What many posters here miss is that there is a big group of tech people that have no interest in dealing with legal matters more than the bare minimum, and overall deem them risky. I am one of them. People like me are well-aware of the fact that if we are not experts then we're absolutely gonna lose because a dedicated lawyer can and will dig up material you couldn't prepare yourself to defend from.
Thus, complying with something somewhat ambiguous like the GDPR is still an expense -- of time, money and risk -- that many small website owners won't be willing to spare.
Look, it's not hard to encrypt all personally identifiable information; there are ready-made frameworks that let you choose which DB columns you encrypt and how. You can generate a key for each user on creation and have their data encrypted with it. The problem is NOT that.
The problem is what happens if a legal firm or an agency targets you. Even if you adhered to the spirit of the law, they can dig up evidence that you didn't obey the letter of the law (since GDPR is quite loose and ambiguous).
Small tech owners can't fight such litigations. I am kind of baffled how this point evades so many people in this thread.
Thus, complying with something somewhat ambiguous like the GDPR is still an expense -- of time, money and risk -- that many small website owners won't be willing to spare.
Look, it's not hard to encrypt all personally identifiable information; there are ready-made frameworks that let you choose which DB columns you encrypt and how. You can generate a key for each user on creation and have their data encrypted with it. The problem is NOT that.
The problem is what happens if a legal firm or an agency targets you. Even if you adhered to the spirit of the law, they can dig up evidence that you didn't obey the letter of the law (since GDPR is quite loose and ambiguous).
Small tech owners can't fight such litigations. I am kind of baffled how this point evades so many people in this thread.