6 ms·

Surprised that no one mentioned the new EU data protection directive, which goes a long way to fix the first issue mentioned in the article, the loss of control

Surprised that no one mentioned the new EU data protection directive, which goes a long way to fix the first issue mentioned in the article, the loss of control over our personal data (only for users in Europe though). I studied it in detail as I work in data analysis and consult companies on this, and I honestly think it is one of the best laws produced by the EU so far: It gives users a multitude of rights such as being informed about exactly which kind of data a company has about them (and even get a digital copy of that data), how the company uses that data and for which purposes it is used. And if you're subjected to algorithmic decision making (e.g. an algorithm decides if the bank should award you a credit) you have the right to know which kind of algorithms were used in the process and to contest the decision. You also have the right to demand the deletion of your personal data and to revoke the right of a company to process it, as well as to demand correction of inaccurate data. The legislation also allows for severe fines and punishments for companies not respecting the regulation (up to 4 % of yearly turnover of the whole company group), so even companies the size of Google or Facebook should have strong incentives to follow the regulation.

halflings 10y ago
Woah, didn't know it went this far. If anything, this would be great for facebook (which has been anything but transparent when it comes to what they do with your data when your account is deleted). Google already has some relatively transparent controls on what data they have on you, and allow you to wipe all or parts of it.
- k__ 10y ago
  But the law only works with companies. The Internet as whole never forgets
  - ethbro 10y ago
    The Internet also has to make money at some point, which means there's usually a corporate entity in the chain, one whose money (for better or worse) eventually touches Western banks. So yes, the Internet never forgets (things it can make a buck off of).
    - jsilence 10y ago
      Actually no. Saying the internet needs to make money is just as wrong as saying the roads need to make money. The net is just an infrastructure that has to be maintained and paiyd for. "Making money" is absolutely not a neccessety.
      - treehau5_ 10y ago
        Ok, we are taxed for the roads and there are some roads that do require you to pay such as toll lanes. Think of Google and facebook as the restaurants and gas stations along the way.
      - ethbro 10y ago
        Roads do need to make money. We just happen to have a larger concept of "make money" that encompasses increased commerce. Mailboxes might be a better example of your point. I'd argue that the current web looks more like roads than mailboxes though. We would have something more like Minitel if we'd gone the mailboxes route.
- icebraining 10y ago
  Max Schrems, an Austrian lawyer, sued Facebook Ireland over this and got them to release all his data. He also keeps a website where he explains how to get yours: http://europe-v-facebook.org/EN/Get_your_Data_/get_your_data_.html http://europe-v-facebook.org/EN/Get_your_Data_/get_your_data...
  - tombrossman 10y ago
    I tried this back in 2012 after seeing Max profiled on Ars Technica. As someone who never had a FB account I was after my 'shadow profile' data. Facebook emailed back stating: "There isn't a Facebook account associated with the email address from which you are writing. This might be because you don't have a Facebook account or because you already deleted your account. In either of these cases, we do not hold any of your personal data." I didn't ask for data attached to an email address, I asked for any personal data they had collected on _me_ and their answer was evasive and non-responsive. I didn't pursue it any further but I know they are bullshitting me, and I had to move on to other things.
return0 10y ago
OTOH, it allows public authorities to bypass these regulations for "criminal purposes" and does not define any absolute safe haven rights from that.
Silhouette 10y ago
You also have the right to demand the deletion of your personal data and to revoke the right of a company to process it, as well as to demand correction of inaccurate data. This is probably the biggest change. Previously, at least in Europe, the emphasis has typically been on allowing people to know what data was being collected and to require correction of inaccuracies, but much less on whether it was actually allowed to be collected in the first place or allowing data subjects to require deletion of data. I'm a little worried about whether the practical implications of this have been properly considered, which is something the EU has historically been quite bad at doing when it comes to technology and business laws. For example, under (65) in the regulation[1], which is primarily about rights to have personal data deleted and the "right to be forgotten", I see few provisions for a business keeping personal data that it legitimately collected with the subject's consent even if the cost of deleting it is prohibitive. An obvious example would be data that also exists in backups taken during the period of storing and processing that data, all of which would need to be updated in non-trivial ways to remove the data from them. [1] http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:OJ.L_.2016.119.01.0001.01.ENG http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:O...
- ThePhysicist 10y ago
