13 ms·

America should borrow from Europe’s data-privacy law

281 points by kushti 9y ago

chimeracoder 9y ago
To push back on the premise a little: The intention behind the GDPR is good, but it still hasn't gone into effect yet, and it remains to be seen what the long-term effects of it are. It's really premature to draw any conclusions about its effectiveness, and history provides us with countless examples of far-reaching regulation that either failed to have the desired outcome, or in fact ended up exacerbating the very problems that it aimed to solve. With a law as massive as the GDPR, it's going to take several years to really get a sense of what steady state will look like, and there are all kinds of ways it can backfire. I hope it won't, but there definitely is a strong, unfounded bias in discourse towards assuming that the GDPR will succeed in the goals that have been projected onto it.
- p49k 9y ago
  While I don’t disagree, I wonder how much harm we should allow our own citizens to endure in terms of the abuse of their data while we wait for someone else’s experiment to conclude.
  - briandear 9y ago
    Could you point me to some examples of actual harm that people have endured for abuses of their data? Preferably not just single-instance anecdotes, but actual data on the harm that is occurring? Theoretically “protecting” people is good, but protecting them from what specifically? Health records are already covered by HIPAA, so other than health, what needs more protections? For example, collecting MixPanel or Google Analytics data from a blog — what’s the actual risk of that data? Very interested in real examples and not just hypothetical fears.. What problem is the EU law solving? Have people on Europe been suffering harms until now?
    - jimnotgym 9y ago
      > Google Analytics data from a blog This is not covered by GDPR, it is a fair use and anonymous. HIPAA is not a widespread standard outside of the US People have lost out due to credit card details having been stolen. PCI compliance is a contract between merchant and bank, and not statute law, and therefore we have seen colossal breaches (like Talk Talk ISP) that are hard to punish. The cost of these breaches currently falls on other merchants who have to lose out to fraudulent car use. Next big co that looses thousands of cards, I really hope they get the top fines, as it is other companies that have to pick up the bill for their actions.
  - _red 9y ago
    >I wonder how much harm we should allow our own citizens to endure in terms of the abuse Those same citizens that voluntarily agreed to the EULA? Do you also support the 'War On Drugs' on the same premise?
    - icebraining 9y ago
      If the GDPR was a War on Drugs, it would be one in which neither the users or the small time dealers/employees have anything to fear, only the gang leaders/shareholders. I'd support that War on Drugs.
    - jimnotgym 9y ago
      You can't opt out of the law in a EULA (under UK and AFAIK European law) Much of what is in GDPR was already illegal under the 1995 regulation, just hard to enforce on US companies
    - stordoff 9y ago
      Seems like somewhat of a false equivalence to me. People (largely) know the risks of drugs, and are knowingly taking the drugs. Data is often gathered unknowingly, or used for unknown purposes, and people don't know the risks/potential uses of that data. It also doesn't remove the ability to agree to the use of data (it just must be actual consent to the purposes of use), so it's more akin to a War on Drugs that targets the supply of impure substances, but allows the supply where the user knows exactly what they are getting.
- phicoh 9y ago
  I'm not a lawyer, but it my impression that the main thing that is different with the GDPR is the threat that it will actually get enforced. In discussions about the GDPR I see things that are part of Dutch law for years, in some cases dating back to the 1970s. In practice nobody cared. In extreme cases the data protection authority would say something. But they were mostly understaffed.
  - icebraining 9y ago
    I don't know about the Netherlands, but here in Portugal, they're pretty responsive. After someone complained, one of my neighbors got fined for posting PII in the building's lobby.
  - jimnotgym 9y ago
    > I'm not a lawyer, but it my impression that the main thing that is different with the GDPR is the threat that it will actually get enforced I think you are dead right. GDPR is an incremental modernisation of the 1995 EU regulation. There have been a number of cases recently that have shown that Facebook, for instance, have been breaking the current EU law, but the national governments (Germany, Belgium recently) have had a hard time enforcing it in any meaningful way. GDPR will allow national governments to enforce their existing laws. If you are a US company who was breaking, for instance, the UK's Data Protection Act 1998 then I have very little sympathy if GDPR now breaks your business model. Breaking the law, but exploiting jurisdiction is not the kind of competitive advantage I will stand up for. BTW you can't opt out of the law in a EULA.
    - avar 9y ago
      How will the GDPR allow EU member states to enforce pre-GDPR law? How was it simultaneously law and unenforceable before?
      - stordoff 9y ago
        As I understand it, the existing Directive has to be implemented by member states in domestic law. This makes it difficult for one member state to enforce action against a company incorporated in another. As a Regulation, the GDPR is directly binding and can be enforced at the EU level, rather than just at the national level. In some ways, it makes it easier to comply, because you just have one set of rules rather than multiple national implementations of the Directive.
- sbuk 9y ago
  > but it still hasn't gone into effect yet Actually, it’s been in effect since April 2016, the information commissioners across the EU will be enforcing the regulations from 25 May of this year.
- kd5bjo 9y ago
  All of the discussion I've seen has been around the right to erasure. The disclosure provisions could have a large effect on employer-employee (or potential employee) relations, or none. I'm not sure what, if any, of interview notes, performance reviews, or discussions about who to let go in a redundancy are "personal data" of the employee. I'm also not convinced anyone else does either.
  - TheCoelacanth 9y ago
    I think it's pretty clear that they are the personal data of employees. What is less clear is to who has a legitimate need to have that data and for how long (and hence who can keep that data without consent).
    - kd5bjo 9y ago
      If they're all the employee's personal data, then the employee has a right to a copy. So companies can't legally keep this kind of thing secret anymore -- you're entitled to know what interviewers said about you to management before you weren't hired for a job, what your coworkers said about you that factored into your performance review, email threads about their side of your salary negotiation, etc?
