Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How the GDPR Will Disrupt Google and Facebook

pagefair.com

Post reply on HN
Print view View original

71–80 of 362 posts

Re: How the GDPR Will Disrupt Google and Facebook

#71

Post by the_mitsuhiko »

leggomylibro wrote: post #62
the_mitsuhiko wrote: post #52

Earlier quoted context omitted.

> I see this as yet another tax on (European) startups who have to invest even more resources into regulatory compliance. This also affects American companies and the degree it affects you primarily depends on how much of your business model was depending on you doing nefarious things with customer data.

Could American companies simply state that European citizens are not allowed to use their service due to stringent compliance laws, and add a checkbox stating something like, 'My residence is not subject to EU jurisdiction?' Yeah, yeah, "giving up lots of customers," but if you're a small startup it might be attractive to target a smaller problem space to start with. Also, everyone does this already with, "I am older…

> Could American companies simply state that European citizens are not allowed to use their service due to stringent compliance laws, and add a checkbox stating something like, 'My residence is not subject to EU jurisdiction?'

That works for B2C situations but it won't work if you have European companies as customers.

Re: How the GDPR Will Disrupt Google and Facebook

#72

Post by eppsilon »

hedora wrote: post #13
prophesi wrote: post #10

Earlier quoted context omitted.

I use uMatrix on Chrome and have every non-pagefair.com script blocked, including google analytics. Not seeing any site rendering issues here. Perhaps it's your browser?

My adblocker blocks the base url of the page. Maybe there is some common adblock regexp that matches stuff on this site.

That would make sense, as PageFair is an ad network: https://pagefair.com/about-us/

Re: How the GDPR Will Disrupt Google and Facebook

#73

Post by the_mitsuhiko »

mankash666 wrote: post #66

Are all companies beholden to this or those with legal entities in Europe. For instance, can a Chinese company with ZERO legal presence in the EU completely ignore these requirements? The internet has no real borders, after-all.

> can a Chinese company with ZERO legal presence in the EU completely ignore these requirements?

Same with an American company with no legal presence in the EU. However quite a few things require you to establish one. Likewise if you are engaging in B2B activities your European customers will ask you for it.

Re: How the GDPR Will Disrupt Google and Facebook

#74

Post by kobeya »

tombrossman wrote: post #70
golemotron wrote: post #58

Earlier quoted context omitted.

I've never understood what would happen if Google or Facebook just ignored EU regulations, claimed that they were not under the EU's jurisdiction, and ignored any judgement. Would the EU erect a great firewall at that point?

Google has assets within the EU which means ignoring EU laws is not an option, unless Google are prepared to forfeit those assets. It's not really a decision they have the authority to make anyhow. Imagine the shareholder lawsuits!

Shareholders filing lawsuits because the company refused to give away money to a fine?

Re: How the GDPR Will Disrupt Google and Facebook

#75

Post by _pdp_ »

This has nothing to do with the size of your company/startup and it has nothing to do with regulatory compliance. It is a pretty simple at its core: if your company/startup gets breached and as a result PII data leaked, then you are liable for the penalty according to the general rules. I don't think anybody will argue this is a bad thing. If anything, it will help companies to be a little bit more careful with what sort of data they collect because frankly, at the moment almost every company is perhaps guilty of collecting far too much personal data under the assumption that one day it may become useful. If you collect PII data then you are liable for damages if you happen to mishandle it.

So here is how to avoid the GDPR penalties.

1. Get compliant - it is pretty much ISO27001 and it will cost you money 2. Don't collect excessive PII data and if you do, store it securely - after all it is a very basic ask 3. Avoid collecting PII data at all cost - think of it as another form of PCI

Frankly, there is no need to panic.

Re: How the GDPR Will Disrupt Google and Facebook

#76

Post by Sir_Substance »

golemotron wrote: post #58
mnm1 wrote: post #44

Earlier quoted context omitted.

I wish more penalties were like this. This sounds great. Now these companies will finally have real incentive to comply. Hell, the percentages should be higher. That's the only way to enforce regulations. Otherwise, they'll just pay a puny fine, American style, and not do shit.

I've never understood what would happen if Google or Facebook just ignored EU regulations, claimed that they were not under the EU's jurisdiction, and ignored any judgement. Would the EU erect a great firewall at that point?

Probably the EU states would unceremoniously and without further warning walk into their EU datacenters and seize every piece of hardware they own, which is quite a lot.

The following outages would impact their US customers, who would sue under US jurisdiction.

Re: How the GDPR Will Disrupt Google and Facebook

#77

Post by the_mitsuhiko »

bflesch wrote: post #57
the_mitsuhiko wrote: post #52

Earlier quoted context omitted.

> I see this as yet another tax on (European) startups who have to invest even more resources into regulatory compliance. This also affects American companies and the degree it affects you primarily depends on how much of your business model was depending on you doing nefarious things with customer data.

Of course this affects american companies, as the whole thing is primarily designed as a weapon for the EU against US dominance in the consumer space. The big problem for the EU is that consumers actually choose the best product in a free market (the internet of free services), and they overwhelmingly decided to use the US-based options. All the framing as "nefarious" is propaganda, consumers choose freely the option…

I suppose we fundamentally disagree on a few things here so I won't go into a discussion about the motivation of this law (which I as a EU citizen support). I do however want to leave a note on this quote here:

> All the framing as "nefarious" is propaganda, consumers choose freely the option they value the most.

Customers cannot choose freely. I'm a customer and I cannot chose certain products because they do not exist. Companies I never engage with are tracking my activities through tracking pixels and other things and because I never establish a business relationship with them, I cannot avoid that. This bill now forces a company I might do business with not do business with companies that do not permit me to get rid of my data.

I think this a good development because it finally makes certain backroom deals visible.

Re: How the GDPR Will Disrupt Google and Facebook

#78

Post by kobeya »

the_mitsuhiko wrote: post #71
leggomylibro wrote: post #62

Earlier quoted context omitted.

Could American companies simply state that European citizens are not allowed to use their service due to stringent compliance laws, and add a checkbox stating something like, 'My residence is not subject to EU jurisdiction?' Yeah, yeah, "giving up lots of customers," but if you're a small startup it might be attractive to target a smaller problem space to start with. Also, everyone does this already with, "I am older…

> Could American companies simply state that European citizens are not allowed to use their service due to stringent compliance laws, and add a checkbox stating something like, 'My residence is not subject to EU jurisdiction?' That works for B2C situations but it won't work if you have European companies as customers.

I don't have any operations in the EU. I don't collect revenue directly from EU residents using my services. I have no presence in Europe, but some Europeans do use my website (it's a free Internet).

What's the EU going to do? They have no jurisdiction over me.

Re: How the GDPR Will Disrupt Google and Facebook

#79

Post by the_mitsuhiko »

kobeya wrote: post #78
the_mitsuhiko wrote: post #71

Earlier quoted context omitted.

> Could American companies simply state that European citizens are not allowed to use their service due to stringent compliance laws, and add a checkbox stating something like, 'My residence is not subject to EU jurisdiction?' That works for B2C situations but it won't work if you have European companies as customers.

I don't have any operations in the EU. I don't collect revenue directly from EU residents using my services. I have no presence in Europe, but some Europeans do use my website (it's a free Internet). What's the EU going to do? They have no jurisdiction over me.

If Europeans use your website and don't pay for it that's fair game largely. The details are a bit more complicated.

Re: How the GDPR Will Disrupt Google and Facebook

#80

Post by mnm1 »

usaphp wrote: post #53
mnm1 wrote: post #44

Earlier quoted context omitted.

I wish more penalties were like this. This sounds great. Now these companies will finally have real incentive to comply. Hell, the percentages should be higher. That's the only way to enforce regulations. Otherwise, they'll just pay a puny fine, American style, and not do shit.

It's a percent from revenue not from profit. So 5% from google revenue is a lot

That's even better. The more the better.
Post reply on HN