  Yes it surely creates some work for companies, but on the other hand what good would it be if you could just keep personal data around just because it happens to be on a backup tape? Companies simply have to implement suitable backup schedules, which will ensure that the data gets deleted within an acceptable time period (e.g. two weeks), which is doable without actively erasing any specific data (instead of simply erasing a whole backup version).
  - Silhouette 10y ago
    You and I have very different definitions of the word "simply". Arranging proper backups at all is not something to take for granted when you're dealing with small businesses that have many other things to do, but obviously they're important for safeguarding the provision of products and services to all customers and it's important that any backups that are made are handled with proper regard to both security and integrity. Requiring businesses to separate every tiny item of data that might ever be legally required from every tiny item of data that is collected and used with consent for reasonable purposes, just in case some customer one day decides to retrospectively withdraw their consent for some or all of that data, could easily become absurdly disproportionate. I hope it would go without saying that incentivizing businesses not to keep backups of all important data because of the compliance overheads is insane. However, without such fine-grained separation, two weeks might be far too short a period to keep backups. To use my own businesses as an example here, we have accounting and reporting obligations that potentially require several years of data. The reporting information is typically derived once a year during reporting season, from straightforward records kept in the main databases and/or spreadsheets. However, we would probably have to completely restructure those records and denormalize all kinds of things in order to delete everything we don't strictly need for some legal purpose, which would be a huge amount of work. That's just the structure of the original data. Then you have to consider things like deduplication in online backup services, where it's practically impossible to guarantee the complete destruction of all instances of certain data without destroying all backups that ever involved that data and starting over. If this is the situation for small businesses that typically only collect a small amount of personal data in the first place and for obvious and necessary purposes, I shudder to think of the implications for organisations that actually process personal data as part of their main purpose rather than incidentally. I'm not sure it's reasonable to assume, in general, that it would even be possible to totally separate legally required data from everything else in such organisations, and there would surely be a lot of grey areas. Now, please don't misunderstand me. I'm all for reasonable regulation to protect individuals from exploitation. I'm a privacy and civil liberties advocate, and I run my own businesses the way I hope others would run theirs, even if sometimes that means not doing things that would probably make us more money because they also make us feel uncomfortable. But there has to be a sensible balance, and the EU does not have a good track record of balancing its business regulations sensibly. (See also: EU VAT, cookie law, various provisions in the last round of consumer protection rules, etc.)
paradite 10y ago
Sounds quite similar to Personal Data Protection Act (PDPA) in Singapore: http://www.pwc.com/sg/en/personal-data-protection.html http://www.pwc.com/sg/en/personal-data-protection.html
Kiro 10y ago
> You also have the right to demand the deletion of your personal data How does it work with data you're legally required to keep? E.g. for tax reasons.
- fegu 10y ago
  "Dear Mr tax man. I request that you delete me." Financial institutions and the government are exempt for "necessary information".
- ThePhysicist 10y ago
  Excellent question! Article 17 of the regulation (http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679 http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:320...) lists some exceptions when the processor (the entity holding your data, e.g. Facebook) is allowed to keep some of your personal data. Most notably, sentence 3b states that data might be kept "for compliance with a legal obligation...", which includes keeping of tax records. Also, as the other poster already said the regulation does not apply in the same way to public institutions like the tax office. However, the processor would not be able to keep any data beyond what is needed for the purpose for which the exception holds, and the data cannot be used for anything else.
ben_jones 10y ago
People often joke about the EU being toothless don't they? What penalties exist, as presumably their is a grace period to this that gives companies the time to build the systems in order to respect it? I feel like most small companies will find a way to skirt (or ignore) this as such systems could likely match the complexity of their products themselves..
- galvin 10y ago
  Small businesses don't need to build complex systems to respect the law. If someone wants their data they can ask for it by email. The business can then manually gather the data from their databases and send it as a ZIP, PDF or whatever. You can worry about building a system when it makes financial sense compared to the time spent manually dealing with data requests.
  - deleted 10y ago
    [deleted]
  - ThePhysicist 10y ago
