Ask HN: GDPR in 2022 – What do I need to know as a solo founder?

The objective of the law is to put an end to the current "Wild West" attitude when it comes to data privacy, and the only reason it hasn't (yet?) had the desired effects is because enforcement is significantly lacking, so you're seeing the downsides without significant upsides.

There is tremendous value in having the GDPR enforced properly though. Imagine a world where you can actually talk to someone or buy something or without Google or Facebook knowing about it, webpages no longer embedding dozens of third-party trackers, "data brokers" going out of business, etc.

IMO it's actually quite insane that we let the situation deteriorate so badly that something like the GDPR was needed, both from a "do the right thing" perspective (smearing your PII over tons of third-parties with dubious or outright malicious business models is a sign of disrespect for your users, not to mention security liability) as well as legal perspective (some countries already had existing legislation around electronic data processing that predates the GDPR).

Read the text of the GDPR directly. It’s surprisingly readable, and there’s several well-organized hypertext versions online.

It’s been several years since I read the GDPR, but my recollection is that companies smaller than 150 people, who don’t process “sensitive” data (sexual orientation, etc.) have lighter requirements. Again, read the GDPR itself for details.

That is the theory, but not how the web works in reality.

SaaS projects usually service the whole world. I have not found a single solo founder who does that in a way that is compatible with the GDPR.

If the EU would try to enforce the GDPR worldwide, it would mean the EU gets cut off from 99% of the internet. Then Europeans can only use giants like Google and Facebook. Because smaller players can not duplicate all of their infrastructure using tools based in the EU.

It won't happen. It would be as if the EU sanctions itself into stone age. Imagine the physical industry would be told that it can only use parts made in the EU from now on.

It is saying that I MAY not have to appoint a DPO, depending on various criteria... but then when you go to look at what that criteria is, it merely tells you:

--- What does ‘regular and systematic monitoring of data subjects on a large scale’ mean?

There are two key elements to this condition requiring you to appoint a DPO. Although the UK GDPR does not define ‘regular and systematic monitoring’ or ‘large scale’, the Article 29 Working Party (WP29) provided some guidance on these terms in its guidelines on DPOs. WP29 has been replaced by the European Data Protection Board (EDPB) which has endorsed these guidelines. Although these guidelines relate to the EU version of the GDPR, they are also a useful resource for understanding the requirements of the UK GDPR.

‘Regular and systematic’ monitoring of data subjects includes all forms of tracking and profiling, both online and offline. An example of this is for the purposes of behavioural advertising.

When determining if processing is on a large scale, the guidelines say you should take the following factors into consideration:

    the numbers of data subjects concerned;
    the volume of personal data being processed;
    the range of different data items being processed;
    the geographical extent of the activity; and
    the duration or permanence of the processing activity.

---

So neither does this page, nor the law (according to this page itself) or any other guidance I have found, define what "a large scale" means. It gives some really squishy criteria, and then leaves it up to the DPA to fine whoever they want to, because they refuse to define anything in concrete terms. No one except commenters on Hacker News can possibly know whether or not they are in compliance.

What you're asking can't be done without tracking an individual in some way.

Imagine you have a physical store, and want to track which clients come back, what products they look at, and in which aisles they stop.

You could take their photo to recognise them when they come back, that's obviously not privacy-respecting at all.

What Google Analytics does is given them a badge with a unique id the first time they walk in, and expect that person to show that unique id on each subsequent visit. And also expect them to show that same badge on every other store (website) they visit. Even in places where they're registered (e.g.: GMail). It's inevitable that by tracking users like that you can eventually tie it to their real life identity, and also produce a really detailed record of all their activities.

This idea has become pretty common somehow: "I just want to see a single user's journey and don't care about who they are". But imagine how you'd do that on a physical store (including with clients that walk out and in again), and if there's ANY way that it wouldn't be super creepy to customers.