      - M2Ys4U 9y ago
        That is already the law, under the 1995 Data Protection Directive.
sakuronto 9y ago
Maybe America should wait a bit to see how it goes before jumping on the bandwagon. There isn't much to gain by adopting these (potentially beneficial) standards sooner rather than later.
- DerpyBaby123 9y ago
  There isn't much to gain for who? If regulations will help companies see that hoarding personal data is a liability they will do less of it, and US consumers will have less to lose in each new data breach by companies. That's a lot to gain for consumers!
  - saryant 9y ago
    This assumes that the regulations successfully achieve their goals. Otherwise we've fallen into the old trap "we need to do something, this is something, therefore we must do it". There is ample possibility that the unintended consequences of GDPR play out in ways the regulators do not expect. Assuming otherwise is foolish.
    - tonyedgecombe 9y ago
      Absolutely, the EU is willing to conduct this experiment, you may as well wait and see what the results are. As far as I can see the companies targeted will do their upmost to avoid any impact on their bottom line so its quite likely they will discover plenty of holes in the legislation.
- lowmagnet 9y ago
  If they do business in Europe at all, they're going to need to comply anyway. GDPR compliance is our biggest development push at the company I work for. We face heavy penalties as a provider of our software in the EU as a saas provider.
jimmaswell 9y ago
GDPR seemed unnecessarily overburdensome and limiting last time I looked into it. I don't think we should have anything like it. I don't really buy this concept that you have a reasonable expectation of privacy on other people's websites and the site owners don't own data collected on their services unless the EULA specifically says something to the contrary. As a practical matter, if we make it even harder to target advertisements then we'll end up with even more of these "you've run out of articles" type sites. I don't want to have to pay the ISP and then also pay every individual website. Collect all the data on me you want to make it so.
- bognition 9y ago
  > GDPR seemed unnecessarily overburdensome and limiting last time I looked into it. I don't think we should have anything like it. Can you provide some more color here? Without concrete examples this statements is pointless.
  - dominotw 9y ago
    Staffing and training a department to answer legal queries regarding how a particular algorithm came to a particular conclusion
    - jimnotgym 9y ago
      Serious question, you do have documentation that explains how your algorithms work don't you? I mean somenone in your company knows how they work?
      - dominotw 9y ago
        Serious answer, those people are not in the business of responding to legal enquires from customers. Even if they did it is still an example of "burdensome".
        jimnotgym 9y ago
deleted 9y ago
[deleted]
no1youknowz 9y ago
> The legislation is far from perfect. At nearly 100 articles long, it is too complex and tries to achieve too many things. The compliance costs for smaller firms, in particular, look burdensome. Not here, but I have seen many comments on other sites that imply this will be a burden on small companies implementing this and worrying about whether they are compliant with some rules that can be interpreted in different ways. Also answering requests for information which range from the benign and can be automated to the letter which caused a stir on linkedin [1] and can be viewed as complex and costly for a small business to answer. The reason why I talk about small companies, in a lot of cases another already overworked person will need to wear another hat and may or may not do a good enough job. Verses the larger ones, they can implement a small task force and get this out of the way. I know some commenters on HN would disagree with this and mention that these smaller businesses who don't adopt GDPR should go out of business. But I largely disagree. Businesses which close due to regulations, results in larger market shares to those left standing. Meaning that competition and what largely benefits the consumer dwindles down. Another knock on to this would mean that prices go up, due to those same regulations. However, what I haven't seen talked about which I wonder if it will make the GDPR moot. Is that Trump is currently engaging in a trade war and I wonder if any lobbying attempts are being made for him to exempt US companies from it[2]? [1]: https://www.linkedin.com/pulse/nightmare-letter-subject-access-request-under-gdpr-karbaliotis/ https://www.linkedin.com/pulse/nightmare-letter-subject-acce... [2]: https://martechtoday.com/president-trump-save-us-from-the-gdpr-horror-show-213403 https://martechtoday.com/president-trump-save-us-from-the-gd...
- bkanber 9y ago
  I agree. I don't think GDPR would ever be passed in the US because it is way too heavy a regulation and does absolutely disproportionately impact startups and small businesses. By disproportionately impacting small businesses you stifle innovation and therefore competition. I do think GDPR is a personal privacy win, but I'm also interested to see what happens in terms of tech startups and new products pulling out of the EU.
  - orwin 9y ago
    the cost of GDPR is almost null for new startups. I provide infrastructure (and tech advice) for data analysts and data scientists (mainly, i also have DL and Blockchain projects) and only one project started last year needed more than a day worth of work, mainly because the infrastructure with both Hadoop and Elasticsearch was weird and the dev who put it together was gone.
yalogin 9y ago
Why do they define small companies using the number of employees or money they make? In today’s world laws should me made based on the amount of data a company has. If they have data on upwards of 10 million they need to comply to all data protection and privacy laws. Companies should and will plan their funding and operations accordingly.
- nsp 9y ago
  How do you define 10 million pieces of data?
  - yalogin 9y ago
    Fuck I omitted the word users from my blurb.
  - Sylos 9y ago
    Yeah, that's the hard part about this. If they have the IP addresses of 10 million people, that's probably less critical than if they have medical data on even just 10 000 people. But the IP collection of how-to-live-with-epilepsy.com might be worse, again, since it implicitly carries the information that you do probably have epilepsy.
handsome-mike 9y ago
Could Americans take advantage of EU protections by using European services?
- some_random 9y ago
  It seems to me like Americans might benefit from EU protections in any case, since corporations have to (from my understanding) apply said protections to EU citizens living outside the EU and those using VPNs to connect from outside the EU.
  - icebraining 9y ago
