[kobeya]

The GDPR does not, as far as I'm aware, have safe harbor clause for startups and other small companies that end up collecting some personal information incidentally as part of whatever they are trying to do but don't have the resources to properly manage it. Lack of such a provision could really hurt innovation.

[oakesm9]

If they can't properly manage it, they shouldn't collect it.

[closeparen]

All information centralizing in the hands of the few companies that can afford the consultants and lawyer time to figure out what the GDPR even means is an unambiguously worse outcome for people’s privacy.

I would go so far as “any company with a mature regulatory compliance function is an extreme threat to your privacy and not mitigated in any way by the GDPR” and “any company small enough to plausibly be found in noncompliance with the GDPR was never a threat.”

[kobeya]

You make it sound nefarious. "Collecting" could be as simple as having a mis-configured webserver log that captures too much. Should a big company take measures to protect user data, and be penalized for breaches? Absolutely. Should a one-man-show app developer be slapped with a crippling fine for something slapped together just trying to see if he can make something people want and try out product/market fit? Only if your goal is to grant an unchallengeable de facto monopoly to the existing players.

[ddalex]

Should we grant an exception from food handling regulations to new restaurants because they don't have the pockets to have chefs and kitchens as well equipped as big chains? Should we slap big fines on people that just want to try and make a new recipe using innovative ingredients?

For a better analogy, replace food with medication.

[kobeya]

Yes and yes. Small food stalls and food trucks should not be held to the same standards as professional restaurants and franchises. Personal use of medications should be less restrictive than pharmacies.

[pyvpx]

guess that one person show will check that webserver logging configuration stanza twice before starting httpd...

[Spivak]

Safe harbor is generally used for user generated content. How do you propose running a pastebin that's GDPR compliant?