    ZIP/PDF would not qualify as an exchange format, as the directive clearly states the data must be "in a structured, commonly used and machine-readable format". XML would do, but a PDF definitely not as it's not machine-readable (in the sense that you can easily extract the structure of the raw data from the file).
- ThePhysicist 10y ago
  Fines are only one pillar of the strategy, as the new regulation also makes it significantly easier for individuals to sue companies due to data misuse and loss in a civil court. But you're right, in the end it will depend on how severely the individual EU countries as well as the commission persecute companies that don't obey the standards. And like in other areas there will be fraud and companies trying to circumvent the regulation. All in all I think the standard for data protection will increase significantly.
deevolution 10y ago
This might be naive, but.. Shouldnt the internet be as far removed from regulation as possible? This just opens the doors for more regulation by central authorities.
- GavinMcG 10y ago
  Why should it be as far removed from regulation as possible? Why not strike a balance where we regulate certain things that are important to us, and leave open the rest? More regulation is a good thing if things we as a society deem critical can only be accomplished through regulation.
- miketery 10y ago
  We need to have a balance - definitely a fine line.
3pt14159 10y ago
If my business runs servers out of Canada that Europeans use, what are the enforcement mechanisms for this law?
- bluelu 10y ago
  European businesses will be punished with the sane terms as well if they use a service which is non eu compliant. So they can only use compliant services.
  - 3pt14159 10y ago
    Ok. That kinda makes sense. Does it flow through to subsidiaries or EU citizen owned foreign enterprises? Because it seems like this could lead to a regulatory race to the bottom.
- ThePhysicist 10y ago
  It's not important where your servers are or if you are a European company, what matters is that you offer services to people in the EU (market place principle). I am not fully clear on how this will apply to foreign companies that do not advertise/target EU users though.
closeparen 10y ago
1) How does this interact with backups? It would seem impossible to build a safe backup system that can comply with "delete all this user's data" faster than the expiration of the backup retention period. Recovering from backup could potentially reintroduce data about someone who requested deletion. 2) How specific is "for which purposes?" I can't imagine companies would ever go collect explicit opt-ins for every new SELECT statement in their codebases. It seems like the only thing to do is list the broadest possible set of purposes upfront. 3) How do you decide whose data it is? For example, HN comments can't be deleted because they're considered the internet's data, not yours. What if I sync my contacts containing your phone number, or a photo of us together? If you demand the deletion of "your data" then do my contacts and photos disappear? What if you make a scene at some establishment, or default on a loan? Can you demand that their record of "let's not do business with this person again" go away?
- Silhouette 10y ago
  What if I sync my contacts containing your phone number, or a photo of us together? If you demand the deletion of "your data" then do my contacts and photos disappear? This is one of the most tricky areas in deciding what is reasonable. Obviously there are advantages to being able to share personal data about other people for your own benefit. On the other hand, every time you do that, you are potentially giving someone personal data without the subject of that data's consent. I don't think we fully understand the implications of modern technologies in this area yet. However, I suspect we'll be learning some lessons the hard way over the next few years, as the correlation and processing of that data starts to catch up with the volume of data that's been collected. It's also possible that some of the people giving up that data about other people, or more likely the businesses that encourage individuals to do so, are going to come under a lot of scrutiny even in terms of compliance with existing law and regulations. For example, if you install a social network's app on your phone, and that app uploads your contact list complete with names and phone numbers to their database, then both you and the social network have obviously just compromised the privacy of everyone on your contacts list. That much is black and white, but if the social network concerned then uses that data for any purpose other than providing whatever services you are explicitly requesting in terms of the contact list you already had, then from a data protection point of view it becomes a lot more just black. I'm a little surprised that data protection regulators, particularly in Europe, have taken such a hands-off approach to this issue for as long as they have already.
kayoone 10y ago
The european data privacy laws have been largely ignored by the big US companies thus far, also because they were supported by the Irish gonvernment which did not really go after the endless number of complaints that were filed. In theory the new regulation should improve things, because it's no longer just a guideline as the previous solution.
discordance 10y ago
The new EU data protection directive is a huge win for users. I think it's going to be amazingly hard (and expensive) for enterprise and SMB to comply. The amount of work and liability to prepare for is massive. For any smart consultants who are up on PII compliance and associated data security practices, there's an endless amount of work here.

