Hacker News new | comments | show | ask | jobs | submit login

It's reassuring to hear that the GDPR is not meant to target little startups and projects but I would like it a lot better if it said that in the actual law, rather than just trusting all current and future regulators to treat me kindly.

If it's only meant to be used against big companies or extreme offenders, why doesn't it say so? It seems like the spirit of the law and the language of the law are not aligned and in my opinion that's a sign of poorly designed regulation.

I object to the idea that small projects should be ok with breaking the law merely because they very likely won't get caught.




Because if your business model is based on selling user data, it doesn't matter if you're a small startup, it absolutely is meant to target you.

If you aren't competent at responsibly handling personal data and you want to build a project or startup, pick one that doesn't handle personal data, or put in the effort to learn how to do things properly.


How does for example a small yoga studio’s email list fit in your examples? Or even just it’s website? Without cookies and login even - the IP adress in the log files alone is considered potential personal data that basically puts people in the need of consulting a lawyer about how to safely deal with that. And makes you a potential target to being sued and getting a lot of hassle. Even found nit guilty in the end, no one will pay days of time and energy needed for defense.

And then: What kind of online business can reasonably be done without using an email adress, if only for login/resetting password if lost? You either have no option to reset passwords, or must do it by phone, which is extremely expensive.


IP address are permitted under the security exception: Storing personal information in order to protect information or information systems is permitted without need for consent. Using your log files for security explicitly permitted and there is nothing that changed a system administrators job before or after GDPR on this point.

If you are using a email list in order to fulfill a contract to your members by informing them about times and so on then that is also permitted by GDPR. If a customer buys a subscription then the company in order to fulfill their side of the contract can then naturally store information to do so.

Mailing lists also has had a long history of best practices in order to not get marked as spam by the large email services. Get consent so users don't mark it as spam and allow unsubscribing. If a small yoga studio used a email list for a significant time and not been forced to do shady behavior in order to bypass spam filters, then they are almost guarantied to be compliant with GDRP.

Similar an online business has a contract when a customer buy a product or service. In order to fulfill that contract a email address is commonly used. Perfect GDPR compliant. Hard to imagine a online business before GDRP that did not have a contract with customers.


So what you're saying is there's lots of complexity and nuances in how you do this with some commonly done things illegal and others not ... and you should probably consult a lawyer to make sure.

Correct ?


You don't have to get it all right on the first try. If you get something wrong, the regulatory body will contact you (via letter or email) and tell you what they feel like is not correct (that is the official guidance on how to handle GDPR violations).

As long as you do your best to implement the GDPR and interact with the regulatory agency in a friendly and helpful manner then there won't be much need for a lawyer (but do consider that the GDPR being written as it is is also the result of being written in the EU where law is written a bit differently)


Your comment sounds so Orwellian I can’t help but cringe.


I’m increasingly convinced that a majority of people who use the term “Orwellian” haven’t actually read Orwell’s books.


I find the use of "Orwellian" rather ironic in this context.

I run a company based in the UK, but I myself am American and most of my business experience is in the US. Despite that, I honestly have had no issues adapting to the GDPR. Considering that the business I operate has systems specifically designed to store as much data on people as possible, I find it absurd other businesses are unable to handle user/client data responsibly.

That said, I cared about privacy BEFORE GDPR and intended to act responsibly regardless of regulation.


It's not orwellian to be friendly towards authority, especially when you're a business and it's about the privacy of the users, protecting the very data that orwellian governments seek to collect and abuse.

Otherwise, I would love to hear which part of my comment was orwellian in nature?


I'd guess he's referring to your (likely correct) implication that the regulators will give more weight to your "friendly and helpful" behavior than to how the text of the law applies to the facts of your case.

The concept of the rule of law was invented primarily in countries that now belong to the EU. Is there no one left there who still thinks it's important? It's not even that people argue "the GDPR couldn't be less vague without loopholes, and this is important enough that it's worth the cost". The idea that a powerful human's best attempt to objectively apply stable, published rules is generally better than a powerful human's unrestrained discretion just seems foreign to most commenters here.

If you ran an organization publicly associated with George Soros in Hungary (whose prime minister has described him as an "enemy of the state"), then would you still feel good relying on your friendly relationship with the government? What steps would you take to comply with the GDPR as it's currently written, if you couldn't rely on the goodwill of the people interpreting it? With a sufficiently corrupt government, there's nothing you can do; but the point where a judge will accept an obvious lie tends to come long after the point where a regulator lets politics disambiguate a vague standard.


The GDPR is a regulation and not a law, thusly the implications are different.

If you produce a device that accidentally violates FCC guidelines, would you rather be immediately punished to the extend of the regulation or rather work with the FCC to rectify the issue and how to fix it for affected customers?

The other reason is that yes the GDPR is vague. It must be because in the past corporations have abused loopholes and the only way to prevent people abusing loopholes without punishing people who don't abuse them is to make it vague and then decide on their behaviour.

And again, these are corporations, legal persons. They don't even have the remotely same rights as a natural person.


At least in the USA, a regulation has the force of law. To say "regulation" instead of "law" just means the rule gets its legal power indirectly from some statute (which probably also limits the scope of the rules), instead of directly from the legislative process. I'd thought the EU was similar. Is it not?

If I ship a device that fails to comply with FCC rules, then I would prefer that the maximum penalty provided by law is also a fair and reasonable one. I understand that most regulated fields are complex enough that if we don't give regulators some discretion, then the law will be filled with loopholes and impossibly complex; but I would like to give them the minimum discretion they need to do their job. I think the GDPR fails that test spectacularly. Do you really think they need the statutory authority to fine someone 20M EUR for their semi-commercial side project that made $1k lifetime total? If not, then why give it to them?

The GDPR applies to natural persons too. Imagine if it didn't! Facebook could just contract all the creepy stuff to a sole proprietorship operated by Mark Zuckerberg...

ETA: From https://ec.europa.eu/info/law/law-making-process/types-eu-la...

> Regulations are legal acts that apply automatically and uniformly to all EU countries as soon as they enter into force, without needing to be transposed into national law. They are binding in their entirety on all EU countries.

So not quite the same as the US, though maybe some analogy in that the regulation is still "secondary law", subordinate to the EU treaty? But I don't see how you can describe a set of rules "binding in its entirety" as anything but law.


To my understanding the EU handles it differently. Regulation as opposed to law is supposed to be enforced in a guiding manner, recognizing that sometimes you accidentally don't comply or there is otherwise a differing implementation. You can somewhat also see that in how the EU ramps up regulation in case nobody is playing ball.

