Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What does the GDPR actually mean for startups?

hackernoon.com

Post reply on HN
Print view View original

31–40 of 56 posts

Re: What does the GDPR actually mean for startups?

#31

Post by JeanMarcS »

no1youknowz wrote: post #3

As a solo founder with already too much to do. I simply looked at the GDPR and decided to kick that can down the road for 12 months after launch of my start up. Although a UK Citizen, will be bootstrapping the startup in the US and simply blocking EU buyers from accessing the site. Why you may ask? - I don't have the funds to hire a DPO. - I don't have the funds to hire out an expensive company to go through the plat…

Well, prepare yourself to be surprised launching in the US as there are also state laws, like in California [0].

And US government is actually working on it too [1]

[0] https://www.cnet.com/news/californias-new-data-privacy-law-t...

[1] https://www.reuters.com/article/us-usa-internet-privacy/trum...

Re: What does the GDPR actually mean for startups?

#32

Post by toast_coder »

JeanMarcS wrote: post #31
no1youknowz wrote: post #3

As a solo founder with already too much to do. I simply looked at the GDPR and decided to kick that can down the road for 12 months after launch of my start up. Although a UK Citizen, will be bootstrapping the startup in the US and simply blocking EU buyers from accessing the site. Why you may ask? - I don't have the funds to hire a DPO. - I don't have the funds to hire out an expensive company to go through the plat…

Well, prepare yourself to be surprised launching in the US as there are also state laws, like in California [0]. And US government is actually working on it too [1] [0] https://www.cnet.com/news/californias-new-data-privacy-law-t... [1] https://www.reuters.com/article/us-usa-internet-privacy/trum...

Its a funny reference to bring up California. So many responses to GDPR have been a blanket refusal and cutting EU users off from a nontrivial amount of content on the internet.

As a US citizen, I already know that everything on earth causes cancer to the citizens of CA, but its interesting how many product commercials where you see the products are not available in CA.

Frankley, I think alot of data privacy crusaders are going to be even more surprised by how easy it is for ditigal product offerings to cut out users by geolocation. If CA wants fo go down the road of making websites display notifications about this cancer causing data collection, well, I feel like I could make my living just by selling my digital products in Texas.

At some point the regulation makes the business unprofitable.

Re: What does the GDPR actually mean for startups?

#33

Post by simion314 »

Silhouette wrote: post #22
lenlorijn wrote: post #12

Earlier quoted context omitted.

Well, for example, one of the mentioned points is about sending PII to a 3rd party where the startup didn't read the 3rd party's privacy policy. So how would the startup be able to accurately present me with information on how my data will be used if they don't even know? I think having an accurate and updated privacy policy is common sense handling of data, wouldn't you agree?

That's a reasonable point, but it's also reasonable to observe that businesses rely on other businesses all the time. As a small business, you usually have little meaningful oversight of the internal processes of outside services you use. You don't get to audit your bank's finances to make sure they're safe to trust with your money. You don't get to review your lawyer's office security arrangements to make sure no-on…

> You don't get to review which products your office cleaning firm uses.

Seems a bad analogy, do you make a contract with them but not read it? I mean in the contract you will specify what cleaning products can or should be used(like in some hospitals strong cleaning products must be supplied and you ask for those in the contract if the supplier gives you bad quality ones then sure it is not your fault but it is your fault if you don't even want to read the contract terms)

I imagine the OP was thinking that he wants to embed in his pages some analytics or similar scripts, maybe some advertising scripts, use a few third party APIs and it seems a lot of work for him.

At least his US customers can now know that their data are could be shared with many third parties that could have weird terms like those third parties could sell it further.

Re: What does the GDPR actually mean for startups?

#34

Post by dahart »

> where your base of operations is in the EU; where you’re not established in the EU but you offer goods or services (even if the offer is for free) to people in the EU; or where you’re not established in the EU, but monitor the behavior of people who are in the EU (as long as that behavior takes place in the EU).

Question — IANAL, but I read a summary on a legal website (I’ll see if I can find a link) of GDPR that said it applies to non-EU companies not when you offer services to all people, some of whom might be in the EU, but when you specifically target and advertise to EU citizens. It sounded like a web app, for example, that is marketed generally toward anyone and allows connections from anywhere, would not be legally subject to GDPR, whereas if I, say, localized in German and had a campaign to get German teachers using my app, then GDPR applies.

Aside from whether adhering to GDPR is a good idea anyway, and I think it is, is that distinction correct? Can strict GDPR be avoided if I’m not targeting the EU specifically, and my customers aren’t primarily EU citizens?

EDIT: here's the link: https://ec.europa.eu/info/law/law-topic/data-protection/refo...

Here's the text:

"When the regulation does not apply

Your company is service provider based outside the EU. It provides services to customers outside the EU. Its clients can use its services when they travel to other countries, including within the EU. Provided your company doesn't specifically target its services at individuals in the EU, it is not subject to the rules of the GDPR."

Re: What does the GDPR actually mean for startups?

#35

Post by maaark »

dahart wrote: post #34

> where your base of operations is in the EU; where you’re not established in the EU but you offer goods or services (even if the offer is for free) to people in the EU; or where you’re not established in the EU, but monitor the behavior of people who are in the EU (as long as that behavior takes place in the EU). Question — IANAL, but I read a summary on a legal website (I’ll see if I can find a link) of GDPR that s…

That doesn't sound right to me.

Re: What does the GDPR actually mean for startups?

#36

Post by dahart »

maaark wrote: post #35
dahart wrote: post #34

> where your base of operations is in the EU; where you’re not established in the EU but you offer goods or services (even if the offer is for free) to people in the EU; or where you’re not established in the EU, but monitor the behavior of people who are in the EU (as long as that behavior takes place in the EU). Question — IANAL, but I read a summary on a legal website (I’ll see if I can find a link) of GDPR that s…

That doesn't sound right to me.