halflings 10y ago

Woah, didn't know it went this far. If anything, this would be great for facebook (which has been anything but transparent when it comes to what they do with your data when your account is deleted). Google already has some relatively transparent controls on what data they have on you, and allow you to wipe all or parts of it.

k__ 10y ago
But the law only works with companies. The Internet as whole never forgets
- ethbro 10y ago
  The Internet also has to make money at some point, which means there's usually a corporate entity in the chain, one whose money (for better or worse) eventually touches Western banks. So yes, the Internet never forgets (things it can make a buck off of).
  - jsilence 10y ago
    Actually no. Saying the internet needs to make money is just as wrong as saying the roads need to make money. The net is just an infrastructure that has to be maintained and paiyd for. "Making money" is absolutely not a neccessety.
    - treehau5_ 10y ago
      Ok, we are taxed for the roads and there are some roads that do require you to pay such as toll lanes. Think of Google and facebook as the restaurants and gas stations along the way.
    - ethbro 10y ago
      Roads do need to make money. We just happen to have a larger concept of "make money" that encompasses increased commerce. Mailboxes might be a better example of your point. I'd argue that the current web looks more like roads than mailboxes though. We would have something more like Minitel if we'd gone the mailboxes route.
icebraining 10y ago
Max Schrems, an Austrian lawyer, sued Facebook Ireland over this and got them to release all his data. He also keeps a website where he explains how to get yours: http://europe-v-facebook.org/EN/Get_your_Data_/get_your_data_.html http://europe-v-facebook.org/EN/Get_your_Data_/get_your_data...
- tombrossman 10y ago
  I tried this back in 2012 after seeing Max profiled on Ars Technica. As someone who never had a FB account I was after my 'shadow profile' data. Facebook emailed back stating: "There isn't a Facebook account associated with the email address from which you are writing. This might be because you don't have a Facebook account or because you already deleted your account. In either of these cases, we do not hold any of your personal data." I didn't ask for data attached to an email address, I asked for any personal data they had collected on _me_ and their answer was evasive and non-responsive. I didn't pursue it any further but I know they are bullshitting me, and I had to move on to other things.

return0 10y ago

OTOH, it allows public authorities to bypass these regulations for "criminal purposes" and does not define any absolute safe haven rights from that.

Silhouette 10y ago

You also have the right to demand the deletion of your personal data and to revoke the right of a company to process it, as well as to demand correction of inaccurate data. This is probably the biggest change. Previously, at least in Europe, the emphasis has typically been on allowing people to know what data was being collected and to require correction of inaccuracies, but much less on whether it was actually allowed to be collected in the first place or allowing data subjects to require deletion of data. I'm a little worried about whether the practical implications of this have been properly considered, which is something the EU has historically been quite bad at doing when it comes to technology and business laws. For example, under (65) in the regulation[1], which is primarily about rights to have personal data deleted and the "right to be forgotten", I see few provisions for a business keeping personal data that it legitimately collected with the subject's consent even if the cost of deleting it is prohibitive. An obvious example would be data that also exists in backups taken during the period of storing and processing that data, all of which would need to be updated in non-trivial ways to remove the data from them. [1] http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:OJ.L_.2016.119.01.0001.01.ENG http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:O...

