It's reassuring to hear that the GDPR is not meant to target little startups and projects but I would like it a lot better if it said that in the actual law, rather than just trusting all current and future regulators to treat me kindly.

If it's only meant to be used against big companies or extreme offenders, why doesn't it say so? It seems like the spirit of the law and the language of the law are not aligned and in my opinion that's a sign of poorly designed regulation.

I object to the idea that small projects should be ok with breaking the law merely because they very likely won't get caught.

In legal contracts "whereas" often expresses sentiment but it's really the actual terms that matter. Having drafted a number of contracts, I feel most contracts generally have a section that approximates "whereas everyone wants things to go well and everyone to benefit..."

That's great that your company works well with GDPR. I imagine many companies will. I'm also sure that the impact on your backups could have been had without the law if you so chose.

However, an organisation that works inside the UK (EU) serving many EU paying customers (presuming here) is very different from say, Instapaper, who pulled out of the EU today because they don't make very much money from EU customers.

If we pass a regulation that says everyone who is in New York for any amount of time must pass an annual 1 hour health exam (conducted by NY state), I imagine this to be totally acceptable to New Yorkers. It correlates with good public policy: you prevent communicable diseases, and can catch health problem before it gets big. However, if this rule were to be enforced strongly, someone who might stop by once or twice a year probably is better off never coming.

How do you handle developer computers with possible client data on them, even semi-anonymized? Or when communicating issues on the live server, you might transfer client information to other stake holders to debug issue. Are you tracking that communication. Where does the communication data reside, perhaps on a server outside of the EU?

There is a lot of complications that arise if you think about the second order/third order consequences of the law.

> There is no way on earth that the EU as a whole has looked on your company/project or whatever and decided to screw you.

The rules are enforced via third-party litigation. So its not the "EU", but some lawyer looking for a nice payday that you have to worry about.

Thank you for a sensible and balanced opinion. The Americans seem to be shitting themselves over this, when it is meant to help us all work toward better privacy - not shoot people or put them in prison. That is what years of living in a police state has done to them - turned them into wall building nervous wrecks !

There are no GDPR police looking to shut you down. Calm down.

> Have a look at the first few paras of this: http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX.... after it says "Whereas". Does the language look a little familiar? Do the sentiments look strangely familiar in some way?

The thing after "Whereas" is just a preamble stating the intentions, not the actual legal text. In this case, I scrolled down no fewer than 31 pages, thinking to myself "The whereas section can't be that long" until I finally found the real start of the legal text "HAVE ADOPTED THIS REGULATION" on page 32 of 88.

>It is about protecting basic, fundamental rights that say 30 years ago we never knew needed to exist.

No. GDPR is an overreaching and idiotic law, where standard IP logs are illegal.

Thanks for posting that, makes me feel much better about the spirit of the GPDR.

I decided to remove any use of cookies from all of my sites() a week ago. For my business (writer, and sometimes consultant) that makes sense for me but I understand that most businesses need some access to customer data so they have a motivation to properly handle personal data.

(

) except my blog is on blogger - still trying to deal with that - I will probably go back to using Jekyll.

It's curious how these "basic, fundamental" rights only apply to select industries, while others are free to completely ignore them (art. 85). What kind of basic, fundamental right is that?

You’re missing the point completely.

I’m really glad to hear that I’m not being targeted. However, I don’t much care about what the intent is, I care about what the effect is.

And what I see is a law that is vague and enforcement agents are given broad discretion. What this looks like is that each case become “facts and circumstances” case, which is an absolute nightmare from a compliance standpoint.

And the additional paperwork and personnel requirements appear to be non-trivial and will add a significant amount to the minimum necessary capital and labor needed to start a startup .

The inevitable and undisputable result is that at least some startups on the margin which could’ve made it before the law was passed will not make it after the law was passed.

Supporters would argue this is a good thing, but I would argue it is not.

The thing for me is that it requires me to log additional data. Now I need to know where my users are from, how old they are, and how often and how they access their account.

All data I happily ignored so far to increase privacy.