Care to elaborate? Do you have law experience or some sources that clarify?

Re: What does the GDPR actually mean for startups?

#37

Post by DanBC »

Silhouette wrote: post #26
marcus_holmes wrote: post #18

Earlier quoted context omitted.

- I don't have the funds to hire a DPO. Just appoint yourself as DPO. It's a role, not a qualification. > - I don't have the funds to hire out an expensive company to go through the platform in minute details and prepare it for GDPR. Just go through your database and work out what data can be associated with an individual. Do you have a good reason to keep that data? If yes, cool, you're golden. If not, delete it and…

These are your customers. If you don't have the time or resources to talk to your customers, then your business is going to fail anyway. This point isn't about your customers. It's about the bitter ex-customer who decides to take revenge through legal means by exploiting the rights they have under the GDPR to waste your time and money. And if you think this is a hypothetical risk, read the news today about kids linin…

> It's about the bitter ex-customer who decides to take revenge through legal means by exploiting the rights they have under the GDPR to waste your time and money.

They don't have that power. They can write you a letter asking for their data.They can write a letter to the regulator asking the regulator to investigate a complaint. The regulator would maybe write you a letter asking for information, and provide some advice about best current practice.

Re: What does the GDPR actually mean for startups?

#38

Post by marcus_holmes »

Silhouette wrote: post #26
marcus_holmes wrote: post #18

Earlier quoted context omitted.

- I don't have the funds to hire a DPO. Just appoint yourself as DPO. It's a role, not a qualification. > - I don't have the funds to hire out an expensive company to go through the platform in minute details and prepare it for GDPR. Just go through your database and work out what data can be associated with an individual. Do you have a good reason to keep that data? If yes, cool, you're golden. If not, delete it and…

These are your customers. If you don't have the time or resources to talk to your customers, then your business is going to fail anyway. This point isn't about your customers. It's about the bitter ex-customer who decides to take revenge through legal means by exploiting the rights they have under the GDPR to waste your time and money. And if you think this is a hypothetical risk, read the news today about kids linin…

Anyone in retail deals with nightmare customers who use social media to cause them untold pain and misery, and wastes huge amounts of time.

It's no different, except that in the GDPR case you can automate the response, and there's an actual regulator at the other end who can decide that the complaint was frivolous.

Dealing with customers is always nightmarish waste of time. But necessary.

I haven't heard about the examination board case, sounds interesting.

Again, if you don't understand how your customer's data is being used by a third party, then perhaps you shouldn't use that third party. I guess Google Analytics is the poster child for this. By using GA you are inviting Google to insert code into your web pages. This should give you the screaming heebie-jeebies.

Re: What does the GDPR actually mean for startups?

#39

Post by Klathmon »

simion314 wrote: post #33
Silhouette wrote: post #22

Earlier quoted context omitted.

That's a reasonable point, but it's also reasonable to observe that businesses rely on other businesses all the time. As a small business, you usually have little meaningful oversight of the internal processes of outside services you use. You don't get to audit your bank's finances to make sure they're safe to trust with your money. You don't get to review your lawyer's office security arrangements to make sure no-on…

> You don't get to review which products your office cleaning firm uses. Seems a bad analogy, do you make a contract with them but not read it? I mean in the contract you will specify what cleaning products can or should be used(like in some hospitals strong cleaning products must be supplied and you ask for those in the contract if the supplier gives you bad quality ones then sure it is not your fault but it is your…

Okay, but do you ensure the manufacturer of those cleaning supplies is making them correctly? Do you test the products coming from that facility to ensure they are of sufficent quality before allowing them to be used by your office cleaning firm? And do you vet the ingredients that the manufacturing facility uses to ensure they are pure and safe?

Because the commenter above makes a fantastic point that I hadn't thought about before, the GDPR requires that kind of knowledge and verification of user data. Not just in your company, not just in the companies you work with, but the companies they work with, and the ones that they work with, and so on.

It's akin to requiring the gas station to post legal notices that the computers it uses for the POS system are manufactured by a company which has verified that the parts that it uses were sourced from a place which was able to check that the materials used were mined by a company that treats their employees safely.

(i'm not against something like the GDPR, but I do feel it goes a bit too far in a handful of areas)

Re: What does the GDPR actually mean for startups?

#40

Post by Aaargh20318 »

Silhouette wrote: post #26
marcus_holmes wrote: post #18

Earlier quoted context omitted.

- I don't have the funds to hire a DPO. Just appoint yourself as DPO. It's a role, not a qualification. > - I don't have the funds to hire out an expensive company to go through the platform in minute details and prepare it for GDPR. Just go through your database and work out what data can be associated with an individual. Do you have a good reason to keep that data? If yes, cool, you're golden. If not, delete it and…

These are your customers. If you don't have the time or resources to talk to your customers, then your business is going to fail anyway. This point isn't about your customers. It's about the bitter ex-customer who decides to take revenge through legal means by exploiting the rights they have under the GDPR to waste your time and money. And if you think this is a hypothetical risk, read the news today about kids linin…

> It's about the bitter ex-customer who decides to take revenge through legal means by exploiting the rights they have under the GDPR to waste your time and money.

Except you can't sue anyone under the GDPR. All you can do as a consumer/bitter ex-customer is file a complaint with your country's privacy watchdog. IF there really is a problem, they will just tell you to fix it, that's all. You only need to worry if you're doing shady things with personal data and don't intend to stop doing them even after being warned, in which case you deserve everything you get.

Post reply on HN