a stir on linkedin [1] and can be viewed as complex and costly for a small business to answer.

The reason why I talk about small companies, in a lot of cases another already overworked person will need to wear another hat and may or may not do a good enough job. Verses the larger ones, they can implement a small task force and get this out of the way.

I know some commenters on HN would disagree with this and mention that these smaller businesses who don't adopt GDPR should go out of business. But I largely disagree. Businesses which close due to regulations, results in larger market shares to those left standing. Meaning that competition and what largely benefits the consumer dwindles down. Another knock on to this would mean that prices go up, due to those same regulations.

However, what I haven't seen talked about which I wonder if it will make the GDPR moot. Is that Trump is currently engaging in a trade war and I wonder if any lobbying attempts are being made for him to exempt US companies from it[2]?

[1]: https://www.linkedin.com/pulse/nightmare-letter-subject-acce...

[2]: https://martechtoday.com/president-trump-save-us-from-the-gd...

Just one data point, from me as a DPO-equivalent:

My company is squarely in the SMB camp at 21 employees and single-digit millions in revenue across three business lines.

GDPR compliance has already cost us hundreds of thousands of dollars and will cost us more as we go on. There will be some very minor benefits to our customers, perhaps, but for the same amount of money we could 100%-definitely-for-sure-absolutely give all of our customers things they would, if given the choice, trade those benefits for.

That's the thing; it's like when you buy an appliance. You can buy the thing that meets the needs for $X, or you can buy something that's better for $2X. Of course, the better appliance would be better. Should we make a law that requires companies to only make the better one? That law would provide a benefit, because consumers would get the better appliance, right? Okay, sure -- but at what cost? And what value-producing companies (because companies do provide value for customers!) are going to be marginally less efficient and therefore marginally less effective and therefore, on the margin, go out of business because of it?

There are valuable ideas in the GDPR. The execution is pretty crappy, and in the end it I think it likely reduces net consumer autonomy because it gives them less choice in how they relate to companies.

> GDPR compliance has already cost us hundreds of thousands of dollars and will cost us more as we go on

Wow, that's incredible! Can I ask where you are based and roughly how the cost is broken down?

I just can't grok how an SMB would need to spend so much on something that seemed relatively straightforward for my own business.

We're a US-based remote company with employees in four countries and contractors in a few others. I have a sense that some of our unique needs make things more complicated for us than for many others, but my other SMB friends seem to be facing a lot of the same struggles.

I go into some more specific categories in another subthread in this article.

It seems incredibly excessive to me unless your business model is harvesting personal data. I work at a rather larger SME (multi channel retailer/wholesaler) and we are spending almost nothing. But then we were not doing anything creepy with our customer data before. We are updating some documentation and will ditch some old data we don't need any more, reword the privacy policy on our website etc. I am not apportioning any direct cost to GDPR as these are all things that need attention periodically anyway.

You can buy the thing that meets the needs for $X, or you can buy something that's better for $2X. Of course, the better appliance would be better. Should we make a law that requires companies to only make the better one?

Well, it depends. If by "better" we mean it has an extra secondary feature, probably not. But if by "better" we mean it doesn't catch fire during use, then probably yes.

The execution is pretty crappy, and in the end it I think it likely reduces net consumer autonomy because it gives them less choice in how they relate to companies.

Can you expand on this? As far as I know, consumers can still give you express consent to use the data in other ways.

One example would be that consumers are literally no longer allowed to give their data in exchange for a service, download, etc. Companies can still offer these things and ask for the data, but the GDPR specifically disallows companies from making that thing contingent on the customer giving them the data.

In my role as a consumer, I have several services I use and many companies I've given my contact info to in order to get something from them. I love being able to use my information as currency. The outcome of the GDPR's treatment will not be that these companies still create the same whitepapers, services, etc. and just give them away for free. It will be that they move their energy to something else, because the whole point in creating those resources was to get the information, and this will probably cut that ROI for that in half or more. In my business roles, I had active projects to create valuable stuff for clients around that type of thing, and they now don't make sense.

> it's like when you buy an appliance. You can buy the thing that meets the needs for $X, or you can buy something that's better for $2X. Of course, the better appliance would be better. Should we make a law that requires companies to only make the better one?

