8 ms·

I really think that all of you who are salivating at the prospect of the GDPR destroying FB should prepare yourself for disappointment. The intent behind the la

I really think that all of you who are salivating at the prospect of the GDPR destroying FB should prepare yourself for disappointment. The intent behind the law might be good, but it's unlikely to accomplish what you want it to. 1. It's a bad law, because it's so overly broad and vague that it's going to be impossible to be fully compliant. For example, an EU resident hits your server while they're on vacation in Australia. You've stored analytics, IP addresses, etc. Congrats, you're now in violation. That's the tip of the iceberg. The law also broadly contradicts loads of other laws about how data must be retained for legal and compliance purposes. So now that everyone is breaking this law, regulators are free to just decide who they want to punish and how much. That's incredibly damaging to the fundamental idea of the rule of law. 2. It sets a really bad precedent regarding jurisdiction and the internet. So now any jurisdiction in the world can declare that if you do something they don't like that even remotely affects them, you owe them whatever they want. What if some oppressive regime passes a law that if your website is shown to one of their citizens and doesn't have a message praising their leader, you owe them 100% of your global revenue in perpetuity. Why not? You've violated their laws regarding behavior towards their citizens! 3. As item #2 gets at, countries can pass whatever laws they want, but they're limited by their ability to enforce those laws. If the EU gets overly broad and punitive here (as I'd argue they have), then companies will either just leave, or shift their digital operations to jurisdictions where courts can't enforce those laws. Ultimately, I think that the realistic path here is that Google and Facebook will fundamentally change almost nothing. The user experience will just get worse, because we'll have to constantly be agreeing to a long list of terms about how our data will be used, etc, etc. And people will just agree and move on. Look at the cookie thing. Yes, I know you think it's different this time because of X, Y, and Z, but I'm skeptical. We'll see. Regardless, the idea that we're suddenly going to live in a new golden age of digital privacy because the GDPR has good intentions is laughable.

lucian1900 9y ago
You shouldn't be storing anything without first obtaining consent. Why are you using analytics indiscriminately? The GDPR does actually have exceptions for cases where local law requires you to store data. Any jurisdiction can already enforce their laws upon you if you affect their citizens. There's nothing new here.
- ryanwaggoner 9y ago
  You shouldn't be storing anything without first obtaining consent. Why are you using analytics indiscriminately? Sorry, I find this ludicrous. Using analytics "indiscriminately"? What does that even mean? The most basic use case for analytics is to use them indiscriminately to see how visitors are using your site. Not to mention that this is basically impossible, since storing IP addresses in Apache log files is also probably a breach. Someone in the EU sends you an email, now you're in violation because the header info is PII. A german walks into your hospital in Miami and signs in; if you don't have a special snowflake data management process for them that runs alongside your standard HIPAA-compliant one, you're probably in violation. Any jurisdiction can already enforce their laws upon you if you affect their citizens. No, they can't. They can declare any law, but that doesn't mean they can enforce it. I really think that basically every business around the world who doesn't have a direct EU presence in terms of office, employees should (and probably will) just ignore the GDPR. It's a huge violation of sovereignty, the freedom and ideals of the internet, and a great example of how people will be pleased to let their governments enact policies no matter how harmful or dangerous as long as they're against an "enemy" that they hate.
  - sveme 9y ago
    > Any jurisdiction can already enforce their laws upon you if you affect their citizens. Isnt't that already done by the US? The case against Kim Dotcom comes to my mind.
    - ryanwaggoner 9y ago
      I'm definitely not defending US jurisdictional overreach.
    - adventured 9y ago
      Kim Dotcom made the mistake of operating servers in the US jurisdiction. New Zealand made the mistake of complying with the US requests to extradite him. The US could not have effectively enforced its laws upon Kim Dotcom without New Zealand's assistance. If China comes after me for something terrible I say about Mao (stray absurd example), and the US turns me over to China because they're influenced and or intimidated by China, that would be a similar premise: the US would bear immense, near total responsibility for capitulating, showing no backbone.
The_Magistrate 9y ago
GDPR isn't enforceable in jurisdictions that don't have corresponding local laws. Take Privacy Shield in the US - this is an agreement betwee the US government and the EU stating the FTC and Chamber of Commerce will act as the supervisory authorities for GDPR enforcement against companies registered in the US. You're right, the fundamental functioning of Google, Facebook, et al. won't change. They will update their privacy policies, and give users access to view, update or delete all of their information more easily. The uses of that information will be disclosed and there will be consequences for misuse or failure to protect that information. GDPR is setting expectations for the protection of data previously where it was an anything-goes or minimum-effort policy. I can see how those opposed to government regulation would hate GDPR, but no other industry standard on data privacy has gained traction and data breaches are happening more frequently at the expense of real people.
jacquesm 9y ago
> I really think that all of you who are salivating at the prospect of the GDPR destroying FB should prepare yourself for disappointment. That's got to be the mother of all strawmen. FB will not be destroyed by the GDPR, but - ideally - the GDPR will cut back some of the worst excesses such as tracking users who are not even members of FB through embedded JS on other people's properties. > It's a bad law, because it's so overly broad and vague that it's going to be impossible to be fully compliant. It's actually a pretty good law compared to the predecessor. If you feel that it is impossible to be fully compliant then maybe you need someone to interpret the law for you - such as a lawyer or a judge -, there are some fields of tension but on the whole it is not at all impossible to be compliant at least with the spirit of the law. Acting in good faith is a good first step. > For example, an EU resident hits your server while they're on vacation in Australia. You've stored analytics, IP addresses, etc. Congrats, you're now in violation. Contrived example, do not pass go. > That's the tip of the iceberg. The law also broadly contradicts loads of other laws about how data must be retained for legal and compliance purposes. And makes special mention of that and has exceptions for those cases. > So now that everyone is breaking this law, regulators are free to just decide who they want to punish and how much. That's incredibly damaging to the fundamental idea of the rule of law. Except that's not how it works, which makes this another strawman. > 2. It sets a really bad precedent regarding jurisdiction and the internet. How so? If you want to argue something is bad then you need to show how it is bad because of negative consequences, what 'any jurisdiction in the world' declares is their business, but the EU has stepped up for the rights of its citizens, and as one of those citizens, I'm pretty happy about it. > So now any jurisdiction in the world can declare that if you do something they don't like that even remotely affects them, you owe them whatever they want. This has nothing to do with the GDPR. > What if some oppressive regime passes a law that if your website is shown to one of their citizens and doesn't have a message praising their leader, you owe them 100% of your global revenue in perpetuity. Yet another strawman. > Why not? Well, why not? Indeed, except, it hasn't happened. > You've violated their laws regarding behavior towards their citizens! Yes, and you're free to ignore them, except in those cases where you wish to have a business presence in the country of said oppressive regime. > 3. As item #2 gets at, countries can pass whatever laws they want, but they're limited by their ability to enforce those laws. Exactly. But the EU can and does enforce its laws. > If the EU gets overly broad and punitive here (as I'd argue they have), then companies will either just leave, or shift their digital operations to jurisdictions where courts can't enforce those laws. That's fine, at least we have proven malicious intent on their part then. Complying with this law isn't all that hard. But it is hard if you are coming at the whole concept of privacy as a party that does not care about it. > Ultimately, I think that the realistic path here is that Google and Facebook will fundamentally change almost nothing. We'll see. My guess is that they like the money too much to do 'nothing'. > The user experience will just get worse, because we'll have to constantly be agreeing to a long list of terms about how our data will be used, etc, etc. And people will just agree and move on. So what are you worried about then? > Regardless, the idea that we're suddenly going to live in a new golden age of digital privacy because the GDPR has good intentions is laughable. Nobody claimed that, could you please lay off the strawmen, you can do much better than that.
