If I ignore GDPR for the next year or so, waiting until this all simmers down to a level of abstraction below the surface level I care about, will I be any worse off?
To be fair there are no experts able to guarantee their advice is good. They often disagree as the law is incredibly vague. And the EU DPAs are not ready to apply the law. Relevant laws have not even passed in many EU countries: https://www.reuters.com/article/us-europe-privacy-analysis/e...
I am the first to agree that this is a terrible law, incredibly vague, overly broad, poorly written, etc.
The difference between actual experts and people like Jacques is that credible experts recognize the complexity and will be honest about it.
Granted, it’s in their interest to do so, but still, at least the better ones won’t lie and tell you it’s simple just because they wish it was.
Not to mention accusing you of bad intent and doing shady things if you don’t quickly agree that the law is perfectly clear and simple and that any compliance costs are worth it if you’re honest.
After all, only an evil person would avoid the EU market with the stated reason that the compliance costs seem too high or the law too vague, because random blogger Jacques already cleared that up for us :)
Or it could be a well meaning law, that has been drafted in good faith to incrementally extend an existing directive, one that IMHO has worked rather well up to the point that organisations outside of the EU have felt they can ignore it, even when acting in EU countries. GDPR is certainly making overseas firms take our laws seriously now...
It has been mentioned a number of times, but EU law is principles-based not rules-based like in the US. I can see how it might appear vague to US eyes, but to my eyes I see a flexible law that will live on while the technology changes. I also felt it was written in plain, straight-forward language, and not poorly-written at all, I personally can live without 'here-on-ins'.
I guess if I lived in the US and had a similar law, and had US prosecutors I might be scared, but the law of European countries has survived on being principle based rather longer than the US has existed. I once had to compare and contrast both systems for an exam, and of course they both work in practice! I note however that Europe is a much less litigious place than the US, and I personally prefer that.
I actually agree with almost 100% of this. The EU should pass laws however they want according to whatever legal framework they want. And companies wishing to do business there should comply. I still think it’s a poorly written and vague law, but perhaps that’s just my distrust of bureaucracy speaking.
My real issue with the law is primarily that the EU thinks that it can assert that it has global jurisdiction with regard to the GDPR. This is so undemocratic and dangerous, it boggles my mind that fans of the GDPR can’t see it. Just because you like the intent of the law doesn’t mean you can admit that it goes too far, or sets bad precedent, or is likely to be abused.
If Saudi Arabia passes anti-blasphemy laws and says they apply globally if a citizen of theirs visits your website, should anyone care?
GDPR is being taken seriously by firms with enforcement exposure. My hope is that every other organization in the world just ignores it. It’s a dangerous precedent.
And then there’s my issue with the fans of the law who will read the above and come back with the vapid response: “well, if you’re not going to comply then clearly you’re shady and I hope you do go out of business.”
It doesn't assert global jurisdiction, what makes you think that?
If you have a legal or business presence in the EU, you will be affected, because that puts you inside the EU jurisdiction.
Note that Facebook/Google/Apple/Microsoft/Amazon/Samsung/etc have a substantial presence in the EU; employees, offices, shops, data-centers, customers, which is why they are affected by the GDPR, and the EU is giving them the choice to either comply, or pull out.
If you have a small business in the US, you can safely ignore the GDPR, because there are no avenues of enforcement against you, because you're not inside the jurisdiction. Non-US companies get sued in US courts all the time, and nothing comes of that either.
> If Saudi Arabia passes anti-blasphemy laws and says they apply globally if a citizen of theirs visits your website, should anyone care?
Everyone doing business with Saudi Arabia should care. Is this not self-evident to you?
If you have a legal or business presence in the EU, you will be affected, because that puts you inside the EU jurisdiction.
If only this were true. Under the GDPR, an EU resident sending their info to me anywhere else in the world apparently constitutes me doing business in the EU in their eyes. That’s their claim of global jurisdiction.
Fortunately, they can’t actually enforce this, so I’ll be ignoring it, just like I would for Saudi Arabian anti-blasphemy laws.
Most of us in Europe don't find it especially vague, poorly written or overly broad. I think most of us are firmly in favour of it, and not especially concerned by the effect on our companies, especially when we've already been doing some of this under current data protection.