ThePhysicist 10y ago
Yes it surely creates some work for companies, but on the other hand what good would it be if you could just keep personal data around just because it happens to be on a backup tape? Companies simply have to implement suitable backup schedules, which will ensure that the data gets deleted within an acceptable time period (e.g. two weeks), which is doable without actively erasing any specific data (instead of simply erasing a whole backup version).
- Silhouette 10y ago
  You and I have very different definitions of the word "simply". Arranging proper backups at all is not something to take for granted when you're dealing with small businesses that have many other things to do, but obviously they're important for safeguarding the provision of products and services to all customers and it's important that any backups that are made are handled with proper regard to both security and integrity. Requiring businesses to separate every tiny item of data that might ever be legally required from every tiny item of data that is collected and used with consent for reasonable purposes, just in case some customer one day decides to retrospectively withdraw their consent for some or all of that data, could easily become absurdly disproportionate. I hope it would go without saying that incentivizing businesses not to keep backups of all important data because of the compliance overheads is insane. However, without such fine-grained separation, two weeks might be far too short a period to keep backups. To use my own businesses as an example here, we have accounting and reporting obligations that potentially require several years of data. The reporting information is typically derived once a year during reporting season, from straightforward records kept in the main databases and/or spreadsheets. However, we would probably have to completely restructure those records and denormalize all kinds of things in order to delete everything we don't strictly need for some legal purpose, which would be a huge amount of work. That's just the structure of the original data. Then you have to consider things like deduplication in online backup services, where it's practically impossible to guarantee the complete destruction of all instances of certain data without destroying all backups that ever involved that data and starting over. If this is the situation for small businesses that typically only collect a small amount of personal data in the first place and for obvious and necessary purposes, I shudder to think of the implications for organisations that actually process personal data as part of their main purpose rather than incidentally. I'm not sure it's reasonable to assume, in general, that it would even be possible to totally separate legally required data from everything else in such organisations, and there would surely be a lot of grey areas. Now, please don't misunderstand me. I'm all for reasonable regulation to protect individuals from exploitation. I'm a privacy and civil liberties advocate, and I run my own businesses the way I hope others would run theirs, even if sometimes that means not doing things that would probably make us more money because they also make us feel uncomfortable. But there has to be a sensible balance, and the EU does not have a good track record of balancing its business regulations sensibly. (See also: EU VAT, cookie law, various provisions in the last round of consumer protection rules, etc.)

paradite 10y ago

Sounds quite similar to Personal Data Protection Act (PDPA) in Singapore: http://www.pwc.com/sg/en/personal-data-protection.html http://www.pwc.com/sg/en/personal-data-protection.html

Kiro 10y ago

> You also have the right to demand the deletion of your personal data How does it work with data you're legally required to keep? E.g. for tax reasons.

fegu 10y ago
"Dear Mr tax man. I request that you delete me." Financial institutions and the government are exempt for "necessary information".
ThePhysicist 10y ago
Excellent question! Article 17 of the regulation (http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679 http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:320...) lists some exceptions when the processor (the entity holding your data, e.g. Facebook) is allowed to keep some of your personal data. Most notably, sentence 3b states that data might be kept "for compliance with a legal obligation...", which includes keeping of tax records. Also, as the other poster already said the regulation does not apply in the same way to public institutions like the tax office. However, the processor would not be able to keep any data beyond what is needed for the purpose for which the exception holds, and the data cannot be used for anything else.

ben_jones 10y ago

People often joke about the EU being toothless don't they? What penalties exist, as presumably their is a grace period to this that gives companies the time to build the systems in order to respect it? I feel like most small companies will find a way to skirt (or ignore) this as such systems could likely match the complexity of their products themselves..

galvin 10y ago
Small businesses don't need to build complex systems to respect the law. If someone wants their data they can ask for it by email. The business can then manually gather the data from their databases and send it as a ZIP, PDF or whatever. You can worry about building a system when it makes financial sense compared to the time spent manually dealing with data requests.
- deleted 10y ago
  [deleted]
- ThePhysicist 10y ago
  ZIP/PDF would not qualify as an exchange format, as the directive clearly states the data must be "in a structured, commonly used and machine-readable format". XML would do, but a PDF definitely not as it's not machine-readable (in the sense that you can easily extract the structure of the raw data from the file).
ThePhysicist 10y ago
Fines are only one pillar of the strategy, as the new regulation also makes it significantly easier for individuals to sue companies due to data misuse and loss in a civil court. But you're right, in the end it will depend on how severely the individual EU countries as well as the commission persecute companies that don't obey the standards. And like in other areas there will be fraud and companies trying to circumvent the regulation. All in all I think the standard for data protection will increase significantly.

deevolution 10y ago

This might be naive, but.. Shouldnt the internet be as far removed from regulation as possible? This just opens the doors for more regulation by central authorities.