    I don't think the GDPR applies to EU citizens outside the EU; only to people in the EU. Also, the GDPR doesn't necessarily apply to every non-EU site that has EU visitors, only to those who in some way target EU customers (the rules are a bit ambiguous: https://gdpr-info.eu/recitals/no-23/ https://gdpr-info.eu/recitals/no-23/) So if someone outside the EU wants to benefit from the GDPR, the best way is to use services by EU companies, as those are required to apply it to everyone.
- Sylos 9y ago
  Yes. Every company with legal standing in the EU has to comply with the GDPR, regardless of what data they process. Companies outside of the EU only have to comply with it when they are processing data of EU citizens. https://gdpr-info.eu/art-3-gdpr/ https://gdpr-info.eu/art-3-gdpr/
bognition 9y ago
Generally I agree but I think the law should take a different slant. Rather then providing consumers recourse after their data has been collected we need to provide individuals the right to control what data will be collected. All devices should have a label describing what kind of data collection they do. This label should be on the packaging in easy to understand human terms (not buried in the EULA). Additionally devices would be put into classified into one of 4 different classes: Class A - no data collection Class B - anonymized statistics for diagnostics that cannot be used for marketing Class C - anonymized usage statistics that can be used in aggregate Class D - Targeted collection that can be used for targeted marketing Consumers should have the explicit right to opt out of any and all data collection without risk of impairing the primary function of a device. For example there is no reason a TV should need to be anything beyond class A (maybe B). A smart speaker on the other hand needs to be a B maybe C. Nothing should need to be a class D.
- brainwad 9y ago
  Your proposed classes would lead to everyone just collecting class D, because it's the only one that allows for targeted collection, which is needed even for diagnostics and debugging. In order to improve algorithms, you need to be able to figure out what the user wanted, which means being able to view their session specifically, not in aggregate.
  - daveFNbuck 9y ago
    You don't need to view my session to improve my toaster. I currently have a class A television and would love to be able to buy another one in the future. I'm not sure that will be possible, but maybe having a standard label would help.
    - bognition 9y ago
      This exactly. People never believe me whenever I explain that smart refrigerators phone home about use and potentially contents. Then I show then the terms and Eula and almost universally they think it should be illegal.
wpietri 9y ago
For those interested in considering alternatives, I recommend giving the sci-fi book "Queen of Angels" by Greg Bear a read. [1] That novel follows a police detective trying to solve a crime. A major source of tension is that all of the quasi-public data (public cameras, citizen movements, credit card use) is in the hands of a separate institution called Citizen Oversight. If I remember rightly, it was a separate, quasi-governmental (or non-governmental) body, broken down by region and with separately elected commissioners. In the novel, the main focus is the relationship with the police, which was very tense; Citizen Oversight was very stingy with data. But you could easily imagine it having jurisdiction over corporate behavior around individual data. And having an active regulator whose job it is to enforce broad principles would have advantages over detailed rule-making fixed in laws. Especially so if they were part of a legally independent body. It was definitely interesting to think about. And given that it came out in 1990, surprisingly prescient on the topic of data and privacy. [1] https://en.wikipedia.org/wiki/Queen_of_Angels_(novel) https://en.wikipedia.org/wiki/Queen_of_Angels_(novel)
throwaway2016a 9y ago
I think the US implementing something similar is inevitable. If not by the government than by a privacy company (like PCI is for the card industry). Already I've started to see contracts with credit card gateways include PrivacyShield clauses. Personally, all products I build going forward will be GPDR and Privacy Shield compliant even though I am in the US. I recommend other entrepreneurs do the same because it is probably easier to consider it now than it is to do it later. For example (to give context we have PCI requirements to) when someone makes a change to the code we have a impact assessment that needs to be filled out. Among those are the questions: 1. How will this change impact security? 2. How will this change impact customer privacy? We fill it out for every single change request (even if the answer to both is "It doesn't) just to document that we are thinking about it and engrain thinking about it into the company culture.
- r00fus 9y ago
  Whats to prevent the ticket creators / assignees from simply saying "no impact " by habit? The danger for these kinds of controls is that you're trained to say "no impact " many times (because there is none most of the time)
  - throwaway2016a 9y ago
    This is something filled out by the security and devops team not by the ticket creator. Also, best practice would be to have "No impact" require an explanation not just simply a two word brushoff. Edit: Also at some point you have to trust your team, hire the right type of people, and embed it in the company culture that the analysis is something to be taken seriously. If leadership takes it seriously the people filling out the forms aren't going to brush it off.
djsumdog 9y ago
I know the EFF opposes the right to be forgotten. I'm curious if there are any similar concerns with the GDPR. The trouble with the right to be forgotten in censorship. The concept is nice, but in the end, the right to be forgotten can mean corrupt powerful people can censor their misdeeds. I think something similar in the US would be problematic without our freedom of speech. Even if you get a criminal record expunged, anyone who scooped up that data, that was once public, does have the right to hold onto and sell it. Not to say that's a good thing. It does encourage Labeling Theory, preventing people with criminal records from being able to find legit work (a counter example, the sex offenders registry in Australia is confidential. It can only be accesses for very specific things, like employment at a school).
- em3rgent0rdr 9y ago
  GDPR focuses too much on "the right to be forgotten" but is a threat to something more important: "the right to not be deleted".
  - ovao 9y ago
    Can you clarify what you mean?
- tankerslay 9y ago
  Just eliminate the various liability shields that have been enacted for third-party content. In certain areas (e.g. the personals website crackdown) we are moving in this direction already. If you make a search engine vulnerable to a libel lawsuit because, for example, their search results make it look like Joe So-and-So was arrested for DUI (when it was actually Joe So-and-Sew or some such thing), they'll just stop indexing that stuff entirely. Best to avoid creating new laws where old legal concepts will work fine.
