What does the GDPR actually mean for startups?

https://hackernoon.com/what-does-the-gdpr-actually-mean-for-startups-b4010e9b962f

by milly1993 • 8 years ago

40 53 8 years ago

docdeek2• 8 years ago

> The scope of this protection extends to any natural person in the EU which can mean users, employees, vendors, partners, customers or even members of the general public.

I hadn’t considered GDPR from the perspective of a company collecting/maintaining data about employees (as opposed to clients, prospects, website visitors etc.). Do the same rules apply inside a company for an employee as they do for a user of a web service? Can I, for example, request a copy of all identifiable data collected and maintained about me by my company in the same way I might request it of Facebook or Twitter?

proaralyst• 8 years ago

Yes. You can request a copy of any personal information held by any company. This is a pre-GDPR right too.

docdeek2• 8 years ago

I was not aware of this - thanks for the reply.

Symbiote• 8 years ago

For a non-creepy company, an employee request can be more concerning than a customer.

They might know the systems in detail, and have information spread around all of them.

Former employees can also make a request.

(This is not a new right, it was in the earlier Data Protection Regulation.)

no1youknowz• 8 years ago

As a solo founder with already too much to do. I simply looked at the GDPR and decided to kick that can down the road for 12 months after launch of my start up.

Although a UK Citizen, will be bootstrapping the startup in the US and simply blocking EU buyers from accessing the site.

Why you may ask?

- I don't have the funds to hire a DPO.

- I don't have the funds to hire out an expensive company to go through the platform in minute details and prepare it for GDPR.

- I don't have the resources to deal with inquiries to that nightmare letter or any questions for that matter.

- I don't have the resources to monitor the 3rd parties privacy policies that I send data to use their service and constantly update my own.

From my perspective this is just burdens my company with more costs in doing business with the EU. I'm more than happy to concentrate on the US and the rest of the world.

One issue that I'd like to point out as well. Some commentators mention that the EU is ~22-25% of the worlds GDP to be accessed. Well, that's a complete fallacy.

The EU unlike the US isn't a contiguous block. There are 28 nations and 24 languages to deal with. You simply can't launch in the EU like you would in the US. Each country has it's own idiosyncrasies to deal with. Which is why some companies just launch in France, Germany, UK and then push out the other smaller markets years down the line and in some cases not at all. There may be other local regulations to deal with.

My opinion is that the GDPR over the long term, will hamper the ability of EU companies to do business on the world stage, even more than currently. But that's a completely different topic for another time.

RobertRoberts• 8 years ago

If it helps any, I read that a DPO is only needed for companies larger than X number of employees. I think X was like 50 or 100. And that the DPO "role" could be fulfilled by anyone.

seszett• 8 years ago

As far as I know it's only required for companies whose core activity is large-scale monitoring of users.

amaccuish• 8 years ago

Which is why I think the OP is spreading a load of FUD.

CrLf• 8 years ago

Seems like the GDPR is working as expected. If your company can't be bothered to apply some common sense to handling user data (which is what the GDPR is mostly about, if you take a couple of hours to actually read it), then we're better off without it. I'm sure if what you're doing is relevant, some other company will happily take your place.

Silhouette10• 8 years ago

If your company can't be bothered to apply some common sense to handling user data

Which of the specific points the GP mentioned do you think is about how they handle user data? As far as I can see, every one of them is administrative in nature.

They're not saying they're going to be tracking everyone in shady ways. They're not saying they're going to be storing unencrypted details and unhashed passwords. They're not saying they're going to be forwarding your every secret to a Sith lord.

They are saying they don't have time to respond to a legal DoS if someone sends them a letter obviously written in bad faith, and they are saying they don't have the resources for their startup to police every major service they depend on. I imagine almost any startup would be in the same position.

As it happens, this person also seems to have some common misunderstandings about their obligations and may be over-estimating the actual risks. That also happens when you write this kind of law, and as we see here, the chilling effect is real.

sleepychu• 8 years ago

What's your startup?

lenlorijn2• 8 years ago

I would argue the opposite. Most of the laws laid out in the GDPR were already laws in EU countries such as Germany and the Netherlands. Creating a single EU law should reduce the effort needed to launch a company that is compliant in multiple countries within the EU.

Also, you wont need a DPO if you don't process large quantities of PII. (https://gdpr-info.eu/art-37-gdpr/)

And you don't need to hire an expensive company to 'prepare' for gdpr. A conversation with a lawyer should suffice where you lay out how you (plan to) use or process PII.

marcus_holmes6• 8 years ago

- I don't have the funds to hire a DPO.

Just appoint yourself as DPO. It's a role, not a qualification.

- I don't have the funds to hire out an expensive company to go through the platform in minute details and prepare it for GDPR.

Just go through your database and work out what data can be associated with an individual. Do you have a good reason to keep that data? If yes, cool, you're golden. If not, delete it and you're golden. The only thing that GDPR changes about data is (rightly) turning it from an asset into a liability.

- I don't have the resources to deal with inquiries to that nightmare letter or any questions for that matter.

These are your customers. If you don't have the time or resources to talk to your customers, then your business is going to fail anyway.

- I don't have the resources to monitor the 3rd parties privacy policies that I send data to use their service and constantly update my own.

You don't have to monitor them, you just need to read them. If you don't have time to read contracts that you're singing, then your business is going to fail anyway.

Pretty much everything in GDPR was already covered by existing UK Data Protection legislation. Under UK law you already had to appoint someone in your organisation to deal with Data Privacy, you already needed to have a good reason to collect personally identifiable information, and an obligation to ensure it wasn't disclosed to third parties.