GlitchMr 9y ago
> For example, an EU resident hits your server while they're on vacation in Australia. If you don't provide specifically targetting EU with your services, you aren't under GDPR scope. Specifically targetting means stuff that shows that you specially consider EU users, for instance by allowing payments in EUR currency or having a website in a language only spoken in EU. > You've stored analytics, IP addresses, etc. Even if you were under GDPR scope, storing information purely for ensuring network security is perfectly fine under a law. > The law also broadly contradicts loads of other laws about how data must be retained for legal and compliance purposes. GDPR allows for storage of data for legal and compliance purposes. In fact, feel free to read https://ico.org.uk/for-organisations/guide-to-data-protection/principle-5-retention/ https://ico.org.uk/for-organisations/guide-to-data-protectio... > So now any jurisdiction in the world can declare that if you do something they don't like that even remotely affects them, you owe them whatever they want. No, GDPR doesn't apply to everyone. If you don't provide services specifically to European Union countries, you don't need to care about GDPR at all. For instance, if your website has a Greek language option, it's understandable that you are offering services to Greece or Cyprus (both of which are European Union countries), and GDPR applies to your website. GPDR only applies when it would be enforceable to begin with. > What if some oppressive regime passes a law that if your website is shown to one of their citizens and doesn't have a message praising their leader, you owe them 100% of your global revenue in perpetuity. They would have difficulties in enforcing it, as you likely don't specifically provide service to them. And even if you did, you could just disable the website for that country instead of paying 100% of your global revenue. Similarly, with GDPR, you can just remove support for EU languages, EU currencies, and so on. > If the EU gets overly broad and punitive here (as I'd argue they have), then companies will either just leave, or shift their digital operations to jurisdictions where courts can't enforce those laws. True, that's an option, but at the same time, EU is a big market that may be not worth ignoring. > Ultimately, I think that the realistic path here is that Google and Facebook will fundamentally change almost nothing. The user experience will just get worse, because we'll have to constantly be agreeing to a long list of terms about how our data will be used, etc, etc. And people will just agree and move on. GDPR is not EU Cookie Law (which actually was badly designed law, unlike GDPR) where you could just put some silly notice and that's about it. For example, an user may demand his information to be removed, and you actually have to handle this request or you risk being sued for not complying with GDPR.
vkou 9y ago
> For example, an EU resident hits your server while they're on vacation in Australia. You've stored analytics, IP addresses, etc. Congrats, you're now in violation. If you don't do business in the EU (Take money from EU customers), there's practically nothing that the EU can do to you. > That's the tip of the iceberg. This is a very unimpressive iceberg. > The law also broadly contradicts loads of other laws about how data must be retained for legal and compliance purposes. So now that everyone is breaking this law, regulators are free to just decide who they want to punish and how much. That's incredibly damaging to the fundamental idea of the rule of law. Fortunately, we have something called 'the courts' that will iron out these ambiguities. And as other posters indicate, this is actually addressed by the GDPR.
wiz21c 9y ago
It will not change anything for 99% of users. But for me it will, I'll call FaceBook, Google, my government and will ask the law to be applied. They won't like it but they'll have to comply. Now, with that data, what will I do ? I'll be able to explain what data collection means to those who don't care, to show examples.
- ryanwaggoner 9y ago
  I think you’re headed for a reality check. There’s this underlying narrative in a lot of the digital privacy stuff that consumers just don’t know what’s happening. If they knew, they’d revolt. I just don’t see it. I think people kinda know, but they just don’t care that much. Hell, I bet half the users on HN have a pretty good understanding of what data is collected, but don’t care enough to check out. We still buy smartphones and use all these sites and put Alexa in our houses. It’s not that we don’t know, we just don’t care.
  - ams6110 9y ago
    I would agree. If you don't use ad/track blockers, you already see that ads follow you around, and are targeted based on recent browsing and shopping. So you intuitively know, at some level, that all these sites are tracking you. I agree that the average person doesn't care too much, based on the lack of serious outrcy about it.
pjc50 9y ago
> So now any jurisdiction in the world can declare that if you do something they don't like that even remotely affects them, you owe them whatever they want This ship sailed a long time ago, unfortunately. That court in Texas with effective global patent jurisdiction. UK libel law. The Sklyarov case which got me interested in digital rights all the way back in 2001: https://en.wikipedia.org/wiki/United_States_v._Elcom_Ltd https://en.wikipedia.org/wiki/United_States_v._Elcom_Ltd. (Arguably it goes all the way back to British maritime law...)