  - amarkov 9y ago
    Is that really the world we want, though? If Google is liable for third-party defamation, aren't they likely to deindex any negative news about anyone who threatens to sue them?
em3rgent0rdr 9y ago
I worry about a GPRS-like law preventing innovation, for example because wouldn't it make IPFS-like storage, which relies on duplication and can't remove files, illegal: [1] https://en.wikipedia.org/wiki/InterPlanetary_File_System https://en.wikipedia.org/wiki/InterPlanetary_File_System
- scarlac 9y ago
  You /can/ implement a deletion mechanism, but you just can't "guarantee" it. I think it'd be up to a court to decide if that would be grounds for winning a case against a potential company that used IPFS (I don't know any that do).
spdustin 9y ago
Here’s what I’d like: any advertisement I see on the Internet should have a small pictograph/icon/link I can select that tells me—specifically—why I’m seeing that ad. Precisely what data points were used, was it remarketing, was it an uploaded list of email addresses, etc.
pleasecalllater 9y ago
You can also borrow free universities (so people won't go bankrupt because of the cost of the education), common health care system (so people won't go bankrupt because of the health bills), and no common guns ownership (so you won't later force your kids to wear transparent backpacks - where is the kids' dignity in all that?).
- dang 9y ago
  Please keep generic political talking points off HN.
deleted 9y ago
[deleted]
loudmax 9y ago
Given the expense and difficulties of complying with these rules and enforcing them, we should seriously consider the opposite approach of radical transparency. As the ability to collect and process data becomes cheaper and easier to deploy, it seems to me that trying to preserve an assumption of universal privacy and anonymity trying to swim up a waterfall. Cameras are becoming so cheap they're practically disposable. Facial recognition software and the big data tools to manage all this data are also becoming more widely available. Are we going to legislate against all that? It's one thing to monitor high profile corporations like Google and Facebook, but if surveillance is cheap enough, how do you make sure that no one is amassing reams of private information? The worst case scenario is that while corporations and criminal organizations continue to discretely gather private data, the rich and powerful will be able to afford the cost of privacy but the rest of us won't have a grasp on who knows what about us. The alternative to working against the tools that technology affords us is to work with them. In some cases this means embracing radical transparency. We define a narrow range of places that really are private, and assume that anything that happens outside of those spaces is public. For example, what happens inside of one's bedroom is private, but what happens outside of one's front door is public. This information wouldn't be available only to the powerful or well-connected, it should be available to everyone. In particular, society should keep a close eye on the richest and most powerful people. Not necessarily on their private lives, but certainly on their finances. I'm not arguing that we should give up all privacy. Encryption works and is difficult to defeat, so we should default to encrypting all interpersonal communication. We don't need to give up privacy, but we do need to prioritize what aspects of our lives should remain the most private. I do think that if that we're going to expect twentieth century notions of privacy and anonymity with twenty-first century technology, we're going to have a very hard time of it.
- scrollaway 9y ago
  I think part of what I adore most about GDPR is how it gives me, as a user, control over how corporations are storing my data in their database. I don't necessarily have any expectation of privacy. A lot of it is public data (my email for example). But maybe I just don't want my email to be in a particular database and be used every which way, because I never consented to that particular corporation using my personal data as part of their business strategy. I'm not just talking about "I signed up to Facebook". I'm talking about "I explicitly didn't sign up to facebook, and yet their Like button is tracking me across the web". It's also things like the right to rectify that I appreciate a lot. Less so on startups, who nowadays have a clue how to do simple user profile forms, and more so for, once again, big corporations who have decided that real names never change, even if the CSR who signed you up over the phone completely misspelled it. I don't think GDPR is as much about privacy as it is about control.
bowlofpetunias 9y ago
It's not the law that's the difference here. The clue is under the headline: > The GDPR’s premise, that consumers should be in charge of their own personal data, is the right one That's not just the GDPR's premise, that's the very foundation privacy as a civil right in Europe, and has been for a very long time. The GDPR is just yet another attempt to force companies who have wilfully ignored the rights of millions of Europeans to start complying with laws we already had in place. It's not something new, just an iteration in enforcement. America should make laws that suit America's values and principles, but as it stands, America has no deep concept of privacy. The GDPR is alien to American values. (BTW, that quote is subtly wrong but illustrates the huge gap in perception: it should be "citizens", not "consumers"...)
jrgaston 9y ago
While I agree with the Economist, the idea that the US look outside its borders for advice is laughable. American exceptionalism and all that.
paulie_a 9y ago
America should have data privacy laws too begin with and a way too completely opt out of Equifax etc
zerotolerance 9y ago
As far as I'm concerned the Internet is public infrastructure and you should never expect privacy of your behavior in public places. Besides, "identifying" information should be useless, but it isn't today. What if we stopped using "identifying" information as authenticating information? PII is only useful because the authentications systems we have in place are such sh*t. Changing this is a much more achievable scope, and would actually address the core value of stolen PII.
golemotron 9y ago
In the US is there a possibility of a 1st Amendment challenge? The act of recording information could be seen as speech or publication. If we take computers out of the argument it would look like this: the government telling people that they can not take notes or make records of information that they hear. Case law has found, for instance, that photography in public (which is making records) can not be banned.