Stage 1 is when they want to fix it and they express wishes that the industry changes their ways. Stage 2 is the cookie law and Smartphone USB charging. A very vague regulation or law is implemented as a sort of warning for the industry to better go and fix it. Stage 3 is nuclear; GDPR.

The smartphone industry is as mentioned at Stage 2. The EU expressed wishes to reduce the charger garbage, nobody did anything, so they simply put out a regulation that almost literally just says "all smartphones need one common charger". Largely this has been microUSB but vendors are switching to microUSB.

The regulations are to my knowledge and experience also employed and enforced in a similar manner; first you get a nice letter informing you that your website is in violation of X. Ignore that or get aggressive towards the regulatory body and you get a less nicely worded letter with a threat of a fine. Continue that path and you get a fine.

The ultimate goal is that everyone should be compliant but it's okay to be occasionally not as long as you are willing to be helpful and fix it immediately.

>Do you really think they need the statutory authority to fine someone 20M EUR for their semi-commercial side project that made $1k lifetime total? If not, then why give it to them?

They don't you have a legal right for a proportional punishment. Unless your little side project caused damages the fine will be appropriate such that you can pay it without going bankrupt. And if it did you'll have to pay those damages on top of course.

>The GDPR applies to natural persons too. Imagine if it didn't! Facebook could just contract all the creepy stuff to a sole proprietorship operated by Mark Zuckerberg...

It only sorta does, it only does not apply to natural persons while they don't engage in commercial activity.

And a sole proprietorship is to my knowledge a legal person, even if the only natural person involved is 1. (I would know, I am basically one, or rather, small business operator would be the more accurate translation, which also has limits on turnaround and profit)

The sole proprietorship would have less rights than the person behind it and has no option but to fully implement the GDPR in any project or product. A natural person on the other hand, publishing a hobby on the internet with no commercial or business activity (which are different things in german law and you can certainly run a commercial activity without ever touching money or forming contracts).


Enforcement of regulations in the USA isn't grossly different in practice. For the kinds of topics that regulations tend to cover, I doubt it could be otherwise--the complexity of the topic makes it impossible to draft law that can be objectively applied to all cases, that ambiguity makes accidental noncompliance common, and regulatory discretion is required so the accidental noncompliers don't get screwed. I accept that as unavoidable, but not as good. The regulations have the force of law, and the penalties--the loss of one's livelihood, or even prison in the extreme--may be just as life-altering as for any other law. So all other things being equal, I'd prefer that the regulators act with as little discretion as possible. That gives everyone the fairest chance to comply with the rules, even if the regulators for whatever reason dislike them.

The GDPR indeed says the punishment should be proportional; but what does that mean to you? Are you sure it would mean the same thing to a regulator? A regulator who dislikes you? If they said that 10k email addresses and MD5-hashed passwords leaked from someone's game server was a worst-case breach, then I'd say that was ridiculous; but I don't see what in the text of the law lets me say that it's objectively false.

The USA has no concept of a separate entity for sole proprietors. It's just you, even if you're trading under a business name. If the GDPR didn't apply to that, then that would be a massive loophole, so I'm pretty sure it does. In any case, the real question is perhaps commercialness, where (a) lots of hobby projects have some small commercial element, ads or donations or a tee shirt or whatever (and to be clear, I do think privacy regulation should apply to them, just more specific regulation); and (b) I strongly suspect the GDPR applies to some noncommercial activity too--would the EU let a political group pull a Cambridge Analytica with all volunteer staff? I haven't researched that, though.

If I lived in Germany, then I'd probably have pretty good faith in my regulators. But imagine the example of that Soros-linked group in Hungary (which I'd edited my first comment to add, so you may have missed it). I don't think that's hypothetical--political organizations keep lots of data, so I suspect that somewhere, a group is making plans to comply with the GDPR, as interpreted by regulators whose government considers them "enemies of the state". What would you do in their place? Wouldn't you wish the text of the regulation gave the regulators less room to maneuver?


>if the GDPR didn't apply to that, then that would be a massive loophole, so I'm pretty sure it does.

Well, they are seperate entities so the loophole exists for how the US handles it but in the EU there is no loophole.

>In any case, the real question is perhaps commercialness

Last I checked you don't need commercial elements like ads, donations or anything like that to be considered commercial. Running your own git server with open registrations would be considered commercial (there is additional seperation in that you don't have to pay taxes unless you are profit-interested).

>I strongly suspect the GDPR applies to some noncommercial activity too-

Monitoring of any kind that is strictly outside private interest.


That's something that utterly amazes me about the EU, and your comment. A lot of the protections that exist for privacy in the US against authorities mostly don't exist in the EU.

The EU lets every police force in the EU, or in Interpol request data interception. That is a LOT of organizations, and of course, they got caught doing abuse just the same. But, for instance, the default practice in the US is that you get told your phone is tapped (yes, really), unless the police explains to a judge why not (nearly always), BUT in that case you still get told afterwards. This does not exist in the EU. You will never be told you got tapped.

Second, in the US, the provider looks at the order, verifies it with the proper authorities, and decides for itself on scope, reasonableness, ... etc. In the EU, nope. If an order is received the only actions that a provider can take must be technical in nature. In theory an employee that does the actual tapping of the phone can't even tell his manager he's tapping phones, and definitely he can't tell anyone which phones are to be tapped or why (nor is there any obligation on the part of the requesting force to tell him why, but it is a field on the form). In many countries, this can be done without judicial oversight, or in nearly all cases with only very, very light oversight. This, to me, is far more worrying than the situation in the US.

If a local police officer in Latvia wants to tap the phone of anyone in the EU, he just has to fill out a form and fax it to interpol.

This is even weirder given that Europe has actual experience with abuse of surveillance powers, everywhere from Germany Eastward, as well as during WWII. They KNOW what can go wrong, they just have to ask their parents or grandparents to find people who were actually exposed to this. And yet ...

Next we find out that large-scale spying on the own population is done in, at least, UK, France, Germany, the Netherlands ... and not a peep. This was barely reported in the local media, in fact. We all know that most other countries are going to be worse than these, not better. And, of course, they cooperate with the NSA as well.

Hell, the US has reporting on how much they spy on their own citizens (in fact, that's the source of most of the outrage). No such stats in the EU. Nobody, not even the police forces themselves, feels the need to have the most banal, basic level of transparency.

