If it's only meant to be used against big companies or extreme offenders, why doesn't it say so? It seems like the spirit of the law and the language of the law are not aligned and in my opinion that's a sign of poorly designed regulation.
I object to the idea that small projects should be ok with breaking the law merely because they very likely won't get caught.
Have you read the bloody law! http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX...
This is legislation designed to protect not only me (as an individual) but you as well (as a probable foreigner) from me!
Out of an 88 page law, 1% of an auxiliary middle of the law is carved out for small companies.
I'm not sure that counts as differential application for small companies. In the US at least, large portions of entire key burdensome laws don't apply for employers below size 50, 10, 5, etc. This does not seem to be the case here.
Does anyone know whether an official impact study on innovation was even done before its passage?
At least my reading of the GDRP is that it tries very hard not be a big burden. If you are a small company or organisation and you collect a minimal amount of information (for example to contact them) there is not a lot you have to do.
The main thing is, you are not allowed to be sloppy. If you collect personal data, you have to think about whether you should collect it at all, where to store it, process it, and when to delete it. And you have to tell people that before you ask them for personal data.
Nothing like, we just collect a bunch of data, give copies to everybody, and have no idea what we collected. That attitude no longer works.
If you set up food regulations, are you going to exempt restaurants with only one cook? Or have aviation regulations that do not apply to airlines with only one pilot?
Given that the entire GDRP is less then a hundred pages, you can easily read it in one evening and get an idea of what you can do, have to do, and what the corner cases are that you may need to discuss with a lawyer.
So if it's "innovative" a small 5-person startup should be able to wreak havoc to my personal data in whatever way they see fit? What is that nonsense. Are you seriously suggesting that "innovation" in startups should be more important than my privacy?
And yes, I've read the law. It's typical of legislation in that it obviously wasn't written by people who knew what it looked like to perform that in a real life business.
Have you read recital 1? https://gdpr-info.eu/recitals/no-1/ ? The starting point of the law is that data protoection is a fundamental human right,. The data subject owns their PII, not some company collecting it.
It's all up whether you are willing to accept that as a fundamental right or not.
I mean there is a billion of Chinese that live with the fact that free speech is not a fundamental human right. Most Westerners have a problem with that.
Now many US based IT professionals seems to have problems with accepting that nobody else can own the data about a human.
> It's typical of legislation in that it obviously wasn't written by people who knew what it looked like to perform that in a real life business.
That's what a cotton farmer could have said when they made slavery illegal. Obviously respecting other's human rights makes some business models illegal.
If you aren't competent at responsibly handling personal data and you want to build a project or startup, pick one that doesn't handle personal data, or put in the effort to learn how to do things properly.
And then: What kind of online business can reasonably be done without using an email adress, if only for login/resetting password if lost? You either have no option to reset passwords, or must do it by phone, which is extremely expensive.
If you are using a email list in order to fulfill a contract to your members by informing them about times and so on then that is also permitted by GDPR. If a customer buys a subscription then the company in order to fulfill their side of the contract can then naturally store information to do so.
Mailing lists also has had a long history of best practices in order to not get marked as spam by the large email services. Get consent so users don't mark it as spam and allow unsubscribing. If a small yoga studio used a email list for a significant time and not been forced to do shady behavior in order to bypass spam filters, then they are almost guarantied to be compliant with GDRP.
Similar an online business has a contract when a customer buy a product or service. In order to fulfill that contract a email address is commonly used. Perfect GDPR compliant. Hard to imagine a online business before GDRP that did not have a contract with customers.
Now compliance is largely handled by the tool makers, and the Yoga studio can focus on their business case and any custom coded extensions to ensure they remain compliant. (For popular stuff like Apache, compliant configurations are probably already available or will be shortly, once we all figure out if we are allowed to keep logging IP addresses by default.)
I'm not sure I understand the email jab; obviously you can store data, you just must obtain consent first, and must allow the data to be deleted on request. That's an opt-in mailing list with an unsubscribe feature that actually works and properly deletes the relevant data. Why should that be difficult for a small business to do right?
Stop logging the IP address then. Hopefully default settings in web servers will change.
> What kind of online business can reasonably be done without using an email adress, if only for login/resetting password if lost?
That means you have a legitimate interest, so long as you don't send marketing emails to those addresses, or sell them, and so long as you delete them if someone deletes their account.
> How does for example a small yoga studio’s email list fit in your examples?
If someone signs up to your email list, they've consented to receiving emails. Just don't sell the list, and remove people if they unsubscribe.
The only real complication (if you're in the UK, I don't know about other countries) is that there is a fee to register as a data controller. https://ico.org.uk/for-organisations/data-protection-fee/
Or, alternatively, just don't do business where it would put you under the jurisdiction of the GDPR. That's what a lot of companies are doing, and there seems to be a lot of resentment over it.
Because, and this has been repeated millions of times on HN, Europe and the US follow different systems in writing laws
In the latter it just confounds me that the legislators set up a situation, where a small business in the UK is better off not selling a digital good (that you can make infinite copies of) to a buyer in Malta, because the bureaucracy would cost more than the sale would pay. You can't have a "single market" like that.
We're a small agency and all of the legal worries around the GDPR have essentially put one of our revenue streams on hold until we sort out the legalities. Like the comment above, we simply do not have $300/hr available for lawyers to go over everything.
