I'm a little confused. Who is sending compliance requests? If it's not the ico, there's rely no problem. If it is the ico, ask what needs to change. No lawyers required.
Phrases like this just sound weird to me. If there's a risk that someone could sue you over something, from a business perspective I have always been taught that you avoid it, period, until you get a lawyer.
I wonder if this is a cultural difference between the US and EU? Might explain some of the different reactions people have had to the legislation.
It's like you're driving too fast on the highway, but if it's just you mom complaining and not a police officer you won't get fined :)
- that said, we should all respect the speed limit, they are there for a reason.
That seems like a pretty broad policy... someone could all the time for any reason no matter how good a reason.
It's sort of like the "never roll your own security" advice that gets brought out when people ask questions about crypto. To a certain extent, yeah, we do have to roll our own security. Of course developers need to roll their own stuff, at least at the integration level.
But as soon as it gets even slightly dangerous, I'm not going to be doing, say, my own XSS filtering. I need a vetted library at that point.
I've been taught to think of the law the same way - you don't roll your own legal advice.
So why not roll your own?
I don't know if it's a social thing or a legal thing or some combination or what, but apparently it's harder to sue in other parts of the world.
> Phrases like this just sound weird to me.
Are you from the USA? Because my best guess is that that's why it sounds weird to you. I almost sued a company (they paid just in time) and even then wouldn't have looked for representation, let alone for issues like these. Just read a blog post or two about GDPR. No lawyers required.
Bigger companies do have legal teams, but smaller one can operate without ever needing a lawyer.
Which bit of GDPR introduces that risk?
I'm being told that the EU would never pursue that with a small business and they'd just tell you what you need to fix.
That also sounds weird to me as an American. I'm not saying it isn't true, just that it's not the way I'm used to thinking about laws.
Look at the US COPPA, with potentially $41,000 per violation. Why isn't this more scary for American website operators? https://www.ftc.gov/tips-advice/business-center/guidance/com...
> A court can hold operators who violate the Rule liable for civil penalties of up to $41,484 per violation. The amount of civil penalties a court assesses may turn on a number of factors, including the egregiousness of the violations, whether the operator has previously violated the Rule, the number of children involved, the amount and type of personal information collected, how the information was used, whether it was shared with third parties, and the size of the company. Information about the FTC’s COPPA enforcement actions, including the amounts of civil penalties obtained, can be found by clicking on the Case Highlights link in the FTC’s Business Center.
I mean, any US website that's compliant with COPPA should find GDPR to be a doddle.
https://corporate.findlaw.com/law-library/ftc-imposes-larges...
The equivalent reaction for GDPR would be if everyone either started making half-hearted efforts to block European users (which isn't what EU wants), or if everyone forced all of their users to agree to the same data collection before they signed up (which as far as I can tell is not legal).
From the law:
> However, an operator of a general audience site or service that chooses to screen its users for age in a neutral fashion may rely on the age information its users enter, even if that age information is not accurate.
This line is basically the entire reason why COPPA is generally not seen as a problem for US businesses.
Are we sure about that? GDPR seems like a gift to European startups who don’t like American competition. BlaBlah car in France got huge, incidentally right around the time the anti-Uber hysteria in France reaches a peak. The sale of Daily Motion to Yahoo was blocked by the French government under ridiculous national economic interest grounds. Europe loves tariffs and trade barriers and they have a history of “protecting” the public from competition. Try shipping spare parts for a child’s stroller to France — I was taxed at 50% — the tax even applying to the shipping fee, not just the parts. My dad made the mistake of sending kids clothes to my kids with the tags still on them — $100 worth of clothes cost me €65 in duties. When I ship small amounts of stuff to the US, I literally have never had to pay a tax. The EU loves protectionism. Farmers literally set fires and throw rocks when Spanish wine crosses into France and the authorities don’t prosecute a single person. Now that EU countries have a bunch of lotteries tickets with American tech companies, the governments are likely foaming at the mouth with excitement over fining American companies. And, sadly, many people in Europe actually think this is about privacy.
Otherwise the only person that seems to be "foaming a the mouth" is you, in this ridiculous Murica rant.
Do I need to remind you that your country is just starting an economic war on the rest of the world with illegal customs taxes ? Also, enjoy getting scammed by your own ISPs now that net neutrality effectively got cancelled on you.
You don't realize how little Europeans care about your precious American tech companies, and more about values such as not being the data points of international megacorps with shady business practices, or low-end programmers ready to milk people of all their data just to install a phone game.