- DanBC 9y ago
  > UK libel law. No.
- ryanwaggoner 9y ago
  It’s a trend, but I don’t think people realize how scary this is. Do we really want a global system of interlocking jurisdictions and reciprocal treaties such that we’re all subject to the most restrictive and oppressive laws in the world? It’s not OK when it’s privacy, because next it may be free speech, or indecency, etc. Do we want a world where we have free speech, unless we say something online against Putin, and then the US is happy to extradite us? Seems fanciful, but I don’t see how it’s fundamentally different than what GDPR tries to assert.
  - pjc50 9y ago
    Ultimately we have to say that not all law is bad, surely? Then take it on a case by case basis. The Internet itself makes world legal convergence a necessity. Pick one: - EU citizens can have their rights violated by US companies - US companies are not allowed to communicate with EU citizens (ie great firewall of Europe) - Everyone gives up on the idea of law where the internet is concerned and crosses a national line (cyberpunk anarchy; sort of the status quo; everyone gets surveilled and ultimately leaked a la Equifax) - EU gives up on having its own law and acceeds to US law (e.g. Switzerland, which is not the EU but proudly independent, eventually gave up its banking secrecy to US KYC/AML)
    - 9y ago
alphaalpha101 9y ago
>1. It's a bad law, because it's so overly broad and vague that it's going to be impossible to be fully compliant. For example, an EU resident hits your server while they're on vacation in Australia. You've stored analytics, IP addresses, etc. Congrats, you're now in violation. That's the tip of the iceberg. The law also broadly contradicts loads of other laws about how data must be retained for legal and compliance purposes. So now that everyone is breaking this law, regulators are free to just decide who they want to punish and how much. That's incredibly damaging to the fundamental idea of the rule of law. Well yes, you're in violation. You've violated the rules. There are two easy solutions to this problem: separated datacentres for your EU customers so that their requests don't even touch the servers set to VILE_PRIVACY_VIOLATIONS=1, or just following the EU rules with respect to all customers. Oh no, they might inadvertently force you to respect the human rights of people outside the EU too! How horrible! It's not damaging to the idea of the rule of law to have regulations that are broad and require many parties to take action. Lots of companies are working very hard to ensure they comply with the new rules. Everyone else can do so too. >2. It sets a really bad precedent regarding jurisdiction and the internet. So now any jurisdiction in the world can declare that if you do something they don't like that even remotely affects them, you owe them whatever they want. What if some oppressive regime passes a law that if your website is shown to one of their citizens and doesn't have a message praising their leader, you owe them 100% of your global revenue in perpetuity. Why not? You've violated their laws regarding behavior towards their citizens! That's not a new precedent at all. If you want to operate within a particular jurisdiction then you have to comply with the laws of that jurisdiction. If you want to operate in Canada, you have to follow Canadian law. If you want to operate in the United States, you have to follow US law. If you want to operate in New Zealand, you have to follow New Zealand law. And if you want to operate in the EU, well, yes, you have to follow EU law. If North Korea decrees that any website that says anything negative about their Dear Leader will be in violation of their laws and must pay them 100% of their global revenue in perpetuity then people just won't operate in North Korea. Big deal. They already probably don't operate in North Korea. The directors won't be able to go there on holiday without being arrested. Oh well. Who cares? That's North Korea's loss. >3. As item #2 gets at, countries can pass whatever laws they want, but they're limited by their ability to enforce those laws. If the EU gets overly broad and punitive here (as I'd argue they have), then companies will either just leave, or shift their digital operations to jurisdictions where courts can't enforce those laws. The EU can enforce their laws regardless of where your 'digital operations' are located. If you have EU customers, you are operating in the EU. You're subject to their laws. You're subject to their tax laws. You might try to get around it, but you won't. Oh you might get away with it for a while, but then the director of your company will go on a holiday to France and be arrested at the airport. Or you'll be extradited from the United States to the EU. Or, most likely, the US regulators that have already agreed to enforce the GDPR within the United States will just do so, without you having to actually go to Europe at all. If these companies want to actively block all connections from the EU and miss out on 500 million customers then good luck with that. I'm sure that cutting off half a billion people in some of the world's richest economies will work out really well for them. >Ultimately, I think that the realistic path here is that Google and Facebook will fundamentally change almost nothing. The user experience will just get worse, because we'll have to constantly be agreeing to a long list of terms about how our data will be used, etc, etc. And people will just agree and move on. Look at the cookie thing. Yes, I know you think it's different this time because of X, Y, and Z, but I'm skeptical. We'll see. Nope. You cannot contract these rules away, just like you cannot agree with your employer to ignore some aspect of employment law that you don't like. That's sort of the whole point, after all. If you could just contract these obligations and rules away they'd be pointless. The cookie thing is completely different because it didn't ban you from tracking cookies, it forced you to notify the user if you use tracking cookies. Well, that's what those banners do. I personally think they're useful. It hopefully makes people at least think twice about whether they actually need to use a cookie or whether their website can actually function fine without them.
kolinko 9y ago
The same counts for US and the security law. If you market your offering to an American, even if they are in Europe, and you actively ban all the US traffic, SEC has a right to go after you.

