<story><title>GDPR for lazy people: Block all European users with Cloudflare Workers</title><url>https://apility.io/2018/05/25/gdpr-lazy-block-eu-users-cloudflare-workers/</url></story><parent_chain><item><author>eli</author><text>It&amp;#x27;s reassuring to hear that the GDPR is not meant to target little startups and projects but I would like it a lot better if it said that in the actual law, rather than just trusting all current and future regulators to treat me kindly.&lt;p&gt;If it&amp;#x27;s only meant to be used against big companies or extreme offenders, why doesn&amp;#x27;t it say so? It seems like the spirit of the law and the language of the law are not aligned and in my opinion that&amp;#x27;s a sign of poorly designed regulation.&lt;p&gt;I object to the idea that small projects should be ok with breaking the law merely because they very likely won&amp;#x27;t get caught.</text></item><item><author>gerdesj</author><text>I&amp;#x27;m a Brit.  I am the MD of a small IT company.  I have two partners and 20 employees.  We started in 2000.  We turn over about £1.5Mpa.  We sell our services to people and organisations.  Our backups are now smaller these days (thanks to GDPR).&lt;p&gt;I understand that because you are outside the EU you might feel like a target but that is not the point of GDPR.  There is no way on earth that the EU as a whole has looked on your company&amp;#x2F;project or whatever and decided to screw you.&lt;p&gt;Have a look at the first few paras of this: &lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;eur-lex.europa.eu&amp;#x2F;legal-content&amp;#x2F;EN&amp;#x2F;TXT&amp;#x2F;PDF&amp;#x2F;?uri=CELEX:32016R0679&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;eur-lex.europa.eu&amp;#x2F;legal-content&amp;#x2F;EN&amp;#x2F;TXT&amp;#x2F;PDF&amp;#x2F;?uri=CELEX...&lt;/a&gt;  after it says &amp;quot;Whereas&amp;quot;.  Does the language look a little familiar?  Do the sentiments look strangely familiar in some way?&lt;p&gt;GDPR is not about destroying people&amp;#x27;s livelihoods.  It is about protecting basic, fundamental rights that say 30 years ago we never knew needed to exist.&lt;p&gt;After all the knee jerk reactions have calmed down a bit, you may find that you personally have benefited in some way from EU regs.  If you find that, then I suggest you fight tooth and nail for similar to be enacted at home.  I&amp;#x27;ll be the first to thank you for that.</text></item><item><author>jeremyt</author><text> I’ve been reading hacker news for about a decade, and it’s getting to the point where I don’t think there are many entrepreneurs and&amp;#x2F;or technical people on here anymore.&lt;p&gt;The number of people who are saying it’s no big deal to comply with this huge law, especially for very small startups, is mind boggling.&lt;p&gt;Let’s just take one feature: the requirement that you can permanently delete all of your information.  Most early-stage startups use the (in 2008, when I did mine) best practice of “delete=1”.   Changing your whole database over to permanent cascade delete is only easy if you’re a very experienced programmer or who knows what he’s doing.  And that sets aside the fact  that even if you know what you’re doing technically, there are lots of business logic problems with just deleting things out of the database and anonymizing users is very tricky.&lt;p&gt;I was not a great programmer when I started my first startup.  I was learning as I went along.&lt;p&gt;We couldn’t afford a lawyer, and the amount of time for me (the only programmer) to go through and read all the regulations and make all the requisite changes in the product I would estimate might take on the order of a month or two, which if timed poorly would’ve killed our company.   I say again: at an early stage startup with one programmer, you cannot have that one programmer spending two months on compliance.&lt;p&gt;It’s just gotten to the point that there’s one comment after another responding to this regulation or that regulation or this situation or whatever with “well, just call HR“, or “I can’t believe you don’t have a company policy for that!”&lt;p&gt;Or “well just ask your lawyers“.  It ain’t that easy.  Do you have any idea how much it would cost to have “your lawyers” go through the GDPR, tell you what you need to do, and deal with all of the edge cases and gray areas? $20k or $30k doesn’t seem too high.&lt;p&gt;My biggest fear is that all of these complex bureaucratic laws are just raising the bar for doing a startup.  Maybe the days of two people doing a startup in someone’s garage should be in the past?  If so, that makes me kind of sad.&lt;p&gt;Regardless it’s not obvious that GDPR is the right policy or that it’s well designed or clear.</text></item></parent_chain><comment><author>beojan</author><text>Because if your business model is based on selling user data, it doesn&amp;#x27;t matter if you&amp;#x27;re a small startup, it absolutely is meant to target you.&lt;p&gt;If you aren&amp;#x27;t competent at responsibly handling personal data and you want to build a project or startup, pick one that doesn&amp;#x27;t handle personal data, or put in the effort to learn how to do things properly.</text></comment>
<story><title>GDPR for lazy people: Block all European users with Cloudflare Workers</title><url>https://apility.io/2018/05/25/gdpr-lazy-block-eu-users-cloudflare-workers/</url></story><parent_chain><item><author>eli</author><text>It&amp;#x27;s reassuring to hear that the GDPR is not meant to target little startups and projects but I would like it a lot better if it said that in the actual law, rather than just trusting all current and future regulators to treat me kindly.&lt;p&gt;If it&amp;#x27;s only meant to be used against big companies or extreme offenders, why doesn&amp;#x27;t it say so? It seems like the spirit of the law and the language of the law are not aligned and in my opinion that&amp;#x27;s a sign of poorly designed regulation.&lt;p&gt;I object to the idea that small projects should be ok with breaking the law merely because they very likely won&amp;#x27;t get caught.</text></item><item><author>gerdesj</author><text>I&amp;#x27;m a Brit.  I am the MD of a small IT company.  I have two partners and 20 employees.  We started in 2000.  We turn over about £1.5Mpa.  We sell our services to people and organisations.  Our backups are now smaller these days (thanks to GDPR).&lt;p&gt;I understand that because you are outside the EU you might feel like a target but that is not the point of GDPR.  There is no way on earth that the EU as a whole has looked on your company&amp;#x2F;project or whatever and decided to screw you.&lt;p&gt;Have a look at the first few paras of this: &lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;eur-lex.europa.eu&amp;#x2F;legal-content&amp;#x2F;EN&amp;#x2F;TXT&amp;#x2F;PDF&amp;#x2F;?uri=CELEX:32016R0679&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;eur-lex.europa.eu&amp;#x2F;legal-content&amp;#x2F;EN&amp;#x2F;TXT&amp;#x2F;PDF&amp;#x2F;?uri=CELEX...&lt;/a&gt;  after it says &amp;quot;Whereas&amp;quot;.  Does the language look a little familiar?  Do the sentiments look strangely familiar in some way?&lt;p&gt;GDPR is not about destroying people&amp;#x27;s livelihoods.  It is about protecting basic, fundamental rights that say 30 years ago we never knew needed to exist.&lt;p&gt;After all the knee jerk reactions have calmed down a bit, you may find that you personally have benefited in some way from EU regs.  If you find that, then I suggest you fight tooth and nail for similar to be enacted at home.  I&amp;#x27;ll be the first to thank you for that.</text></item><item><author>jeremyt</author><text> I’ve been reading hacker news for about a decade, and it’s getting to the point where I don’t think there are many entrepreneurs and&amp;#x2F;or technical people on here anymore.&lt;p&gt;The number of people who are saying it’s no big deal to comply with this huge law, especially for very small startups, is mind boggling.&lt;p&gt;Let’s just take one feature: the requirement that you can permanently delete all of your information.  Most early-stage startups use the (in 2008, when I did mine) best practice of “delete=1”.   Changing your whole database over to permanent cascade delete is only easy if you’re a very experienced programmer or who knows what he’s doing.  And that sets aside the fact  that even if you know what you’re doing technically, there are lots of business logic problems with just deleting things out of the database and anonymizing users is very tricky.&lt;p&gt;I was not a great programmer when I started my first startup.  I was learning as I went along.&lt;p&gt;We couldn’t afford a lawyer, and the amount of time for me (the only programmer) to go through and read all the regulations and make all the requisite changes in the product I would estimate might take on the order of a month or two, which if timed poorly would’ve killed our company.   I say again: at an early stage startup with one programmer, you cannot have that one programmer spending two months on compliance.&lt;p&gt;It’s just gotten to the point that there’s one comment after another responding to this regulation or that regulation or this situation or whatever with “well, just call HR“, or “I can’t believe you don’t have a company policy for that!”&lt;p&gt;Or “well just ask your lawyers“.  It ain’t that easy.  Do you have any idea how much it would cost to have “your lawyers” go through the GDPR, tell you what you need to do, and deal with all of the edge cases and gray areas? $20k or $30k doesn’t seem too high.&lt;p&gt;My biggest fear is that all of these complex bureaucratic laws are just raising the bar for doing a startup.  Maybe the days of two people doing a startup in someone’s garage should be in the past?  If so, that makes me kind of sad.&lt;p&gt;Regardless it’s not obvious that GDPR is the right policy or that it’s well designed or clear.</text></item></parent_chain><comment><author>raverbashing</author><text>&amp;gt; If it&amp;#x27;s only meant to be used against big companies or extreme offenders, why doesn&amp;#x27;t it say so?&lt;p&gt;Because, and this has been repeated millions of times on HN, Europe and the US follow different systems in writing laws</text></comment>