Ask HN: Startup people, how do you feel about GDPR?
I'm doing research for my master's thesis on what the impact of GDPR is on startups and how startup founders and employees feel about GDPR in general.
I would like to hear your opinions and discuss them in this thread, and would also very much appreciate if you could spare 5 minutes to respond to a survey: https://forms.office.com/e/E37CdBAC8s
Thank you! I wish there was some kind of compliance fast track. Like a starter kit for startups that aren't really interested in doing anything with people's personal data, but where it's just an accidental complexity of doing business with people. Maybe a pre-written terms of service, a code of conduct and a checklist for features your product needs to have for people to correct or delete their data themselves, which you don't want to waste time doing manually anyway. At a certain point most companies are going to want to do some more advanced analytics on the personal data, but by then they have probably already grown to a scale where it doesn't hurt as much to hire a legal counsel to write a new ToS for their specific use case. It might make sense for VCs to chip in and hire a law firm to make such a starter kit, to be distributed under a Creative Commons or similar license. Just like creative commons itself is a legal starter kit for creators who don't need a bespoke solution to ease up on a little on their copyrights. That's a good point. Thanks for your comment! It was confusing because of the lack of clarity. However the demands are reasonable, and the benefits to consumers are incredible. We just need better guidelines and better enforcement. > the benefits to consumers are incredible ehh... are they? If you're in Europe (or even the UK), the most noticeable change is the proliferation of cookie banners, most of which don't even comply with GPDR (the single "reject all" button almost never works as you'd expect). Another notable change is that a bunch of local US news sites are now inaccessible. The only obviously visible benefit to consumers is data portability ("Google Takeout," etc.) However, even that is a double-edged sword, because it also makes it easy for someone who hacks your account, or law enforcement, to get a nicely formatted dump of all your data. Beyond these changes, I'm skeptical that the regulations caused any meaningful change in what companies do with your data behind closed doors. In my opinion, the creation of such regulations primarily serves as a barrier to entry for large corporations, much like many EU regulations. Smaller companies often lack the resources to employ costly lawyers to guide them through the complex regulatory landscape, which ultimately allows only big companies to thrive. This gives big corporations a distinct advantage within the system. While I don't oppose the GDPR itself, as an independent developer, it deters me from a lot of ideas, even though I have no intention of engaging in questionable activities. The fear of inadvertently making an error and being hit with a massive fine is quite daunting. So in the end I just don't do it. It's a massive headache. The law is complex and I feel the EU is massively putting small companies at a disadvantage. Big companies can easily afford to hire experts that will guide them through all this, but small companies can barely afford to keep afloat. It would be different if the EU at least had some sort of free legal help for small and medium enterprises. They already have funds to helo EU companies getting a trademark, why not GDPR? https://euipo.europa.eu/ohimportal/en/online-services/sme-fu... I had a couple of personal projects with a few hundred users. Both could have become startups, but I shut them both down because of GDPR.
