Comment by nforgerit | Hacker News Reader

Comment by nforgerit | Hacker News Reader

Parent Full thread

(I love the EU, I really do. That much, that I really care about its ability for innovation.)

As a European software engineer I'm calling BS on your statement, Mr Manager. EU legislation might not aim to stifle innovation (in contrast, they're always talking about a "level playing field") but their imprecise and vague regulation texts are like a loose cannon for whatever innovative business might come up if you have your first hire to be "the lawyer who gives legal advice in context of EU regulation".

Now, those people will just quietly move away to find a new home-market for scaling up and then eventually selling to EU countries. This is not "lagging behind" but an economical fiasco since the same laws only help local oligopolies of gatekeeper enterprises and (the ones they initially aimed for) Big Tech who can afford licenses and lawyers.

Two little examples (but there's more):

- What about the safe harbor thing? It's all a grey area now after court rulings decided that pretty much all US-EU IT biz is at least partially violating the EU regulations.

- We're now all happily clicking cookie banners and startups are getting sued by third-rate law firms. Some things were good with GDPR but did it help with Big Tech's (and meanwhile Tiktok's) way of collecting data? Nope.

I understand and agree to your arguments, but I don't want to change EU.

> like a loose cannon for whatever innovative business might come up if you have your first hire to be "the lawyer who gives legal advice in context of EU regulation".

But loose cannon is better than no cannon.

Also, how about not doing what is forbidden? You don't need to show cookie banner if you don't store cookies that helps to follow your users. You don't need to follow PII storing rules if you don't store PII.

Look, yes this rules are hard to follow sometimes but thats exactly why we have it.

I don't want to every company in the world to store my info without my consent and without possibility to delete it.

Sorry, but companies should deal with it.

You could always just not harvest infinite amounts of user data that you don't need? The company I work for doesn't even have a consent banner since we don't store anything that isn't vital to the service, and even then it's barely anything.

If companies are so incapable of not harvesting data en-masse then they deserve to be sued out of existence and shut down for their shenanigans.

This is not the point. The point is _legal insecurity_ due to vague regulation texts that small business owners can't cope with while big businesses can which puts the initial goal when creating those laws upside down.

That's the beauty of these types of EU laws though, they require inaction in order to be compliant. Literally just stick to the data you absolutely, vitally need for the running of your app or website or whatever, and you're fine. It's legitimately harder to be non-compliant, since it means you're putting your devs to work to implement some idiotic metric tracking that is ultimately useless.

Also it's not really my experience having worked for a few EU tech companies. The small guys have 0 issues following the regulations, even without a single lawyer working there, since they're usually not so blinded by the prospect of infinite money and usually just stick to collecting what is necessary and nothing more. My company has 1 or 2 lawyers, but they're more there for things wholly unrelated to GDPR or anything like it, and we've never been on the sharp end of the legislation and likely never will be, assuming the suits don't drop 100IQ points and decide to go for "infinite" growth.

The amount of inaction you’d need to be guaranteed to comply with the GDPR would be equivalent to never starting a business at all.

Even a cash-only business with no electronics anywhere would still need nontrivial GDPR compliance efforts because it has employees. Just because you need the data to run your business doesn’t automatically make you exempt without further paperwork. Your lawyers definitely do occasional GDPR compliance work.

https://www.dickinson-wright.com/news-alerts/the-gdpr-covers...

It’s a bit like accounting. You can structure your business operations is ways that make the accounting easier or harder, but unless you shut the business down you will always have done enough somewhere to need to think about (and probably file paperwork for) accounting/GDPR. And much like accounting, I’m not saying the GDPR is bad, but it’s also not a business activity that you can just ignore because you’re not running an adtech data vacuum or whatever.

Not in line with what I have seen in terms of required GDPR work in small businesses. Pretty minimal as far as I have observed it.

> The amount of inaction you’d need to be guaranteed to comply with the GDPR would be equivalent to never starting a business at all.

Tell that to GitHub for instance: https://github.blog/2020-12-17-no-cookie-for-you/

I mean you /do/ understand that they're just switching the means collecting data, right? You /do/ understand that Alphabet doesn't need to care about cookie banners and web fonts when they can simply tell their gigantic user base to keep logged in to not see any banner anymore? You /do/ understand that webpages switched to dark UI patterns luring their visitors into "yes to all" clicks taking those as a charter to push them into even more ad networks? You /do/ understand that you will need to consult a lawyer's advice for anything touching PII data to be on the safe side and don't want your small business to potentially going bankrupt? You /do/ understand that this costs additional money that won't go into product development?

Edit: In addition with AI act and its very broad definition of what an AI is and a classification like "Education" you might end up in level "highest risk" just for calculating statistics on your quiz app (no one knows until a court rules). With Cyber Resilience Act and its application of the (physical) supply chain direction, your open source repo from 5 years ago might end up being a footgun with you being personally accountable for other companies using it in their product. And so on...

Cookie banners are only a very small part of the GDPR.

That's true. They are a good start though.

And for a startup it's trivial to comply with GDPR because:

- you start from scratch, so you know not to collect more data than you need

- you don't need that much data to begin with

Reply on news.ycombinator.com