Clearly when it comes to spying the EU is of the opinion, them, yes, perfectly allowed. Think of the children ! I mean, clearly these guys do not believe in privacy.

So yes, it is very Orwellian when they just request that you work with them on the privacy of their citizens. Clearly the result they want is not actual privacy and protections for their citizens.

If they believe in privacy protections, they have a lot of state agencies that they need to attack for not having any decent respect for privacy, as well as the fact that what few protections do exist only exist in a vast complex tangled web that errs on the side of violating people's privacy. And that's ignoring the fact that privacy protections have been systematically eroded further and further in Europe (e.g. recently in Germany).


>A lot of the protections that exist for privacy in the US against authorities mostly don't exist in the EU.

They actually do, the german police for example, generally destroys any video or image footage they make after 24 hours if there is no reason to believe they would help solve a crime.

I can't say anything about Latvia but in germany atleast the privacy of letter and remote communication is heavily protected and usually not granted lightly (exceptions being stuff like actual nazis)

People are definitely aware of the past and there is always a lot of outcry whenever a new law attempts to encroach on that territory, politicians have destroyed their careers with such proposals.

>And that's ignoring the fact that privacy protections have been systematically eroded further and further in Europe (e.g. recently in Germany).

Please note that the BND, the german intelligence service, recently shutdown a surveillance program after several thousands of people requested the deletion of their datasets.

>You will never be told you got tapped.

I don't understand why you should be told that the police is trying to get evidence of you doing a crime? Or someone else's crime?

Again, we have different laws and legal systems (!) in the EU up to and including not having the US constitutions. I think it would benefit the conversation if you recognize these differences instead of applying american laws and principles on the EU.


> They actually do, the german police for example, generally destroys any video or image footage they make after 24 hours if there is no reason to believe they would help solve a crime.

Source ? This, to me, seems unlikely in the extreme. I mean this is strict enough that even I would agree they would regularly shoot themselves in the foot with such a policy.

> Please note that the BND, the german intelligence service, recently shutdown a surveillance program after several thousands of people requested the deletion of their datasets.

I doubt it's the only one. Call me when they change the law back so they can't legally do this.

> I don't understand why you should be told that the police is trying to get evidence of you doing a crime? Or someone else's crime?

The idea, in the US, is that you get informed afterwards. How else will you sue the police if it wasn't reasonable at all ? How will abuses be discovered ?

Keep in mind that more than a few police officers have been sued for using surveillance on women they were merely interested in, in some cases then proceeding to beat up and harass other interested parties. I doubt that this behavior is in fact limited to (a few) US cops, we both know the truth is that (some) EU cops simply get away with it.


>Source ? This, to me, seems unlikely in the extreme. I mean this is strict enough that even I would agree they would regularly shoot themselves in the foot with such a policy.

General guidance policy and numerous court cases. Not all footage is 24 hours, most is however. Some exceptions go for 48 hours. [http://timetravel.mementoweb.org/list/2010/http://www.polize...]

Video surveillance, especially when in public spaces, is frowned upon and there is a long rat tail of court cases.

The law is very strict in when, what, who and how long video surveillance is allowed, including the 24 hour limits, though in case a crime is suspected the footage can be kept for 14 days until a crime is confirmed. [https://recht.nrw.de/lmi/owa/br_bes_text?anw_nr=2&gld_nr=2&u...]

>we both know the truth is that (some) EU cops simply get away with it.

Generally, they are reprimanded or even punished when such behaviour is discovered as it is a violation of various laws, including privacy.

>How else will you sue the police if it wasn't reasonable at all ? How will abuses be discovered ?

Generally, any evidence the police brings up in a court case requires that the police has an explanation on how they got to that evidence. That may have been illegal, in which case a second case might be brought up and the involved officers will be punished.

However, unless the evidence they collected is wrong due to the surveillance (the bar is very low on the police being guilty of forcing you to commit a crime), the evidence will be used regardless (a few edgecases but generally evidence is not poisoned if gained by wrong means like in the US IIRC).

>I doubt it's the only one. Call me when they change the law back so they can't legally do this

Already is, which is in part why the BND stopped this too.

The bar is high for someone tapping the phone or otherwise doing remote communication surveillance, [GzBBPF, Section 1, 2, 4 and 7]. Unless there is a very strong suspicious that you commited treason or commited a federal crime and there is absolutely no other way to prove you did it, they can't legally tap the phone.


I can't believe you can be this naive. Your arguments basically boil down to "the state can be trusted".

Basic dependencies of your argument: the police force will never abuse surveillance, then not make a court case out of it.

Second basic dependency of your argument: the court will easily rule against the very forces they depend on if they find violations.

These are reports German police officers that got caught, shall we say, being VERY untrustworthy:

https://www.itproportal.com/2011/09/12/privacy-boss-slams-ge...

https://www.thelocal.de/20161213/cannibal-cop-convicted-of-m...

http://www.scmp.com/news/world/europe/article/2142710/dozens...

http://www.spiegel.de/international/germany/hanover-police-o...

https://www.thelocal.de/20121017/45615

https://www.youtube.com/watch?v=vM1c_58e6jk

https://www.youtube.com/watch?v=juQD0OU6SD8

So I feel like I've provided plenty of evidence that the police cannot be trusted to act correctly, or even just sane. The German police, clearly, is no exception to this rule. Therefore Germany trusting them to do the right thing is just hiding abuse, not preventing it.

You also left the question unanswered: if tapping is so correctly and justly done, then why does it need to be such a big secret ? There is a case to be made that, sometimes, it needs to be kept secret DURING an investigation, but why afterwards ? In many cases, even that is not necessary, when for instance following or tracing someone who was brought in to the police station, it seems to me like there is no reason whatsoever to keep it a secret that the police reads his mail/call logs/... Why do they want this perpetual secrecy, if not to hide abuse ?

The answer is very simple: because Germany hires neonazis, cannibals, violent bullies and worse into their police force, and police officers like those are also trusted with tapping people's conversations.


Which is exactly my point put a bit shorter :)


I would sincerely hope that the small Yoga studio is not attempting to custom code their website in this case, in which case the economical solution is for the Yoga studio to use a GDPR compliant website and mailing list toolset, and simply migrate to a different set if they find that they aren't.

Now compliance is largely handled by the tool makers, and the Yoga studio can focus on their business case and any custom coded extensions to ensure they remain compliant. (For popular stuff like Apache, compliant configurations are probably already available or will be shortly, once we all figure out if we are allowed to keep logging IP addresses by default.)

