6 ms·

The EU (and certainly mostly Germany) has historically a very strict stance on protecting private data. The so called “informationelle Selbstbestimmung” is rega

The EU (and certainly mostly Germany) has historically a very strict stance on protecting private data. The so called “informationelle Selbstbestimmung” is regarded a part of the fundamental human rights. See for example the Volkszählungsurteil of the german constitutional court (German, sorry https://de.m.wikipedia.org/wiki/Volksz%C3%A4hlungsurteil https://de.m.wikipedia.org/wiki/Volksz%C3%A4hlungsurteil) So the best case scenario is that the goal is to actually protect the EU citizens. (I’ll avoid discussing whether the GDPR is a good tool to achieve this goal)

x0x0 9y ago
Though the gdpr doesn't really do that; see one-stop-shop and all. It's transparently aimed at American companies. NB: I don't necessarily disagree with the EU deciding to break Google and FB's business models; but pretending that's not what is happening is silly. It would have been helpful if FB hadn't basically told EU privacy regulators to DIAF.
- guy98238710 9y ago
  Aren't big consumer-oriented businesses (mostly American) in the best position to extort consent from end users?
  - x0x0 9y ago
    They're in the weakest position. The GDPR is composed of a bunch of vague hand waving subject to after the fact rule making by 29-ish different country specific privacy orgs, plus a fewer number of rules set out in black and white, presumably with limited local rule making capabilities. The black and white rules include that consent must be default opt-out, must specifically enumerate and permission each processing purpose, and cannot be required unless necessary to provide the service, even for free services.
    - guy98238710 9y ago
      What stops Google from presenting users with a large popup with lots of legal notices mixed with sweet talking marketese? Most people would just click "Okay, I agree" having never read anything in that popup.
      - Xylakant 9y ago
        Informed consent is required and hiding the crucial information in a sea of legalese would violate that. EULAs get slapped down for such things on a regular basis.
        guy98238710 9y ago
        I didn't mean it to be deceptive. They could just explain things at length in sweet language. Then inject consent request at a point in the workflow where people are most likely to click it away in hurry. The point is that Google or Facebook would get away with this while smaller sites won't.
        x0x0 9y ago
        Under gdpr, consent requires * brevity * clarity * consent to be separate from other T&Cs * default opt-out for everything * each purpose for which processing will take place to be individually enumerated and consented * granularity: the ability to opt-out (default) to each processing purpose There's no ban on including a button that opts a user in to everything, but you would have to take care to make it very difficult to click by accident or I can possibly see a regulator permitting this. See eg discussion of "clear affirmative action" (A32). And I think the eu will very specifically place the highest scrutiny on google and facebook, rather than the least. edit: no doubt, some smart-asses are going to push their luck, but they'll get slapped down in short order (imo). The GDPR regulators will be looking to make an example of some companies. Also, the stick here is the larger of 10m euro or 4% of global turnover.
      - PeterisP 9y ago
        The simplest thing is that they must provide an option to refuse (without making getting service conditional on it), and there's explicit legal requirement that "revoking consent must be as easy as giving it". If next to "Okay, I agree" button there's a "No, just let me through" button, people are going to do just that.
- Xylakant 9y ago
  I don’t agree that the goal was to target and brak up US companies. It just happens that the largest companies that rely on tracking are US companies. This law will hurt EU companies just as much, as evidenced by the article.

x0x0 9y ago

Though the gdpr doesn't really do that; see one-stop-shop and all. It's transparently aimed at American companies. NB: I don't necessarily disagree with the EU deciding to break Google and FB's business models; but pretending that's not what is happening is silly. It would have been helpful if FB hadn't basically told EU privacy regulators to DIAF.

guy98238710 9y ago
Aren't big consumer-oriented businesses (mostly American) in the best position to extort consent from end users?
- x0x0 9y ago
  They're in the weakest position. The GDPR is composed of a bunch of vague hand waving subject to after the fact rule making by 29-ish different country specific privacy orgs, plus a fewer number of rules set out in black and white, presumably with limited local rule making capabilities. The black and white rules include that consent must be default opt-out, must specifically enumerate and permission each processing purpose, and cannot be required unless necessary to provide the service, even for free services.
  - guy98238710 9y ago
    What stops Google from presenting users with a large popup with lots of legal notices mixed with sweet talking marketese? Most people would just click "Okay, I agree" having never read anything in that popup.
    - Xylakant 9y ago
      Informed consent is required and hiding the crucial information in a sea of legalese would violate that. EULAs get slapped down for such things on a regular basis.
      - guy98238710 9y ago
        I didn't mean it to be deceptive. They could just explain things at length in sweet language. Then inject consent request at a point in the workflow where people are most likely to click it away in hurry. The point is that Google or Facebook would get away with this while smaller sites won't.
        x0x0 9y ago
        Under gdpr, consent requires * brevity * clarity * consent to be separate from other T&Cs * default opt-out for everything * each purpose for which processing will take place to be individually enumerated and consented * granularity: the ability to opt-out (default) to each processing purpose There's no ban on including a button that opts a user in to everything, but you would have to take care to make it very difficult to click by accident or I can possibly see a regulator permitting this. See eg discussion of "clear affirmative action" (A32). And I think the eu will very specifically place the highest scrutiny on google and facebook, rather than the least. edit: no doubt, some smart-asses are going to push their luck, but they'll get slapped down in short order (imo). The GDPR regulators will be looking to make an example of some companies. Also, the stick here is the larger of 10m euro or 4% of global turnover.
    - PeterisP 9y ago
      The simplest thing is that they must provide an option to refuse (without making getting service conditional on it), and there's explicit legal requirement that "revoking consent must be as easy as giving it". If next to "Okay, I agree" button there's a "No, just let me through" button, people are going to do just that.
Xylakant 9y ago
I don’t agree that the goal was to target and brak up US companies. It just happens that the largest companies that rely on tracking are US companies. This law will hurt EU companies just as much, as evidenced by the article.