Personally I think it's an excellent attempt to bring some sanity back to our online privacy. It's perfectly readable and understandable by an individual. Though of course it's not perfect. What is?
It's been fascinating and extremely educational to see in the numerous HN discussions how many from the US are managing to view it from entirely the opposite point of view.
Wrt to vagueness i have to respectfully disagree. Perhaps an opinion poll would help, but from what i 've gathered from Q&A forums that are frequented by europeans in the past weeks, it's freaking vaguety vague. to the point where it's not clear how broad it is at times.
Maybe it reads fine if you are a "data subject" (i hate this term btw) , but if you actually need to comply its hard, even for the simple stuff that every website has. E.g. cookies, advertising, backups
I 'm not even sure if the data subject can figure out what to expect from GDPR. E.g. Is HN compliant? Can you tell if a website you visited today is compliant?
Most of us in Europe don't find it especially vague, poorly written or overly broad.
Yes, you all keep saying that, often while tripping over each other with contradictory explanations of when it applies and how to interpret it. Yes, truly well-written and not vague at all.
Wait...you mean that referring to the people in charge of GDPR as "good natured enforcers" who will "first warn you with a notice that you are not in compliance with the law, give you some period of time to become compliant and will - if you ignore them - fine you," even though no requirement for warnings exists in GDPR, might be unrealistic? Perish the thought. /s
You could however look at the MO of the agencies themselves. They have existed for a long time and have not attempted to overreach. In fact the opposite is true.
They have also never had the power to collect from any but the largest of companies outside their own borders. Now they are at least claiming that they do have this power. That sets a dangerous precedent and opens up the floodgates of abuse, because they don't have to deal with the PR or economic damage that the fines they assess internationally will cause - they import the money and export the problems. They simply see a massive inflow of money and get to hobble foreign competitors of local companies. It's a protectionist law, with the added bonus of extreme financial incentives for aggressive enforcement.
I'm intrigued. How is it baseless to say that a given EU country, say Germany, would not see a massive inflow of foreign money and a bunch of hobbled foreign competitors of German companies if they chose to engage in aggressive enforcement of GDPR against foreign companies?
Because we have an entire legal framework with centuries of precedent. Just about every law and regulation gives just a maximum penalty without countless cases of those being used to hobble foreign competitors.
Since we are beating dead horses, I will again repeat that nothing stated in the GDPR requires warnings or requires that fines not be very large. Is it, or is it not, legally possible for a regulator to seek fines against you under GDPR without first issuing a warning?
Please link to the specific law that exists outside the GDPR that requires such warnings. It has to be written somewhere...you (and other fans of GDPR) keep making this argument, so such a law must exist. The "answer" you linked to was just more of the same stuff you keep spouting, not a written law. If I can see such a law in the "old and large legal framework" you GDPR fans keep referring to that is somehow supposed to protect us from abuses, I'll happily admit that I'm wrong.
I think, though I could be mistaken, that it originates from German law. The UK had a very similar requirement established in case law. Nonetheless the EU views proportionality as a central principle enshrined in Article 49 of the EU Charter of Fundamental Rights [0]. "The severity of penalties must not be disproportionate to the criminal offence"
You're no doubt going to tell me that's far too vague and woolly. So this link might give you a flavour of how EU fundamental principles[1] came about from a bunch of centuries old separate national legal systems:
Just a random result on first page - there may be better or more easily readable sources.
That proportionality applies to everything in EU law, and there have been numerous cases through the courts, national Judicial Review, and taking cases to the EU Courts of Justice. The principle is firmly enshrined.
As with anything human mistakes are made, so of course there are appeals from time to time. That's how case law gets made.
That proportionality applies to everything in EU law
Again the problem is that this is in the eye of the beholder. With 20 million euro maximum fines, it would be easy to say that 100k euros is proportional for the lowest levels of offenses - after all, its only 0.5% of the maximum. But that would still kill most small businesses.
Regardless, it’s pointless to argue since GDPR is here in about 36 hours, and we will all get to witness its wrath - hopefully from the sidelines. I think that within a year, most US based websites will have closed their doors to EU residents, which may be the worst aspect of this for both the EU and the US. It’s sad, but nobody - even sites with the best of intentions - can take on the liability of potential 20M euro fines, regardless of what you say the odds are of those actually being handed out.