I'm not sure I understand the email jab; obviously you can store data, you just must obtain consent first, and must allow the data to be deleted on request. That's an opt-in mailing list with an unsubscribe feature that actually works and properly deletes the relevant data. Why should that be difficult for a small business to do right?


> I would sincerely hope that the small Yoga studio is not attempting to custom code their website in this case, in which case the economical solution is for the Yoga studio to use a GDPR compliant website and mailing list toolset, and simply migrate to a different set if they find that they aren't.

You just gave a perfect example of why GDPR will hurt startups and innovation.


How so?


Parent just admitted that it would be unreasonable for a small business to comply with GDPR and that larger organisations were better equipped to deal with it.


Many small business rely on wordpress because it's free and hosting is cheap. There's plugins for nearly every functionality you can imagine. Perhaps having them migrate to proprietary systems is the better solution, but I can't help but feel it's a net loss for the World Wide Web.


On the contrary, I think this is secretly a benefit. As soon as WordPress updates to include all the necessary tools to be GDPR compliant, every small business using their platform should be able to easily pull those features in with minimal developer work. The common platform is a boon here because it helps everyone work together on the issue, rather than requiring the smaller players to implement a mountain of work by themselves.


> the IP adress in the log files alone is considered potential personal data

Stop logging the IP address then. Hopefully default settings in web servers will change.

> What kind of online business can reasonably be done without using an email adress, if only for login/resetting password if lost?

That means you have a legitimate interest, so long as you don't send marketing emails to those addresses, or sell them, and so long as you delete them if someone deletes their account.

> How does for example a small yoga studio’s email list fit in your examples?

If someone signs up to your email list, they've consented to receiving emails. Just don't sell the list, and remove people if they unsubscribe.

The only real complication (if you're in the UK, I don't know about other countries) is that there is a fee to register as a data controller. https://ico.org.uk/for-organisations/data-protection-fee/


Ip adresses are needed for security anslysis in case of attacks, for example.

the thing is not about doing what you propose but that however you‘re doing it, you have a lot of bureaucracy and legal insecurity right now.

The examples of wrongdoing you give should be leading to hard measures. But those with good intentions shouldn’t have high bureaucracy costs.

To be clear: i don’t say these laws shouldn’t exist. They just should have been targeted at the actual wrongdoers and put smallest possible burden on all with no bad intentions.


> Ip adresses are needed for security anslysis in case of attacks, for example.

Then you have a legitimate need for the data, so store it for a reasonable length of time and then delete it.


>Ip adresses are needed for security anslysis in case of attacks, for example

People repeat this a lot, but it sounds like complete nonsense.

Why does your business need to perform “security anslysis in case of attacks”? Do you get paid to do that? Why would you need IP addresses for that?


One obvious case is DoS attacks. Rudimentary attacks can be mitigated by blocking IP addresses of the attacker.

Another example is logging requests to secure sections of the site and/or server and perform IP blocks on fishy activity.


You can do that with a hash of the IP.


How would this work? You can't just sha256 IPs as that'd be trivial to reverse, no different from storing the plaintext.

I don't see why the IPs would ever have to hit the disk for this purpose, just keep them cached in RAM for a few minutes.


Salt the hashes, perhaps use PBKDF2. The problem is solved for passwords, just treat IPs like low entropy passwords.


there's only 4 billion possible IPs, you can reverse the entire search space in a few hours

the only way round this is to make the webserver spend a non-trivial amount of time running some derivation function on the IP for each and every request (remember you can't cache the result if the entire point is not to store the IP)


And all that stuff is super complex... for a number which is not person bound and personally identifying in the furst place. Only with a lot more effort. So my critique is, the lawmakers should have made actions to use ip‘s to identify persons illegal, but not storing ips themselves.


IP is person bound and personally identifying, in a lot of countries you can trace back an IP to a list of people and with an additional information like a last name or a timestamp you can fairly reliable identify a single person.


How would all these things be legal just because an IP in a logfile isn’t?


Largely they aren't. It's not important that they are legal or illegal.

The problem is that it's possible and that is where the GDPR hooks in.


It’s probably also possible to identify people based on the combination of their car color, built timestamp, model and specifically ordered extras. Shall storing these, without a name, be made illegal then and forcing someone to save these in a database to hire a lawyer to ubderstand their legal position? Just because if the name is added to such a database of cars produced, it will be personal identifying?

Put another way:

If the goal is to prevent certain actions by making them illegal and a given boundary can already ensure that, whats the point in widening that boundary even more?


>If the goal is to prevent certain actions by making them illegal and a given boundary can already ensure that, whats the point in widening that boundary even more?

Atleast in germany the boundary has not been widened and most corporations seemed to operate just fine.

> Just because if the name is added to such a database of cars produced, it will be personal identifying?

When you add data to your database you'll have to consider this, yes.

Privacy under the GDPR means that you evaluate whether or not it is necessary to store such data.

Why? Because the GDPR is not only about the present but also about potential problems. If your database gets breached and someone runs of with the data, the GDPR seeks to ensure that the data contained is the absolute minimum necessary and does not threaten the privacy of the users if possible.

Put another way:

Under GDPR you do not own data like car color, built, model, extras. People give you stewardship of the data and you are responsible for it. It is your task to protect it. Protecting people's data is easier when you don't have as much of it.


> Stop logging the IP address then. Hopefully default settings in web servers will change.

But in legal matters, you need to identify people and have some kind of audit trail, especially if they tried to breach your system. That makes no sense.


Depends what's on the site. If it's just a static site, there isn't a lot of point trying to investigate a breach, just fix the changes and move on.


Why stop at IP addresses then?

If IP addresses in logs are necessary for audit trails, why aren’t fingeprints?


You put it to a total overexaggerated extreme here.

That doesn’t help.

IP adresses are not 1:1 assigned to a person for a whole lifetime, fingerprints are.

Only with a lot additional effort and connection to other databases, IP adresses can actually be connected with a person, but only for an uncertain period of time, finding out this timespan, and ensuring it’s really only exactly this one person requires even more effort.

So a properly crafted law would have made all these efforts illegal, and put high fines on them, but not the decades old practice of storing ip adresses in logfiles.


Why do you need to store IP addresses in log files?

I understand audit logging for authenticated users, but that's hardly a general case.


