StreetLend.com shuts down, citing GDPR regulations | Hacker News Reader

StreetLend.com shuts down, citing GDPR regulations

streetlend.com

724 pointscbeach1,123 comments

What many posters here miss is that there is a big group of tech people that have no interest in dealing with legal matters more than the bare minimum, and overall deem them risky. I am one of them. People like me are well-aware of the fact that if we are not experts then we're absolutely gonna lose because a dedicated lawyer can and will dig up material you couldn't prepare yourself to defend from.

Thus, complying with something somewhat ambiguous like the GDPR is still an expense -- of time, money and risk -- that many small website owners won't be willing to spare.

Look, it's not hard to encrypt all personally identifiable information; there are ready-made frameworks that let you choose which DB columns you encrypt and how. You can generate a key for each user on creation and have their data encrypted with it. The problem is NOT that.

The problem is what happens if a legal firm or an agency targets you. Even if you adhered to the spirit of the law, they can dig up evidence that you didn't obey the letter of the law (since GDPR is quite loose and ambiguous).

Small tech owners can't fight such litigations. I am kind of baffled how this point evades so many people in this thread.

From the description Streetlend didn’t violate the GDPR in concept though. Addresses are public record, available in public databases, and there is nothing stopping you from doing lending eBay. All it needed to do was clear it’s records every 6 months and let people delete their accounts.

Except this isn’t really true. Streetlend made its money by selling your privacy data to advertisers through Amazon. So when you put up a power drill for lend, people would see power drills for sale at local shops, based on their online presence harvested through stuff like their Facebook account.

The really ironic thing about that this is that streetlab imagined itself “ethical” when it’s entire business model was selling your data...

The GDPR isn’t really that hostile to small business and it doesn’t require an understanding of law. You can hire a data protection officer at a legal firm for almost nothing, and as long as you follow their advice on how to pass audits, you’re really not in trouble.

That being said, the GDPR is really hostile toward startups trying to make money the same way Facebook and Google does. You need to have a massive legal department to do that, and Streetlend obviously did not. But is that really so terrible?

It may call for a new business model for the internet, and that may seem impossible right now. But do you remember when the EU outlawed environmentally shitty lightbuilbs and everyone said we were going dark because it was impossible to do anything else? Today 95% of lightbuilbs are LEDs because of that.

Startups will find a way to make money that isn’t selling your data.

> Streetlend made its money by selling your privacy data to advertisers through Amazon. So when you put up a power drill for lend, people would see power drills for sale at local shops, based on their online presence harvested through stuff like their Facebook account.

If you mean he just slapped some Amazon ads on his site to support his side project, then accusing that guy of "selling your privacy data" requires quite a bit of mental gymnastics and is a pretty dishonest description of the facts.

The blame here is wholly with the users for putting their data online in the first place (really, you can go a very long way with my.fake.name@gmail.com!) and especially Facebook for providing the framework that enables this all.

*edited for grammar

> The GDPR isn’t really that hostile to small business and it doesn’t require an understanding of law. You can hire a data protection officer at a legal firm for almost nothing, and as long as you follow their advice on how to pass audits, you’re really not in trouble.

So many contradictions in one paragraph.

> You can hire a data protection officer at a legal firm for almost nothing,

Failed reality check.

The massive legal team part is indeed the problem as it further entrenches Facebook and Google from competition in that space.

If what it says on the blog is correct then he is using affiliate links for amazon for similar products to what you search.

At it's core it is the most ethical a free service can make money (aside from donations). He isn't selling the data or showing personally targeted ads. (Of course it could be using some amazon plugin that does it anyway for convenience or from ignorance, but he can do it without it through amazon apis)

> Except this isn’t really true. Streetlend made its money by selling your privacy data to advertisers through Amazon. So when you put up a power drill for lend, people would see power drills for sale at local shops, based on their online presence harvested through stuff like their Facebook account.

Founder here. Streetlend never passed personal data to Amazon. It used the search term eg “ladder” and showed ladders on sale from Amazon. No personal data was passed.

>> You can hire a data protection officer at a legal firm for almost nothing

What? Define almost nothing. For small businesses it is a wishful thinking they can hire anybody from a legal firm. They probably don't even have a lawyer or a legal department as they can't afford such luxury.

> But do you remember when the EU outlawed environmentally shitty lightbuilbs and everyone said we were going dark because it was impossible to do anything else? Today 95% of lightbuilbs are LEDs because of that.

And now we are finding out LED lights are bad for our eyes and our sleep, so we may go blind sooner and die sooner.

Ok that might be a bit extreme, and besides there is an efficient incandescent tech that will probably come back and save us (and you can argue the EU helped that too)... but my point is the EU has good intents but their creations seem polarised into either extremely preemptive or extremely reflexive and are often premature and poorly thought out, fighting for something for the people but often without thought for how they will directly hurt the people.

For tech the EU isn't exactly unique in this respect though, the UK for instance recently tried to inact some pretty rediculous laws that undermine basic technologies that make the internet work.

>almost nothing

Yeah, I'll just get a small loan from my father.

> You said:

"From the description Streetlend didn’t violate the GDPR in concept though. Addresses are public record, available in public databases, and there is nothing stopping you from doing lending eBay. All it needed to do was clear it’s records every 6 months and let people delete their accounts."

> But the comment you commented on said:

"The problem is what happens if a legal firm or an agency targets you. Even if you adhered to the spirit of the law, they can dig up evidence that you didn't obey the letter of the law (since GDPR is quite loose and ambiguous)."

The issue seems to be that the resources required to resolve a delta - from Streetlend's pov - are perceived as excessive. Too much risk; not enough reward.

Look at what happened with Thiel and Gawker. Right or wrong is irrelevant if the opposition has deeper pockets and can bleed you to death (in legal fees).

> Startups will find a way to make money that isn’t selling your data.

Perhaps, that could be true. But plenty will not want to be caught in the crossfire in the meantime. And that too is a biz decision.

“can hire a data protection officer at a legal firm for almost nothing”

Out of touch with reality much?

Unfortunately there is no more site to prove it, but I would imagine something like this. GDPR on its own shouldn't be a problem for Streetlend, there was something more, users data releated and how to make money off them.

so is every site that uses affilate links selling your data? I didn't see anything else mentioned in the description.

You have to identify your data class which takes a lawyer. You have to assure that no data is held longer than 48 hours even telemetry without providing an export and delete function. You have to support level 4 data requests which will take a lawyer.

Just like all regulation its very doable but its way more cost effective for the big players.

I think your misunderstanding how his site worked. Where did you get that it sold private data to Amazon?

Could you share the name of a legal firm charging ‘almost nothing’ for a data protection officer? Because the ones I’m finding definitely cost more than ‘almost nothing.’

Ugh, sorry but no, the EU can't claim any credit for the success of LED lightbulbs.

They can take some credit for the dim and dimmer mercury containing CFLs, and the ludicrously expensive and somewhat unreliable early LEDs, if they like.

> the EU outlawed environmentally shitty lightbuilbs

when did that happen?

Here in the US you mostly see fluorescent energy saving bulbs, even though incandescent bulbs are widely available in the pharmacies and in the supermarkets. And that is because they are cheaper to operate: the market decided that, rather than a regulator.

>Startups will find a way to make money that isn’t selling your data.

It's hard to argue with statements like that. What if they don't? There are plenty of startups providing extremely valuable or fun services (like flightradar24 for example) that are supported by ads. After GM, Ford and Chrystler there were basically no successful auto startups in the US for 70 years. This regulation makes life for startups disproportionately harder than for Google and FB that already have an army of EU lawyers on payroll.

I have to make two points.

1. This regulation is specifically (deliberately?) anti small business. If your revenue is less than €20m their fine is up to €20m, i.e. can be 100% of your revenue, meaning bankruptcy. If your revenue is greater than €500m, your fine is capped at only 4% of your revenue, i.e. an acceptable fluctuation. It's worse than a regressive tax.

2. China also has many regulations. Instead if trying to extend their jurisdiction to foreign sites, they simply block them. I thought about this and I actually prefer the Chinese non-expansionist model: I would rather outsource due diligence to the Chinese government than hire expensive EU lawyers and then implement EU specific blocks.

FYI we do not collect any data other than for spam and DDoS attack mitigation, but apparently if you have any third party code in your site like ads you have to subject all of that to this expensive audit.

Well meaning regulation like this written by people who have never created anything pratical in their lives other than regulations illustrates why entrepreneurship in modern Europe is nearly impossible.

> If your revenue is less than €20m their fine is flat €20m

Rubbish, this is just spreading FUD.

From the UK ICO: "It’s true we’ll have the power to impose fines much bigger than the £500,000 limit the DPA allows us. It’s also true that companies are fearful of the maximum £17 million or 4% of turnover allowed under the new law.

But it’s scaremongering to suggest that we’ll be making early examples of organisations for minor infringements or that maximum fines will become the norm."

Look at the track record of the UK ICO - how many small businesses and side gigs have been fined £500k? How many businesses of any type have been fined the current maximum of £500k?

So where does this ludicrous assumption that everyone is always going to be hit with the maximum fine from here on in come from?

> If your revenue is less than €20m their fine is flat €20m,

As I posted elsewhere, this is NOT true.

>The $20 million fine is not automatically applied. Here's a flow chart which details the process of a GDPR breach: https://40uu5c99f3a2ja7s7miveqgqu-wpengine.netdna-ssl.com/wp...

>from https://www.i-scoop.eu/gdpr/gdpr-fines-guidelines-applicatio...

Compliance is trivial and involves steps that are already best-practices anyway. You won't need to split any atoms.

https://techblog.bozho.net/gdpr-practical-guide-developers/

The penalty isn't meant to be something you afford. It's a penalty. (It's a feature, not a bug.) I'm having a really hard time not being sarcastic right now but compliance with the law might also end up being an economical option worth looking into. Cheaper than lawyering-up for being sued by shysters for non-compliance, and cheaper than being penalized for non-compliance.

Mind you, taking whatever-it-is off the internet is fine too. I totally understand. What I don't like is all the whiny sanctimony and martyrdom. "Yes I'm taking my thing off the internet, but first I'm going to make a big deal about what a tragedy it is for the world." Um no. The fact that your thing is a "small business" means few people care about it. (Sad to say. More people care about Facebook than about you. That's why they're the big incumbent.) And it emphatically doesn't mean for example, that you're some hallowed, heroic underdog who deserves protection, especially when you won't even afford the same to your own users and their data.

> China also has many regulations. Instead if trying to extend their jurisdiction to foreign sites, they simply block them. I thought about this and I actually prefer the Chinese non-expansionist model: I would rather outsource due diligence to the Chinese government

Hell of a way to defend the most absurd and overreaching displays of censorship we see on the modern web.

> outsource due diligence to the Chinese government

That is easily one of the more absurd statements I've seen this month.

> Well meaning regulation like this written by people who have never created anything pratical in their lives

And websites whose customers advertising agencies, and whose product is people, create something? Attempting to track and then monetize everything everyone does online is _creating_ something now?