Proportionate for both. Destroying a small or micro business clearly isn't proportionate. Again firmly established in CJEU case law from previous businesses within the EU who have been hit with too severe a fine for some breach of EU law.
> I think that within a year, most US based websites will have closed their doors to EU residents
I would be astonished if that is the case. If it shuts out those not willing to play nicer with data and privacy - great! Even if that ultimately includes Facebook.
Every small business within the EU is adopting this "potential liability" without any signs of a rush to relocate outside the EU or shutting down.
Even if they are realistic for some agencies now, they’re not guaranteed to be for all agencies forever.
But what irritates me a lot more is the many GDPR fans here who not just disagree with this assessment but accuse the other side of ill intent.
It’s disgusting to call people evil and shady because they are uncomfortable with relying on the voluntary goodwill of some faceless overseas bureaucrat that they did not elect and who has been given the power of life and death over one’s livelihood. 99% of people here who have concerns don’t want to violate user privacy, but this law is so shitty that they don’t even know how to comply. And every single thread is packed with people exclaiming that it’s so obvious and easy, while all spouting totally different and contradictory advice. What a shitshow.
Perhaps us Europeans should demand that US law is drafted in a way that is more familiar to us? In fact I find the hierarchy of state and federal law really complicated compared to UK law, so you should change that too.
Sarbanes-Oxley in particular is much more draconian than any UK corporate law, and this is a barrier to me coming and breaking the law in the US, so you should change that too.
I didn't vote for your overseas faceless bureaucrat either, so I can I treat US law as optional?
Sorry Team America, you don't get to choose our laws
And you don’t get to decide that your laws apply to us just because your citizens are voluntarily sending us data. If you don’t want us to have the data, don’t send it. My server receiving a request from an EU citizen doesn’t give you jurisdiction over my business. I know you think it does, and I’m sure I’ll be downvoted, but you can pass whatever laws you want and if they don’t apply to me, I’ll continue to ignore them.
Wait, you think it is ludicrous to take how the enforcers behave with current privacy regulations as a rough guide to gow they will treat enforcement of future regulation? Perish the thought.
Yes. It’s absolutely ludicrous for me to say “ah, some random people on the internet say the EU regulators in their country have been fine, so I’ll be A-OK with dozens of countries all assuming vague and unchecked power over my business in perpetuity.”
I didn’t elect these governments, I don’t know them or trust them, and I don’t know or trust you either.
I don’t trust unaccountable power as a general rule.
What? Not sure what point you’re trying to make here, but if it’s the point that the HN moderators are not accountable to me, it’s kind of a pointless one. Of course they’re not, but I’m free to leave. The EU is claiming jurisdiction over my business because of something their citizens have done, not anything I’ve done. If you don’t want me to have your citizens’ data, tell them to stop sending it to me.
> The EU is claiming jurisdiction over my business
I think this is a huge strawman argument that you've constructed and hinged your entire line of reasoning on.
The EU claims jurisdiction over EU businesses. The reason very large US businesses are caring about GDPR, is because they are multinational businesses with a significant presence in the EU, i.e. they are also EU businesses. And if you're doing business in a country, you have to comply with local law. There's nothing new or weird or over-reaching about that.
When Facebook constructs a data center somewhere in the EU, the local Facebook subsidiary has to comply with local zoning laws, building codes, and labour laws.
When Facebook gathers personal data about EU citizens, the local Facebook subsidiaries have to comply with local privacy laws.
Note that Facebook isn't extending the GDPR protections to non-EU users, because it doesn't have to! It only has to extend GDPR protections to EU users, if they wish to keep their European subsidiaries.
I think in the larger cultural context, the public at large is getting more aware of and concerned about data collection. If you don’t have large amounts of PII on EU residents then simmer. If you might, don’t be the one they make an example of.
In the threads like 'Removing Monal from the EU' [1] most folks say you'll get a warning before any enforcement is done. You could try rolling the dice on that.
Also on the type of data. If you are using super sensitive data (eg health profiles/histories of people) you better not risk because you are gonna get hit hard.