Why are ip adresses even considered personal data? They aren’t for most people and situations, unless a lot if other activities are done. All of which would be already illegal without consent by the law. The ip adress i write this from changes every day, and nobody can know if i share it with someone or not.

I want to be protected from marketing firms that sell my email adress , and everyone who uses it to send me mails for whatever product to buy judt because i entered it for some totally different reason. Those shall be fined with 5 figure amounts.

I don’t see how my(and my housemates/office colleagues etc) ip in the logfiles of the webserver which a small business rented for 3€ to upload 3 html filed can be abused (without storing my email and name without consent which is actual personal data and therefore illegal) and i dont want my hairdresser, car mechanic etc be in need to consult a lawyer to understand all that stuff and have a day worth of bureaucracy and adfing a “we have your current ip in the logs” note just because they want me to be able to google their street adresses.

The law is simply not well crafted for no use if the latter is the case.


>If you aren't competent at responsibly handling personal data and you want to build a project or startup, pick one that doesn't handle personal data, or put in the effort to learn how to do things properly.

Or, alternatively, just don't do business where it would put you under the jurisdiction of the GDPR. That's what a lot of companies are doing, and there seems to be a lot of resentment over it.


There isn't a law banning the use of Electron instead of learning how to build desktop applications properly, and there's a lot of resentment over people doing that too.


>There isn't a law banning the use of Electron instead of learning how to build desktop applications properly, and there's a lot of resentment over people doing that too.

Yeah, and that resentment makes no sense to me either. In both cases it's simply people doing what, in their estimation, makes the best use of their available resources.


> If it's only meant to be used against big companies or extreme offenders, why doesn't it say so?

Because, and this has been repeated millions of times on HN, Europe and the US follow different systems in writing laws


Perhaps we should then take some lessons from how they in USA write laws.


Lol hell no, the US is horrible at writing laws that are good for the common person. I'd rather trust the the EU with its clumsy but well-intentioned laws over the USA's malicious, designed-by-companies laws


In the Czech Republic, small companies and self employed people are commonly fined for breaking extremely complex and unclear laws, some of them set by the EU (e.g. VAT) - without any malicious intent, ready to pay whatever should've been paid. It's the big companies that get to make deals with the government and avoid punishment. They also consistently favour big companies over small ones with tax breaks, dotations etc. I don't trust the EU in the slightest.


Most regulation seems to fall into that category in the US too. Big companies have the money to combat it and still make a windfall of profits, while the small guy trying to build a company gets crushed because some regulatory prosecutor is trying to make a name for himself.

Tax law is probably the most common example of this.


lol, no thanks.


He's talking a nice talk, but history has shown us that when EU makes regulations/laws then they just don't care about the consequences or the collateral. As evidence I would bring the completely useless cookie law and the completely botched "digital VAT" change.

In the latter it just confounds me that the legislators set up a situation, where a small business in the UK is better off not selling a digital good (that you can make infinite copies of) to a buyer in Malta, because the bureaucracy would cost more than the sale would pay. You can't have a "single market" like that.


"but I would like it a lot better if it said that in the actual law"

Have you read the bloody law! http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX...

This is legislation designed to protect not only me (as an individual) but you as well (as a probable foreigner) from me!


Reading the law, I only see a single exception for small companies: Article 30.1 and 30.2 doesn't apply for companies less than 250 employees.

Out of an 88 page law, 1% of an auxiliary middle of the law is carved out for small companies.

I'm not sure that counts as differential application for small companies. In the US at least, large portions of entire key burdensome laws don't apply for employers below size 50, 10, 5, etc. This does not seem to be the case here.

Does anyone know whether an official impact study on innovation was even done before its passage?


You can be a company of ten people and still turn over millions by selling your users’ data in shadowy ways. Why shouldn’t you be stopped just because you’re small. How can the size a company be used as a rational differentiator in a law like this?


Because the vast, vast, vast majority of small companies aren't turning over millions of dollars. That's the same logic as, "some people cheat on welfare, so lets defund it." This logic gets pushed around a lot by GOP pundits.

The law may be good as a whole but be overly burdensome for small companies. You should at least acknowledge that instead of just dismissing that outright.


Similar laws have existed for many decades. In The Netherlands, privacy laws date back to the 1970s.

At least my reading of the GDRP is that it tries very hard not be a big burden. If you are a small company or organisation and you collect a minimal amount of information (for example to contact them) there is not a lot you have to do.

The main thing is, you are not allowed to be sloppy. If you collect personal data, you have to think about whether you should collect it at all, where to store it, process it, and when to delete it. And you have to tell people that before you ask them for personal data.

Nothing like, we just collect a bunch of data, give copies to everybody, and have no idea what we collected. That attitude no longer works.

If you set up food regulations, are you going to exempt restaurants with only one cook? Or have aviation regulations that do not apply to airlines with only one pilot?

Given that the entire GDRP is less then a hundred pages, you can easily read it in one evening and get an idea of what you can do, have to do, and what the corner cases are that you may need to discuss with a lawyer.


> If you set up food regulations, are you going to exempt restaurants with only one cook?

But restaurants with only one cook can't afford a $300/h lawyer to tell them how to keep their shit hygienic!


And in the EU we have a different way of working. In the UK you can literally phone up the ICO and get free advice, specific advice on how to stay compliant.

If it turns out that you are in breach, they will write to you with information about what you're doign wrong and how to fix it.

In the EU we don't rely on lawyers for a fraction of the stuff you do in the US.


> Does anyone know whether an official impact study on innovation was even done before its passage?

So if it's "innovative" a small 5-person startup should be able to wreak havoc to my personal data in whatever way they see fit? What is that nonsense. Are you seriously suggesting that "innovation" in startups should be more important than my privacy?


Are you seriously proposing that regulations move forward without an understanding of their impacts?

No matter what the ultimate decision is, no matter how sensitive the subject matter, impact studies are critical to making smart decisions.


If a regulation is going to impact "innovative" startups that sell my data, I am totally for it. I don't want more innovative ways to sell my personal information.


> sell my data

I think you're justifying a really extreme reaction based on the worst behavior of a few companies. GDPR doesn't just go after data-resellers. It targets how a well-intended company can use and keep your data even with no third party involved.

Laws that mess up the good-guys lives are bad laws. GDPR is from the same folks who thought a law that lead to pestering users about cookies was a good idea.


It's not stopping any well intended company from fairly using data. A law making it harder for well intentioned gun enthusiasts from getting guns is a good law according to me. All well intentioned gun enthusiasts should support it. Otherwise there'd be a day people would get tired of the bad intentioned gun owners and legislate a complete ban on guns.