281 points by kushti 9y ago

To push back on the premise a little: The intention behind the GDPR is good, but it still hasn't gone into effect yet, and it remains to be seen what the long-term effects of it are. It's really premature to draw any conclusions about its effectiveness, and history provides us with countless examples of far-reaching regulation that either failed to have the desired outcome, or in fact ended up exacerbating the very problems that it aimed to solve. With a law as massive as the GDPR, it's going to take several years to really get a sense of what steady state will look like, and there are all kinds of ways it can backfire. I hope it won't, but there definitely is a strong, unfounded bias in discourse towards assuming that the GDPR will succeed in the goals that have been projected onto it.

p49k 9y ago
While I don’t disagree, I wonder how much harm we should allow our own citizens to endure in terms of the abuse of their data while we wait for someone else’s experiment to conclude.
- briandear 9y ago
  Could you point me to some examples of actual harm that people have endured for abuses of their data? Preferably not just single-instance anecdotes, but actual data on the harm that is occurring? Theoretically “protecting” people is good, but protecting them from what specifically? Health records are already covered by HIPAA, so other than health, what needs more protections? For example, collecting MixPanel or Google Analytics data from a blog — what’s the actual risk of that data? Very interested in real examples and not just hypothetical fears.. What problem is the EU law solving? Have people on Europe been suffering harms until now?
  - jimnotgym 9y ago
    > Google Analytics data from a blog This is not covered by GDPR, it is a fair use and anonymous. HIPAA is not a widespread standard outside of the US People have lost out due to credit card details having been stolen. PCI compliance is a contract between merchant and bank, and not statute law, and therefore we have seen colossal breaches (like Talk Talk ISP) that are hard to punish. The cost of these breaches currently falls on other merchants who have to lose out to fraudulent car use. Next big co that looses thousands of cards, I really hope they get the top fines, as it is other companies that have to pick up the bill for their actions.
- _red 9y ago
  >I wonder how much harm we should allow our own citizens to endure in terms of the abuse Those same citizens that voluntarily agreed to the EULA? Do you also support the 'War On Drugs' on the same premise?
  - icebraining 9y ago
    If the GDPR was a War on Drugs, it would be one in which neither the users or the small time dealers/employees have anything to fear, only the gang leaders/shareholders. I'd support that War on Drugs.
  - jimnotgym 9y ago
    You can't opt out of the law in a EULA (under UK and AFAIK European law) Much of what is in GDPR was already illegal under the 1995 regulation, just hard to enforce on US companies
  - stordoff 9y ago
    Seems like somewhat of a false equivalence to me. People (largely) know the risks of drugs, and are knowingly taking the drugs. Data is often gathered unknowingly, or used for unknown purposes, and people don't know the risks/potential uses of that data. It also doesn't remove the ability to agree to the use of data (it just must be actual consent to the purposes of use), so it's more akin to a War on Drugs that targets the supply of impure substances, but allows the supply where the user knows exactly what they are getting.
phicoh 9y ago
I'm not a lawyer, but it my impression that the main thing that is different with the GDPR is the threat that it will actually get enforced. In discussions about the GDPR I see things that are part of Dutch law for years, in some cases dating back to the 1970s. In practice nobody cared. In extreme cases the data protection authority would say something. But they were mostly understaffed.
- icebraining 9y ago
  I don't know about the Netherlands, but here in Portugal, they're pretty responsive. After someone complained, one of my neighbors got fined for posting PII in the building's lobby.
- jimnotgym 9y ago
  > I'm not a lawyer, but it my impression that the main thing that is different with the GDPR is the threat that it will actually get enforced I think you are dead right. GDPR is an incremental modernisation of the 1995 EU regulation. There have been a number of cases recently that have shown that Facebook, for instance, have been breaking the current EU law, but the national governments (Germany, Belgium recently) have had a hard time enforcing it in any meaningful way. GDPR will allow national governments to enforce their existing laws. If you are a US company who was breaking, for instance, the UK's Data Protection Act 1998 then I have very little sympathy if GDPR now breaks your business model. Breaking the law, but exploiting jurisdiction is not the kind of competitive advantage I will stand up for. BTW you can't opt out of the law in a EULA.
  - avar 9y ago
    How will the GDPR allow EU member states to enforce pre-GDPR law? How was it simultaneously law and unenforceable before?
    - stordoff 9y ago
      As I understand it, the existing Directive has to be implemented by member states in domestic law. This makes it difficult for one member state to enforce action against a company incorporated in another. As a Regulation, the GDPR is directly binding and can be enforced at the EU level, rather than just at the national level. In some ways, it makes it easier to comply, because you just have one set of rules rather than multiple national implementations of the Directive.
sbuk 9y ago
> but it still hasn't gone into effect yet Actually, it’s been in effect since April 2016, the information commissioners across the EU will be enforcing the regulations from 25 May of this year.
kd5bjo 9y ago
All of the discussion I've seen has been around the right to erasure. The disclosure provisions could have a large effect on employer-employee (or potential employee) relations, or none. I'm not sure what, if any, of interview notes, performance reviews, or discussions about who to let go in a redundancy are "personal data" of the employee. I'm also not convinced anyone else does either.
- TheCoelacanth 9y ago
  I think it's pretty clear that they are the personal data of employees. What is less clear is to who has a legitimate need to have that data and for how long (and hence who can keep that data without consent).
  - kd5bjo 9y ago
    If they're all the employee's personal data, then the employee has a right to a copy. So companies can't legally keep this kind of thing secret anymore -- you're entitled to know what interviewers said about you to management before you weren't hired for a job, what your coworkers said about you that factored into your performance review, email threads about their side of your salary negotiation, etc?
    - M2Ys4U 9y ago
      That is already the law, under the 1995 Data Protection Directive.

sakuronto 9y ago

Maybe America should wait a bit to see how it goes before jumping on the bandwagon. There isn't much to gain by adopting these (potentially beneficial) standards sooner rather than later.

DerpyBaby123 9y ago
There isn't much to gain for who? If regulations will help companies see that hoarding personal data is a liability they will do less of it, and US consumers will have less to lose in each new data breach by companies. That's a lot to gain for consumers!
- saryant 9y ago
  This assumes that the regulations successfully achieve their goals. Otherwise we've fallen into the old trap "we need to do something, this is something, therefore we must do it". There is ample possibility that the unintended consequences of GDPR play out in ways the regulators do not expect. Assuming otherwise is foolish.
  - tonyedgecombe 9y ago
    Absolutely, the EU is willing to conduct this experiment, you may as well wait and see what the results are. As far as I can see the companies targeted will do their upmost to avoid any impact on their bottom line so its quite likely they will discover plenty of holes in the legislation.
lowmagnet 9y ago
If they do business in Europe at all, they're going to need to comply anyway. GDPR compliance is our biggest development push at the company I work for. We face heavy penalties as a provider of our software in the EU as a saas provider.

jimmaswell 9y ago

GDPR seemed unnecessarily overburdensome and limiting last time I looked into it. I don't think we should have anything like it. I don't really buy this concept that you have a reasonable expectation of privacy on other people's websites and the site owners don't own data collected on their services unless the EULA specifically says something to the contrary. As a practical matter, if we make it even harder to target advertisements then we'll end up with even more of these "you've run out of articles" type sites. I don't want to have to pay the ISP and then also pay every individual website. Collect all the data on me you want to make it so.

bognition 9y ago
> GDPR seemed unnecessarily overburdensome and limiting last time I looked into it. I don't think we should have anything like it. Can you provide some more color here? Without concrete examples this statements is pointless.
- dominotw 9y ago
  Staffing and training a department to answer legal queries regarding how a particular algorithm came to a particular conclusion
  - jimnotgym 9y ago
    Serious question, you do have documentation that explains how your algorithms work don't you? I mean somenone in your company knows how they work?
    - dominotw 9y ago
      Serious answer, those people are not in the business of responding to legal enquires from customers. Even if they did it is still an example of "burdensome".
      - jimnotgym 9y ago

deleted 9y ago

[deleted]

