5 ms·

In general, this is a very good thing. The main outcome will be that more engineers will be needed to do more work to ensure that data is handled more carefully

In general, this is a very good thing. The main outcome will be that more engineers will be needed to do more work to ensure that data is handled more carefully. The cost will be slightly reduced profits at companies that handle large volumes of data globally. What's bad about that?

jstanley 11y ago
The cost will also be massively reduced profits at companies that handle small volumes of data globally.
- anon1385 11y ago
  If those companies can't remain profitable without being irresponsible with sensitive private data then maybe they shouldn't exist at all.
  - jstanley 11y ago
    This isn't just an impediment to businesses that deal in selling "sensitive private data". It's an impediment to any business that has any data about its customers (e.g. delivery addresses). Unless I'm misunderstanding it?
    - icebraining 11y ago
      Yes, it's personal data, ie., data that identifies or allows for the identification of a person.
    - JupiterMoon 11y ago
      Yes this type of data is in the EU area considered as belonging to the customer not to business. The US and the various European countries have totally incompatible legal views on data protection so it should hardly be a surprise that eventually the EU is going to say that US companies have to follow the local laws.
    - happyscrappy 11y ago
      Nope, more useless EU bureaucracy (stupid cookie popup) just to pretend that the NSA won't get (be given) the data by EU governments. Everyone thinks the cookie law is dumb, but there it is, constantly reminding everyone of their folly.
      - JupiterMoon 11y ago
        In terms of state level spying. I understand that currently GCHQ hands everything over to the NSA. However, I can vote and lobby in my country to have proper safeguards on how our domestic spy agencies work. I can't vote or lobby in the US to add safeguards to the NSA there. Therefore I want as a first step that my data stays in the UK. And besides this the rules for how private companies can handle my data are totally different in the UK to the US. In the UK private data comes with fairly strict obligations under the data protection acts and leaking (even accidentally or due to insufficient safeguards preventing malicious actions) can be punished robustly. As I understand it in the US the laws are rather different.
    - rmc 11y ago
      Then treat personal data as radioactive. Don't store it. Don't collect it if you don't need it. If you have it, try to get rid of it, and delete it ASAP.
      - jstanley 11y ago
        That's not practical. "I haven't received my package!" "Well, we sent it 2 weeks ago" "What address did you send it to?" "Don't know" EDIT: Also, "Why does this shopping website require me to re-input the shipping address every time I want to buy something? Why can't it remember it like every website used to?"
        Nursie 11y ago
        In general one is allowed to store data for a limited time for specific purposes. A delivery address, for instance, is vital to deliver a package to. You could probably even keep a names and addresses database so long as it was something you needed to keep in order to conduct business with the customer. Routine data mining, asking for irrelevant info, selling it on to third parties, not so much.
        iofj 11y ago
        Maybe it's just me, but these rules are contradictory. The sentences seem explicitly designed to make that so. For instance, your email address and birthday, for, say, amazon.com, could easily be argued to "need to be kept in order to conduct business". After all, your email ... amazon spams it ... that's certainly part of the business they conduct (and frankly, they'd be more expensive if they didn't do that, so there's easy arguments that it'd be harder to do business if they didn't). Your birthday ... same. They spam you harder on your birthday ... also part of their business. Laws like this won't protect anything. The simple fact is you can't have easy to use sites like google, facebook, amazon and the many millions of easy webshops and have protection of private data, it just wouldn't work as well. Since people prove time and time again that they want the webshops and "private" chats far more than they want privacy, there is no way to win this fight. Everything is decided already (and already today kids don't have anywhere near the expectation of privacy that adults have, this will get worse), there's just a few decades of denial remaining. Take the single account (real name policy) on facebook. We all know that's the reason facebook comments don't work like youtube comments do. That's why not every second post on facebook is about hitler. That's why it's easy to find people on facebook. And so on. You can't drop it and expect the same functionality, and people have proven with their feet (/mouse) that they want the functionality more than they want multi-name policy.
- teekert 11y ago
  Perhaps US politicians should then consider being a Safe Harbour for data themselves. I'm sure that if the US would not have, for example, used their anti-terror apparatus to spy on foreign oil companies [0] and have some more respect for other countries [1] (most NSA criticism focuses on US citizens), things might have been different. I'm very glad the EU is standing up for itself, it should do the same when it comes to TTIP. [0] http://www.theguardian.com/world/2013/sep/09/nsa-spying-brazil-oil-petrobras http://www.theguardian.com/world/2013/sep/09/nsa-spying-braz... [1]http://www.theguardian.com/world/video/2014/feb/07/eu-us-diplomat-victoria-nuland-phonecall-leaked-video http://www.theguardian.com/world/video/2014/feb/07/eu-us-dip...
