Hacker News Reader

Comment by cameronbrown | Hacker News Reader

Isn't this the argument free-marketers have always made? The people who said GDPR would stifle competition? It will be a long time before the outcome of these choices are obvious.

View on HN

And they wouldn't be wrong about that.

Note that the 2 main arguments and counter arguments: it helps protect people's information vs it increases the barrier of entry are NOT exclusive. Both can be valid at the same time and I believe that in many regulations they are both valid. That's how life works, a chain of compromises.

What are some examples of GDPR increasing barriers to entry?

Trivial example but the nekochan community for SGI retrocomputing shut down because of it. It's particularly hard for small business or unprofitable things done for fun/sport/public benefit.

I've seen many people shut down their side projects citing gdpr. Without fail it's always people who haven't really researched the impact gdpr has on them and they didn't really want to keep the project going anyways so it's more of an excuse to shut it down without facing backlash.

It seems like you are contorting the blame to "well you should just do more work!" Bureaucratic regulations have costs in implementation, enforcement and non-compliance. Those costs are naturally easy for corporations to absorb because they can hire people to do it full time or whatever the case may be. Maybe several hours or $1000 for a lawyer or whatever to review some regulation are a bridge too far for someone already devoting time and dealing with whatever negatives the side project is coupled with like less free time, negative users/customers/competition, and other opportunity cost.

So yes, taking on new and unknown (to the creator) legal liability from some regulation is a great reason to shut down a side project.

If you’re a hobby project or small business that’s already not collecting customers’ personal information, then what hard work do you have to do to comply with GDPR?

Huh? I think you're lost.

An IP address counts as personal data, so that means you can't use any PaaS without having a privacy policy and vetting your platform's policy (which requires legal skills), just because they might keep the logs.

All public Trello power-ups have to be GDPR compliant, for example. The requirements are laid out on their developer documentation page [1]. You have to poll an endpoint every 14 days to remain compliant, delete data on request, etc. If you're building a power-up for free/fun, it might make you think twice (just because of the payoff/effort ratio). But I'm going to charge money for my power-up, so something like this isn't really a big deal.

If you have time/money or plan to make money, GDPR compliance isn't terribly difficult. But free/cash-strapped service providers would probably think twice before becoming compliant (which is why a lot of local US news websites just don't allow European visitors -- compliance is somewhat expensive, and local news in the US isn't doing too great right now).

[1] https://developers.trello.com/docs/personal-data-storage

The GDPR is intended to protect user privacy, not "competition". Everything has side effects, but if a monoculture of online services is the price, my guess is the drafters of that law (which I'm not a huge fan of, FWIW) would be OK with that. This is the tech industry, we're always just a few decades away from everything being disrupted anyway.

I'll have to go digging but there already was a good article that made it to the front page here about how much GDPR has helped google. It had some great numbers and graphs showing a sizable increase to googles marketshare once they were the first ones to be "GDPR compliant".

Considering how only large tech companies have been fined noticeably so far I doubt that's the case.

Both things can be true: only large companies have been fined, but the cost of compliance means that small companies exit the market or never enter.

Many companies will attempt to follow the rules, even if they think that the probability of getting fined is low.

There's other new EU regulations than just GDPR. The recent copyright ones do nothing for users but severally cripples startup competitors to YouTube, as an example.

Reply on news.ycombinator.com