Also I like the cookie idea. If only people really cared about misuse of their data they'd like it too. We've seen how good 3rd party cookies have been for some democracies.


Maybe it's just me, but the 2nd Amendment talk in this case really seems like a hamfisted way to spout political opinion that's in no way relevant.

>All well intentioned gun enthusiasts should support it.

Really black/white argument there which the issue is not. And nor is this topic. There should be more nuance in GDPR, but there isn't which creates a lot of discomfort.

>It's not stopping any well intended company from fairly using data.

It actually is, but whether or not that is an overall good thing is yet to be seen. Certainly, they did some level of testing before proceeding.


So without curiosity or concern for any other impact you say yes...

I might say yes but I still want an impact study.

I prefer governing bodies operate with an awareness of how their actions affect society.


I don't think we're going to lose as many "well intentioned" websites as much as we'll get rid of bad intentioned businesses.


You’re missing the point. One last time: it is ideal to operate with an awareness of consequences.


> Are you seriously proposing that regulations move forward without an understanding of their impacts?

No, and it is dishonest of you to suggest that was claimed.

> impact studies are critical to making smart decisions.

Which were done as was consulting with industry etc. well before the law was passed two years ago.


In the history of laws, many of the ones designed with good intentions have been quite harmful.

And yes, I've read the law. It's typical of legislation in that it obviously wasn't written by people who knew what it looked like to perform that in a real life business.


> And yes, I've read the law.

Have you read recital 1? https://gdpr-info.eu/recitals/no-1/ ? The starting point of the law is that data protoection is a fundamental human right,. The data subject owns their PII, not some company collecting it.

It's all up whether you are willing to accept that as a fundamental right or not.

I mean there is a billion of Chinese that live with the fact that free speech is not a fundamental human right. Most Westerners have a problem with that.

Now many US based IT professionals seems to have problems with accepting that nobody else can own the data about a human.

> It's typical of legislation in that it obviously wasn't written by people who knew what it looked like to perform that in a real life business.

That's what a cotton farmer could have said when they made slavery illegal. Obviously respecting other's human rights makes some business models illegal.


First, let me say that, I'm not the person you're replying to, I haven't read through the entire GDPR (yet), and I think that stronger privacy laws are a very good thing. (Part of the reason I regularly donate to the EFF.)

> The starting point of the law is that data protoection is a fundamental human right,. The data subject owns their PII, not some company collecting it.

> It's all up whether you are willing to accept that as a fundamental right or not.

As a fundamental right, doesn't that mean that the government needs to abide by it as well? Can an EU resident demand that their image be removed from all footage collected by public surveillance cameras, for example?

> Now many US based IT professionals seems to have problems with accepting that nobody else can own the data about a human.

I think the idea that someone can own facts about anything is bound to cause some amount of confusion or even cognitive dissonance.

At what point does one's right to be forgotten supersede another's right to remember?

If Alice knows something about Bob because of their personal interactions, as he asks her to forget about it, but she still remembers it, is she violating Bob's right to be forgotten? How about if she had written it down in a journal? Does she need to erase what she wrote? What if her journal was stored electronically? In any of these cases is she allowed to tell another person? What if she already told another person before Bob told her to forget about it?

More concretely, suppose Bob visits Alice's house, and then a couple of weeks later tells Alice that she must forget that he visited. If she ignores his request is she violating Bob's rights?

Now suppose Bob is visiting Alice's website, which records his IP address in a log file. Bob asks to be removed from the log, and again Alice ignores his request.

I think for many technically minded people there seems like an awfully smooth gradient between these last two scenarios, and so classifying one as reasonable and the other as a violation of human rights can be surprising. Precisely where is the line drawn that makes one scenario reasonable, while the other is completely unacceptable?


> As a fundamental right, doesn't that mean that the government needs to abide by it as well? Can an EU resident demand that their image be removed from all footage collected by public surveillance cameras, for example?

Yes, in Germany, everyone, meaning citizen(EU/EEA) or not, enjoys the right of forgotten from surveillance cameras or any image/personal information that is not subject to the legal registry, from public record beyond 90 days. Unless you are targeted for an otherwise legal reason.


Which law is that exactly (german here, but i dont know what you’re referring to€


Not able to answer that question but the Auskunftspflicht also covers police surveillance footage.

Personal anecdote: I was involved in a student demonstration once that ended with the police recording every individual separately in addition to checking our national ID cards. After about 14 days I wrote them a letter requesting information about what data they had kept and to destroy that data if it is not part of an active investigation.

I received a formal response saying they had already destroyed the data shortly after collecting it because they didn't end up needing it.

I presume the law is exactly the same as with any other organisation, i.e. the BDSG (Bundesdatenschutzgesetz) which as of now implements the GDPR (DSGVO) in Germany.


Yes, and meanwhile they illegally sniff your whole Internet traffic... just one current example https://blog.fefe.de/?ts=a5f2e96c


Generally, Bundesdatenschutzgesetz (BDSG), mainly Kapitel 3. §57, §58 and §61.


> At what point does one's right to be forgotten supersede another's right to remember? > > If Alice knows something about Bob because of their personal interactions, as he asks her to forget about it, but she still remembers it, is she violating Bob's right to be forgotten? > > etc.

No, no-one can force you legally to forget something, and I think this brings up the main problem with your argument, which is that we're not talking about Alice and Bob, we're talking about Alice and Bob's Widgets INC.

I'm technically minded and I see a 100% separation between the interaction between Alice and Bob, and Alice and Bob's Widgets INC. Yes, I do think it's completely reasonable for Alice to ask bob to be removed from log files, journals whatever.

Lets look at a parallel you drew:

> More concretely, suppose Bob visits Alice's house, and then a couple of weeks later tells Alice that she must forget that he visited. If she ignores his request is she violating Bob's rights?

I wouldn't say that Alice is violating anyone's rights here. Being unreasonable, yes. Asking for something with no legal or enforceable basis, yes.

> Now suppose Bob is visiting Alice's website, which records his IP address in a log file. Bob asks to be removed from the log, and again Alice ignores his request.

This is a non sequitur, these are different scenarios with different requests, just with the names kept the same. Businesses aren't people, and they don't have memories like people. Businesses don't (for the most part, legal actions notwithstanding) need IP address information. It can be helpful, certainly. Knowing your customer has returned, knowing what they have looked at etc., but it's not essential.

