How do small US accessory retailers deal with the GDPR?

[JHC]

From the work I'm doing on the GDPR I'm having a hard time imagining much other than many US small shops refusing orders from the EU.

Not that big a deal?

http://www.cmo.com/opinion/articles/...tml#gs.pMbwhCM

[okie john]

From the work I'm doing on the GDPR I'm having a hard time imagining much other than many US small shops refusing orders from the EU.

Not that big a deal?

http://www.cmo.com/opinion/articles/...tml#gs.pMbwhCM

GDPR will be a BIG problem for a lot of US companies of all sizes, most of which have their heads in the sand.

Enforcement is still very much up in the air, but a few US companies will feel the lash of fines/punishments and consumers will get a clue about how much information companies have about them. Once that happens, access to data will tighten, which will radically change how US companies do business.


Okie John

[Newportl]

Yep. In my industry, smaller services shops have made the decision to stop providing services to the EU. Still though, they have a problem if an EU citizen requests deletion of historical data. Here's an example: https://www.brentozar.com/archive/20...-stuff-europe/

[TAZ]

So when is the EU going to publish a list of local businesses given extensions on compliance?

I guess this could cut both ways. Us consumers need to flood the EU with removal requests.

In the long run, unless a business makes enough $$ from the EU to cover the new expenses that will come with this regulation, they will stop doing business with them. May not be hard fir some business models, but what happens when some guy from the EU finds your business on Google and solicits info from you? You’re now in the trap of needing to prove you purged their info.

If the goal if the EU is to isolate themselves and protect local businesses from competitors then this will work just fine. If the USA instituted something similar are we going to be called racist?

[okie john]

There are three problems here.

1. By assembling huge wells of data on individuals and selling access to it, social media and other companies have created something they no longer understand and therefore cannot control.
2. Bad actors have found ways to exploit that data, and these companies have neither the ability or the inclination to defeat them.
3. Virtually none of the people who are the subjects of these virtual dossiers have consented to letting these companies assemble, use, or sell this data. Most people have no idea how much data is available about them, or the level of precision that it provides into people who want to examine their lifestyles.

Many companies based entire business models on having untrammeled access to deep wells of data about people. Most legitimate companies only *need* a fraction of the data that they have, but they don't know which fraction that is because it changes constantly, so they grab and store as much as they can. The storage is where the hacks occur.

The goal of GDPR isn't to force immediate removal of data, but to change the atmosphere to one where companies don't get to grab as much data as they can about you without your knowledge and consent, and other companies don't get to assemble and re-assemble that data from disparate sources and resell it. The threat of fines will drive the market to create tools that make it possible for companies to purge data per the rules. (Zuck getting his feet held to the fire in front of Congress may have changed that in some places.) Eventually those tools will become available to smaller businesses. In a few years, business models will have evolved and purging data for GDPR compliance will probably be automated.


Okie John

[JHC]

Yep. In my industry, smaller services shops have made the decision to stop providing services to the EU. Still though, they have a problem if an EU citizen requests deletion of historical data. Here's an example: https://www.brentozar.com/archive/20...-stuff-europe/

My current understanding is that old data is "grandfathered" if its just archived. Any new processing of it would have to be compliant.

Our boutique holster makers were the first folks I thought of re a PIA compliance and liability assumed.

[GardoneVT]

There are three problems here.

1. By assembling huge wells of data on individuals and selling access to it, social media and other companies have created something they no longer understand and therefore cannot control.
2. Bad actors have found ways to exploit that data, and these companies have neither the ability or the inclination to defeat them.
3. Virtually none of the people who are the subjects of these virtual dossiers have consented to letting these companies assemble, use, or sell this data. Most people have no idea how much data is available about them, or the level of precision that it provides into people who want to examine their lifestyles.

Many companies based entire business models on having untrammeled access to deep wells of data about people. Most legitimate companies only *need* a fraction of the data that they have, but they don't know which fraction that is because it changes constantly, so they grab and store as much as they can. The storage is where the hacks occur.

The goal of GDPR isn't to force immediate removal of data, but to change the atmosphere to one where companies don't get to grab as much data as they can about you without your knowledge and consent, and other companies don't get to assemble and re-assemble that data from disparate sources and resell it. The threat of fines will drive the market to create tools that make it possible for companies to purge data per the rules. (Zuck getting his feet held to the fire in front of Congress may have changed that in some places.) Eventually those tools will become available to smaller businesses. In a few years, business models will have evolved and purging data for GDPR compliance will probably be automated.


Okie John

GDPR compliance will be solved by companies not doing business with the EU, period.

IT expenses are rarely revenue generating line items; as such, it’s an expense companies routinely avoid incurring even when it’s a legal or logistical requirement. Lots of obsolete business systems and processes are in place because poorly run firms won’t spend the money to implement basic data processing improvements. I wouldn’t be surprised if nonzero number of firms ran the cost benefit numbers and found they’d rather eat production downtime and legal expenses then invest in updated (and expensive) data security tools,for one example.

As such, most firms that don’t rely on the EU for high profit revenue will just pull the plug on doing business with Europe - or go old school and transact business via paper correspondence .