I mean carpooling was about solidarity and ecology, then blablacar seized the market and turned it into "no mobile phone, no credit card, no access to carpooling", "give us money first". I used to carpool before blablacar and many times I did not ask that much money or even no money at all, sometimes I got barter out of carpooling. Or the other way around, people enjoyed my company and refused my money. Now this social link is over because everybody is using blablacar and blablacar requires expensive upfront payment.
I hate how blablacar turned something that was about helping each other and bringing people together into a capitalist profit making venture aiming for world market domination.
So you just hate it because it's a company and it's making money. Right ?
> I mean carpooling was about solidarity and ecology, then blablacar seized the market and turned it into "no mobile phone, no credit card, no access to carpooling", "give us money first".
BlaBlaCar single-handedly created the huge carpooling market that now does exist in France for example. They didn't seize the market, people gave it to them. There are still other carpooling websites which you can use, and carpooling panels in events are still a common thing.
Up-front payment, not directly giving out people's phone number : you pretend this is bad practice, but this is exactly the security that was needed to bring the masses to carpooling, and as a matter of fact it did.
You seem to dislike that people would be ok in a win-win situation, where they both get paid for their expenses, and are happy to chat with other people while doing a small move for the planet. This is what's happening.
> I hate how blablacar turned something that was about helping each other and bringing people together into a capitalist profit making venture aiming for world market domination.
This is truly misguided. The opposite equivalent to my parent, but now with an anti-capitalist idealistic view of the world. Do you not see that? People are not into this ideological warfare of yours. The "world market domination" ... of carpooling? Do you realize how ridiculous that sounds?
Please find a mindset where you are able to leave BlaBlaCar be. Seriously, these are people too, and they are providing a great service. And I'm worried people, just like you do, are too prone to ranting on companies for all the bad reasons. The very reason you're using the excessive word hate, to me, seems to prove you're personalizing the entity and are a bit out of the rational realm in your claims.
I think you are misremembering here, when blablacar started and was called covoiturage.fr there were a variety of other carpooling websites, some having been around for several years notably covoiturage.com. At the time carpooling through websites was on the rise and many competitors existed (123envoiture.com, easycovoiturage.com, vadrouille-covoiturage.com, and more), all were free to use. I remember because I was an active user of pretty much all of those sites. covoiturage was one website among others and not the most popular, then came Frédéric Mazzella who bought covoiturage.fr and create a company Comuto to operate it with the intent of aggressively capturing the carpooling market.
first step was to offer the service for free and build a community around it while buying the competitors, next step was to push the remaining competitors out of business with the network effect and use the fear card to position blablacar as a unavoidable middleman (so people could not communicate directly and strike a deal outside the website as was the usage until that point), then pivot from free to paid for. Last step is domination of the market and increasing prices to very expensive as there is no competition as Mazella explained in an interview:
"Pour l'instant, seul les services Français et Espagnol sont payant, pourquoi ne pas toujours commencer avec le modèle économique ?", Kevin Deniau.
"Tout est un problème de masse critique et d'absence d'offre de covoiturage", Frédéric Mazella.
F.Mazella n'a pas souhaité dire que le passage en mode gratuit de Blablacar est uniquement pour capter l'attention des utilisateurs et qu'une fois le marché écrasé et dominé sous couvert de gratuité, le système payant se mettait en place. Ce fut le cas en France de manière progressive pour faire passer la pilule et c'est la même chose en Espagne, où la fronde s'organise petit à petit. https://blogs.mediapart.fr/evenstrood/blog/110714/covoiturag...
I'm not saying anything about bad practice (good or bad is a relative notion), I'm saying that blablacar destroyed the social component of carpooling to turn it into an economic one. That blablacar put artificial barrier preventing people who need carpooling the most (people who cannot afford a smartphone or a credit card) from having access to it.
I've been doing carpooling for years and had no issues with cash payment or direct contact with other users, but suddenly blablacar marketed these as undesireable and risky and pretended there was a need to move to less freedom for more security by making them the unavoidable middleman and upfront payment, obviously the need was actually on their side and was about putting them in position to maximize profit.
And I'm not alone to have noticed this, this is quite common knowledge [1][2][3][4][5]. It's around that time that I notice a change in carpoolers, before all were people going from one place to another, now appeared people with no need to go from A to B with large vehicles taking as much passengers as possible to make as much money as possible.
