GDPR: Removing Monal from the EU • Hacker News Board

Re: GDPR: Removing Monal from the EU

#341

Post by jacquesm » Thu, May 17, 2018, 11:15 PM UTC

tathougies wrote: post #324

jacquesm wrote: post #284

Earlier quoted context omitted.

No, you don't have to close at all. You just need to comply with the law, just like everybody else. You also need to file your taxes, keep the books in order, ensure that you do not pollute the environment, in some cases you need to be licensed in order to be able to practice your trade and so on. Why would this particular regulation suddenly cause you to close your business unless you were doing something really sha…

Perhaps it costs money to do so, and the company does not have enough working capital + lines of credit to make the payments necessary? I feel like your statement here is basically "you are a business, therefore it is impossible for you to run out of money", which -- superficially -- seems very naive.

At that level it doesn't have to cost anything other than your time. And if it's not a business it is a hobby and those cost time (and usually also money).

The GDPR is not going to cause any but the weakest businesses to close shop, in fact if the GDPR causes a business to close (which I highly doubt other than people voluntarily throwing in the towel because they can't be bothered) then I am not sure if I'm going to shed tears over that because it likely means that that business was so weak already that other things besides GDPR compliance were suffering as well (such as security).

Re: GDPR: Removing Monal from the EU

#342

Post by tobltobs » Thu, May 17, 2018, 11:15 PM UTC

skrause wrote: post #292

tobltobs wrote: post #253

Earlier quoted context omitted.

Data Protection Officer, right to be forgotten, data exportability, ... Can you hint me to one of those German laws which do require one of the above?

https://de.wikipedia.org/wiki/Bundesdatenschutzgesetz It literally translates to "federal data protection law" and has been German law since 1978. In certain conditions it has also mandated a DPO ( https://de.wikipedia.org/wiki/Datenschutzbeauftragter ) since then, but in fact the first DPO position in Germany was created in 1971. The right to be forgotten is mandated by article 35 BDSG ( https://www.gesetze-im-inter…

Thank you for those detailed links. They are kind of eye opening, and I am German. However, it is hard to understand how stuff like GEZ, Schufa and article 35 can exist concurrently in the same country.

Re: GDPR: Removing Monal from the EU

#343

Post by bkor » Thu, May 17, 2018, 11:15 PM UTC

tathougies wrote: post #324

jacquesm wrote: post #284

Earlier quoted context omitted.

No, you don't have to close at all. You just need to comply with the law, just like everybody else. You also need to file your taxes, keep the books in order, ensure that you do not pollute the environment, in some cases you need to be licensed in order to be able to practice your trade and so on. Why would this particular regulation suddenly cause you to close your business unless you were doing something really sha…

Perhaps it costs money to do so, and the company does not have enough working capital + lines of credit to make the payments necessary? I feel like your statement here is basically "you are a business, therefore it is impossible for you to run out of money", which -- superficially -- seems very naive.

Obviously it might cost money (or time, which might mean money). Argument is still the same, it's not out of the ordinary to comply with regulations and laws.

It seems more like a cultural difference, whereby some one-man shops from US find privacy not important.

Re: GDPR: Removing Monal from the EU

#344

Post by jacquesm » Thu, May 17, 2018, 11:16 PM UTC

tathougies wrote: post #327

jacquesm wrote: post #273

This is a ridiculous over-reaction based on an extremely shallow interpretation of the GDPR. If you are running a small business and you feel that you won't be able to operate your business because of the GDPR consider all those other laws that you have to be in compliance with as well. If that's your attitude towards legal compliance then you should probably shut your business down completely rather than to hope tha…

This guy is not a small business. He's just a guy, doing this for fun, it seems.

Hobbies cost money and time. In this case it will only cost him a little bit of time.

Re: GDPR: Removing Monal from the EU

#345

Post by bkor » Thu, May 17, 2018, 11:17 PM UTC

zerostar07 wrote: post #282

danbruc wrote: post #255

While Monal is privacy focused, it is also free, open source and run by a single person — me. I simply do not have the resources or the time to jump through the regulatory hoops required by the EU. As a new and small construction company we simply don't have the resources to comply with all the building codes and the related paperwork. I just can't afford to meet all food safety requirements, I just want to provide f…

the laws you refer to preexisted. Did they tear down all the houses that don't comply with contemporary building standards? I dont think so. GDPR is enforced retroactively on everything since the beginning of the internet.

> GDPR is enforced retroactively on everything since the beginning of the internet.

That is not allowed. GDPR is only enforced for things which do not comply after in goes into effect. Further, it's not specific to the internet.