I suggest you start taking all of this a bit more seriously than your comment suggests, not because of the legal implications, but the moral ones. Your customers are trusting you with their personal information. It's a serious responsibility that you need to take seriously. If you can't be bothered making sure that your customer's data is safe, then you shouldn't be trusted with it.

dbbk2• 8 years ago

You actually can't appoint yourself as DPO since it would be a conflict of interest. But you only need a DPO if your core business is large scale user tracking, which it probably isn't (especially if you're a small startup).

https://www.pensar.co.uk/blog/data-protection-officer

The following companies need to appoint a data protection officer under Article 37:

* Public authorities or bodies, except for courts acting in their judicial capacity.

* Companies who process data requiring ‘regular and systematic monitoring of data subjects on a large scale.’

* Companies who process, on a large scale, any special category of personal data. This includes data which reveals racial or ethnic origin; political opinions; religious or philosophical beliefs and other such information.

* Companies who process, on a large scale, personal data relating to criminal convictions and offences

Silhouette10• 8 years ago

These are your customers. If you don't have the time or resources to talk to your customers, then your business is going to fail anyway.

This point isn't about your customers. It's about the bitter ex-customer who decides to take revenge through legal means by exploiting the rights they have under the GDPR to waste your time and money. And if you think this is a hypothetical risk, read the news today about kids lining up to damage exam boards in exactly this way if they didn't get the grades they wanted, and explain to me how that isn't a threat to the integrity of the examination system.

You don't have to monitor them, you just need to read them. If you don't have time to read contracts that you're singing, then your business is going to fail anyway.

The fact that you have read the privacy policy of one of your suppliers does nothing to help the data subject. Unless they have meaningful information about how personal data about them is being processed and who is doing that processing, they haven't really gained any meaningful control or protection.

And no small business has the time to fully read all of the legal paperwork affecting them. Like consumer contracts, it's the great fiction of the legal community. Most new businesses won't even have had time to read the contract with their banks and other financial services before signing to open their account, and those often contain some very nasty and one-sided terms. But of course those contracts all tend to contain similarly nasty and one-sided terms, and you're going to need those services to do business anyway.

dbbk2• 8 years ago

This is really not a big deal. As has been mentioned you most likely don't need a DPO. Just sign up to Iubenda, it'll help you manage the compliance and make it as easy as humanly possible.

JeanMarcS2• 8 years ago

Well, prepare yourself to be surprised launching in the US as there are also state laws, like in California [0].

And US government is actually working on it too [1]

[0] https://www.cnet.com/news/californias-new-data-privacy-law-t...

[1] https://www.reuters.com/article/us-usa-internet-privacy/trum...

toast_coder• 8 years ago

Its a funny reference to bring up California. So many responses to GDPR have been a blanket refusal and cutting EU users off from a nontrivial amount of content on the internet.

As a US citizen, I already know that everything on earth causes cancer to the citizens of CA, but its interesting how many product commercials where you see the products are not available in CA.

Frankley, I think alot of data privacy crusaders are going to be even more surprised by how easy it is for ditigal product offerings to cut out users by geolocation. If CA wants fo go down the road of making websites display notifications about this cancer causing data collection, well, I feel like I could make my living just by selling my digital products in Texas.

At some point the regulation makes the business unprofitable.

wglb• 8 years ago

I recommend reading https://jacquesmattheij.com/gdpr-hysteria/ for a more detailed understanding of how you might be exposed, and what your obligations are.

Some of your notes have been addressed by other commenters in the thread, but overall many of your points directly contradict what is discussed by Jacques. You probably want to evaluate your risk of exposure with your current approach.

robinjfisher• 8 years ago

I'm surprised that the guide doesn't address automated decision making about users. In my day job, we are using a scheduling platform for short-notice, short-term work e.g. social care. A job is loaded on the sytem and pushed to x users for acceptance (fastest finger first).

The system has a ratings module (not active yet) whereby clients can rate the worker and vice versa. The system then makes decisions on future job releases based on the ratings. Part of the reason for not having the module active is due to the issue of communicating to the affected users how those decisions are being made and providing them with a right of manual review.

As organisations increasingly rely on AI or ML to make decisions affecting individuals, so the need for greater transparency into those decision making processes so they can be communicated to the people concerned.

dahart2• 8 years ago

where your base of operations is in the EU; where you’re not established in the EU but you offer goods or services (even if the offer is for free) to people in the EU; or where you’re not established in the EU, but monitor the behavior of people who are in the EU (as long as that behavior takes place in the EU).

Question — IANAL, but I read a summary on a legal website (I’ll see if I can find a link) of GDPR that said it applies to non-EU companies not when you offer services to all people, some of whom might be in the EU, but when you specifically target and advertise to EU citizens. It sounded like a web app, for example, that is marketed generally toward anyone and allows connections from anywhere, would not be legally subject to GDPR, whereas if I, say, localized in German and had a campaign to get German teachers using my app, then GDPR applies.

Aside from whether adhering to GDPR is a good idea anyway, and I think it is, is that distinction correct? Can strict GDPR be avoided if I’m not targeting the EU specifically, and my customers aren’t primarily EU citizens?

EDIT: here's the link: https://ec.europa.eu/info/law/law-topic/data-protection/refo...

Here's the text:

"When the regulation does not apply

Your company is service provider based outside the EU. It provides services to customers outside the EU. Its clients can use its services when they travel to other countries, including within the EU. Provided your company doesn't specifically target its services at individuals in the EU, it is not subject to the rules of the GDPR."

maaark• 8 years ago

That doesn't sound right to me.

dahart2• 8 years ago

Care to elaborate? Do you have law experience or some sources that clarify?

What does the GDPR actually mean for startups?

Related Stories