So yes, it's reasonable to ask for removal from logs, and no, it isn't reasonable to ask someone to forget you visited their house.


I guess this demonstrates a prime example of one of the biggest differences in the US:

In the US, corporations are people.

In the EU, corporations are legal persons but don't inherently enjoy the same rights/protections as natural persons (i.e. humans).

Just remember the Hobby Lobby ruling: in the US, corporations can have religious beliefs. In the EU that sentence doesn't make any sense because a corporation cannot hold beliefs (though the people employed by or owning it can).


> In the US, corporations are people.

> in the US, corporations can have religious beliefs. In the EU that sentence doesn't make any sense because --

It doesn't make sense because in the EU we didn't artificially create a legal construct to support the notion of corporations having religious beliefs (or "being people").

Please don't act as if both ideas are equally valid descriptions of the real world when one of them is strictly a legal fiction and completely meaningless in any other sense.

I'm sorry but just like the notion that a 2-person startup would need $300/h lawyers for any significant amount of time to ascertain they're sufficiently in compliance with the GDPR to not get sued into oblivion (.. or something? over here people can just read and implement the needed provisions by themselves in under a week, is what I heard from my friends in the business), this seems to be a problem inside the US legal system, doesn't really seem to me like it's the EU's problem to take into account when it's broken like that.


I'm not disagreeing with you. I'm just trying to be objective rather than judge the two models based on my opinion. My opinion would be that the US system is the result of Friedman free market capitalism trumping civil rights over decades. And in Europe I'd consider myself libertarian.


> No, no-one can force you legally to forget something, and I think this brings up the main problem with your argument, which is that we're not talking about Alice and Bob, we're talking about Alice and Bob's Widgets INC.

I assume you mean Alice's Widgets INC., since Alice was the one with the website.

But in any case, I didn't say "Alice's business's website". I said "Alice's website", as in her personal website. Are you saying that an individual's website can record visitor's IP addresses and store them indefinitely, but a business cannot?


What if it is a personal website, not affiliated with any corporation?


> Precisely where is the line drawn that makes one scenario reasonable, while the other is completely unacceptable?

1. don't be unreasonable

2. be acceptable


Perhaps you should take your own advice.


> As a fundamental right, doesn't that mean that the government needs to abide by it as well? Can an EU resident demand that their image be removed from all footage collected by public surveillance cameras, for example?

That's a good point. The term "fundamental right" occurs only the recitals, not in the law itself IIRC. The laws applies to authorities, but not when they carry out the legal tasks in prosecuting and preventing crimes and dealing with public security. So you would not have any rights with respect to video surveillance by authorities, unless you could prove that that is not done for public security :(

When it comes to authorities practices differ a lot in the EU. Let me give 2 examples because I live/lived there

1. In Germany video surveillance of public spaces is not very popular. One of the biggest cities in Germany, Frankfurt/M. seems to have 6 (six) such cameras now. And whenever there is a new one, it still makes big headlines http://www.fnp.de/lokales/frankfurt/Datenschuetzer-Es-wird-z... (In socialist East Germany they had them already in the 1980, but I am sure they all disappeared in 1990)

Google has stopped rolling out Streetview in the very early beginnings. Not that it is an authority, but it shows the public opinion, even if it's a single picture every couple of years and faces are blurred.

It appears that the resistance is more and more broken. At my last visits in Germany I saw cameras on trains/buses for the first time. I'd assume they are not counted as public spaces, but private properties. Which is a problematic classification considering their function. In Northern Ireland cameras were standard on buses already in the 1990s, no idea for how long before that.

When you get a German passport they will store the fingerprint on it (I guess that's a nearly world-wide standard for machine readable passports). However, in Germany they make a big fuzz about it that the fingerprint is erased from all databases as soon as you have accepted your new passport. If you detect a typo in your passport after accepting it, you have to apply for a new one, pay again and have your fingerprints taken again.

2. In Finland public videos surveillance has existed in all big cities (not that there are many...) for decades. There are also street condition (think snow) cameras on the internet. It's not their purpose, but some of them show fully identifiable people when they happen to walk by. Not many people seem to be bothered about it.

In Finland the fingerprints for the passports are stored until there will be a law how they are allowed to be used. Only few people believe that the police would not use them to solve a high profile crime before the law is ready.

A common Europe is still a big fiction in many aspects.


FWIW the cameras on public transit (which have been the norm in Cologne for at least a decade I think) are legal (under the old data protection laws anyway) because the recordings are automatically destroyed after 24 hours or so.

I think the GDPR would protect them because of a number of factors:

* there's a legitimate security interest (vandalism, terrorism, rape and other personal crimes)

* the recordings are not stored longer than necessary to fulfill that purpose

* there is clear signage indicating you are entering an area with surveillance cameras (i.e. you are giving informed consent)

The GDPR protects the individual's right to privacy but it's a balancing act and the security interests are fairly valid.


> * there is clear signage indicating you are entering an area with surveillance cameras (i.e. you are giving informed consent)

So if I don't want to be filmed on the bus I take a taxi for 10 times the price? (Not sure whether they might have cameras, too. Haven't taken a taxi in Germany for many years.) Or I walk 2 hours?

That's not what I would call informed consent. It's information yes, but as long as there are no competing bus lines without cameras there is no choice really.


We're going in circles. Let me repeat: nobody has a problem with increased data protection and privacy. We're all better off for it.

But the laws regarding it are not clear for an actual operating business. Instead of being simple and straightforward to implement, they are an ambiguous mess that are wasteful and misplaced. Laws designed that way almost never actually accomplish what they set out to do.


> Instead of being simple and straightforward to implement,

I am not sure I can fully follow you here.

If implementers accepted that they only collect what is absolutely necessary and they delete what the they are not legally requited to keep things would be much easier.

Problems start when the business model is that customers'/users' data is our product/an asset and we somehow try the find the minimum possible implementation that just meets the requirements of the law while still using all loopholes it might possibly leave.

I agree that the law is not very clear for how you should code it. Nor very detailed what you can do with a certain piece of data. So it depends on your approach: If you take a conservative approach that if in doubt, we don't keep the data it suddenly gets much clearer. If you start fiddling maybe I could still do it if we did it like this and that you end up in endless work.

And of course if you have an existing system that never had the requirement of deleting anything there is a lot of work. But the law has been in force for 2 years, so businesses that wake up now when the transition period has ended it can be a mess.