> 1. This regulation is specifically (deliberately?) anti small business. If your revenue is less than €20m their fine is up to €20m, i.e. can be 100% of your revenue, meaning bankruptcy. If your revenue is greater than €500m, your fine is capped at only 4% of your revenue, i.e. an acceptable fluctuation. It's worse than a regressive tax.

With the amount of creativity observable for inventing tax-avoiding business structures, I'm sure if the minimum clause weren't there, big players would quickly find a way to spread their revenue over dozens of small entities, each looking like a "small business" on paper.

So I'm not sure it would be even possible to make a regulation "with teeth" that explicitly exempts small players.

A related thread that you might find useful w.r.t to anti-small business biases in GDPR.

https://news.ycombinator.com/item?id=16909945

" This regulation is specifically (deliberately?) anti small business"

No, it is not.

"Well meaning regulation like this written by people who have never created anything pratical in their lives other than regulations illustrates why entrepreneurship in modern Europe is nearly impossible."

No, it doesn't. It demonstrates that far too many "entrepreneurs" are people who want to play fast and loose with regulations, and not be held accountable for anything.

According to this it is up to €20m: https://www.gdpreu.org/compliance/fines-and-penalties/

And you prefer China's policy of censorship over the EU's policies of protecting consumer's privacy. Well that's interesting.

> Small tech owners can't fight such litigations.

Yes. This I think is a downside of the law. Some small owners are going to have a more difficult time.

But this is true for any regulation like food safety regulations, construction regulations, etc. They hurt more a small restaurant than a big chain. But in the end, these regulations are there to protect the customers. Small restaurants have closed and will continue closing for not following food safety regulations. But what is the alternative? Is business creation the final goal of our society? Or there are things more important?

In summary, small businesses are going to have to extend their insurances to also cover risks related to GDPR. But it's the price to pay for having safer data.

TBH most food & construction safety laws are way more small business friendly than the GDPR. Food safety has a well defined relatively easy to follow rule set and food inspectors come in and give you a food safety rating, which you can work on and improve. It won't destroy a small mom & pop restaurant with a $million fine.

For construction, you build your building to 'code', an inspector comes in and stamps the building and then your done. If your not code compliant, then you can correct without much penalty at all, not get a $million penalty and you don't have to go to court or get lawyers. Making your own shack in your backyard isn't an arduous process as far as code compliance goes.

Since most software is constantly modified and edited, I don't think the construction model really works. More the food safety one or a data fiduciary one.

To me, asking a small developer with a site that gets a few thousands users to implement GDPR is like asking a dad to do full safety test on a toy car he built for his kid, just because a big company like GM had safety issues. The problem EU is trying to solve here are large companies like Facebook making monopolies and syphoning data. So why the hell do they have to impose rules on small hobby websites that run at a loss?

There's a huge chunk of the web that is filled with niche web tools, mostly made as a hobby, running for free. I myself own 2-3 such sites. Now, I'm forced to spend my hobby time adding a bunch of new features on a site that already loses money? I'm sorry but the couple thousand people that depend on this tool will have to find someplace else I guess.

HN sure loves to worry about AMP killing the internet, well to me this is far more dangerous. Can't wait for larger troll companies bullying small devs with lawsuits and killing all their competition using GDPR.

> But what is the alternative?

Status quo? Baby steps? Enforcement of existing statutes? Consumer education? Promotion/support of preferred alternatives? Codified small business leniency? Objective enforcement clarity?

I don't dispute the goal of GDPR -- I support it fully. My worry is that it could be abused by legal trolls. They are a fact of life.

>>But what is the alternative? Is business creation the final goal of our society? Or there are things more important?

The alternative is to let consumers fend for themselves, and if government is going to help, limit that help to investigating and punishing fraud, enforcing contract law, and providing free information resources to help consumers make better informed decisions.

Yes business creation should be the highest goal of society. New businesses are what counteract income inequality and drive innovation.

We need innovation to solve the already existing problems in society, that claim tens of millions of lives every year. There is no zero risk path open to society.

I'm not sure what GDPR is protecting me against that wasn't already covered by PCI-DSS and existing cybersecurity standards. Not being financially defrauded is the only thing i care about. For everything else is easy to avoid sharing personally identifiable data if it's really a concern.

I have a little birth control pill reminder iOS app I made like 7 years ago that I still maintain in the app store. I don't make really any money off of it but I keep up with it because it has a good amount of users. I don't THINK any of the GDPR stuff falls under anything the app does, but I sure as hell aren't taking any chances. I just removed it from any country that fell under "Europe" in the app store. I guess my point is I agree with what you're saying, and here's an example of a little hobby app that GDPR killed for EU countries. It's not worth my time, money, or risk to bother with it.

We (people who operate online services) are exposed to legal action already, but we aren’t worried about it because realistically there’s such little risk of being targeted. The same is true of the GDPR, the organisations responsible for ensuring GDPR compliance are going to have their hands full for years and years to come, by the time the little guys have anything to worry about the situation will be much better defined. I cannot see a scenario in which I’m going to be pursued because of accidental non-compliance with my revenueless service when there are so many large companies that can afford million dollar fines who can’t even store passwords properly.

if you’re so risk averse that any minuscule chance of GDPR noncompliance precludes you from running an online service... aren’t you already not running anything because of existing legal risk?

I'm a small business owner and this is my concern at all. What stops a competitor to just pay a lawyer to sue you or report you to GDPR authorities. Even if you are 100% compliant(which I doubt), you'll still have lots of issues, stress and wasted time with the audit.

> Small tech owners can't fight such litigations. I am kind of baffled how this point evades so many people in this thread.

Even if they could fight, why would they want to? There are lots of us with tiny things on the internet where the burden of maintenance is only slightly below the enjoyment we get making it available. Increase that burden and the costs are negative and things get shuttered.

Question, if I have a small thing and don't want to preemptively concern myself with GDPR, as a non-EU site operator can I tell an information requester "no"? Might I harm my ability as a person to travel to the EU? Ignoring the standard "if you do nothing wrong you have nothing to worry about" and "the GDPR is really easy to understand" arguments, and assuming I'm not wanting to do any real work, would it be wise for me to just add known EU subnets to my firewall?

Or, to put it another way: a big group of tech people who have no interest in protecting the data of their customers, preferring to be able to cut corners and do as they please with information that is not theirs.

There is nothing in the GDPR that allows for a person or lawyer to sue a company for GDPR non-compliance. All they can do is complain to the regulatory authority in their EU country, which has the sole power to issue fines. And if you're not taking care of my data, then I have no problem at all with you being fined.

After more than a decade of privacy abuses from almost all companies, I am perfectly ok with the collateral damage to start-ups, apps and personal projects that this law will cause, as long as it stops the abuse.

Society doesn't owe entrepreneurs a business model, but it does owe people a dignified life and some control over information that can be used to harm them.

I paraphrase: what most posters here seem to miss is that most chemist cannot be bothered to read up on environmental rules. It should be my right to dump toxic waste wherever I want, because I am a chemist.

Sorry, but society doesn't work like that. You are always responsible for your actions no matter if you earn a profit or not. And not bothering to read up is also not an excuse.

Companies take risks. This is just another one, that has to be managed like all other.

This is why regulation favors incumbents. The rules don’t help any individual company, so they won’t self-regulate, but the cost becomes a barrier to competition and innovation.

There were "legal matters" on the Internet before the GDPR. These scary rogue legal firms can already target you if they want, without the GDPR. Yet plenty of law abiding small Internet businesses existed yesterday and will continue to exist tomorrow.

I don't currently run a business online, but if I were, honestly I'd be more worried about the usual headaches like accepting payments legally, dealing with spam/fraud/abuse, finding product/market fit, etc. GDPR would be somewhere around 500th on my list of "start-up things that give me crippling anxiety."

... well, you set up a LTD precisely to limit liabilities in that catastrophic case scenario but you'd probably find that people "coming after you" will be proportionate to how much you have to come after ... I.e. if you're a guy with a side project that makes no money; you're unlikely to attract "parasitic lawyers".

Further, in my opinion the GDPR is wholesome. You ought to implement it even if it didn't exist. If your business relies on playing fast and lose with user data then IMO it's not an honest business ...

Further still, the worse punishment is 4%/20M; it's not the default intervention or anywhere near the only way that the GDPR will be enforced.

They don't even need to dig up any possible violations - just the legal process alone is enough to kill any side project.

Or, "You can beat the rap, but you can't beat the ride." For a small company or individual, even winning a GDPR case will be a Pyrrhic victory.

>he problem is what happens if a legal firm or an agency targets you. Even if you adhered to the spirit of the law, they can dig up evidence that you didn't obey the letter of the law (since GDPR is quite loose and ambiguous).

>Small tech owners can't fight such litigations. I am kind of baffled how this point evades so many people in this thread.

Isn't this the same with the other laws, like copyright,trademark, patents, software licenses? I could say the same about one of this other laws, like you may have a video of you doing something cool and a bit of copyrighted music could be heard in background then you coulg get sued by a big bad law firm, the difference is that in this case the regular citizens are protected and not the budget of big music publishers.

I'm baffled by the fact that people think you can be sued for non compliance. You get reported to a government authority that will address the issue.

The point to protect users, not to prosecute companies for operating. However, GDPR would be enforced if you just ignored it.

It really isnt such a big deal.

I am resisting a push into converting from an on-premise, installed product to a SAAS model for precisely these reasons. I don't want to be responsible for that liability, and I'm just the engineer doing the work. It's a minefield, compared to the way things were.

> The problem is what happens if a legal firm or an agency targets you.

Nothing. GDPR enforcement is carried out by each country's regulatory authority; they're the only ones who can sue, target or take action against you for non-conformity.

OP of the top-level comment here.

A lot of people here: please CHILL. You make me look like a histeric. Not what I had in mind.

- I don't want to become a semi-lawyer or hire a lawyer until absolutely necessary.

- I had 7 hobby projects where people could fill out full names if they wanted to.

- I deleted all of them -- apps and database -- without backing them up. Never served ads or trackers, never had a 3rd party JS on any of them. Unless somebody had unfettered access to the VPS-es without me knowing it, I never leaked personal info.

It's a very simple cost calculation: I don't even want to invest 2 hours in reading the GDPR in details nor do I want to rework the hobby projects to encrypt the personal data in the DBs, hence I refuse to be a part of the abusing privacy problem and delete anything that might have gathered any personal data. I believe in the GDPR and this was my way to at least not contribute to the problem.

Seriously, what's so unclear? You can repeat to me that "knowing laws and protecting from bogus lawsuits is a fact of life" but it doesn't have to be before I have a business -- which I don't. So I still respectfully disagree that I have to learn legalese today.

So seriously, don't get so worked up over a comment that expresses a sentiment that I want to become more law-aware only when absolutely necessary and not a minute before that.

Geez.

Encrypting all user data doesn’t get you out of the gdpr if you hold the key to decrypt the data.

Are many US based businesses considering limiting access to EU consumers to avoid GDPR? Reselling user data seems to be part of many business models, and I don't know if EU is such a huge market internationally, especially without UK. I support the goal of improving data privacy, and in general GDPR is seen positively by those I've talked to, but the EUs last attempt resulted in useless, intrusive cookie warnings all over the place.

> [...] there is a big group of tech people that have no interest in dealing with legal matters more than the bare minimum, and overall deem them risky.

Then maybe those people shouldn't be opening side businesses? Running a business implies having to deal with business matters which include legal.

For example in Switzerland if I want to open a small cafe in the corner selling home made cheesecake, I'll have to first figure out what the exact regulations in my state are, obtain a permit for opening one, create a "Hazard Analysis and Critical Control Points" concept and send it to the authorities, make somewhat sure I get accounting right, maybe getting a permit for infrastructure changes, etc.

I'm not talking about GDPR especially because I don't know enough about it yet. And in general I am sceptical of laws and regulations that don't seem absolutely necessary.

What I don't get is why anyone should care that some tech people running a business don't want do deal with legal like everyone else? What makes us so special?

> You can generate a key for each user on creation and have their data encrypted with it. The problem is NOT that.

This is still debatable, because what if in near future your encryption turns out to be weak and all the personal data become readable again? Things like this... This law was really not thought through.

>> The problem is what happens if a legal firm or an agency targets you. Even if you adhered to the spirit of the law, they can dig up evidence that you didn't obey the letter of the law (since GDPR is quite loose and ambiguous).

As I understand it, you will be able to appeal or somehow else address the European Data Protection Board, that will be tasked with ensuring the consistent application of the regulation:

Coordination and Consistency

Under the Directive, there has been a certain level of coordination in interpretation and enforcement. Apart from informal contacts among authorities, there has been a succession of non-binding opinions issued by the “Article 29 Data Protection Working Party,” an advisory committee comprised of representatives of the national supervisory authorities (commonly termed “data protection authorities” or DPAs), along with the European Data Protection Supervisor appointed by the European Commission. Under the Regulation, that group will become a more independent and powerful regulatory body called the European Data Protection Board, tasked with ensuring “the consistent application” of the GDPR. An entire chapter of the Regulation (Articles 55-63) is devoted to cooperation and consistency, with procedures for multiple DPAs to coordinate investigations and promulgate consistent decisions and policies reviewed by the Board and reported to the European Commission.

One feature of coordination that should be helpful for multinationals is a provision for companies to work with a “lead supervisory authority” in the country where the company has its “central administration.” That authority will then coordinate with the authorities in other countries where the company operates, attempting to achieve consensus on issues that affect all of them.

https://www.infolawgroup.com/2016/05/articles/gdpr/gdpr-gett...

Block all European IPs. It's just not worth the risk.

Can anyone give an example of a company that has been targeted by legal firm or an agency ? All I know about it patent trolls. So how would these legal firms make any money from the GDPR !?

Form a limited company and run the site from that. If you're prepared to shut the site down anyway, then that remains the worst thing that can happen for non-compliance.

There's no need to shut the thing down just in case someone sues you when that hasn't happened yet.

On the other hand, there's a good reason to shutter your site because you don't have time to make it respectful of people's privacy. By all means, shut down your site because the GDPR makes you realise that! But that's not what OP is saying.

>Look, it's not hard to encrypt all personally identifiable information; there are ready-made frameworks that let you choose which DB columns you encrypt and how. You can generate a key for each user on creation and have their data encrypted with it. The problem is NOT that. The problem is what happens if a legal firm or an agency targets you.

The problem is also not botching the encryption process -- and relying blindly on some "ready-made frameworks" is a sure-fire way to do that.

Yeah, that's what I was talking about couple of weeks ago here. I was afraid that GDPR will stifle innovation and it's just a beginning.

GDPR is highly vague omnipresent regulation with huge strict fines. It's like infamous cookie law times a million.

They could make it into a good law, my opinion on what should have been done:

Keep good parts, such as:

- Appoint official 'security' representative who're responsible for breach disclosures, promoting security practices etc, that person can be personally held responsible for shifty company behavior (though nothing draconian) like non-disclosing a breach, so they would be motivated to be on user side in the company.

- Let users ability to download their own data

- Let users clear way to tell company that they want to stop using their account (and related data gathering)

- Mandate more open disclosure of what is done with data gathered from users

And also:

- Mandate easier ways to review EULA and changes to EULA (like each change should be available separately, describe what changed and why)

- Create system of centralized disclosure of security vulnerabilities by third parties, with record showing request and response publicly after some time. Maybe also create some system of grants for third party penetration testing for larger players in the internet.

- Split available data into categories, like 'non-sensitive data', 'sensitive data', 'highly sensitive data'. Medical records, financial records etc is highly sensitive and higher standards are applied. Email and name is non-sensitive data (so you could run a simple forum, or any other simple free service, where you only want email from a user, without being afraid).

- Split companies into tiers, under 50 employees or 100000 users nothing applies; 51-1000 employees higher standard applies; over 1000 - full power applies. This also should be tied with previous point - for example, smallest tier company should still be responsible for some rules if they deal with highly sensitive data, and if it's largest tier company they should be following some rules even if they only deal with non-sensitive data.

- More sensible fines. For example 1% or $100k, whichever is smaller for the first time, 2% or $1m second time etc. Designated security officer can also be held responsible in the same manner (like, % of salary and later being forbidden to work as a security officer). It can also be tied to tiers of companies.

- Start applying law gradually, beginning with just applying it only for european countries.

I believe that would keep benefits for users and won't create giant problems for the industry as a whole.

Why would a small, unprofitable website be the target of an opportunistic legal team?

The law is not even in effect yet. The persecution you're talking about is imaginary. Those of us having trouble being so imaginative probably tend to prefer waiting for evidence.

Ok, then don't comply and shut down, but I don't see what's ambiguous about the GDPR in this context. Also, they goal of the EU is not to fine the hell out of small businesses; it's compliance. Companies found to be out of compliance will be worked with and an attempt to conform to the spirit of the law shows good faith.

This article sounds a lot like sour grapes and shows no real attempt to actually figure out what compliance would look like.

> The problem is what happens if a legal firm or an agency targets you. Even if you adhered to the spirit of the law, they can dig up evidence that you didn't obey the letter of the law (since GDPR is quite loose and ambiguous).

And in that case the regulator would write you a letter asking you to fix it. At that point you have the choice to fix it, or to write back and explain why you can't fix it now. Or you can ignore the regulator, which may lead to a small fine.

That’s why I would think that no matter what you do you’re probably still technically exposed so not to worry.

What’s the upside for a legal firm to target you? You’re not going to pay fines to them, right?

You aren't willing, so you exit the market. Someone else will come along, who is willing, and fills the need while respecting people's privacy. Everyone wins.

Considering one can be sued for just about anything, or accused of patent infringement for just about anything in tech, the fear of litigation isn't a compelling argument.

Probably because, compared to the status of legal matters in the US, blaming _europe_ of all places for being legally murky is just mind boggling.

The GDPR is about 68 to 90 pages depending on which language you're reading it in. It is trying to be futureproof by leaving measures defined in terms of 'current state of technology', 'reasonable security considering the risk' and other such ambiguous terms.

I run a small business and I like this. Just about anybody can read it and understand what rights and requirements are being set out in it.

The GDPR specifically refers to the concept of "micro, small and medium-sized enterprises" [GDPR 40p1 and 42p1 use this text; they direct member states about the spirit of the law, referring that the needs of such businesses need to be taken into account].

GDPR 58p2 sets out that regulatory bodies in a member state have the power to issue warnings. As in, if you mess up, unless the mess-up is malicious or excessively negligent, you get a written warning and reasonable time to fix the problem. My government (The Netherlands) has taken the effort, as have a significant number of third parties, of creating a legal document of 3 to 10 pages covering some details, and they generally set out more explicitly that you grant yourself a week or so to fix problems without penalty. Whilst the GDPR is intentionally ambiguous in order to try to be somewhat futureproof and remain short enough to read back to back in an afternoon, it's fairly clear this is perfectly fine.

The most strenuous sections of the GDPR involve requests from those whose data you store. If they ask you to supply what data you have of them, and whom you've shared it with, you have to comply. Within reasonable timeframes, and you cannot lie about it. If they ask that you delete this data, you must be capable of doing so, and you must do so within a reasonable timeframe. However, the GDPR is nice enough to grant you exceptions for reasonable measures which nevertheless make it hard to comply. Things like a backup tape are specifically called out. It's okay if data that's been requested to be removed, stays on those. You would have to show that this data is pseudonimized (GDPR-ese for encrypted, pretty much).

Any service which has a hard time supporting requests to explain what data you store and where you've stored it, or which cannot delete it from the main service on demand... should indeed just call it a day and shut down. I don't think a service like streetlend would have a hard time supporting such requests, however.

> The GDPR is about 68 to 90 pages depending on which language you're reading it in [...] I run a small business and I like this. Just about anybody can read it and understand what rights and requirements are being set out in it.

I don't run a small business, I make small things on the internet, this is not why I got into tech, I don't want to read 68 pages of yuk. If I made a small site that saves some user data i'd just pull it down too, I don't want the burden of worrying about being sued for some small thing I created, you just wont have it anymore.

FB fucked it up for everyone, ultimately people gota learn that when you give data to someone you implicitly entrust them with it. FB had to go and be evil and now the EU is overreaching demanding everyone spend their time bubble wrapping everything... everyone backing them up are the village people taking to the streets with torches and burning shopkeepers after the king was found doing witchcraft. Go burn the king.

> this is not why I got into tech, I don't want to read 68 pages of yuk

One of the goals of this law and similar efforts is to make it clear that you need to consider the social, ethical, and legal ramifications of the things you crate. You are not creating neutral things in a vacuum; there is no neutral ground in a burning world[1]. That "small thing on the internet" might be reuniting families that were separated by work or politics, or it might be undermining the support structures of an entire industry or community. Maybe you are creating a social space*, which includes a duty to manage that space to keep so it doesn't become a tool of abuse[2]. Maybe your small site stays small. Obviously you cannot be expected to foresee every potential consequence of your creation, but you at least need to make the effort and catch the low-hanging fruit (e.g. the basic privacy features enforced by the GDPR).

[1] http://opentranscripts.org/transcript/no-neutral-ground-burn...

[2] http://www.gdcvault.com/play/1024060/Still-Logged-In-What-AR

Arguing the EU is overreaching in demanding basic protections its citizens data, and that the only people who support it are... rioters (?) is a pretty vacuous and idiotic argument to make.

If you're making something that stores personally identifiable information outside of what you need, and don't care enough to secure it or offer ways for a user to manage that data then yes, take it down. Good riddance.

Or, just don't store that data in the first place. If you're storing usernames, passwords and the like then you have nothing to worry about.

> FB fucked it up for everyone

Nah, just for companies that trade personal information as if it was cattle feed. As an individual, I have no problem with the GDPR.

If you won't handle my personal information with proper care, you should shutdown or get sued out of existence.

Cheers.

If your small site is saving all that user data in an unsecured S3 bucket then yeah, pulling it down seems like the right idea.

"If I made a small site that saves some user data"

Then you already had a ton of legal obligations, you were just not aware of them, since only now everyone is talking about the GDPR.

"FB fucked it up for everyone"

A lot of the things people are complaining about right now were already illegal, before the GDPR. People were just not caring about it.

> FB had to go and be evil and now the EU is overreaching demanding everyone spend their time bubble wrapping everything

What you call overeaching other's call protecting the interests of consumers.

> [...] If I made a small site that saves some user data i'd just pull it down too, I don't want the burden of worrying about being sued for some small thing I created, you just wont have it anymore.

Actually I think that's a good thing then.

If you think you can understand the GDPR by reading it, that's merely proof you haven't read it.

Questions without answers in the GDPR:

* how to carry out a legitimate interest balancing test

* who is your lead regulator (do you have a lead regulator?)

* When do you need a DPO (large scale is left undefined, as is systematic)

* How reasonable will any particular regulator be towards inadvertent violations

* what precisely counts as the required technical and organizational measures in art24

* how do you define what is one purpose and what is two purposes?

That's the nature of law. It's a set of principles, it's not black and white in the way techies want the world to be.

Painful when needing to implement? Absolutely (not my favourite either, I want definite answers). The way it is? Yes.

DPO turns almost always into always in the EU because you got more than 10 people that work in HR or Work with Customers.

what happens if someone enters identifying information that you did not ask for, e.g. users who use their real name instead of (pseudonymous) username

> The GDPR is about 68 to 90 pages depending on which language you're reading it in. It is trying to be futureproof by leaving measures defined in terms of 'current state of technology', 'reasonable security considering the risk' and other such ambiguous terms.

1 page or 1,000 pages, most people are not in a position to accurately interpret it and understand what does or does not comply.

They would be if they read it. Every complaint I've seen about how the law is obviously going to be misapplied is called out specifically in the text in a way that makes it a non-issue.

They went to great effort to make it readable and not full of legalese, you are really only doing yourself a disservice to not at least try.

As far as I understand, to make this site GDPR compliant you would have to:

1. Get consent when someone creates an account, saying what you do with the data including how you make automatic decision (e.g. which amazon pages you recommend).

2. Allow people to unconsent/delete accounts

3. Have a page that allows a user to download their data.

4. Have a way for them to fix mistakes in that information

That doesn't seem that burdensome. In fact some flavor of that is pretty much what you get with standard a standard create account/view account/change account/delete account workflow.

You know, until someone opportunistically sues you using a legal firm that costs the plaintiff nothing, and then you're out the cost of getting a lawyer and trying to defend that all of your actions and interpretations of the GDPR are correct. And if your business is already small/not making money, you're adding to the hole you're already in.

Which, you know, the guy directly cites as the reason he's shutting down if you actually read the site.

There's plenty of ambiguity in the GDPR, especially around logging, backups, and third parties (e.g. login through Facebook/Twitter/Google, you know, that thing that five years ago everyone was trying to sell at the way to do user authentication). This guy just decided it's not worth the potential of being sued while we wait for the dust to settle on how those ambiguities shake out (because, honestly, the only way we're going to get those cleared up is if someone is sued and they're made clear by case law).

Unless I'm mistaken, you can't actually sue over your interpretation of the GDPR. You can report companies to the appropriate authority, who can then investigate, and with whom you can communicate. Just like the many other authorities of the kind[1].

[1]: https://www.citizensadvice.org.uk/consumer/get-more-help/how...

No-win-no-fee lawyers don't just take any case that walks through the door.

The expected value of the case to the lawyers is the probability of winning, multiplied by the minimum of the expected award and the resources the defendant has available to pay, multiplied by the fee percentage that the lawyers are charging, minus the costs involved in litigating the case.

In the cases we're considering here, the probability of winning is low, the expected award is low, and the resources available to the defendant are low. They're simply not going to take them on.

Sue you for what? Gdpr grants no new right to sue. The only thing that's changed is that if someone emails you saying "delete the stuff on me please" you have to do so unless you have a good excuse. And if you refuse, it goes to arbitration and if you refuse unlawfully, you get a fine.

All you have to do to be Gdpr compliant is delete user data when asked. There is no "trap card" provision.

Incorrect. That "someone" cannot sue you over a GDPR claim; only the national entity responsible for that can take complaints, which they analyze and emit a fine if deemed appropriate.

Do you know of a good place to read about the GDPR and backups?

My concern has been the account deletion provision. Does the GDPR expect us to be able to go back and modify past backups? Years-old tape archives?

> You know, until someone opportunistically sues you using a legal firm that costs the plaintiff nothing, and then you're out the cost of getting a lawyer and trying to defend

This has always been true, nothing has changed

No, EU is not USA, it doesn't work this way here. You can't sue companies for violating GDPR directly as a person, you can only write a complain to authorities that will decide how to proceed (issue a warning, start an investigation, issue a fine etc.)

It's more complicated than that.

Want to host the data on aws? You need a documented data processor agreement with them. Same thing with cloudflare and any other service you might want to use.

Want to use google analytics or some other javascript? Those cookies aren't required so you need a way to let users opt-in to using those cookies. And opt-out and delete any third party cookies. I'm still not clear on how the regulations expect you to delete third party cookies.

Amazon affiliate links also aren't necessary to use the service, and that sets cookies. Have to get consent before users can click on those links.

Don't forget that ip addresses are considered personal data.

And all of this might have to be written down and documented per Article 30 as well. The organization is smaller than 250 people, so that might be an out, but people are using the site daily so one could argue the processing is not occasional.

> Amazon affiliate links also aren't necessary to use the service, and that sets cookies. Have to get consent before users can click on those links.

Assuming that these cookies are only set after clicking the link, and that there is no personal information in the links, then what is the problem? In any case, Amazon setting cookies is not your problem, it is Amazon's.

What is a good primer and checklist on this law?

The whole point of the law is to destroy the business model of people using Google Analytics, Google AdSense, Amazon affiliate links, etc.

So that maybe someday we'll have a web without tracking again.

Be careful about interpreting the law if you aren’t a lawyer: 1) IP addressed aren’t a personal identifier since more than one person can use the same IP 2) Google analytics is a processor of data and the general consent you get from your users can grant you the ability to use google analytics since its use helps you enhance the site and make a better user experience 3) You need a data processor agreement to provide access to data that the processor has collected on your user’s behalf. Given you run your aws services, that should be straightforward to provide access.

Saying that some data that you enter will be shared with Amazon, doesn't seem all that far from reasonable expectations and shouldn't need to be codified in law anyway. So number 1 should be there already.

Number 2 could be an "email me if you want your account removed". This will trigger like two emails a year, and you just run a DELETE FROM command. If it becomes more, you make a page.

For numbers 3 and 4, see number 2. I expect that this won't be much either.

The page doesn't mention a single thing that would be a good reason to quit over GDPR. I think the author was looking for a reasonable-sounding exit, especially since he was operating at a loss (and apparently cared about it, since he was cooperating with Amazon to begin with).

What were the previous data protection laws in the UK anyway? In the Netherlands, none of the 4 points above are new. Our data protection law from 2001 also required all of this.

It's just some guy's side project. He probably doesn't make any money on it, doesn't care about the tech stack (which is from 2013), doesn't want to pay a lawyer for advice, and couldn't be bothered working out how to package all the data for release to users.

If you administer a free service that takes an hour a month to keep running, and suddenly you're faced with an immediate upfront time cost plus the likelihood of spending many more hours every few months responding to user requests, shutting your service down might be a rational decision when you would otherwise have kept it running.

Poster indicated they weren't making money on it. If you're already operating at a loss and have been for years, the GDPR can be an easy way out .. and if you're literally not making anything and working a full time gig, any changes (even these seemingly trivial ones) do increase the burden to where it's probably not worth it.

So the owner might be making an excuse, yes, but I don't blame them as it seems like a legit way out if they wanted to close up.

How does one revoke consent from an immutable interaction log, like a blockchain or distributed version control system?

You don't.

Are you going to purge all your logs of IP addresses, since those are considered personal information too? Also if your website is ad supported in any way, are you sure they are in compliance, or will you get nailed because your ad provider wasn't completely compliant?

https://www.ctrl.blog/entry/gdpr-web-server-logs

"All of these logs contains personal information by default under the new regulation. IP addresses are specifically defined as personal data per Article 4, Point 1; and Recital 49. The logs can also contain usernames if your web service use them as part of their URL structure, and even the referral information that is logged by default can contain personal information (e.g. unintended collection of sensitive data; like being referred from a sensitive-subject website).

If you don’t have a legitimate need to store these logs you should disable logging in your web server. You’re not even allowed to store this type of information without having obtained direct consent for the purposes you intend to store the information"

Are you going to either 1) completely disable logging on your webserver or 2) ask for consent just to use a default Apache/Nginx logging configuration? The law makes no technical sense.

Did you miss the whole part of that blog post that talks about legitimate interest?

> Are you going to either 1) completely disable logging on your webserver or 2) ask for consent just to use a default Apache/Nginx logging configuration? The law makes no technical sense.

3) Change your webserver not to store IPs or to delete them relatively quickly?

The default Apache/Nginx configurations aren't suitable for production in many other ways but most distributions ship them with log rotation enabled which would prevent this from being a problem in the default install.

You can ask for consent (a trap page) and block access if they don’t give it to you since you need access logs to operate the site.

That's a solid 50 hours of engineering and QA. At a $75/hr contracting rate, that is $3,750 (50 * $75/hr).

And that's just the engineering work. The website owner cannot know whether or not the engineering work and website meets the requirements of GDPR by himself. He does not have the ability to interpret the GDPR policies. The website owner would need to consult with a compliance lawyer or expert to assess the website for compliance. I would guess it would take a lawyer 10 hours at minimum (assuming the lawyer is a GDPR expert and already knows GDPR in and out) to assess a website for GDPR compliance, billed at a low $250/hr is $2500.

It’s worth noting that HN doesn’t comply to any of the 4 points. Should we should it down? I don’t think so.

Sorry for asking this,What is "their data". Ipadresses, page visit history ?

I agree, this guy seems just to cry with no clear reason whatsoever

This is an incredibly unfair conclusion. Beyond the time it would make it to make the actual technical changes, he's right in saying that GDPR is written in a very ambiguous way that is going to open up the possibility of litigation that smaller shops will not be equipped to absorb. He's made a calculated decision that for him personally it is not worth the additional legal/financial risk to continue operating the business. GDPR is complicated and we dont know what the enforcement side is going to look like yet.

The guy apart from crying without ever having read those 80 pages (english language text), doesn't see the big picture. The fact that I can force Facebook, Google, etc. to tell me what they are doing with my data (which I btw had given consent to treat like yesterday's newspaper), and subsequently asking the various Cambridge Analytica's the same question, gives the people a power they never had.

Now they do.

He wants to leave the game? Feel free! He wants people to be completely powerless? Well.. the kitchen has a door. Feel free to open and leave if it gets too hot.

How many times i have seen comments comparing civil engineers and software engineers and the liabilities each have.

Civil engineer failing to comply with regulations ending up in jail vs. software engineer well, doing nothing if his software does something wrong.

So welcome to the future where software engineers will be held responsible for what they create. I think it's right direction. And don't start with 'hackers playing for fun with side projects will no longer be able to do this'. It's same for engineer building a shed in his backyard. No one will have problems if he has not done load calculations and is using that shed by him self. Only difference is that if you put it on the internet it's like building that shed in a public park. And then you have problems if you don't think what you are doing.

People die when a civil engineer messes up. Most people don't die from a website.

