Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR fines were meant to rock the data privacy world

wired.co.uk

Post reply on HN
Print view View original

51–60 of 99 posts

Re: GDPR fines were meant to rock the data privacy world

#51

Post by dwoozle »

baroffoos wrote: post #26
DaiPlusPlus wrote: post #24

Earlier quoted context omitted.

My experience with startups lately is if it’s a greenfield project that started within the past 3 years then they’ll do everything by the book: sometimes even down to storing email addresses as hashes in the database, requiring a user to login first for the software system - and the company - to know their email address). Older systems which depend on having PII and even financial information as cleartext in the data…

I am aware of a legacy system powering a local business which runs on Rails 1 on a version of debian from 2012 and stores users passwords in plaintext, downcased. I have tried to explain so many times that this system needs to be replaced urgently not for security reasons but because no one actually knows how to use rails 1 anymore.

I have a Rails 1 product making $10K a year but I don’t have even the ability to log into the box anymore so if even the tiniest thing falls over that revenue is permanently gone for me.

Re: GDPR fines were meant to rock the data privacy world

#52

Post by 100011 »

probo23 wrote: post #2

GDPR: A well-intentioned EU measure that unfortunately hurts the smallest and weakest and fails to have an impact on the big ones that it should target. Noble in thought, weak in action

"A well intentioned" is a complete miss of a description. The bill is doing exactly what intended. It's evident a bigger corp. can pay bills easier than smaller.

Re: GDPR fines were meant to rock the data privacy world

#53

Post by em-bee »

Mirioron wrote: post #29
baroffoos wrote: post #25

Earlier quoted context omitted.

Its funny how we let this all slide when it comes to tech. Imagine if someone said "Food safety regulations only hurt the small businesses, they don't have the resources to wash a cutting board after cutting chicken while McDonalds serves unhealthy but legally safe food"

But that's exactly what happens in the world though. In some poorer countries like China, street vendors are literally using gutter oil to make food. If you want rules to be respected then you must be able to enforce them. Poorer places just can't afford to enforce those rules. If rules aren't enforced equally then people won't follow them, because if they have additional costs that their competition doesn't then the…

they can and they do enforce it. street vendors are much less common in china than they used to be.

Re: GDPR fines were meant to rock the data privacy world

#54

Post by mjfisher »

dwoozle wrote: post #51
baroffoos wrote: post #26

Earlier quoted context omitted.

I am aware of a legacy system powering a local business which runs on Rails 1 on a version of debian from 2012 and stores users passwords in plaintext, downcased. I have tried to explain so many times that this system needs to be replaced urgently not for security reasons but because no one actually knows how to use rails 1 anymore.

I have a Rails 1 product making $10K a year but I don’t have even the ability to log into the box anymore so if even the tiniest thing falls over that revenue is permanently gone for me.

I'm curious about the economics of this - is it big enough to not be worth redeveloping when you consider over the income over say, 3-5 years?

Re: GDPR fines were meant to rock the data privacy world

#55

Post by goto11 »

Mirioron wrote: post #28
mooman219 wrote: post #3

Earlier quoted context omitted.

Being honest, some of the most egregious handling of PII is by small companies who don't have the resources to understand that it is PII, or how to store it, or how to be in compliance. I don't think it's failing in that case. A small company wouldn't google how to build a bridge then DIY it, but that's what's happening with storing PII. If I had a dollar for every article I read where a doctor's office had records o…

You're right, but they probably can't afford to do it right. And since enforcement on this is lackluster it makes sense for the companies to just ignore it altogether, because if they get caught then it probably doesn't really matter if they took some steps to help privacy or none at all. I think there should be some exceptions to it for small companies based on the impact of the PII. Eg if the company handles email…

> can't afford to do it right

The simplest way to comply is to not obtain and store personally identifiable information at all. Luckily this is also the cheapest. So I don't really buy that you "cant afford to do it right".

If you want to obtain and store personally identifiable information, then you have to mange it properly, just like selling food, medicine, financial services etc. need to follow certain regulation.

Note that all the competitors in the space will have to follow the same regulation, so it is not like it put you at a disadvantage.

Re: GDPR fines were meant to rock the data privacy world

#56

Post by lagadu »

Mirioron wrote: post #35
phs318u wrote: post #33

Earlier quoted context omitted.

> they probably can't afford to do it right Two things occur to me here. 1) it's a cost of doing business. Costs of doing business change over time. Step changes as a result of regulation are typically introduced with windows to allow businesses time to respond. If you can't reasonably cover the cost of the change then...capitalism. You will fail and someone else will succeed. No one is guaranteed a profit. 2) Sounds…

> 1) it's a cost of doing business. Costs of doing business change over time. Step changes as a result of regulation are typically introduced with windows to allow businesses time to respond. If you can't reasonably cover the cost of the change then...capitalism. You will fail and someone else will succeed. No one is guaranteed a profit. Except that foreign companies won't have this same limitation. The end result is…

You're getting downvoted because you're incorrect: it doesn't matter where a company is from, if they're conducting business with people in the EU, they're bound by it. Which is why several non-EU companies have paid fines and plenty are implementing GDPR-based privacy measures (and I speak from experience here).

Re: GDPR fines were meant to rock the data privacy world

#57

Post by eru »

probo23 wrote: post #2

GDPR: A well-intentioned EU measure that unfortunately hurts the smallest and weakest and fails to have an impact on the big ones that it should target. Noble in thought, weak in action

> Noble in thought, weak in action

I might be tempted to agree, but the impact was all too predictable.

In general, complying with regulations often has economies of scale.

Re: GDPR fines were meant to rock the data privacy world

#58

Post by lagadu »

barry-cotter wrote: post #14
EdwardDiego wrote: post #12

Earlier quoted context omitted.

The article you're commenting on mentions reasonably large firms being held accountable. What's your basis for the "smallest and weakest" claims?

The GPDR is a large compliance burden. The bigger your company is the less this hurts you because it’s very approximately a fixed cost. So the GPDR kneecaps small companies while being a painful but bearable expense for large ones. On net it helps the internet giants by reducing competition.

By your logic complying with financial regulations is a large compliance burden too that kneecaps small companies.

Re: GDPR fines were meant to rock the data privacy world

#60

Post by akvadrako »

tsimionescu wrote: post #45
twobat wrote: post #17

GDPR as applied is a joke. At one of the places I work they keep talking about "we can't backup this data anymore because it has personal info".

That's not enforcement, that's misreading...

Not really - you need a way to scrub user data on demand from backups and they should also have limited duration.
Post reply on HN