>Laws designed that way almost never actually accomplish what they set out to do.

How would you have written the law? Do you have counter-examples of laws being written so clearly that you could recommend them?

The key point really is: Many business models and practices on the internet are incompatible with the spirit of GDPR. It's a fundamental right that the users own their data and businesses are not allowed to do with it whatever they want.

Lawmakers did not want it write it that so clearly, because lobbyists would not have accepted it. And business owners still don't want to accept any suich fundamental right. So complaining about the law being too complicated is somewhat canting.


They are not "simple and straightforward to implement" for two reasons. First one, the problem domain is not simple and straightforward to implement. It may be surprising, but it's only because we've never learned to treat PII with proper respect. Second one, it's because businesses did their best to avoid and abuse privacy laws previously, so the new law has to counter the usual workarounds.

Yeah, it might be getting harder making a startup working on personally-identifiable data - even if it's not doing anything shady. But it's also hard to make a food or healthcare startup; you can't just "move fast and break things" there either. In EU, PII were finally granted the status of something actually important.

As for startups that depend on abusing user data, I'm very happy they have problems now.


A datum is not actually important just because it relates to a person in some way. It's not as if this a regulation about venturing into deviantly risky territory: running a network service of any kind involves the processing of peer IP addresses.


And processing that IP address is neccersary for the operation of the service offered so entirely acceptable.


Exactly. Plus they don’t simply concentrate on people intentionally/ignorantly abusing data (putting my email on mailing lists again and again and ignoring me telling multiple times i don’t want it, reselling, etc) but put a lof of insecurity and bureaucracy on people with nothing more than a static website with IP adresses in logfiles...


May I ask what is not clear to you? I can try to help. As I can see it, it very simple, it is same thing as with borrowing someones car:

- personal data (car) are any data that have potential identifying a person

- person owns its data (car). You cant buy them (well this part is different than the car), you cant steal them, you cant sell them, but you can borrow them from. But for that you need to ask (consent), where it is not allowed to trick the owner to give them to you, whithout beeing fully aware what was borrowed and why. And if you are borrowing the data for someone else, you need to ask about that too. And tell when you will return it.

- it is immature and unfair to play grumpy if someone doesn't want to allow to use its data. Or try to force/blackmail them from him. So its not allowed to do that (noyb.eu)

- once you borrow the data (like property, envision a car), behave acordingly, owner can demand them back, demand to see them, demand to know what you are doing with them and if stolen it is completely normal to tell them about that. And if they were stolen due to your fault (leaving keys in a car), they might demand to be compensated. Same goes if you misuse them (let me put some fertiliziers on back seat, forget to return them, giving it to all your friends without asking,...)

- if the data owner asks you to do something that requires his data ("hey, can you please take my car and bring me icecream from the store") you don't need to ask for data, it is expected you can have them.

Did I forget something? I consider it simple, as long as you try to stay genuinly respecting to other persons ownership. Just think about borrowing your car or borrowing car from your best friend and you wont go far wrong.


things as opposed to knowledge are fundamentally different things.

if yoi tell me your birthday how can i forget it?

if you borrow me a car i have something i can return...


> if yoi tell me your birthday how can i forget it?

That's not really relevant. GDPR doesn't ask people to forget things out of their minds.

So let's rephrase to a more relevant example:

> if yoi provide me your birthday on a web form and I put it in a database how can i forget it?

This now becomes relevant, and easy do answer. You delete it.


>if yoi tell me your birthday how can i forget it?

Ask any husband.

Joking aside, if the memory is on a computer system, as opposed to a person, you can, you know, just delete it.


Out of curiosity, could I legitimately ask Google, GitHub, etc. under the GDPR to delete my name in the AUTHORS file of the git commit it was added in when I contributed to Chrome's v8 engine 10 years ago? Would they have to comply if I did?

Obviously, removing the commit would break git's ability to sign any hashes for that repository after that point…

And thinking it through a bit more, what about the companies that use v8? Could I ask my regulator to get Joyent to remove it from their systems? I'm sure they have copies…


You could ask, but them not complying fall neatly in the legitimate need case...


Ah, this is so interesting! It seems like you're allowed or not allowed to keep data based on the data structure that you use to store it!


Data structure has nothing to do with it. If you stored social media users as fake AUTHORS lines in a git repo, that still wouldn't make you allowed to keep it. In the inverse situation, storing git authorship in the comments table of your photo site's database, you would be allowed to keep it for legal uses.


I interpreted the original posters point that the git repository could not be modified without destroying it. I thought that's how the next poster was responding to it. If you cannot modify an old entry without destroying the integrity of your system, are you required to modify? Either the answer is yes and you effectively cannot use certain data structures (with their integrity) or the answer is no and certain data structures allow you to keep data.


You would want to avoid using a git-like data structure for data you have to delete. But the example was data that's part of making the copyright license function, and you can keep it for legal purposes.


> But the example was data that's part of making the copyright license function

You entirely missed the point of my hypothetical, which was about immutable data structures like git employs.

As it turns out, our business also uses a git-like hash-chained commit log for our normal database. Deleting old entries would thus violate the integrity of our database. Is that now illegal under the GDPR?


When, it's about being able to judge things on their specific merits -- as opposed to having some blanket one size fits all rule.

Law has nuance and cases (and corner cases), it's not some strict predicate.


I agree and understand, but it does give us a likely unintended consequence: no sequential hashed data structures when you are required to be able to modify it. Probably a good thing for hearing less about blockchains!


No. They're required to know who the authors are for legal reasons.


Extreme over-exaggeration in my opinion.

Actually, just because one critcices the way the law is made doesn’t mean they think it’s basic intention is wrong.

As of your slavery example: Forbidding slavery is one(good) thing. Saying „everbody having somebody work for them out of anything but total free will and not being able to prove it is doing forbidden slavery“ is something else. If i must work because i need to eat and pay rent, is that total free will? How can anyone prove that?

So sure, the wording is extremely important.


Yes, indeed I have. But if there's something I've missed, I'd surely appreciate a quote or specific reference.


Please point to the specific section you’re referring to.


I'm sure a whole cottage industry around GDPR compliance will be up and running by the 26th. :|

We're a small agency and all of the legal worries around the GDPR have essentially put one of our revenue streams on hold until we sort out the legalities. Like the comment above, we simply do not have $300/hr available for lawyers to go over everything.




Guidelines | FAQ | Support | API | Security | Lists | Bookmarklet | Legal | Apply to YC | Contact

Search: