241–250 of 362 posts
Earlier quoted context omitted.
_Zero_ revenue? That's not a startup, that's a hobby.
Instagram was zero revenue when bought by Facebook. And Siri when acquired by Apple. I wouldn't describe it as a hobby.
Earlier quoted context omitted.
There is also a pretty easy cryptographic solution for your offline backups: In your backup, encrypt each user's data using a per-user key (AES or something). The keys will be tiny, so you can store the keys in a hot database. When a user deletes their account, simply purge the user's key. Tada - like magic all of that user's data on your tape backups has turned into unreadable noise.
This makes me very nervous about data loss. If I accidentally wipe the hot database then I've effectively deleted all my backups. It also makes corporate ramsomware attacks much easier.
Complying with this requirement will require us as an industry to make some changes to how we store user data. But the amount of work each company needs to do is proportional to the complexity of our existing backup system. If you're a tiny startup and don't keep offline backups at all, you can just delete the user from your database. The more complex & rigorous your backup system is, the more complex your user deletion system will need to be.
Its a hassle, but no moreso than any other requirements we deal with on a daily basis.
And if you think GDPR is a toothless joke, let's take a look at the defined fine stucture. It is pretty simple, only 3 levels (strikes for the fellow Americans): Strike 1 - Stern warning letter Strike 2 - 2% of your TOTAL GLOBAL REVENUE Strike 3 - 4% of your TOTAL GLOBAL REVENUE (or 20mil EUR, whichever is higher) And now you know why GDPR is a board level topic. Keep in mind that the EU/US Safe Harbor agreement got…
For startups - GDPR is like Y2K at the time, a GOLDMINE. Unless you're a start-up that handles personal data, in which case it's another bureaucratic overhead that also carries a risk of draconian penalties if you make a mistake, even if you have perfectly sensible reasons for working with that data and you're not doing anything at all surprising or dubious with it. Of course, the EU has form for this, given its simi…
GDPR explicitly mentions that "warnings" and "periodic data audits" should be considered measures to take before the fine is applied.
It also says[0] that when deciding on the fine, due regard shall be given to nature, gravity, and duration of the infringement; degree of cooperation, intention or negligence, actions previously taken by the authorities, previous infringements, nature of data etc.
It seems unlikely that anyone in good faith would get screwed by this.
[0] http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELE...
I encourage a little more thought before cheering this on as a win. While GDPR isn't as ridiculous as the Cookie Law, it still shows that the EU/EC don't understand the technology they are trying to regulate, and it comes at a huge cost to tech companies. Take the right to be forgotten . First of all, it should be common sense that no one has the right to force legitimate news articles to disappear because they don't…
I believe that in many countries there has been laws for a while mandating the deletion of personal data after a certain number of years (for instance I believe this is the case in banking). This is not new and if your backup system does not comply with regulations, it's probably more of a design problem.
Earlier quoted context omitted.
To be honest, the Facebook, Amazon, Apple, Microsoft and Google of this world aren't the one that have been leaking the most personal data. It's the smaller companies and startups that have been leaking personal data at an alarming rate. What we are beginning to see now is the regulatory backlash. Regulations are inconvenient, expensive, create barriers to entry (ask bankers!). But the current pace of gathering then…
Leaking PII isn't the main issue. Processing of PII is. And Facebook et. al. do a lot of that.
Leaked info to governments, especially in places in the world where it can mean imprisonment or death is a real issue.
Processing of PII may gave people the willies, but being annoyed by targeted ads seems like #firstworldproblems compared to people who've experienced real attacks via PII leaks.
It also creates opportunity costs for improving human society. How many human diseases could be cured if "processed" PII health data, anonymized statistics or case studies, were used by researchers freely? How much additional burden does it incur if each time this data is transferred to a sub-processor everyone must re-opt-in again?
Would a world of perfect privacy be a utopia, or a nightmare?
And if you think GDPR is a toothless joke, let's take a look at the defined fine stucture. It is pretty simple, only 3 levels (strikes for the fellow Americans): Strike 1 - Stern warning letter Strike 2 - 2% of your TOTAL GLOBAL REVENUE Strike 3 - 4% of your TOTAL GLOBAL REVENUE (or 20mil EUR, whichever is higher) And now you know why GDPR is a board level topic. Keep in mind that the EU/US Safe Harbor agreement got…
Throwaway account. I have national sales responsibilities for one of the majors. Think IBM/Microsoft/Oracle/etc leading a sales team of 74 reps. You'd be surprised at how LITTLE sales we've generated from GDPR. We've been providing free GDPR assessments for the past 1.5 years for over 200 accounts as lead gen opportunity and very little sales have resulted. It all boils down to companies simply don't believe the fine…
[1]https://www.microsoft.com/en-us/TrustCenter/Privacy/gdpr/def...
Earlier quoted context omitted.
If you don't want the NSA to gather information on you, the GDPR will not address that.
If it is illegal for google to collect the data, then the NSA can't force them to or subpoena the non-existent files.
Earlier quoted context omitted.
> Fine, we now have an engineer building GDPR features instead of features that benefit our customers. I am not finding any shred of sympathy for your story. To me this sounds approximately as evil as saying you are a pipeline company having to comply with all of those pesky environmental and occupational regulations by spending money on worthless safety features for people working and living on or around the pipe, a…
You seem to be responding to an entirely different GP post to the one I read, which seemed pretty clear that the GP's company isn't doing the kind of tracking and analytics that a lot of people might say were "NOT OK". It's easy to post bold privacy advocacy from the cheap seats, but I suspect you wouldn't like a world where these new rules really were enforced to the letter. Many of the organisations whose products…
How about data breach? Can they also guarantee that the data is stored safely?
Earlier quoted context omitted.
Instagram was zero revenue when bought by Facebook. And Siri when acquired by Apple. I wouldn't describe it as a hobby.
I am pretty sure instagram had revenue, even if no profit. It was a paid app, the money must have gone somewhere.