The definition of the law is complex. I wasn’t doing anything underhand, but I don’t have the legal expertise to ensure I am 100% compliant with all parts of the law, and I don’t have the resources to hire lawyers. I cannot afford the punitive fines, and I have to consider the financial safety of my family. GDPR presents an unacceptable risk to me. Yours is exactly the kind of scenario I find very interesting and will evaluate in my research. While it's important to protect individual right to privacy, it's also very important for the EU to make entrepreneurship as approachable as possible to truly boost economic growth. Thanks for sharing your thoughts! > While it's important to protect individual right to privacy, it's also very important for the EU to make entrepreneurship as approachable as possible to truly boost economic growth. I'm sorry to break it to you, but the EU doesn't care about entrepreneurship and small businesses. Anything EU politicians and representatives like to say to the contrary is mere lip service. By and large, the EU is an environment that's hostile towards entrepreneurship. Not sure if there is some overarching hostility I just haven't seen, but there are so many startups, especially tech startups, where I live in the EU. I hear of someone I know starting their own studio or other business very regularly, and there is very much a general "vibe" of entrepreneurship in the cities I've lived in. Luckily this hostile environment doesn't seem to be much of a deterrent around here at least. > The definition of the law is complex I don’t understand that sentiment. The text is almost self-contained and easy to read relative to lots of other legal things such as tax laws that you have to know if you start a business. The GDPR basically boils down to “guard your user’s data, keep only what you need, and tell them what you do with it”. For the typical “we keep user email addresses so that we can send them bills and credit card info so that we can charge them” use case it’s not hard to comply with the GDPR. And, nitpick: the GDPR is not a law. > "The GDPR basically boils down to..." It's easy as a casual observer to opine on what a law "boils down to," but take my word for it, the stakes are higher as the person legally obliged to interpret and implement -every single letter- of the law in their own business. GDPR fines are measured in millions of Euros. I'm just an ordinary guy with a family to feed. > The GDPR basically boils down to “guard your user’s data, keep only what you need, and tell them what you do with it”. That's how GDPR is commonly advertised, but for those who actually have to implement it, i.e. small to medium-sized businesses (large companies basically go scot-free, because a. they can afford legal departments to deal with GDPR how they see fit and b. local authorities can't be arsed to investigate the privacy violations routinely committed by companies such as Facebook or Google), the picture is much more complex, to the extent GDPR becomes an existential risk even to ordinary businesses that don't do anything unexpected or untoward with their users' data, for instance: - In certain larger EU countries you're not even allowed to record a website visitor's IP address (because some court has decided those count as PII) and consequently have to jump through a ridiculous amount of hoops to make sure it isn't. - You have to make sure that any service provider you're working with complies with GDPR. - Currently, due to an ECJ case ruling informally known as Schrems II (https://www.gdprsummary.com/schrems-ii/ ), you're not allowed to store any user data with a company affiliated with a US company in any way, which boils down to virtually every business and the economy as whole being in violation of GDPR. Now, it's often argued that the EU and GDPR aren't to blame for this because it's the US CLOUD Act that created this issue. Technically, this is true and the CLOUD Act indeed is hugely problematic, to say the least. However, the problem remains and it's on the EU to negotiate an agreement with the US that allows companies to legally do business in the real world (as opposed to an ideal world according to GDPR) again. > In certain larger EU countries you're not even allowed to record a website visitor's IP address (because some court has decided those count as PII) You’re not allowed to do that without reason. If you have a reason, and tell your users, there’s nothing wrong with it. Some anecdata that proves that: https://gdpr.eu/privacy-policy/: “IP and browser user agent string: this data is collected when you leave a comment.” https://commission.europa.eu/privacy-policy-websites-managed...: “In addition, IP addresses and device IDs might be saved for one year in the log files of the Directorate-General for Informatics operational environment for security or other purposes (see DPR-EC-02886 DIGIT IT security operations and services for more information).” > If you have a reason, and tell your users, there’s nothing wrong with it. That's still for the courts to decide. Specifically, the German federal court for example didn't define what constitutes a legitimate reason for storing IP addresses. This is precisely the problem with GPDR: While maybe well-intentioned, that regulation has been kept intentionally vague, which has local authorities interpret the rules how they see fit (or how it suits their purpose), since there's no clearly defined ruleset to depend upon. > "for security or other purposes" "other purposes" is about as vague as it gets. According to GDPR, a legitimate interest has to be specific and the specific reason that constitutes such an interest has to be communicated to the user. This is not surprising at all. The EU itself is hilariously non-compliant with GDPR. After all, why would they comply with GDPR? Public authorities are largely exempt from GDPR anyway. What do you mean by "the GDPR is not a law"? That statement is simply not correct. He means that due to the inanity of the eu the gdpr is a directive to the actual countries to pass a law (or laws) that match or exceed it. But that's not true. The GDPR is enforceable as law in each member country. Really? I guess we're both wrong. Yup. The GDPR is literally a regulation, not a directive. A directive is implemented into national law while a regulation is enforced as is and supersedes national legislation. I’d love to see a crowd-sourced site where small companies submit data about the impact of GDPR. Ie fines, any interaction with legal authorities, data requests which had a big impact, even including bankrupting the company, to get a good idea of the real world impact of GDPR on small businesses. gdpr.fyi if it wasn’t already taken/expensive ;-)