lucian1900 9y ago

You shouldn't be storing anything without first obtaining consent. Why are you using analytics indiscriminately? The GDPR does actually have exceptions for cases where local law requires you to store data. Any jurisdiction can already enforce their laws upon you if you affect their citizens. There's nothing new here.

ryanwaggoner 9y ago
You shouldn't be storing anything without first obtaining consent. Why are you using analytics indiscriminately? Sorry, I find this ludicrous. Using analytics "indiscriminately"? What does that even mean? The most basic use case for analytics is to use them indiscriminately to see how visitors are using your site. Not to mention that this is basically impossible, since storing IP addresses in Apache log files is also probably a breach. Someone in the EU sends you an email, now you're in violation because the header info is PII. A german walks into your hospital in Miami and signs in; if you don't have a special snowflake data management process for them that runs alongside your standard HIPAA-compliant one, you're probably in violation. Any jurisdiction can already enforce their laws upon you if you affect their citizens. No, they can't. They can declare any law, but that doesn't mean they can enforce it. I really think that basically every business around the world who doesn't have a direct EU presence in terms of office, employees should (and probably will) just ignore the GDPR. It's a huge violation of sovereignty, the freedom and ideals of the internet, and a great example of how people will be pleased to let their governments enact policies no matter how harmful or dangerous as long as they're against an "enemy" that they hate.
- sveme 9y ago
  > Any jurisdiction can already enforce their laws upon you if you affect their citizens. Isnt't that already done by the US? The case against Kim Dotcom comes to my mind.
  - ryanwaggoner 9y ago
    I'm definitely not defending US jurisdictional overreach.
  - adventured 9y ago
    Kim Dotcom made the mistake of operating servers in the US jurisdiction. New Zealand made the mistake of complying with the US requests to extradite him. The US could not have effectively enforced its laws upon Kim Dotcom without New Zealand's assistance. If China comes after me for something terrible I say about Mao (stray absurd example), and the US turns me over to China because they're influenced and or intimidated by China, that would be a similar premise: the US would bear immense, near total responsibility for capitulating, showing no backbone.

The_Magistrate 9y ago

GDPR isn't enforceable in jurisdictions that don't have corresponding local laws. Take Privacy Shield in the US - this is an agreement betwee the US government and the EU stating the FTC and Chamber of Commerce will act as the supervisory authorities for GDPR enforcement against companies registered in the US. You're right, the fundamental functioning of Google, Facebook, et al. won't change. They will update their privacy policies, and give users access to view, update or delete all of their information more easily. The uses of that information will be disclosed and there will be consequences for misuse or failure to protect that information. GDPR is setting expectations for the protection of data previously where it was an anything-goes or minimum-effort policy. I can see how those opposed to government regulation would hate GDPR, but no other industry standard on data privacy has gained traction and data breaches are happening more frequently at the expense of real people.