no1youknowz 9y ago

> The legislation is far from perfect. At nearly 100 articles long, it is too complex and tries to achieve too many things. The compliance costs for smaller firms, in particular, look burdensome. Not here, but I have seen many comments on other sites that imply this will be a burden on small companies implementing this and worrying about whether they are compliant with some rules that can be interpreted in different ways. Also answering requests for information which range from the benign and can be automated to the letter which caused a stir on linkedin [1] and can be viewed as complex and costly for a small business to answer. The reason why I talk about small companies, in a lot of cases another already overworked person will need to wear another hat and may or may not do a good enough job. Verses the larger ones, they can implement a small task force and get this out of the way. I know some commenters on HN would disagree with this and mention that these smaller businesses who don't adopt GDPR should go out of business. But I largely disagree. Businesses which close due to regulations, results in larger market shares to those left standing. Meaning that competition and what largely benefits the consumer dwindles down. Another knock on to this would mean that prices go up, due to those same regulations. However, what I haven't seen talked about which I wonder if it will make the GDPR moot. Is that Trump is currently engaging in a trade war and I wonder if any lobbying attempts are being made for him to exempt US companies from it[2]? [1]: https://www.linkedin.com/pulse/nightmare-letter-subject-access-request-under-gdpr-karbaliotis/ https://www.linkedin.com/pulse/nightmare-letter-subject-acce... [2]: https://martechtoday.com/president-trump-save-us-from-the-gdpr-horror-show-213403 https://martechtoday.com/president-trump-save-us-from-the-gd...

bkanber 9y ago
I agree. I don't think GDPR would ever be passed in the US because it is way too heavy a regulation and does absolutely disproportionately impact startups and small businesses. By disproportionately impacting small businesses you stifle innovation and therefore competition. I do think GDPR is a personal privacy win, but I'm also interested to see what happens in terms of tech startups and new products pulling out of the EU.
- orwin 9y ago
  the cost of GDPR is almost null for new startups. I provide infrastructure (and tech advice) for data analysts and data scientists (mainly, i also have DL and Blockchain projects) and only one project started last year needed more than a day worth of work, mainly because the infrastructure with both Hadoop and Elasticsearch was weird and the dev who put it together was gone.

yalogin 9y ago

Why do they define small companies using the number of employees or money they make? In today’s world laws should me made based on the amount of data a company has. If they have data on upwards of 10 million they need to comply to all data protection and privacy laws. Companies should and will plan their funding and operations accordingly.

nsp 9y ago
How do you define 10 million pieces of data?
- yalogin 9y ago
  Fuck I omitted the word users from my blurb.
- Sylos 9y ago
  Yeah, that's the hard part about this. If they have the IP addresses of 10 million people, that's probably less critical than if they have medical data on even just 10 000 people. But the IP collection of how-to-live-with-epilepsy.com might be worse, again, since it implicitly carries the information that you do probably have epilepsy.

handsome-mike 9y ago

Could Americans take advantage of EU protections by using European services?

some_random 9y ago
It seems to me like Americans might benefit from EU protections in any case, since corporations have to (from my understanding) apply said protections to EU citizens living outside the EU and those using VPNs to connect from outside the EU.
- icebraining 9y ago
  I don't think the GDPR applies to EU citizens outside the EU; only to people in the EU. Also, the GDPR doesn't necessarily apply to every non-EU site that has EU visitors, only to those who in some way target EU customers (the rules are a bit ambiguous: https://gdpr-info.eu/recitals/no-23/ https://gdpr-info.eu/recitals/no-23/) So if someone outside the EU wants to benefit from the GDPR, the best way is to use services by EU companies, as those are required to apply it to everyone.
Sylos 9y ago
Yes. Every company with legal standing in the EU has to comply with the GDPR, regardless of what data they process. Companies outside of the EU only have to comply with it when they are processing data of EU citizens. https://gdpr-info.eu/art-3-gdpr/ https://gdpr-info.eu/art-3-gdpr/

bognition 9y ago

Generally I agree but I think the law should take a different slant. Rather then providing consumers recourse after their data has been collected we need to provide individuals the right to control what data will be collected. All devices should have a label describing what kind of data collection they do. This label should be on the packaging in easy to understand human terms (not buried in the EULA). Additionally devices would be put into classified into one of 4 different classes: Class A - no data collection Class B - anonymized statistics for diagnostics that cannot be used for marketing Class C - anonymized usage statistics that can be used in aggregate Class D - Targeted collection that can be used for targeted marketing Consumers should have the explicit right to opt out of any and all data collection without risk of impairing the primary function of a device. For example there is no reason a TV should need to be anything beyond class A (maybe B). A smart speaker on the other hand needs to be a B maybe C. Nothing should need to be a class D.

brainwad 9y ago
Your proposed classes would lead to everyone just collecting class D, because it's the only one that allows for targeted collection, which is needed even for diagnostics and debugging. In order to improve algorithms, you need to be able to figure out what the user wanted, which means being able to view their session specifically, not in aggregate.
- daveFNbuck 9y ago
  You don't need to view my session to improve my toaster. I currently have a class A television and would love to be able to buy another one in the future. I'm not sure that will be possible, but maybe having a standard label would help.
  - bognition 9y ago
    This exactly. People never believe me whenever I explain that smart refrigerators phone home about use and potentially contents. Then I show then the terms and Eula and almost universally they think it should be illegal.