Really depends on the mess up. You mess up and leak confidential info to an ex-boyfriend? Well, here you are contributing to the stats of women killed by their partners.

If software didn't have strong real-world implications the entire software market would have been just a subset of the gaming market.

I'm not a regulations fan but for me, it feels simply like something obvious materializing.

That does not mean that software has no real world consequences. Otherwise, why would people be building software ?

There's a reason companies which are 100% software can be valued in the billions of dollars. Their software has huge, very real consequences.

What if the software we interact with causes stress? Stress kills, just not in the same visible way as a bridge falling down.

> Only difference is that if you put it on the internet it's like building that shed in a public park

The difference here is that code published online has no assurances of being correct or adequate to the task.

Someone building a shed in a public park is, as far as I'm aware, generally not a regular occurrence and certainly you'd agree that a building on public property could be reasonably assumed to have been built to some sort of safety standards by a public body. There's a tacit agreement that, if I enter such a structure, I can reasonably assume it won't collapse on me due to poor design.

Code, on the other hand, is published online by hundreds of thousands of developers everyday. No reasonable individual can expect that any selection of that code is likely to contain anything that can be considered production-grade. Why are we taking the liability from the irresponsible corporation whose service gets pwned because they didn't review my shitty experimental crypto before using it?

Even popular and well used libraries and software shouldn't be held to this standard. You're expecting people who are building something in their free time to bear legal responsibility for the mistakes of an organization who is paying nothing to use their software. That's beyond not fair -- that would absolutely kill open source software and completely ruin the current ecosystem where a single developer and huge enterprises are on a similar level from an access-to-technology standpoint.

Do understand, that my comment here was about software handling personal information. And not software it self but companies using/writing that software.

"Perversely, this new EU law hurts small and ethical startups, but helps reinforce the dominance of Facebook, Google and Twitter, who are able to prepare and defend themselves using established legal teams and cash reserves, and who now face less competition from startups."

This bit is true. If the startup I work for had not turned profitable in the years leading up to GDPR, we would not be able to compete in this space anymore.

These comments are just ridiculous.

If your business is on such shaky ground that straightforward changes required by GPDR are going to cause your business to collapse then you have bigger problems. Because one employee suing you or your rent increasing will also cause you to collapse.

It seems like more research into GDPR could have prevented this.

Firstly, there's nothing this site does that is so unusual. If the user gives explicit and informed consent for their data to be used in this way, then you are likely to be covered.

Secondly, it's looking unlikely that the rules will be enforced that strictly in the near term, especially against a small, hobby website. IANAL but you likely have a couple of years until you have any chance of being on the ICO's radar (ICO is the UK's enforcer). And even then, you can reasonably expect the find to be << €4M.

Thirdly, if you run this site from a limited company (about £100/year to maintain), then the very worst case would be that you are investigated under the GDPR in the future, and you can fold the site then at which point your liability ends. No need to do it now, in fear of something that may never happen.

I hope it's not too late to change your mind about shutting down!

I am currently working in one of this multi-$bn companies. They run/are preparing GDPR.

So far I haven't found ANY person who has read the full 80 pages. Everyone is asking eveyrone else, they download whatever presentations they find on the internet, but NOT ONE have bothered reading the damn thing.

It will be a massacre for many companies, only because very few do their homework.

"...then you are likely covered." "it's looking unlikely..." "...run this site from a limited company..."

I can understand why a small project that isn't immediately profitable can take a look at the uncertainty and say, "no thanks."

Unfortunately for you, the ICO was directly asked about this and responded that they do not envision a grace period

> Steve Wood, ICO Deputy Commissioner: Will there be a grace period? No. You will not hear talk of grace periods from people at the ICO. That's not part of our regulatory strategy.

Couple of video game services are also shutting down due to GDPR

Super Monday Night Combat wich was developed in the US by Uber Entertainment [1]

Ragnarok Online terminates the access from Europe. They are in Korea. [2]

1 https://steamcommunity.com/games/104700/announcements/detail...

2 http://blog.warpportal.com/?p=10892

Super Monday Night Combat has very, very few plays on steam[1]. Likely was not worth any development time to fix it up.

1. https://steamdb.info/app/104700/graphs/

Sure, but isn't that a huge chunk of the web. Full of small games, services and tools that are only used by a handful of people, but those people enjoyed that thing. Just because it's niche doesn't mean it's useless. Just because Facebook has 10 orders of magnitude more users doesn't mean it's 10 orders of magnitude more useful.

There are plenty of devs out there who were running things probably at a loss, but for the sake of their community and users. Sure a few bug fixes here and there was a pain, but it was so small that it was worth it to make a couple people happy. Now they have one big reason to not keep it up.

I have a feeling a number of more services are going to announce they are cutting of access to the EU as we get closer to the deadline.

I run a site targeting north americans. I get a tiny number of european visitors. Should I be cutting them off? It’s not a market I target in any way.

I don't really understand why. They just should not collect real names or any other personal information and then they would be fine.

Not really. The GDPR covers "personal data," which is much broader than the category of "personally identifiable information" that other legislation covers. A user identifier, even if opaque and not related to any personal information, counts as personal data.

IP addresses are PII. Your Apache logs with default configuration already are in violation of GDPR if they log visitor's IP addresses.

I admit to being baffled as to why they shut down. If a user of the service has given permission for their location to be shared on the 'nearby' map, then they still comply with all the legislation because they have tacit permission from the user that their location will be shared with others.

If the user then decides NOT to share their location or want their data deleted entirely, then the as long as the site stops sharing their location or removes their data completely (within 30 days), then they are still GDPR compliant, AFAIK.

EDIT: Sounds to me like a side project started getting a little unwieldy or had too much technical debt for the developer to manage, and he decided to shut it down using GDPR as a vague justification?

They explained why. Obviously you may still disagree, however their opinion of acceptable risk is subjective (ie it's silly to tell someone what their tolerance for risk should be).

> GDPR threatens website owners with fines of 4% of turnover or €20 million (whichever is higher) if they do not jump through a number of ambiguously-defined hoops. The law, combined with parasitic no-win-no-fee legal firms, puts website owners at risk of vindictive reporting. Young websites and non-profits cannot afford legal teams. Therefore the risk posed by GDPR is unacceptably high.

> Perversely, this new EU law hurts small and ethical startups, but helps reinforce the dominance of Facebook, Google and Twitter, who are able to prepare and defend themselves using established legal teams and cash reserves, and who now face less competition from startups. The EU Cookie Law, EU VAT regulation and now the EU GDPR are all examples of poorly-implemented laws that add complexity and unintended side-effects for businesses within the EU.

> he decided to shut it down using GDPR as a vague justification?

That's my theory as well.

It's just too bad that he drags GDPR through the mud with this as well, since there are indeed a bunch of people (just like anyone can, apparently be against net neutrality) who would prefer things to remain lawless. They'll point to this article as justification, after which the other party will have to go and read it thoroughly and attack its points, and win that sub-argument, before they're even back to square one with the original discussion.

can he provide a list of all 3rd parties he's ever shared that data with? probably not?

Unfortunately the European Union's new GDPR (General Data Protection Regulation), introduced on 25th May 2018, creates uncertainty and risk that I can't justify taking.
GDPR threatens website owners with fines of 4% of turnover or €20 million (whichever is higher) if they do not jump through a number of ambiguously-defined hoops. The law, combined with parasitic no-win-no-fee legal firms, puts website owners at risk of vindictive reporting. Young websites and non-profits cannot afford legal teams. Therefore the risk posed by GDPR is unacceptably high.

Perversely, this new EU law hurts small and ethical startups, but helps reinforce the dominance of Facebook, Google and Twitter, who are able to prepare and defend themselves using established legal teams and cash reserves, and who now face less competition from startups. The EU Cookie Law, EU VAT regulation and now the EU GDPR are all examples of poorly-implemented laws that add complexity and unintended side-effects for businesses within the EU.

Can anyone in the EU actually comment on the content here? This seems completely out of proportion with everything I have heard about the GDPR.

Given the authors stance on data privacy and accessibility, I am somewhat glad that he is shutting the site down.

I'm working on GDPR compliance at the moment, as are many of my friends here in the UK. Even people in non-IT jobs have been involved or had training, so awareness is high.

The figures cited above are correct, but the consensus from people I've spoken to is that the maximum fines would only be for the most serious breach. It's hard to imagine a small non-profit being fined €20 million. That said, people are taking it seriously.

I can't help wondering if the owner of Streetlend has just decided it's not worth maintaining at a loss anymore and decided to take a swipe at GDPR. I can't know that of course. However what seems fairly inevitable is that technical, commercial and legal changes will come along now and then and it takes real work to adapt. I don't know of any company/organisation that is motivated to keep running but didn't try to comply with GDPR.

I tend to agree, seems a little sour. (and now I'm sounding a little judgy)

https://www.borroclub.co.uk is managing (so far) to compile to GDPR.

I'm unsure of all the negativity regarding the GDPR here.

GDPR compliance is catching up with your project's "ethical debt" in much the same way as a project sometimes has to deal with a "technical debt". If it's unimportant, it's of no concern. If you kept up with good practice, it's of no concern. It's only if it's important and you let the debt accumulate that it could potentially be a problem.

> GDPR compliance is catching up with your project's "ethical debt" in much the same way as a project sometimes has to deal with a "technical debt".

This is needlessly polarizing. I don't have any ethical issues with a service not letting me delete my account or download all my data. Sure, it's nice, but it's not an ethical issue if they don't. I also don't have issues with services processing and analyzing _their_ data (it's not my or our data) any way they choose without notifying me.

It's not an ethical issue for you, but the world is made of many other people, and it is an ethical issue for them.

I don't get the hand wringing. If you have an image sharing service you will have to contend with child pornography. If you have any content sharing service you have to deal with copyright infringement. You need a lawyer to create a company. If you do open source you will often put a license file in your github repo.

Tech has already and will continue to interact with laws/lawyers. At some point open source libraries will appear to streamline compliance. For now it sucks but ya gotta muddle through or call it a day.

In the first two cases, we generally don't. Or didn't, until recently. DMCA is very push-oriented: You get a takedown notice specifying certain URLs, you take down that content. Compliance solved!

GDPR requires restructuring of applications to keep data on a temporary basis with the consent of the users, to remove data after the fact, to selectively restore, and to allow users access to their own data. These are proactive steps required, and while applications written in the next six months will be built with those requirements in mind, it's still a fairly large burden for business-as-usual applications.

Totally, but there are unlikely to be many ways to structure the law to give users consent over their data and not burden business as usual. Even responding to DMCA requests is burdensome. You can automate it like Google has tried but it fails sometimes and has become a major technical and personell challenge.

I don't want to trivialize compliance. Even ostensibly simple requirements are never quite that, and every second spent on them is time not spent on your product.

> GDPR requires restructuring of applications to keep data on a temporary basis with the consent of the users

The GDPR requires mostly that you document what data is stored and how, and that you have a legitimate reason for doing it this way. Consent is not necessarily required.

> to selectively restore, and to allow users access to their own data.

So, you get a takedown/access notice, and then you take down/show that data. Compliance solved.