JoshTriplett 11y ago
> The main outcome will be that more engineers will be needed to do more work https://en.wikipedia.org/wiki/Parable_of_the_broken_window https://en.wikipedia.org/wiki/Parable_of_the_broken_window Artificially creating additional work by imposing additional requirements does not necessarily improve the situation just because it employs people to do that work, whether you personally like those requirements or not.
- jamesblonde 11y ago
  This is a good thing, IMO. It's like having a shoddy builder who builds a poorly insulated house and then screams - hey, your house will be more expensive if I build it properly. But the builder has plenty of profits with which to take the hit. Consumers are already trading off their data for services (like Facebook). If the costs were so high that Facebook or Google needed to pass on real costs to consumers, there might be an issue. But the costs won't be that high. It's just a bit more work to build it right.
- madez 11y ago
  In contrast to the parable you are citing, the only thing broken in this case is the privacy of european citizens. The ruling to declare "Safe" Harbor invalid is not breaking anything but a step to fix a system that is systematically violating constitutional rights. In the light of US companies not effectively safeguarding european data against access by US authorities, judgements are needed to rectify the situation.
- jeremysmyth 11y ago
  The parable of the broken window weighs what is seen (the payment to the glazier) with what is not seen (the missed payments to other things that could've been purchased had the window not been broken). In the case of safe harbour, the window was already broken. Data being passed from Europe to the US was not being handled correctly, despite the promises inherent in Safe Harbor. If protections had already been in place (i.e. if data service providers were actually adhering to the promises of safe harbour) then service providers have already fixed the window. Those that were safeguarding data correctly have no further engineering work to do (although there might be further regulatory/compliance effort to prove it depending on how individual nations implement the stopgap safeguard laws to replace Safe Harbor). The only engineering work required to "fix the window" is work that should already have been done according to the safe harbour agreements, and threads like this prove how broken Safe Harbor was to begin with.
atirip 11y ago
Well, viable strategy now for many startups (also EU ones) using US infrastructure is to block all EU customers. How is that good?
- rmc 11y ago
  It'll do wonders for EU start ups using EU infastructure.
  - Silhouette 11y ago
    using EU infastructure ...which in many cases doesn't exist yet. In particular, Europe lags significantly in "on-line" services. Obviously it would solve some problems if this were not the case. However, given that for now it is the case, the price of enforcing a total ban on exporting personal data outside Europe would be closing down vast numbers of on-line European small businesses that aren't intentionally doing anything unreasonable or customer-hostile. Clearly this isn't going to be accepted readily by anyone involved. A more realistic result when the dust has settled might be yet another disclosure that businesses are required to make prominently when someone buys or signs up for something, in order to be deemed to have explicit consent from the data subject to export the data. This appears at first sight to be a reasonable way to handle the ruling, and in principle I think it's hard to argue with requiring a business to disclose fairly what they're really doing with personal data. Indeed, I've noticed that in recent years organisations like my insurers have started adding terms that explicitly say they're going to export personal data and foreign governments might get access to it, and that if you want to deal with them at all then you have to accept that. (I'm not sure how I feel about such conditions when having the insurance is mandatory by law, as for example with motor insurance for drivers, and based on my experience so far it looks like literally everyone offering such insurance is now imposing similar conditions.) Then again, for on-line businesses at least, isn't that what privacy policies have evolved to deal with? Separate to this case, under the new consumer protection rules, it seems likely that such policies would now be considered to fall under the same general rules about fairness and transparency as the main terms of a consumer contract. Assuming that is true, I'm not sure there is a huge advantage in cluttering up on-line order/sign-up forms with explicit wording about routine things, while there is certainly a disadvantage in making such forms any more complicated than they need to be. The question then becomes one of reasonable expectations about what a normal customer would consider routine. I suppose that brings us back to approximately where we came in, other than the fact that it's now a matter of public record that the US government itself was violating those reasonable expectations and opened Pandora's box. Somehow I suspect that if some sort of basic disclosure/consent on sign-up doesn't deal with this issue, it will be addressed by adjusting the relevant European-level legislation so that disclosure to allied governments in the interests of national security is a blanket exemption, and enough people won't know or care about the implications that this will pass even though privacy advocates would surely oppose it.