GavinMcG 10y ago
Why should it be as far removed from regulation as possible? Why not strike a balance where we regulate certain things that are important to us, and leave open the rest? More regulation is a good thing if things we as a society deem critical can only be accomplished through regulation.
miketery 10y ago
We need to have a balance - definitely a fine line.

3pt14159 10y ago

If my business runs servers out of Canada that Europeans use, what are the enforcement mechanisms for this law?

bluelu 10y ago
European businesses will be punished with the sane terms as well if they use a service which is non eu compliant. So they can only use compliant services.
- 3pt14159 10y ago
  Ok. That kinda makes sense. Does it flow through to subsidiaries or EU citizen owned foreign enterprises? Because it seems like this could lead to a regulatory race to the bottom.
ThePhysicist 10y ago
It's not important where your servers are or if you are a European company, what matters is that you offer services to people in the EU (market place principle). I am not fully clear on how this will apply to foreign companies that do not advertise/target EU users though.

closeparen 10y ago

1) How does this interact with backups? It would seem impossible to build a safe backup system that can comply with "delete all this user's data" faster than the expiration of the backup retention period. Recovering from backup could potentially reintroduce data about someone who requested deletion. 2) How specific is "for which purposes?" I can't imagine companies would ever go collect explicit opt-ins for every new SELECT statement in their codebases. It seems like the only thing to do is list the broadest possible set of purposes upfront. 3) How do you decide whose data it is? For example, HN comments can't be deleted because they're considered the internet's data, not yours. What if I sync my contacts containing your phone number, or a photo of us together? If you demand the deletion of "your data" then do my contacts and photos disappear? What if you make a scene at some establishment, or default on a loan? Can you demand that their record of "let's not do business with this person again" go away?

Silhouette 10y ago
What if I sync my contacts containing your phone number, or a photo of us together? If you demand the deletion of "your data" then do my contacts and photos disappear? This is one of the most tricky areas in deciding what is reasonable. Obviously there are advantages to being able to share personal data about other people for your own benefit. On the other hand, every time you do that, you are potentially giving someone personal data without the subject of that data's consent. I don't think we fully understand the implications of modern technologies in this area yet. However, I suspect we'll be learning some lessons the hard way over the next few years, as the correlation and processing of that data starts to catch up with the volume of data that's been collected. It's also possible that some of the people giving up that data about other people, or more likely the businesses that encourage individuals to do so, are going to come under a lot of scrutiny even in terms of compliance with existing law and regulations. For example, if you install a social network's app on your phone, and that app uploads your contact list complete with names and phone numbers to their database, then both you and the social network have obviously just compromised the privacy of everyone on your contacts list. That much is black and white, but if the social network concerned then uses that data for any purpose other than providing whatever services you are explicitly requesting in terms of the contact list you already had, then from a data protection point of view it becomes a lot more just black. I'm a little surprised that data protection regulators, particularly in Europe, have taken such a hands-off approach to this issue for as long as they have already.

kayoone 10y ago

The european data privacy laws have been largely ignored by the big US companies thus far, also because they were supported by the Irish gonvernment which did not really go after the endless number of complaints that were filed. In theory the new regulation should improve things, because it's no longer just a guideline as the previous solution.

discordance 10y ago

The new EU data protection directive is a huge win for users. I think it's going to be amazingly hard (and expensive) for enterprise and SMB to comply. The amount of work and liability to prepare for is massive. For any smart consultants who are up on PII compliance and associated data security practices, there's an endless amount of work here.