Re: GDPR: Removing Monal from the EU

#346

Post by fcbrooklyn » Thu, May 17, 2018, 11:17 PM UTC

bkor wrote: post #332

fcbrooklyn wrote: post #264

Earlier quoted context omitted.

Your first two examples are cute, but your third has the unfortunate side effect of undercutting your argument. A car you built yourself (or more often a motorcycle) actually _can_ be driven on roads in the US, as long as it has the appropriate indicators (brake lights, turn indicators, headlights). There's a crazy subculture around building bikes that would never in a million years pass muster as production vehicles…

> A car you built yourself (or more often a motorcycle) actually _can_ be driven on roads in the US Such a car cannot be driven on the road within The Netherlands without it being validated as safe (plus some other inspections). For US, same seems to apply. Per https://www.dmv.org/car-registration.php it mentions: "Pass a vehicle safety inspection.". So again you need to deal with paperwork and read what those safety…

Yeah, for "specially constructed vehicles" that safety inspection is extremely minimal. For a production vehicle, the requirements are much more extreme, and cost millions to comply with.

Re: GDPR: Removing Monal from the EU

#347

Post by nathanaldensr » Thu, May 17, 2018, 11:18 PM UTC

bkor wrote: post #332

fcbrooklyn wrote: post #264

Earlier quoted context omitted.

Your first two examples are cute, but your third has the unfortunate side effect of undercutting your argument. A car you built yourself (or more often a motorcycle) actually _can_ be driven on roads in the US, as long as it has the appropriate indicators (brake lights, turn indicators, headlights). There's a crazy subculture around building bikes that would never in a million years pass muster as production vehicles…

> A car you built yourself (or more often a motorcycle) actually _can_ be driven on roads in the US Such a car cannot be driven on the road within The Netherlands without it being validated as safe (plus some other inspections). For US, same seems to apply. Per https://www.dmv.org/car-registration.php it mentions: "Pass a vehicle safety inspection.". So again you need to deal with paperwork and read what those safety…

Some rules are decided by state. For example, Idaho has no vehicle inspection process, just registration (i.e., paying a fee and getting a license plate and license plate sticker).

FWIW, dmv.org is not an official government site.

Re: GDPR: Removing Monal from the EU

#348

Post by Fellshard » Thu, May 17, 2018, 11:18 PM UTC

tluyben2 wrote: post #209

drewbuschhorn wrote: post #134

Earlier quoted context omitted.

Do I misunderstand this section: "Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Article 77, each data subject shall have the right to an effective judicial remedy where he or she considers that his or her rights under this Regulation have been infringed as a result of the processing of his or her personal dat…

That is not how the EU works, in the US i would be very afraid reading that, in the EU nothing will happen if you do not violate in a spectacular way, and that, after many warnings. They are after companies tracking you across real estate and selling relevant data from their vast silos to companies that can market stuff to you. They tried many ways already to prevent this kind of practice in some countries but loopho…

It is reasonable to assume overreach by governing bodies will occur; this is no less true for the EU than for any national government. The EU is no less likely to misuse that hammer, intentionally or not.

Re: GDPR: Removing Monal from the EU

#349

Post by wilsonnb » Thu, May 17, 2018, 11:18 PM UTC

rocqua wrote: post #225

jimmaswell wrote: post #78

Earlier quoted context omitted.

But it's not "their" data. It's the webmaster's data. It rightfully belongs to the webmaster. It just happens to pertain to the user. There is no justification for that information still belonging to the user after the user surrenders it to the website.

If I get nude picutures of you, or your mother, daughter etc. is it then "my data"? Am I therefore allowed to do with that data as I wish? I think most people agree that unless those pictures are gathered with very specific consent, subject to many restrictions, they are not "my data". This is obviously an extreme example, but the reasoning extends to more data that is considered sensitive. The point being that "data…

Well whoever took the picture is the one that holds the copyright usually so it's more or less that person's data.

Pictures probably aren't a good example because they are covered by intellectual property laws.

Re: GDPR: Removing Monal from the EU

#350

Post by theclaw » Thu, May 17, 2018, 11:19 PM UTC

sparrish wrote: post #210

jwdunne wrote: post #99

You don't need a DPO. I work with healthcare businesses and some of them don't even need a DPO. You only need a DPO if you are a public authority, if you do large scale processing or large scale processing of sensitive data (ambiguous in the GDPR). If you collect some data, all you need is a privacy policy outlining such, stating what you collect in general and that your legal basis for doing so is to provide the use…

I'd feel better if there were a definition of 'large scale' somewhere but the official documents are just too ambiguous. Are 1 million IPs in my logs 'large scale'?

Possibly but they are not "sensitive data" (aka "special categories of personal data"). Article 9 of the GDPR outlines what these special categories are:

"personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, [...] genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation"