How the GDPR Will Disrupt Google and Facebook
I encourage a little more thought before cheering this on as a win. While GDPR isn&#x27;t as ridiculous as the Cookie Law, it still shows that the EU&#x2F;EC don&#x27;t understand the technology they are trying to regulate, and it comes at a huge cost to tech companies.<p>Take the <i>right to be forgotten</i>. First of all, it should be common sense that no one has the right to force legitimate news articles to disappear because they don&#x27;t like the content, but that is what the EU has ruled should happen.<p>I get the desire to have a company forget about you, and remove all the personal information they have. It makes sense from a personal standpoint. But how do you do it technically?<p>If you follow GDPR strictly you would need to be able to purge the data from your <i>backups</i>. Now most backups are considered immutable, so you aren&#x27;t going to do that, meaning you need a way to ensure that &quot;forgotten&quot; users never get restored.<p>But how do you even delete the live data? Does the tech company you work for have the ability to delete all traces of a user from their system, cleaning severing all relationships with other objects in your system? Do you have the ability to retrieve <i>everything</i> you know about a specific user, and provide it to them? You will need to write the code to do this.<p>There is a good chance your little startup that isn&#x27;t cash flow positive will have to spend $1 million of its VC money on becoming GDPR compliant.<p>Do you sell a SaaS service to businesses, and those businesses send you their customer&#x27;s data? Then you are the processor and they are the controller. Cool, less for you to do, sort of. Except that controller must agree to <i>every</i> sub-processor you use. Want to switch from AWS to GCP? You can only do it if all your customers agree. Want to use try out a new metrics or logging service? If it will have any PII you can&#x27;t do it without customer (controller) permission.<p>You will basically need to hire full-time compliance officers to deal with this. The big tech companies already have compliance officers, but GDPR is so massively invasive to businesses that even small companies now need compliance officers.