jstanley 11y ago

The cost will also be massively reduced profits at companies that handle small volumes of data globally.

anon1385 11y ago
If those companies can't remain profitable without being irresponsible with sensitive private data then maybe they shouldn't exist at all.
- jstanley 11y ago
  This isn't just an impediment to businesses that deal in selling "sensitive private data". It's an impediment to any business that has any data about its customers (e.g. delivery addresses). Unless I'm misunderstanding it?
  - icebraining 11y ago
    Yes, it's personal data, ie., data that identifies or allows for the identification of a person.
  - JupiterMoon 11y ago
    Yes this type of data is in the EU area considered as belonging to the customer not to business. The US and the various European countries have totally incompatible legal views on data protection so it should hardly be a surprise that eventually the EU is going to say that US companies have to follow the local laws.
  - happyscrappy 11y ago
    Nope, more useless EU bureaucracy (stupid cookie popup) just to pretend that the NSA won't get (be given) the data by EU governments. Everyone thinks the cookie law is dumb, but there it is, constantly reminding everyone of their folly.
    - JupiterMoon 11y ago
      In terms of state level spying. I understand that currently GCHQ hands everything over to the NSA. However, I can vote and lobby in my country to have proper safeguards on how our domestic spy agencies work. I can't vote or lobby in the US to add safeguards to the NSA there. Therefore I want as a first step that my data stays in the UK. And besides this the rules for how private companies can handle my data are totally different in the UK to the US. In the UK private data comes with fairly strict obligations under the data protection acts and leaking (even accidentally or due to insufficient safeguards preventing malicious actions) can be punished robustly. As I understand it in the US the laws are rather different.
  - rmc 11y ago
    Then treat personal data as radioactive. Don't store it. Don't collect it if you don't need it. If you have it, try to get rid of it, and delete it ASAP.
    - jstanley 11y ago
      That's not practical. "I haven't received my package!" "Well, we sent it 2 weeks ago" "What address did you send it to?" "Don't know" EDIT: Also, "Why does this shopping website require me to re-input the shipping address every time I want to buy something? Why can't it remember it like every website used to?"
      - Nursie 11y ago
        In general one is allowed to store data for a limited time for specific purposes. A delivery address, for instance, is vital to deliver a package to. You could probably even keep a names and addresses database so long as it was something you needed to keep in order to conduct business with the customer. Routine data mining, asking for irrelevant info, selling it on to third parties, not so much.
        iofj 11y ago
        Maybe it's just me, but these rules are contradictory. The sentences seem explicitly designed to make that so. For instance, your email address and birthday, for, say, amazon.com, could easily be argued to "need to be kept in order to conduct business". After all, your email ... amazon spams it ... that's certainly part of the business they conduct (and frankly, they'd be more expensive if they didn't do that, so there's easy arguments that it'd be harder to do business if they didn't). Your birthday ... same. They spam you harder on your birthday ... also part of their business. Laws like this won't protect anything. The simple fact is you can't have easy to use sites like google, facebook, amazon and the many millions of easy webshops and have protection of private data, it just wouldn't work as well. Since people prove time and time again that they want the webshops and "private" chats far more than they want privacy, there is no way to win this fight. Everything is decided already (and already today kids don't have anywhere near the expectation of privacy that adults have, this will get worse), there's just a few decades of denial remaining. Take the single account (real name policy) on facebook. We all know that's the reason facebook comments don't work like youtube comments do. That's why not every second post on facebook is about hitler. That's why it's easy to find people on facebook. And so on. You can't drop it and expect the same functionality, and people have proven with their feet (/mouse) that they want the functionality more than they want multi-name policy.
teekert 11y ago
Perhaps US politicians should then consider being a Safe Harbour for data themselves. I'm sure that if the US would not have, for example, used their anti-terror apparatus to spy on foreign oil companies [0] and have some more respect for other countries [1] (most NSA criticism focuses on US citizens), things might have been different. I'm very glad the EU is standing up for itself, it should do the same when it comes to TTIP. [0] http://www.theguardian.com/world/2013/sep/09/nsa-spying-brazil-oil-petrobras http://www.theguardian.com/world/2013/sep/09/nsa-spying-braz... [1]http://www.theguardian.com/world/video/2014/feb/07/eu-us-diplomat-victoria-nuland-phonecall-leaked-video http://www.theguardian.com/world/video/2014/feb/07/eu-us-dip...