jacquesm 9y ago

> I really think that all of you who are salivating at the prospect of the GDPR destroying FB should prepare yourself for disappointment. That's got to be the mother of all strawmen. FB will not be destroyed by the GDPR, but - ideally - the GDPR will cut back some of the worst excesses such as tracking users who are not even members of FB through embedded JS on other people's properties. > It's a bad law, because it's so overly broad and vague that it's going to be impossible to be fully compliant. It's actually a pretty good law compared to the predecessor. If you feel that it is impossible to be fully compliant then maybe you need someone to interpret the law for you - such as a lawyer or a judge -, there are some fields of tension but on the whole it is not at all impossible to be compliant at least with the spirit of the law. Acting in good faith is a good first step. > For example, an EU resident hits your server while they're on vacation in Australia. You've stored analytics, IP addresses, etc. Congrats, you're now in violation. Contrived example, do not pass go. > That's the tip of the iceberg. The law also broadly contradicts loads of other laws about how data must be retained for legal and compliance purposes. And makes special mention of that and has exceptions for those cases. > So now that everyone is breaking this law, regulators are free to just decide who they want to punish and how much. That's incredibly damaging to the fundamental idea of the rule of law. Except that's not how it works, which makes this another strawman. > 2. It sets a really bad precedent regarding jurisdiction and the internet. How so? If you want to argue something is bad then you need to show how it is bad because of negative consequences, what 'any jurisdiction in the world' declares is their business, but the EU has stepped up for the rights of its citizens, and as one of those citizens, I'm pretty happy about it. > So now any jurisdiction in the world can declare that if you do something they don't like that even remotely affects them, you owe them whatever they want. This has nothing to do with the GDPR. > What if some oppressive regime passes a law that if your website is shown to one of their citizens and doesn't have a message praising their leader, you owe them 100% of your global revenue in perpetuity. Yet another strawman. > Why not? Well, why not? Indeed, except, it hasn't happened. > You've violated their laws regarding behavior towards their citizens! Yes, and you're free to ignore them, except in those cases where you wish to have a business presence in the country of said oppressive regime. > 3. As item #2 gets at, countries can pass whatever laws they want, but they're limited by their ability to enforce those laws. Exactly. But the EU can and does enforce its laws. > If the EU gets overly broad and punitive here (as I'd argue they have), then companies will either just leave, or shift their digital operations to jurisdictions where courts can't enforce those laws. That's fine, at least we have proven malicious intent on their part then. Complying with this law isn't all that hard. But it is hard if you are coming at the whole concept of privacy as a party that does not care about it. > Ultimately, I think that the realistic path here is that Google and Facebook will fundamentally change almost nothing. We'll see. My guess is that they like the money too much to do 'nothing'. > The user experience will just get worse, because we'll have to constantly be agreeing to a long list of terms about how our data will be used, etc, etc. And people will just agree and move on. So what are you worried about then? > Regardless, the idea that we're suddenly going to live in a new golden age of digital privacy because the GDPR has good intentions is laughable. Nobody claimed that, could you please lay off the strawmen, you can do much better than that.

GlitchMr 9y ago

> For example, an EU resident hits your server while they're on vacation in Australia. If you don't provide specifically targetting EU with your services, you aren't under GDPR scope. Specifically targetting means stuff that shows that you specially consider EU users, for instance by allowing payments in EUR currency or having a website in a language only spoken in EU. > You've stored analytics, IP addresses, etc. Even if you were under GDPR scope, storing information purely for ensuring network security is perfectly fine under a law. > The law also broadly contradicts loads of other laws about how data must be retained for legal and compliance purposes. GDPR allows for storage of data for legal and compliance purposes. In fact, feel free to read https://ico.org.uk/for-organisations/guide-to-data-protection/principle-5-retention/ https://ico.org.uk/for-organisations/guide-to-data-protectio... > So now any jurisdiction in the world can declare that if you do something they don't like that even remotely affects them, you owe them whatever they want. No, GDPR doesn't apply to everyone. If you don't provide services specifically to European Union countries, you don't need to care about GDPR at all. For instance, if your website has a Greek language option, it's understandable that you are offering services to Greece or Cyprus (both of which are European Union countries), and GDPR applies to your website. GPDR only applies when it would be enforceable to begin with. > What if some oppressive regime passes a law that if your website is shown to one of their citizens and doesn't have a message praising their leader, you owe them 100% of your global revenue in perpetuity. They would have difficulties in enforcing it, as you likely don't specifically provide service to them. And even if you did, you could just disable the website for that country instead of paying 100% of your global revenue. Similarly, with GDPR, you can just remove support for EU languages, EU currencies, and so on. > If the EU gets overly broad and punitive here (as I'd argue they have), then companies will either just leave, or shift their digital operations to jurisdictions where courts can't enforce those laws. True, that's an option, but at the same time, EU is a big market that may be not worth ignoring. > Ultimately, I think that the realistic path here is that Google and Facebook will fundamentally change almost nothing. The user experience will just get worse, because we'll have to constantly be agreeing to a long list of terms about how our data will be used, etc, etc. And people will just agree and move on. GDPR is not EU Cookie Law (which actually was badly designed law, unlike GDPR) where you could just put some silly notice and that's about it. For example, an user may demand his information to be removed, and you actually have to handle this request or you risk being sued for not complying with GDPR.

