GDPR for lazy people: Block all European users with Cloudflare Workers

  "Anyone can design a lock that they themselves can't pick"

https://en.wikipedia.org/wiki/AOL_search_data_leak

The "right to erasure" isn't as strict as the "right to be forgotten" -- You (the end-user) would need to prove that merely having your name and address in billing records violates your right to privacy. And to make that argument you'd have to provide evidence the business is using said information for purposes other than billing.

Personal data can be used lawfully to "fulfill contractual obligations with a data subject" (eg: fulfilling a purchase, and retaining information for warranty/returns/RMA etc purposes) and "To perform tasks at the request of a data subject who is in the process of entering into a contract with the controller. " and "For the legitimate interests of a data controller or a third party"

Let's take that feature because it's mentioned often, but it doesn't exist.

Read Article 17* carefully yourself. It doesn't say "permanent". It never even says the word "delete". Elementary, My Dear Watson.

* https://gdpr-info.eu/art-17-gdpr/

> at an early stage startup with one programmer, you cannot have that one programmer spending two months on compliance.

And then here's the other straw man.

An early stage startup in the US with one programmer has more to worry about from US regulation than European regulation. Nonetheless, if you want to trade with Europe then reading the ICO guidance on the GDPR for your business should take a couple of hours.

> My biggest fear is that all of these complex bureaucratic laws are just raising the bar for doing a startup.

There are so many things I care about more than whether you can create a startup with wilful disregard for people's rights.

Did you even notice that Equifax* lost control of personal data on pretty much every single American? Your name, date of birth, your SSN. Equifax did this because they are actually incentivised to make their systems as insecure as they can get away with.

The only thing you're right about is that real security has real costs, but you're not convincing me that they're not needed.

* https://www.sec.gov/Archives/edgar/data/33185/00011931251815...

You have to do very little if you're keeping backups for less than month, simply delete from the DB and wait for backups to age out:

https://ico.org.uk/for-organisations/guide-to-the-general-da...

If you are keeping for longer than a month be prepared to justify that.

> This is made even worse if you have multi region backups and cold back ups.

You should be automating this. I assume you're automating the dumps. Automate the deletion. Deleting three encrypted files off S3 every day really isn't particularly hard. I've written stuff to do this a bunch of times.

> Even a one-year-old start up could have literally thousands of database dumps in different places if they followed best practice of triple redundant daily dumps.

If you have backups sprinkled willy-nilly about the place that you may have lost track of then it shows you have a significant lack of care about my data, and so I don't want you to have it at all.

>

> 1) A College student working on a side project with no revenue are treated the same as some massive multi-national.

That's false. The GDPR repeatedly refers to evaluating the risk with regards to various decisions. The ICO even has separate guidance for small businesses and big businesses.

> 2) It's a foreign requirement that feels like a violation of sovereignty. Most business/startup owners complain about there being too much domestic regulations, now we have to worry about things outside of our own countries -- that also can come into conflict with our domestic tax authorities on things like data retention. An international agreement would be entirely different.

This one I can appreciate, but perhaps look at it from our point of view:

You're violating our laws that protect our citizens.

Why would we possibly have any sympathy for that?

> 3) The GDPR requires clear and concise language, but have done nothing of the sort when writing the regulations. For most websites outside of the EU, could they not have produced a concise 1-2 page infographic produced by the regulators themselves?

The GDPR is easier to read than many US laws, and you don't have to read it anyway. The ICO has written extremely high-quality guidance for most businesses which will suffice. It should take no more than a few hours to determine how your business would be affected.

https://ico.org.uk/for-organisations/business/