Is there any kind of blanket CYA waiver that we can put on sign-up pages like "if you're an EU citizen, sorry you can't use this site because GDPR. Definitely don't click 'sign up' below anyway" ? What is the opt-out criteria for a site?

No, waivers don't make personal data of EU disappear. Just like you can't put a waiver on front of a restaurant and start poisoning people with in unhygienic food, you also can't just waiver yourself away from being responsible with users data.

However, they are making it clear they are not attempting to serve EU users. Which means they are not covered by GDPR.

Interested in finding this out as well. So far, not a single thread discussing GDPR on HN made this explicitly clear.

That's part of the fun. It is so ambiguous and vague that nobody is clear on the specifics.

Here's an even dumber question. If you don't live in the EU and your site is not hosted there, do they have any legal power to get to you? What is the worst case scenario if you don't respond and don't pay any fines? Will they block your site from the EU or get your provider to take it down? What kind of power do they have to come at you?

>GDPR threatens website owners with fines of 4% of turnover or €20 million (whichever is higher) if they do not jump through a number of ambiguously-defined hoops. The law, combined with parasitic no-win-no-fee legal firms, puts website owners at risk of vindictive reporting. Young websites and non-profits cannot afford legal teams. Therefore the risk posed by GDPR is unacceptably high.

I get the point about legal trolls,but how are the hoops ambigously defined?

- don't store data you don't need for your business' stated purpose

- get active consent before you do so

- be ready to delete data on command

- store the data with best principles (i.e., instead of having ID and other stuff connected, centralize identifiying information and protect,use pseudonyms otherwise)

IANAL, but this seems pretty sensible?

He said the site does not make money. So why would he spend more of his time to make the changes needed to be compliant?

That said, I think the fear of no win, no fee legal firms is a little overblown. You can't get blood out of a turnip and if he's not making money there's no reason any law firm would be interested in suing him.

> but how are the hoops ambigously defined?

Well, just in this thread, two people providing 4-point lists of _simple_ things that can be done to abide by the GDPR provide two different lists that they themselves are ambiguously defined.

So, perhaps it's not as _simple_ as you make it out to be.

>- don't store data you don't need for your business' stated purpose

>- get active consent before you do so

These are mutually exclusive. The GDPR specifically warns against soliciting consent for collection and processing activities that are actually needed, as consent is not considered meaningful when the alternative is to avoid doing business. Consent is only valid if you can "degrade gracefully" in its absence. (I'm not a lawyer).

- deletion of data

Deletion of data from all external services that you use and internal services. If you have some processed data from internal data pipelines you will have to clear that as well. What about error reporting services? Internal logs? I think for data backups you can have it encrypted and that works as a good alternative but if you have to delete data from there it is not at all feasible.

- store the data with best principles (i.e., instead of having ID and other stuff connected, centralize identifiying information and protect,use pseudonyms otherwise)

Even if in the main data stores you store them in a well normalized way. It becomes a pain to do the same thing to do the same in data pipelines, sinks etc. If you are having a reporting DB it would make sense to denormalize data there.

I read the farwell-post as "My start-up failed, and I am shutting it down because I am sick of it", but instead of owning up, I blame the GDPR...

As a Brit, he would most likely already have to comply with most of the stuff already. And he should know that most government bodies use dialogue instead of fines initially..

I find it hilarious that so many think 'its ok to force 70page read for every developer because look what Facebook did'. But at the same time if anyone read the EULA of Facebook when you signed up, then you would have known precisely the risks of sharing your data with Facebook. They hid absolutely nothing from view. Chew on that for a bit.

Surely you're aware of what is known as inalienable rights? Rights that you cannot sign away no matter what?

> GDPR threatens website owners with fines of 4% of turnover or €20 million (whichever is higher) if they do not jump through a number of ambiguously-defined hoops.

Disregarding the "hoops" -- shouldn't this 4% go entirely to the affected users? I thought this was meant to protect the users. Seems like a cash-grab by the government. Can someone make a good argument as to why the fines should be paid to a third party (the state) when this issue is between the service provider and the customers?

The only thing I can think of is that the state is the only entity which can enforce the new rights, meaning they get paid for violations of the rights. Still, if someone threatens the integrity and privacy of your data, shouldn't the damages be paid to you?

$20M fine. 80M users. Here's you 25 cent check.

Much like class action lawsuits, the end user doesn't make much. The lawyers or the state, which go to great expense may recover their expenses, or they may not. The largepunitive fine is to prevent the suits from ever happening in the first place.

    > [...]Can someone make a good argument as to
    > why the fines should be paid to a third
    > party (the state) when this issue is between
    > the service provider and the customers?[...]

The same reason you pay speeding tickets to the state instead of personally to each person living on the street you sped on, or who could otherwise have been directly affected by that specific occurrence of speeding. Or the same reason health inspection fines for restaurants in the US are paid to the city or state, not everyone who's ever visited the restaurant.

There's no concept in the GDPR that the violation only exists between the site and the users whose privacy it violated, where are you getting that idea from?

> pay speeding tickets to the state instead of personally to each person living on the street you sped on

Roads are usually state-owned property, whereas your personal information is your property, right? If Alice mishandles Bob's property, why is Charlie getting paid for it?

> There's no concept in the GDPR that the violation only exists between the site and the users whose privacy it violated

Why not? The site-customer relationship is the only relevant one here. What prevents a profitable, large-scale data mining company from simply accepting the Max(4%,$20m) = 4% tax for mishandling data?

A $20m dollar fine would surely deter smaller actors, but the 4% fine doesn't seem like a deterrent for large-scale data-mining operations, which can be incredibly lucrative. For example, if Facebook had the choice between not using the data and making $60b per year, versus using the data and making $90b - .04 x $30b, wouldn't they accept the tax and continue using the data? If this is the case, I don't see GDPR making a big difference if the highest-market-share companies can "get away" with paying the fee.

This would increase the gap of viable profit models between smaller and larger companies, at the sole benefit of the state, with little, if any, benefit for the victims (the users). Of course, I am assuming that there is no criminal penalty for noncompliance. The government might think: why impose a criminal penalty if the state can simply tax large corporations for the mountains of profit they are making off of insights from personal data?

I am about to launch a startup. As an American citizen GPDR scares the shit out of me. My app doesn't do anything I consider rude to my users but that doesn't mean European courts can't find something wrong with the way I do business.

I consider myself lucky that I'm in a state that doesn't make me collect tax in states I don't have nexus.

Europeans are required to use something like chargebee to deal with VAT in different countries. I don't mean to be rude, but if a service like chargebee didn't exist, you Europeans would be fucked.

I'm sure VAT is just the visible part of the iceberg. It's an awful situation for entrepreneurs.

‘Europeans would be fucked’... as if there aren’t any successful or innovative European companies?

Bare in mind that you probably use some sort of service to handle every time of payment, even if it’s a local sale (e.g. Stripe, VISA Pay/V PAY etc.). Additionally, selling goods in the US is just as complicated for an external business as it is into the EU - state, county and city sales taxes, as well as exemptions from US taxes laid out in international treaties have to be accounted for. The general advise if you want to sell internationally is ‘get an accountant’, because it’s actually quite a complicated subject (unsurprisingly).

VAT is actually pretty easy to deal with as a non-European business. The combined work to handle VAT for all of the EU is less than the work to handle sales tax for a single US state.

> if a service like chargebee didn't exist, you Europeans would be fucked.

Sounds like a business opportunity right there.

WTF... The GDPR is only the continuation of the current regulation. If they can't follow it now, it's probably they were already not respecting it before.

And all in all, it really looks like a way to get out without having to admit some other failure.

Yeah I struggle to see how all these businesses which are panicking over GDPR could ever have been compliant with, for example, the UK DPR which has been in effect for a very long time and has many of the same requirements.

The biggest change going to GDPR is clearer definitions of what a data controller is and data processors and new restrictions on "automated decision making".

The ability to view, delete and demand data be accurate has long been a requirement of meeting UK data protection laws and I'm sure many other countries too.

It seems that businesses just ignored the law until it came with fines worth worrying about. A bit like the VATMOSS changes where US businesses were worrying they would have to start dealing with EU VAT even though that was the case previously.

As far as I'm aware, you cannot be privately sued for breach of GDPR. You can only send complaints to the regulatory agency, who then take action. The fines levied then go to the government.

There is no incentive for lawyers to troll around trying to sue for breach of GDPR, because there's no money to be made by them.

Article 79, "Right to an effective judicial remedy against a controller or processor," seems to say that individuals can sue controllers or processors. This may be limited to cases where the regulatory agency does not find in the data subject's favor? https://gdpr-info.eu/art-79-gdpr/

Article 82, "Right to compensation and liability," begins with the text "Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered." https://gdpr-info.eu/art-82-gdpr/

Do we know that for a fact? Sounds good but I have the bad feeling some legal groups will find a way around it. I hope I am wrong though. Really.

Time will tell best, I guess.

What would be great is an 'open source' legal movement. Non-profit legal orgs which read the details of laws, cases and then put up detailed 'views' of the laws from the perspective of an individual, company, buyer, seller, landlord, tenant etc. Instead of having a list of laws, have an experience based checklist for each type of agent.

Also, requiring the government to not just frame laws but provide this kind of information. The ico website[1] seems to be doing it for this particular law.

This might be less useful in boundary cases, where firms with legal resources play at the edge, but it can at least serve as a safe upper bound for a lot of regular activity. Lot of this information already exists in books, legal reviews, but this is important enough to be made conveniently available on an public website.

[1] https://ico.org.uk/for-organisations/guide-to-the-general-da...

GDPR is having a massive chilling affect at my job as well. I think some brand new web frameworks need to be born that focus on compliance. It feels like a solid opening to me to get some new ideas out.

Does anyone expect the GCHQ to get investigated based on its collection and use of private data?

I won't hold my breath that this will ever happen. For that reason (and many others) I expect that GDPR enforcement will be capricious and biased and used as a weapon against unpopular groups.

Nope, law enforcement groups get a special carve-out. They can collect whatever.

Can we go back and see what HN users views about the EU Cookie Law was, before the law was put into implementation? Perhaps we will also see hearty support for it, as we now see with the GDPR - when the EU cookie law is just regarded as a nuisance now.

https://hn.algolia.com/?query=Cookie Law

It's counter productive in that disabling or regularly clearing cookies to improve privacy can result in annoying popup messages every. single. time. a website is visited.

I am truly grateful to the developer or the firefox addon 'I don't care about cookies'...

I would think any small software shop outside of Europe is better off blocking all EU IPs rather than risk having to lawyer up when they wind up being targeted and potentially face a $20m fine. It would be financially irresponsible to do otherwise unless they have some kind of GDPR insurance policy (if such a thing exists.)

A handy service that checks if a visitor is from an EU IP would be handy.

GDPR discussions: Americans trying to interpret European Law and European way of enforcing laws

That describes most of it

> GDPR discussions: Americans trying to interpret European Law and European way of enforcing laws

Should they just pretend they don't exist? The Europeans haven't interpreted this law or provided a clear history of enforcement either. That's the point of these discussions – they're uncertain about the consequences of the law!

How about, I won't even try interpreting it and watch a few unfortunate fools get fined so I can learn from their mistakes. Until then, none of my websites will be available in the EU until I can afford a legal team.