vkou 9y ago

> For example, an EU resident hits your server while they're on vacation in Australia. You've stored analytics, IP addresses, etc. Congrats, you're now in violation. If you don't do business in the EU (Take money from EU customers), there's practically nothing that the EU can do to you. > That's the tip of the iceberg. This is a very unimpressive iceberg. > The law also broadly contradicts loads of other laws about how data must be retained for legal and compliance purposes. So now that everyone is breaking this law, regulators are free to just decide who they want to punish and how much. That's incredibly damaging to the fundamental idea of the rule of law. Fortunately, we have something called 'the courts' that will iron out these ambiguities. And as other posters indicate, this is actually addressed by the GDPR.

wiz21c 9y ago

It will not change anything for 99% of users. But for me it will, I'll call FaceBook, Google, my government and will ask the law to be applied. They won't like it but they'll have to comply. Now, with that data, what will I do ? I'll be able to explain what data collection means to those who don't care, to show examples.

ryanwaggoner 9y ago
I think you’re headed for a reality check. There’s this underlying narrative in a lot of the digital privacy stuff that consumers just don’t know what’s happening. If they knew, they’d revolt. I just don’t see it. I think people kinda know, but they just don’t care that much. Hell, I bet half the users on HN have a pretty good understanding of what data is collected, but don’t care enough to check out. We still buy smartphones and use all these sites and put Alexa in our houses. It’s not that we don’t know, we just don’t care.
- ams6110 9y ago
  I would agree. If you don't use ad/track blockers, you already see that ads follow you around, and are targeted based on recent browsing and shopping. So you intuitively know, at some level, that all these sites are tracking you. I agree that the average person doesn't care too much, based on the lack of serious outrcy about it.

pjc50 9y ago

> So now any jurisdiction in the world can declare that if you do something they don't like that even remotely affects them, you owe them whatever they want This ship sailed a long time ago, unfortunately. That court in Texas with effective global patent jurisdiction. UK libel law. The Sklyarov case which got me interested in digital rights all the way back in 2001: https://en.wikipedia.org/wiki/United_States_v._Elcom_Ltd https://en.wikipedia.org/wiki/United_States_v._Elcom_Ltd. (Arguably it goes all the way back to British maritime law...)

DanBC 9y ago
> UK libel law. No.
ryanwaggoner 9y ago
It’s a trend, but I don’t think people realize how scary this is. Do we really want a global system of interlocking jurisdictions and reciprocal treaties such that we’re all subject to the most restrictive and oppressive laws in the world? It’s not OK when it’s privacy, because next it may be free speech, or indecency, etc. Do we want a world where we have free speech, unless we say something online against Putin, and then the US is happy to extradite us? Seems fanciful, but I don’t see how it’s fundamentally different than what GDPR tries to assert.
- pjc50 9y ago
  Ultimately we have to say that not all law is bad, surely? Then take it on a case by case basis. The Internet itself makes world legal convergence a necessity. Pick one: - EU citizens can have their rights violated by US companies - US companies are not allowed to communicate with EU citizens (ie great firewall of Europe) - Everyone gives up on the idea of law where the internet is concerned and crosses a national line (cyberpunk anarchy; sort of the status quo; everyone gets surveilled and ultimately leaked a la Equifax) - EU gives up on having its own law and acceeds to US law (e.g. Switzerland, which is not the EU but proudly independent, eventually gave up its banking secrecy to US KYC/AML)
  - 9y ago