Maybe? Many such laws already exist: regulations on fire safety of buildings, fire safety of pillows and furniture, energy efficiency and safety of cars and home appliances, anything related to food processing, and so on.

I don't think there are any consumer products at all where governments haven't made laws about only selling "the better one".

I can't really see how it's so burdensome for small firms? It's tauted as a truth every time GDPR is mentioned, but why?

If you ask me, being ready for GDPR is much harder for big companies with legacy systems, bureaucracy etc.

And I find that letter easy to answer. If companies don't, that just makes GDPR even more necessary.

Reasons it has cost my small company hundreds of thousands of dollars:

Hundreds/thousands of hours of time (over a thousand for sure by May 25th, and it doesn't stop there) of very expensive employees to understand what compliance means and work toward achieving it (law/privacy professional, developers, training time for all employees)

New software tools for specific compliance requirements (documentation, etc.)

Consulting and new services needed (EU representative, etc.)

Cost of EU servers (this is NOT required for compliance, but so many of our customers have a bad understanding of what the GDPR requires of them that we found we would lose tens of thousands in ARR if we didn't bring up an EU server stack).

I've spoken with friends at big megacorps, and the challenges are massively different. At our company, we need almost everyone to understand quite a bit of the GDPR. We also can't build giant custom solutions -- like many SMBs, we are essentially a framework built around a chain of dozens of third party services that all have their own GDPR needs, from G Suite to Mailchimp to github to our bookkeeping and accounting contractors. The job of GDPR compliance just doesn't scale proportionately from 1 employee to 1000 -- there's a base level before the scaling starts, and the scaling from there isn't even 1:1.

That's the cost of introducing the GDPR.

Once the GDPR has been around for a few years, everybody in the workforce will (or at least should) know what it is and how it works. The cost of training will only felt when somebody enters the workforce.

Even if you think it's worth the cost, you can't deny that there are still ongoing costs; doing something a less efficient way bears a cost, and more auditing, documentation, and overhead bears a cost.

The cost of doing it is a small negative effect on some (predominantly older) companies' bottom lines.

The cost of not doing it is widespread violation of our fundamental human right to privacy.

It's definitely worth it.

On one hand...

- As someone else mentioned, GDPR are actually easier to implement from a technical perspective in a project from the ground level than it is a legacy project that already has tons of data.

- If you know from the beginning something is not a viable business model than it is easier to shift your business model early on in the company than post-revenue after you already have your business built on personal data.

On the other hand...

- The rules are very complex and sometimes ambiguous leading companies to sometimes legitimately be unsure if they are doing the right thing. And paying a lawyer to tell them is outside the budget of small business.

- A mid-sized product has the worst burden because they need to convert legacy data AND don't have the resources.

- To properly implement often requires a at least intermediate knowledge of devops / encryption / etc which might mean no more MBA bootstrapping v1 after spending two weeks learning mySQL or a coding bootcamp without hiring an experienced Software Engineer.

Personally as a small company I don't mind it. But I'm also a coder. If I had to outsource my code to someone who was being paid hourly and you told me GPDR would add hundreds of hours (not unrealistic) it would be a big portion of my budget with no business benefit (though personally I think a lot of benefit for the customer).

Burdensome? Well, outsource then, to accountable specialists! Capitalism 101. Aggregation could be a service.

If so this law could create a data aggregation giant, where data from many (non-web) sources is combined, many more than today, potentially aggravating the problem.

I expect the solution for small businesses is to outsource to the cloud. Instead of building your own user database or customer management system, have someone else do it who specializes in security and privacy.

If the specialists can handle this well, this is probably not a bad thing. But it's another example of the increase in production values that gives an advantage to larger companies.

I agree. I don't think GDPR would ever be passed in the US because it is way too heavy a regulation and does absolutely disproportionately impact startups and small businesses. By disproportionately impacting small businesses you stifle innovation and therefore competition.

I do think GDPR is a personal privacy win, but I'm also interested to see what happens in terms of tech startups and new products pulling out of the EU.

the cost of GDPR is almost null for new startups. I provide infrastructure (and tech advice) for data analysts and data scientists (mainly, i also have DL and Blockchain projects) and only one project started last year needed more than a day worth of work, mainly because the infrastructure with both Hadoop and Elasticsearch was weird and the dev who put it together was gone.

Reply on news.ycombinator.com