You may think this is win-win situation, but it's really not[7] (also the testimony at the end of [2]), it's a business as usual situation where capitalist parasitic company turning something desireable into an economic commodity/convenience [8][9]
we'll have to agree to disagree on me despising blablacar for what they did as being misguided. Frédéric Mazella knows well what he did and he dit it on purpose with intent. I do realize how realistic and sad it is that a capitalist company killed the human potential of carpooling to try to meet ROI expectation of those who funded them while aiming for world market domination by his own admission. The social element of being human ought not to be controlled by finance.
I hope that by reading all this including sources, you understand where I'm standing and that I know what I am talking about.
[1]: http://carfree.fr/index.php/2014/07/04/la-finance-a-t-elle-t... [2]: https://comptoir.org/2015/05/08/blablacar-comment-ils-nous-o... [3]: https://blogs.mediapart.fr/evenstrood/blog/200614/blablacar-... [4]: http://alireailleurs.tumblr.com/post/89843872188/blablacar-a... [5]: http://leplus.nouvelobs.com/contribution/891698-covoiturage-... [6]: http://simplifier-la-mobilite.tumblr.com/post/112955153091/b... [7]: https://forum.quechoisir.org/frais-de-covoiturage-non-rembou... [8]: https://www.monde-diplomatique.fr/2013/10/DENOUN/49720 [9]: https://www.journaldunet.com/management/expert/60567/abus-de...
[7] is a collection of problems people encountered. I had read a few of these long time ago, and re-read them now : these seem to be situations any service linking people together would encounter, and I don't see how any other website could avoid those entirely.
[8] I can't read; [9] is quite general.
> I've been doing carpooling for years and had no issues with cash payment or direct contact with other users, but suddenly blablacar marketed these as undesireable and risky and pretended there was a need to move to less freedom for more security by making them the unavoidable middleman and upfront payment, obviously the need was actually on their side and was about putting them in position to maximize profit.
You are personnalizing BlaBlaCar as a sneaky fox whispering into people's ears, playing on their fears and need for security. BlaBlaCar's position was the result of people's acceptance of their services in free will. You cannot change that. Also, it is very clear in some of your links that BlaBlaCar targeted the conductors (this "critical" mass) with economical incentives in order to bring the market to the next level, which, again, succeeded like nothing had before. I'm not sure destroyed is really what would describe their rise if you take a broader point of view.
> I'm not saying anything about bad practice (good or bad is a relative notion), I'm saying that blablacar destroyed the social component of carpooling to turn it into an economic one.
You are appealing to relativism, and then clearly implying that social and economic components are mutually exclusive, and I'd go as far as to say you also implied which one is evil and which one isn't. I just wanted you to notice that.
Also, it's not because something isn't free that you have to be an ass about it and that it's not social; and the inverse is also true. That's not something very common in France, but you can actually charge people and, at the same time, give them a good social experience.
> That blablacar put artificial barrier preventing people who need carpooling the most (people who cannot afford a smartphone or a credit card) from having access to it.
There are no people who need carpooling the most. Everyone needs to travel around for cheap money. It kinda feels like virtue signaling from your part to imply that you think about the poorest users, as if the person talking to you wasn't.
Also, this is quite untrue. On Leboncoin you will find older or used smarpthones from 10 euros, to 100 if you want fancy ones, while the cheapest phone plans, including internet, start at 2 or 3 euros a month. This extends worldwide with 3 billion smarpthone users in the world [1]. The magic of capitalism...
Technically speaking, to counter BlaBlaCar's existing monopoly on carpooling users, you'd have to create an open-sourced meta-platform for carpooling where people can register, and choose to use either BlaBlaCar as a middleman (that's what they do best), or not, or any other company or system that has been built to do just that. Over time, you would acquire an open database of carpooling users, which would serve for the greater good. This, and only this, improves free choice and resources efficiency, without the abuse that might come from a centralized platform such as BlaBlaCar. In my opinion, destroying or hating the business that built this carpooling community (I'm sure you did your best, but realistically it didn't exist before) doesn't. I also don't think you should go so far as to despise the CEO specifically: it seems far-stretched to me, mixing your feelings with a rational situation. And I don't think it brings you any good.
Anyway, if you're ready to do the open-source meta-carpooling part, I'm interested.
[1] https://www.statista.com/statistics/330695/number-of-smartph...
blablacar exists since 2004, it was first covoiturage.fr and had became the market leader in France in 2008, in 2009 the began opening services in foreign countries, in 2011 the bought main competitor which started in 1997 and are confident that their market domination allow them to pivot from free to taking a 20% commission.
january 2012, Uber launches in France.
in 2013 they change their name to blablacar so it's the same name in the 10 coutries they operate, uber grows to operate in two cities in France.
