Startups Stack Exchange Archive

General Data Protection Regulation and startups

On the one hand, a lot of companies (mostly in credit and insurance) now take advantage of your on-line data to assess your creditworthiness, or influence the price of your insurance.

On the other hand, the European Union is enforcing the General Data Protection Regulation, that basically states “You [the citizen] have the right to complain and obtain redress if your data is misused anywhere within the EU”.

What is going to happen to this startups who do their best to collect all this social information to sell indicators to larger companies ?

Answer 9525

Law is based around intent. If you have obtained the users permission to use their data, and they agreed, then you are somewhat covered.

I say “somewhat” because no matter what the end user agree’s to, you must take reasonable steps to protect the data. SSL over the wire, a good firewall, encrypting/hashing passwords, and purging sensitive data that is no longer required go along way to showing you are serious about data protection.

What data needs purging varies… if you buy/sell stuff, deleteing reference to who ever paid you money is not likely to win you praise from the tax man, however retaining names/addresses,date of birth and social security numbers of people you send a newsletter to might be considered overkill after 12months.

When you are in business, you always carry liability - there is no 100% way to divest yourself of it.

You can only reduce risks. Besides enhanced security data protection, your company should take liability insurance (its not expensive - I pay about 400euro a year to cover me for up to 5million per incident). If your company does not carry liability insurance, and the company is sued in court, its possible that the courts will take the executive directors personally liable (which means their homes, cars etc could be at risk).

Lastly - With exception to medical, pharmaceutical and possibly corporate banking, nobody goes around checking if you did anything wrong or right. So as a small business, navigate your business like you do when you drive a car… navigate carefully, respect others, and when there is an accident, don’t hide it as it will eventually catch up with you. If you do end up in court, a judge will be more understanding that you did your best to administer your duties and that mistakes happen. I’m not saying they’ll let you walk free, but they are unlikely to throw the book at you.

Best of luck


All content is licensed under CC BY-SA 3.0.