I went to a conference recently and attempted to have a discussion about GDPR. Two other people showed up, none of whom had not done any research into the issue at all.

My fear is that patent-lawyer-style firms will start aggressively blackmailing companies for "settlements" or they will begin tons of GDPR-based violations aimed at your business.

> Did it turn a profit? No, sadly not, but running at a loss was fine as my day job covered the bills.

It seems the root of the issue would be financing the changes.

In a way, looking further into the regulations to clear how to deal with ambiguous parts or even straight hire a lawyer to look at the details would be a simple move if the expense could be justified.

Could it be summed up as “unexpected but mandatory changes kill unprofitable business” ?

It's not like he ever intended to turn it into the next Facebook, though, is it? It's like your grandmother's unprofitable home-made scone business shutting down because she doesn't have a certified kitchen.

It could if you also added "and prevent possibly profitable businesses from ever being started".

Can someone explain what ramifications this has for companies operating in the US that may have "personal" data on EU people? I am curious to know if there will be a new wave of lawyers coming after me for running Twicsy. (FYI, I get requests for removals every day, and I comply with all)

GDPR is not difficult to comply with and based on the decades of experience with the Data Protection Act on which it is based, the chances of being sued (or threatened with litigation) seem tiny indeed.

Also, I think the reason why this site cannot cope with GDPR run deeper than being willing to add a 'delete account' and 'download my data' functionality to a loss making site.

On the screenshots, it shows a prominent section on the home page: “StreetLend with Facebook friends (and their friends, and people they endorse)”

This suggests they are using the Facebook login to harvest from the Facebook social graph.

Head down that particular road and you are in a privacy shit show - and after Cambridge Analytica and GDPR my guess is that Facebook is cutting of this supply of data - or setting hurdles that streetlend cannot hit.

A few people were sued by the ICO for non compliance with the DPA - but it didn't open the floodgates of civil litigation. To my mind (and I am in the processes of updating two small businesses to be compliant) it just sets good ethical standards and Google / FB etc are missing a trick in not just declaring this is the standard they will follow worldwide.

Government is not on your side. Remember that, for all countries, for all times, for all peoples. Government protects itself first, at your expense, by helping those who can help it accomplish that said goal. If you can't help it to that end, you're nothing, literally. It truly couldn't care less about you, your liberties, or even your very life. Government can and does completely destroy people's lives, regularly, for having committed no moral offense of any kind, having caused no harm whatsoever to anyone anywhere in any way, but instead for having violated nothing more than a statute granting random behavioral power over you to some overfunded, distant, and uninterested regulatory agency.

This explanation might aid those who're confused about why a community strengthening, environmentally positive, socially worthwhile website like Streetlend would shut down in response to this huge collection of laws that was sold to us as actually helping us.

> a community strengthening, environmentally positive, socially worthwhile website like Streetlend

If Streetlend were even remotely as you described, they would have easily made enough money to defend itself against the government - all in glorious free market fashion. All hail supply side Jesus! Oh wait, it's tiny operation making a pittance in revenue. Whoopsie!

Thankfully, this is the 21st century and Western society has long ago decided that it'd rather have "the government" destroy individuals with a system of courts to appeal to rather than let anyone do whatever they wanted. Thanks Obama.

It seems better to ban EU citizens from your service than to shut down entirely.

It will be interesting to see if hacker news shuts down or starts blocking/banning EU. They certainly aren't compliant today.

Another business destroyed due to needless regulations and busy suits.

I'm not sure "needless" is the right word here. Even if you think this law is bad, there is clearly a need for data privacy and protection laws.

People's reaction to their data being scooped up by Cambridge Analytica just because a facebook friend did a survey proves the need. What CA did was probably legal, but in most people's minds should not have been legal.

> People's reaction to their data being scooped up by Cambridge Analytica just because a facebook friend did a survey proves the need. What CA did was probably legal, but in most people's minds should not have been legal.

It's not _their_ data. This is the part that drives me nuts. When you give something to facebook, it's no longer yours and you loose control of it. It's like this for _everything_. That nude you send your SO? It's out of your control. That nude your SO took of you? It's even less in your control.

If you don't have a service agreement with someone, it's not your data. It will never be your data. Stop pretending.

It's dangerous to let people think they control data they hand to other people. They don't. They never will. Why perpetuate the illusion?

> there is clearly a need for data privacy and protection laws

Is there? What if people just accepted responsibility for carelessly handing out information to third parties? Certainly there is much more individuals can do to protect themselves before the government steps in and slaughters small business like the EU did.

> but in most people's minds should not have been legal

Do people think a company selling user data to another company should be illegal? Or are most people more concerned with the relation said company has with Russia, and their potential involvement in influencing the US election? I think it's the latter. And certainly there should be laws about data transactions involving the state's democratic security.

Nerds operate on technicalities, many laws operate on best effort and in-faith. It is extremely easy to to be in compliance with GDPR

    1. Try
    2. Do it
    3. Keep Doing it

Good luck with your "but We Tried and then We Kept Trying" legal brief.

For anyone interested we (Aptible) made this Slack community to answer questions about GDPR: https://join.slack.com/t/gridiron-gdpr/shared_invite/enQtMzQ...

Disclaimer: we are a vendor that makes a SaaS offering for GDPR

Er... is that meant to be funny? That website is asking for my email without saying what it's used for :) Also, I can't refuse to provide it and still get access to the functionality.

I might have missed the GDPR news/discussions but if you are in a non-eu country and you are harvesting/using EU citizens data what could the EU do?

European developers have to deal with American software patents all the time to ensure global distribution of their software. And software patents are way less reasonable than GDPR. With GDPR, one can at least be sure that it is up to the site operator to ensure compliance. With software patents, there's always a risk that some random patent troll shows up with some obscure patent registered 10 years ago.

Sad -- regulation hurts small businesses. Why not make GDPR apply once the number of users reaches a certain critical mass?

That's actually a great idea in my opinion, not sure why you were down voted. It seems that the incumbent large internet companies will easily be able to afford this burdensome regulation but new startups all the way through medium sized small businesses may struggle or even be suffocated by it. It would seem reasonable to have a tiered system where the penalties only kick in when the business has scaled.

Am I missing something?? Sure you could be sued, and that might end the small business. But isn’t that what limited liability companies are for?

Option 1: close it down through fear of something happening.

Option 2: close it down if the worst thing actually happens.

Either way if the small company is operating at a loss/ v small profit, it’s not going to harm you personally?

Yes, I think you are missing somewthing. You can't be sued for GDPR.

You get reported to an authority that will handle the process. The Americans think you can just sue people all the time. It not what it is like in Europe. The point of this legislation is to help users, not to penalise businesses.

I mean how many companies were prosecuted for the cookie law?

If GDPR is so easy to apply, why isn't HN complying?

HackerNews also sends/streams data to Big Query for public usage: https://cloud.google.com/bigquery/public-data/hacker-news

I think you can delete from BigQuery now, but even just a year ago you couldn't.

It seems to me that they website would be easy to make GDPR compliant. What was the challenge here?

If I own a small business, what about I just sell online without collecting any data at all? Credit-card and Paypal etc are third-party APIs that I do not have a copy for my own, shipping can be out-sourced to USPS/UPS/Fedex and I don't keep any of them either. Am I now safe for GDPR? It's like a grocery store, you buy stuff and leave the door, I have nothing on record other than you paid me via credit card or nameless cash before you walk out of the door.

Don't know how to do RMA though, maybe for each purchase my site and the buyer both should have a receipt that just records the transaction but nothing else private, still not sure how to implement that though.

It's so unhelpful for small business owners.

How much are you going to sell if you can't market your goods or services properly?

It doesn't matter what you do, since you can still get a GDPR inspection / lawsuit that ends up with you non-guilty and losing a lot of money and time.

> GDPR threatens website owners with fines of 4% of turnover or €20 million (whichever is higher)

This is only for the worst, flagrant willing and knowing breaches. Small websites who made an effort to comply wouldn't ever get hit with this kind of fine.

I think this a political statement protesting regulation. It expresses a real ignorance of the legal process, culture and mindset in Europe that looks to actually protect the public from abuses of power, position and exploitation.

Wouldn't it be better for most small businesses if EU required a kind of "GDPR certification" that comes with its own audits? That might contain potential predatory law suits?

On the practical front,how would a product like google docs that offers collaborative editing deal with "forget me"? If I edited someone else's document, would Google (or whoever) be obliged to contact the co-authors to request that edits be removed? ... or should they do that automatically? What's expected to happen to the version history of these documents?

It's the EU, not the USA. There will be no lawsuits. Compliance agency will check, they will report to the business, the business gets time to fix it. Unless very negligent, there will be fines.

EU bashing aside, we 've seen this play out before. Search for old HN comments on the cookie law: It was supposed to reduce traffic by 90%, but nowadays its worse than useless. GDPR will fail too, because it does not address the crux of the issue: that most people do not care about willfully handing over their data, and in fact many of them take pleasure at being public. Most people will not care to delete their data from the service they used for 1 day. They will not ask their local bakery to hand them over reports etc. Most people spend most of their time on facebook, and most of them have already opted-in to the kind of processing that facebook does. Google, amazon, netflix, spotify etc are in line, because people are not going to give up on the most useful tech services.

Some of the worst private offenders in europe are actually public services like tax authorities who dug up tons of stolen data from banks, financial services, or who use google maps and facebook to find out who is flaunting their wealth. While not NSA-level, police authorities are catching up. Registries of all kinds with very private info have very lax access rules in EU countries outside the rich north.

Sure, some techies may feed their entitlement by going after some glaring cases of violations for a few months, but the case remains that, if privacy is a big issue, people are going to have to pay for it (i.e. they have pay a premium). Cryptography/decentralization remains another option.

Chris Beach accuses the GDPR or beigng ambiguous and an example of a of poorly-implemented laws. Combined with the guidance from something like the UK ICO, it seems to me to be remarkably clear and not onerous if your business isn't based on extracting value from user personal data in the first place.

Could we have some examples of the ambiguity and poor implementation?

The main area of ambiguity in my opinion is around "legitimate interests". Many companies who would otherwise breach GDPR regulations are using this as a get out of jail free card, particularly sites/applications which collect personal data without consent.

Personally, I think there will be a number of court cases post-GDPR to clarify what precisely is "legitimate interest" and what is a breach of the regulations.

I thought the UK was no longer a part of the EU?

Tentatively scheduled for a May 2019 departure, but still sticking to EU rules until end of 2020. And finally the UK will probably always adhere to the GDPR, member of EU or not, otherwise it will be at a massive disadvantage for tech companies dealing with Europe.

One interpretation of GDPR is that it applies to EU citizens globally, irrelevant of where the company or its data is hosted.

1. The UK is still a member of the European Union

2. The GDPR is already law, it just had a 2 year delay before it fully came in to force

They are still in the process of leaving and until they do they are subject to EU regulations.

You should open source the software / code. Maybe someone not in the EU could use it to start small side project..

Is there a GDPR checklist of technical things to do to prevent this from happening to cash-strapped endeavours?

I hate how GDPR forces me to log additional data. Like now I should ask for a age, have detailed access logs and so on.