JoshTriplett 11y ago

> The main outcome will be that more engineers will be needed to do more work https://en.wikipedia.org/wiki/Parable_of_the_broken_window https://en.wikipedia.org/wiki/Parable_of_the_broken_window Artificially creating additional work by imposing additional requirements does not necessarily improve the situation just because it employs people to do that work, whether you personally like those requirements or not.

jamesblonde 11y ago
This is a good thing, IMO. It's like having a shoddy builder who builds a poorly insulated house and then screams - hey, your house will be more expensive if I build it properly. But the builder has plenty of profits with which to take the hit. Consumers are already trading off their data for services (like Facebook). If the costs were so high that Facebook or Google needed to pass on real costs to consumers, there might be an issue. But the costs won't be that high. It's just a bit more work to build it right.
madez 11y ago
In contrast to the parable you are citing, the only thing broken in this case is the privacy of european citizens. The ruling to declare "Safe" Harbor invalid is not breaking anything but a step to fix a system that is systematically violating constitutional rights. In the light of US companies not effectively safeguarding european data against access by US authorities, judgements are needed to rectify the situation.
jeremysmyth 11y ago
The parable of the broken window weighs what is seen (the payment to the glazier) with what is not seen (the missed payments to other things that could've been purchased had the window not been broken). In the case of safe harbour, the window was already broken. Data being passed from Europe to the US was not being handled correctly, despite the promises inherent in Safe Harbor. If protections had already been in place (i.e. if data service providers were actually adhering to the promises of safe harbour) then service providers have already fixed the window. Those that were safeguarding data correctly have no further engineering work to do (although there might be further regulatory/compliance effort to prove it depending on how individual nations implement the stopgap safeguard laws to replace Safe Harbor). The only engineering work required to "fix the window" is work that should already have been done according to the safe harbour agreements, and threads like this prove how broken Safe Harbor was to begin with.

atirip 11y ago

Well, viable strategy now for many startups (also EU ones) using US infrastructure is to block all EU customers. How is that good?

rmc 11y ago
It'll do wonders for EU start ups using EU infastructure.
- Silhouette 11y ago
  using EU infastructure ...which in many cases doesn't exist yet. In particular, Europe lags significantly in "on-line" services. Obviously it would solve some problems if this were not the case. However, given that for now it is the case, the price of enforcing a total ban on exporting personal data outside Europe would be closing down vast numbers of on-line European small businesses that aren't intentionally doing anything unreasonable or customer-hostile. Clearly this isn't going to be accepted readily by anyone involved. A more realistic result when the dust has settled might be yet another disclosure that businesses are required to make prominently when someone buys or signs up for something, in order to be deemed to have explicit consent from the data subject to export the data. This appears at first sight to be a reasonable way to handle the ruling, and in principle I think it's hard to argue with requiring a business to disclose fairly what they're really doing with personal data. Indeed, I've noticed that in recent years organisations like my insurers have started adding terms that explicitly say they're going to export personal data and foreign governments might get access to it, and that if you want to deal with them at all then you have to accept that. (I'm not sure how I feel about such conditions when having the insurance is mandatory by law, as for example with motor insurance for drivers, and based on my experience so far it looks like literally everyone offering such insurance is now imposing similar conditions.) Then again, for on-line businesses at least, isn't that what privacy policies have evolved to deal with? Separate to this case, under the new consumer protection rules, it seems likely that such policies would now be considered to fall under the same general rules about fairness and transparency as the main terms of a consumer contract. Assuming that is true, I'm not sure there is a huge advantage in cluttering up on-line order/sign-up forms with explicit wording about routine things, while there is certainly a disadvantage in making such forms any more complicated than they need to be. The question then becomes one of reasonable expectations about what a normal customer would consider routine. I suppose that brings us back to approximately where we came in, other than the fact that it's now a matter of public record that the US government itself was violating those reasonable expectations and opened Pandora's box. Somehow I suspect that if some sort of basic disclosure/consent on sign-up doesn't deal with this issue, it will be addressed by adjusting the relevant European-level legislation so that disclosure to allied governments in the interests of national security is a blanket exemption, and enough people won't know or care about the implications that this will pass even though privacy advocates would surely oppose it.