Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: GDPR in 2022 – What do I need to know as a solo founder?

news.ycombinator.com

Post reply on HN
Print view View original

61–70 of 80 posts

Re: Ask HN: GDPR in 2022 – What do I need to know as a solo founder?

#61

Post by lmkg »

jiveturkey wrote: post #56
lmkg wrote: post #22

Court rulings in the EU have found that US law is not compatible with GDPR: US lets law enforcement have unfettered access to the data of EU residents, with no restrictions or redress mechanisms that satisfy the EU court. This means that sending data from the EU to a US company is almost always a GDPR violation. There are a few nuances to this which are very important. - The US CLOUD Act gives US law enforcement acce…

> sending data from the EU to a US company 1. not data. Personal Data. of course if you know you know, but threads like these are rife with non informed readers. 2. nothing to do with the geo residency of the company. it's about sending the data to the US (or most non-EU countries). Even an EU company can't send the data to the US absent various agreements. 3.You are way overstating the violation part. It's very easy…

> not data. Personal Data.

That's fair. Although a lot of data can become personal data if you're not careful.

> it's about sending the data to the US (or most non-EU countries)

Disagree, the United States is in a worse condition that most other countries. Even in countries without an adequacy decision, you can usually satisfy GDPR by incorporating SCCs into your contract. A US company cannot comply with GDPR because they are beholden to US laws which require them to violate the terms of any contracts they sign protecting the data privacy of their users (according to the CJEU).

> It's very easy to be able to send the data and be compliant

Probably depends on your context. Something like, say, sending a pile of data over to GCP to train an ML model on? Probably easy to comply. Front-end dev work? Anything that makes the user's device connect to a Google URL is forbidden, since that's sending personal data (IP Address). The higher-level your framework, the more care it takes to avoid some dependency doing this behind your back.

Re: Ask HN: GDPR in 2022 – What do I need to know as a solo founder?

#62

Post by the_third_wave »

coenhyde wrote: post #17

If I was starting a startup today. I'd probably just block Europe and focus on other markets initially. Loop back on Europe once you have product market fit and the resources to deal with GDPR.

European here who honestly agrees with what you're saying but most likely not for the reason you expect. The GDPR may be a bit of a blunt axe but it surely has done a good job of smoking the data parasites out of the woodwork. If whatever business you were to start can not survive without tracking its users without their consent and without giving them the possibility to retract that consent the problem lies with your business plan, not with the EU law which insists on giving users the aforementioned rights.

Re: Ask HN: GDPR in 2022 – What do I need to know as a solo founder?

#63

Post by yread »

Why do people even use Google Fonts? Just put the woff2 (and the other formats) files with your static assets and if necessary configure the mimetype for your webserver and your done.

Self-host matomo, it is super easy to manage.

You can't easily track every mouse movement of every user but maybe it's for the best

Re: Ask HN: GDPR in 2022 – What do I need to know as a solo founder?

#64

Post by rrwo »

ensignavenger wrote: post #58
rrwo wrote: post #57

Earlier quoted context omitted.

You don't need to hire a separate person as DOO. It's recommended but not mandatory.

Every single official guidance on GDPR that I have seen, such as https://ico.org.uk/for-organisations/guide-to-dp/guide-to-th... , states that I would have conflict of interest serving as DPO because "Basically this means the DPO cannot hold a position within your organization that leads him or her to determine the purposes and the means of the processing of personal data." The same document specifically points out t…

It is recommended, not mandatory. You are a single person company.

Do you think every family run corner shop or plumber or painter in the EU has hired a DPO? No.

Re: Ask HN: GDPR in 2022 – What do I need to know as a solo founder?

#65

Post by jdlshore »

ensignavenger wrote: post #18

As a small, bootstrapped one person startup, the part of GDPR that seems impossible for me to comply with (I am not lawyer nor am I European, so maybe I am wrong, but everything I have read about it indicates I am right) is the appointment of a Data Protection Officer. I do the duties of the DPO myself, but from what I have read, this is not in compliance with GDPR, which requires the DPO to be "independent". See htt…

You don’t need an EU DPO, just an EU representative, according to my reading of it. (At least not under a certain size, which is what I was looking at.) They’re basically a glorified post office box. I used DataRep, which was very reasonably priced.

Re: Ask HN: GDPR in 2022 – What do I need to know as a solo founder?

#66

Post by bryanrasmussen »

TekMol wrote: post #23

I looked into this issue over the last weeks and made a list of other solo founders and how they handle it. You can find many, many of them when you search Twitter for "buildinpublic". The sad truth is that most successful solo founders these days: 1) Make it very hard to figure out where the service they provide is located. 2) When you find out, it is usually registered in a country outside of the EU. Crunchbase oft…

If you're servicing the EU you need to take the GDPR into account, so I'm not sure I understand what benefit it gives you to be outside the EU unless you have a service that can refuse to serve an economically rich area of the world?

Re: Ask HN: GDPR in 2022 – What do I need to know as a solo founder?

#67

Post by dewey »

TekMol wrote: post #37
dewey wrote: post #34

Earlier quoted context omitted.

I‘m pretty sure that’s not accurate. Not sure where they scraped that from but I think I remember it being incorporated in Singapore. Which makes a lot more sense if you follow where Pieter is usually located.

Do you confuse Nomadlist with RemoteOK? RemoteOK is in Singapore. I added it to the comment now.

What's your source?

Re: Ask HN: GDPR in 2022 – What do I need to know as a solo founder?

#68

Post by coenhyde »

the_third_wave wrote: post #62
coenhyde wrote: post #17

If I was starting a startup today. I'd probably just block Europe and focus on other markets initially. Loop back on Europe once you have product market fit and the resources to deal with GDPR.

European here who honestly agrees with what you're saying but most likely not for the reason you expect. The GDPR may be a bit of a blunt axe but it surely has done a good job of smoking the data parasites out of the woodwork. If whatever business you were to start can not survive without tracking its users without their consent and without giving them the possibility to retract that consent the problem lies with you…

I'm not going to disagree with that and I'm not opposed to the privacy controls in GDPR. The context here in a solo dev who is dealing with GDPR. When you're trying to get a business off the ground, iterating fast and trying to build a business that can survive to day 2, every single bit of busy work should be avoided. Why reduce your chances of success by chasing a market that takes more work than other markets? The global market without Europe is big enough to support any startup; so long as you build something people want.

Re: Ask HN: GDPR in 2022 – What do I need to know as a solo founder?

#69

Post by ensignavenger »

jdlshore wrote: post #65
ensignavenger wrote: post #18

As a small, bootstrapped one person startup, the part of GDPR that seems impossible for me to comply with (I am not lawyer nor am I European, so maybe I am wrong, but everything I have read about it indicates I am right) is the appointment of a Data Protection Officer. I do the duties of the DPO myself, but from what I have read, this is not in compliance with GDPR, which requires the DPO to be "independent". See htt…

You don’t need an EU DPO, just an EU representative, according to my reading of it. (At least not under a certain size, which is what I was looking at.) They’re basically a glorified post office box. I used DataRep, which was very reasonably priced.

And what size is that? Do you have a source?

Re: Ask HN: GDPR in 2022 – What do I need to know as a solo founder?

#70

Post by ensignavenger »

rrwo wrote: post #64
ensignavenger wrote: post #58

Earlier quoted context omitted.

Every single official guidance on GDPR that I have seen, such as https://ico.org.uk/for-organisations/guide-to-dp/guide-to-th... , states that I would have conflict of interest serving as DPO because "Basically this means the DPO cannot hold a position within your organization that leads him or her to determine the purposes and the means of the processing of personal data." The same document specifically points out t…

It is recommended, not mandatory. You are a single person company. Do you think every family run corner shop or plumber or painter in the EU has hired a DPO? No.

I have seen nothing that says it is recommended and not mandatory- do you have a source?
Post reply on HN