I have semi anonymized data that I can now either make fully anonymous or link it directly to a user.

Worst of all is however that the complexity of my app doubles easily when I Actually follow all the rules.

Seems a little angry, sour, and conspiracy-esque. But 20 Mill is some dark cloud.

GDPR hasn't effect https://www.borroclub.co.uk/ So seems like it is possible to have a sharing website and not violate GDPR

They're afraid of frivolous lawsuits... does this mean the loser doesn't pay the winner's expenses in the UK either?

Judging by their post and the comments here, this is more of a problem with the US/UK legal system not with the EU regulation.

Kinda weird that the whole post is an advertisement for the website which is anyways shutting down, but contains no explanation for WHY the regulations aren't feasible to implement.

Have you actually looked at GDPR? It's virtually infeasible for any small company to adhere to, based on the decades worth of software that we've built the world's economy around. Logs, databases, backup systems, analytics, metrics, sign in systems, e-commerce systems, fundamental algorithms were all built without any concept of users being able to legally claw back their data. Actually implementing this stuff in the real world is a fucking nightmare. It means rebuilding your entire stack if you actually intend to comply with the laws to their fullest extent. And even then, someone can hire a lawyer and sue you, which then burdens you as you struggle to prove your compliance, wasting valuable time and resources for someone who didn't have the forethought to decide ahead of time if they wanted you to have access to their data or not.

Damn, I wanted to do this for Australia (or at least NSW) for gadgets/electronics/computer parts etc. I wonder if I put geoblocking in place if I'd be covered.

Couldn't he keep operating until he gets caught, then lose the case, go bankrupt (the company, not himself), and shutdown at that point instead of now?

Is it not possible to country ban each website ? Why couldn't they do that for all of europe and move on ?

Not really a "victim"

Here's the thing: if you already cared about your users' privacy and security, and had some level of common decency in your approach to users, none of this is a big deal or indeed different to what you'd already be doing.

Except the gdpr goes well beyond common decency.

None of this violates the GDPR.

So long as they clearly allow opt in to what data is being processed, and why, and a way to delete it, you are mostly ok.

As the site might need to deal with issues of fraud, you are allowed a little more leeway in storing personal data.

As always discussions about GDPR on HN is 99 % FUD.

Regulation always has unintended consequences. This is an example of it. Although they mean well regulation never accomplishes its goal and restricts the freedom of many.

> Although they mean well regulation never accomplishes its goal

Yeah man, that's why we have the safest cars and airplanes in history, because of the free market, not because of regulations. I'm sure that United Airlines, who literally dragged a passenger from their airplane, would have invested a ton in passenger safety if not forced by regulators.

Sarcasm aside, laws do work. There's a reason the most developed countries in the world have a very strong legal system. You give up a bit of freedom (which is a bit of an obsession for Americans) in exchange for a lot of protection from various nasty things people do to each other. As a result you sleep better and you get the side benefit of a special brand of freedom: freedom from fear from your fellow human beings, from their arbitrary whims (to a reasonable degree). Unregulated societies look like Somalia. Trust me, you wouldn't like that brand of freedom ;)

How is Moxie's Signal affected by GDPR?

Are there no exemptions in GDPR for small-time operations like StreetLend? Was it a problem because of its affiliation with Amazon?

Unless the owner is doing something shady (or just doesn't understand the GDPR), the issue is pretty clear.

He's running an unprofitable business (by his own admission), and likely is running it as some sort of sole proprietorship and doesn't want to take the risk on himself.

The solution is to create a company so that the company can shoulder most of the risk so the company goes bankrupt in the event he finds himself unwilling to comply with regulatory requests.

I'm guessing he just doesn't want to dump any more money into a failing project, which is his decision to make.

Is this a failure of the GDPR though, or a success?

Personally I think fly-by-night websites should be the last people responsible for handling personal data. If they're unwilling to attempt to comply with regulations, then perhaps the internet is a better place without these sites.

>If they're unwilling to attempt to comply with regulations

This is an obtuse, bordering on malicious misreading of the post. They're not unwilling to implement the necessary features. They're unwilling to shoulder the risk.

> Personally I think fly-by-night websites should be the last people responsible for handling personal data. If they're unwilling to attempt to comply with regulations, then perhaps the internet is a better place without these sites.

This isn't a data broker, a credit reporting agency, someone with a giant sensor fleet, etc. It's extremely straightforward to not share data with a "fly-by-night" website like this.

"Failing" seems a bit harsh. Lots of people run websites that don't make money, and lots of users get value from such sites. Sometimes the operator still hopes to gain from the site (in publicity or whatever), or sometimes it's just a gift.

The GDPR just made that gift more expensive. If he's not doing anything deliberately shady, then the probability that he'll get fined is small; but a small probability times 20M EUR is still a big number.

Maybe I don't understand the GDPR well enough, but the statutory fines seem insane to me. Why do you think 20M EUR is the right number here? Or am I missing details of the law (the law, not how you expect it will be enforced) that mean his actual maximum liability is smaller? Do you just have extraordinary confidence in the regulators to "do the right thing", and thus no qualms about giving them the legal authority to ruin his life?

Pretty much any start up starts out as a "fly-by-night website". Maybe this guy's just an idiot, but regulations like this harm small businesses and innovation. You can debate the merit of them, but this is what they cost.

I think there's stigma around GDPR among some entrepreneurs because of a complete refusal from some people to see personal data as something they need to treat carefully.

Let's look at an alternate universe for a moment, where online shopping developed with very barebones regulations, PCI-DSS isn't a thing and fraud is far more rampant. Now the EU introduces new regulations much like PCI-DSS with heavy fines attached to it.

Suddenly you would have every small business coming out of the woodwork, claiming PCI compliance is a huge hassle, the fines are unreasonable, etc. Yeah, PCI compliance is a hassle (which is why we have companies such as Stripe taking care of it for you). But to protect and empower the users, it's needed. This isn't about your business, it's about your users and how they can, today thanks to PCI-DSS, generally trust that their credit card is safe to enter online (which is a net good for any industry that needs online payments).

But that universe is crazy because, who wouldn't treat credit card numbers as extremely sensitive data? Well, many companies who today aren't actually PCI-DSS compliant. Sometimes devs just don't know why, when or even how to encrypt the data and nobody audits that until there's a breach.

So my opinion is this is a success of GDPR. Clearly nobody in this comment section thinks the person in question would really have had a hard time complying with it, and probably wanted to shut down anyway. Either its users are better off because the service is a data vampire that doesn't care about compliance, or it's a no-op because it would have shut down either way. Make room for competition that does care, I'm all for that.

In the US, as a sort of general non-lawyerly rule of thumb, incorporation shields owners from contract liability, but not from tort liability, which is what they'd face from GDPR screwups.

The owner is just focusing on their startup, as they should be. It's up to the owner to decide their tolerance of risk against regulations which hold them to account.

A defensive piece you've made completely misunderstands how a business works in terms of the decisions made regarding risk, especially to an individual who lacks bandwidth/resources.

According to your post, you only expect well endowed individuals/large businesses to be compliant, which is precisely the problem.

sounds like you are willing to eliminate hobby websites and nights and weekends startups, forcing every new idea to incorporate first. that's the sort of thing that the internet was supposed to route around.

When I was reading about the GDPR today, I read that email address and IP are considered private data as well. This means any website with an email login or subscription or that even logs hits with the request IP must take action.

I fully support protection against physical locations and personal information (name, address, etc), but to include email and IP address seems a little excessive.

While creating a company does shield you from some level of personal liability, you're (a) still exposed to directors' duties and similar obligations that attach to a director personally, and (b) still at risk of having your name attached to a company that has gone into liquidation.

> The solution is to create a company

Single member LLCs allow piercing of corporate veil pretty easily.

My question is, if the choice is between shutting down or just completely firewalling out all citizens of the EU, why not limp along without the EU market instead of dying out completely?

If a site makes it very clear EU citizens are not welcome on the service and will be banned on site, can they really be held liable for any EU citizens who get in anyway through proxies?

Our company has stated it has no plans to comply with GDPR and if faced with litigation it will simply be ignored unless the United States government gets involved. Complying is simply something we can’t afford to do right now, especially for a market that makes us a lot less revenue.

this startup is based in EU so they have to comply for all their users around the world.

What happens when GDPR conflicts with SOX, which prohibits the destruction of data?

GDPR is a great example of the kinds of disasters that happen when nations try to force the entire planet to follow their unilateral actions.

If you are a bank and a client asks you to delete their data. The bank will still keep it for the tax agencies.

If a tribunal gets asked to delete the personal data of the accused, they will keep the data.

There is a principle of public interest and public obligations to keep data.

What part do you think that is a disaster?

Please read and understand the requirements of the GDPR before promoting incorrect ideas like this.

Can you name a conflict?

The GDPR applies to trying to do business in europe. Seems simple enough.

GDPR is a great example of the kinds of disasters that happen when nations try to force the entire planet to follow their unilateral actions.

(Shrug) It's a public response to abuses by private actors. It's a great example of the kinds of disasters that happen when the user is the product and not the customer.

I can shutdown my site at any given moment, citing attack from Mars. And? I think that GDPR was just an excuse, if this would be a booming bussiness, he wouldn't have problem adjusting to GDPR.

The result of " sed 's/GDPR/tax law/g' " applied to the comments says a lot about the filter bubble we're in.

Why did it have to shut down?

Unable and/or unwilling to assess compliance/risk, this leads to the owner wanting to shut down.

Scroll down, it answers the question.

I didn't really understand the implications of GDPR until I read this. Now I understand the paranoia.

Basically, in good faith, everyone is happy: website owners take measures to protect their users' data, and ask for consent. But 1 unsatisfied user, or heck a slimy competitor, can bring you down (I assume €20 million fine is business-killing for most startups).

The key is "targeted". If you're targeted, since it's ambiguous, your chance of losing is higher.

On the brighter side: Some people make extra income! /snark

"Targeted" is someone complaining to their national regulatory authority.

Who will likely do nothing based off a single report.

What bothers me about GDPR is that you can’t make consent a precondition for service. Maybe user data is my business model. Or maybe I’m a US company and I don’t want to have to deal with issues of Europeans accessing my site. Why should the GDPR be my problem if I’m not in the EU. Don’t like it, don’t use it. There’s too much over reach here.

Then block anyone from the EU from accessing your website. If you don't want to deal with EU laws then don't do business with the EU -- it's that simple. If you operated a legal online narcotics or pornography business you would have to do the same thing to not do business with countries where your wares would be illegal to sell.

You can't have it both ways. Either you want to have EU residents as customers, or you don't want to deal with EU laws.

That isn’t true. You can ask for what is necessary to run your business as a precondition for using your site.

Typical.. Equifax gets off with a slap on the wrist. Facebook talks to Congress for a bit before returning to business as usual. Nothing happens to Cambridge Analytica.

But damn if they don't destroy a few small businesses to show that the government is on the case.

Equifax is US. Congress is US. Cambridge Analytica got raided by ICO, the UK's data protection agency, investigation is ongoing (although on of the witnesses is a bit... shaky). Troll somewhere else.

Different government.

Reply on news.ycombinator.com