2014: uber grows to 6 cities in France, blablacar adds ukraine, russia, brazil and gets 100 millions funding to tackle world market and now transports 1 million people per month.
2015: france his 2nd biggest market for uber in Europe with over 500k users per year, blablacar buy German competitor Carpooling, Hungarian competitor AutoHop and Mexican sart-up Rides now totalling 20 millions users in 19 countries and rises 200 millions to speed up world market deployment. UberPop is forced to suspend operation due to operating illegally by evading legal obligations.
2017: uber still operates illegally without a licence and European Court confirms the UberPop suspension while also confirming that Uber is a transportation company and has to follow laws and regulations.
As we can see here, by the time Uber arrived in France, blablacar had already seized the french market for quite some time, blablacar operates lawfully while uber evades legal obligations and kept at it despite repeated warnings which is probably the reason why it got into trouble.
And this is coming from someone who strongly dislike blablacar.
Then again if US tech companies paid their taxes instead of engaging in heavy tax evasion (hello apple, facebook, amazon, google, ...), and respected local laws maybe they would not get so much flak.
American startups have less to worry about than european ones, they have their non-GDPR market to address and grow, and we'll see in the future if extra european companies get fined (AND effectively pay) because of GDPR
For past experience with German privacy regulators (as an example, since our old law was fairly strict too), I'll quote a recent comment of mine:
From what I know, the German DPAs (they are organized on state level) hand out like 2 fines per month each, generally way below the maxima (under old German law, the max was 300000 €), and concluding the majority of cases without a fine. E.g. from the Bavarian DPA (german doc: https://www.lda.bayern.de/media/baylda_report_07.pdf, page 151):
in the years 2015-2016 they had 173 proceedings that involved potential fines. 52 of those resulted in fines. 34 of those fines were <1k€, 13 were <10k€.
If that's the case then I suspect you'll see fewer companies panicking over time. It may just take an adjustment period for companies to realize, "Oh, this legislation isn't actually filled with hidden land mines."
https://government.diginomica.com/2017/08/10/ico-maximum-fin...
Or you can incorporate outside of the EU (Guernsey or soon enough the UK perhaps?) and ignore the GDPR. At which point we'll just wait and see if the EU has any teeth outside its jurisdiction and how it will enforce this law.
Bad news: If you have a business, people can attempt to sue your business for whatever they want, and you might have to defend against it. There is nothing on the books that says lawsuits have to be reasonable before they can be filed, only that people who abuse the legal system get punished AFTER a court decides they're a moron.
And in fact even filing a frivolous case can result in fines or jail time for contempt.
So no, you can’t in practice sue someone for anything.
[1]: https://www.linkedin.com/pulse/nightmare-letter-subject-acce...
It gave 2 year to get conformity to something which has been effective since 1995 through a European directive. The forum owner decided to ignore this a do nothing, now he's confronted with the consequences of his choices.
But again his reaction is akin to a knee jerk reaction as he is probably in capacity to answer the request while outsourcing to a third party does remove his responsibility and obligation to answer GDPR requests just now it's gonna get a bit more complicated as he has a third party into the loop which is probably not complying either.
You might want to get in touch with fluxBB dev to get a GDPR button extracting the relevant data from the database to avoid the pain of building the db query by hand.
Those requests can be:
- Please give me all my data
- Please delete all my data
- Please stop doing things (processing) my data
Or some mix of all the above. A site owner (controller) has 30 days from receiving such a request to respond or the person making the request can report them to their Supervisory Authority (ICO is the UK Supervisory Authority, each country in the EU has their own).
For example, if you told the user why you collected the data, and you're still using it for that purpose, and you have a legitimate need to continue to do so then you don't need to delete the data. And there's an extra exemption for "exercising the right of freedom of expression and information".
* furiously delete all user's data *
This is probably gonna get you in much more trouble than you could have been initially. For example France has law telling ISP they have to collect and retain customer data and activities for a year to able to retroactively identify who did what online at what time, failing this is not a matter of a report that could lead to warning and then to a fine but years of jail time instead.
If you can completely distill a binder of a legal framework down to an "if this then that else this" sentence, you don't understand it, and your hubris is going to kill your company. If you think the correct response is "don't respond, wait until it escalates", you don't understand it and your hubris is going to kill your company. If you're doing anything worthwhile you're going to be bumping up against some law or another, and you can't just ignore it and you can't afford to not understand it. That's why you pay lawyers.