alphaalpha101 9y ago

>1. It's a bad law, because it's so overly broad and vague that it's going to be impossible to be fully compliant. For example, an EU resident hits your server while they're on vacation in Australia. You've stored analytics, IP addresses, etc. Congrats, you're now in violation. That's the tip of the iceberg. The law also broadly contradicts loads of other laws about how data must be retained for legal and compliance purposes. So now that everyone is breaking this law, regulators are free to just decide who they want to punish and how much. That's incredibly damaging to the fundamental idea of the rule of law. Well yes, you're in violation. You've violated the rules. There are two easy solutions to this problem: separated datacentres for your EU customers so that their requests don't even touch the servers set to VILE_PRIVACY_VIOLATIONS=1, or just following the EU rules with respect to all customers. Oh no, they might inadvertently force you to respect the human rights of people outside the EU too! How horrible! It's not damaging to the idea of the rule of law to have regulations that are broad and require many parties to take action. Lots of companies are working very hard to ensure they comply with the new rules. Everyone else can do so too. >2. It sets a really bad precedent regarding jurisdiction and the internet. So now any jurisdiction in the world can declare that if you do something they don't like that even remotely affects them, you owe them whatever they want. What if some oppressive regime passes a law that if your website is shown to one of their citizens and doesn't have a message praising their leader, you owe them 100% of your global revenue in perpetuity. Why not? You've violated their laws regarding behavior towards their citizens! That's not a new precedent at all. If you want to operate within a particular jurisdiction then you have to comply with the laws of that jurisdiction. If you want to operate in Canada, you have to follow Canadian law. If you want to operate in the United States, you have to follow US law. If you want to operate in New Zealand, you have to follow New Zealand law. And if you want to operate in the EU, well, yes, you have to follow EU law. If North Korea decrees that any website that says anything negative about their Dear Leader will be in violation of their laws and must pay them 100% of their global revenue in perpetuity then people just won't operate in North Korea. Big deal. They already probably don't operate in North Korea. The directors won't be able to go there on holiday without being arrested. Oh well. Who cares? That's North Korea's loss. >3. As item #2 gets at, countries can pass whatever laws they want, but they're limited by their ability to enforce those laws. If the EU gets overly broad and punitive here (as I'd argue they have), then companies will either just leave, or shift their digital operations to jurisdictions where courts can't enforce those laws. The EU can enforce their laws regardless of where your 'digital operations' are located. If you have EU customers, you are operating in the EU. You're subject to their laws. You're subject to their tax laws. You might try to get around it, but you won't. Oh you might get away with it for a while, but then the director of your company will go on a holiday to France and be arrested at the airport. Or you'll be extradited from the United States to the EU. Or, most likely, the US regulators that have already agreed to enforce the GDPR within the United States will just do so, without you having to actually go to Europe at all. If these companies want to actively block all connections from the EU and miss out on 500 million customers then good luck with that. I'm sure that cutting off half a billion people in some of the world's richest economies will work out really well for them. >Ultimately, I think that the realistic path here is that Google and Facebook will fundamentally change almost nothing. The user experience will just get worse, because we'll have to constantly be agreeing to a long list of terms about how our data will be used, etc, etc. And people will just agree and move on. Look at the cookie thing. Yes, I know you think it's different this time because of X, Y, and Z, but I'm skeptical. We'll see. Nope. You cannot contract these rules away, just like you cannot agree with your employer to ignore some aspect of employment law that you don't like. That's sort of the whole point, after all. If you could just contract these obligations and rules away they'd be pointless. The cookie thing is completely different because it didn't ban you from tracking cookies, it forced you to notify the user if you use tracking cookies. Well, that's what those banners do. I personally think they're useful. It hopefully makes people at least think twice about whether they actually need to use a cookie or whether their website can actually function fine without them.

kolinko 9y ago

The same counts for US and the security law. If you market your offering to an American, even if they are in Europe, and you actively ban all the US traffic, SEC has a right to go after you.