wpietri 9y ago

For those interested in considering alternatives, I recommend giving the sci-fi book "Queen of Angels" by Greg Bear a read. [1] That novel follows a police detective trying to solve a crime. A major source of tension is that all of the quasi-public data (public cameras, citizen movements, credit card use) is in the hands of a separate institution called Citizen Oversight. If I remember rightly, it was a separate, quasi-governmental (or non-governmental) body, broken down by region and with separately elected commissioners. In the novel, the main focus is the relationship with the police, which was very tense; Citizen Oversight was very stingy with data. But you could easily imagine it having jurisdiction over corporate behavior around individual data. And having an active regulator whose job it is to enforce broad principles would have advantages over detailed rule-making fixed in laws. Especially so if they were part of a legally independent body. It was definitely interesting to think about. And given that it came out in 1990, surprisingly prescient on the topic of data and privacy. [1] https://en.wikipedia.org/wiki/Queen_of_Angels_(novel) https://en.wikipedia.org/wiki/Queen_of_Angels_(novel)

throwaway2016a 9y ago

I think the US implementing something similar is inevitable. If not by the government than by a privacy company (like PCI is for the card industry). Already I've started to see contracts with credit card gateways include PrivacyShield clauses. Personally, all products I build going forward will be GPDR and Privacy Shield compliant even though I am in the US. I recommend other entrepreneurs do the same because it is probably easier to consider it now than it is to do it later. For example (to give context we have PCI requirements to) when someone makes a change to the code we have a impact assessment that needs to be filled out. Among those are the questions: 1. How will this change impact security? 2. How will this change impact customer privacy? We fill it out for every single change request (even if the answer to both is "It doesn't) just to document that we are thinking about it and engrain thinking about it into the company culture.

r00fus 9y ago
Whats to prevent the ticket creators / assignees from simply saying "no impact " by habit? The danger for these kinds of controls is that you're trained to say "no impact " many times (because there is none most of the time)
- throwaway2016a 9y ago
  This is something filled out by the security and devops team not by the ticket creator. Also, best practice would be to have "No impact" require an explanation not just simply a two word brushoff. Edit: Also at some point you have to trust your team, hire the right type of people, and embed it in the company culture that the analysis is something to be taken seriously. If leadership takes it seriously the people filling out the forms aren't going to brush it off.

djsumdog 9y ago

I know the EFF opposes the right to be forgotten. I'm curious if there are any similar concerns with the GDPR. The trouble with the right to be forgotten in censorship. The concept is nice, but in the end, the right to be forgotten can mean corrupt powerful people can censor their misdeeds. I think something similar in the US would be problematic without our freedom of speech. Even if you get a criminal record expunged, anyone who scooped up that data, that was once public, does have the right to hold onto and sell it. Not to say that's a good thing. It does encourage Labeling Theory, preventing people with criminal records from being able to find legit work (a counter example, the sex offenders registry in Australia is confidential. It can only be accesses for very specific things, like employment at a school).

em3rgent0rdr 9y ago
GDPR focuses too much on "the right to be forgotten" but is a threat to something more important: "the right to not be deleted".
- ovao 9y ago
  Can you clarify what you mean?
tankerslay 9y ago
Just eliminate the various liability shields that have been enacted for third-party content. In certain areas (e.g. the personals website crackdown) we are moving in this direction already. If you make a search engine vulnerable to a libel lawsuit because, for example, their search results make it look like Joe So-and-So was arrested for DUI (when it was actually Joe So-and-Sew or some such thing), they'll just stop indexing that stuff entirely. Best to avoid creating new laws where old legal concepts will work fine.
- amarkov 9y ago
  Is that really the world we want, though? If Google is liable for third-party defamation, aren't they likely to deindex any negative news about anyone who threatens to sue them?

em3rgent0rdr 9y ago

I worry about a GPRS-like law preventing innovation, for example because wouldn't it make IPFS-like storage, which relies on duplication and can't remove files, illegal: [1] https://en.wikipedia.org/wiki/InterPlanetary_File_System https://en.wikipedia.org/wiki/InterPlanetary_File_System

scarlac 9y ago
You /can/ implement a deletion mechanism, but you just can't "guarantee" it. I think it'd be up to a court to decide if that would be grounds for winning a case against a potential company that used IPFS (I don't know any that do).

spdustin 9y ago

Here’s what I’d like: any advertisement I see on the Internet should have a small pictograph/icon/link I can select that tells me—specifically—why I’m seeing that ad. Precisely what data points were used, was it remarketing, was it an uploaded list of email addresses, etc.

pleasecalllater 9y ago

You can also borrow free universities (so people won't go bankrupt because of the cost of the education), common health care system (so people won't go bankrupt because of the health bills), and no common guns ownership (so you won't later force your kids to wear transparent backpacks - where is the kids' dignity in all that?).

dang 9y ago
Please keep generic political talking points off HN.

deleted 9y ago

[deleted]

loudmax 9y ago

Given the expense and difficulties of complying with these rules and enforcing them, we should seriously consider the opposite approach of radical transparency. As the ability to collect and process data becomes cheaper and easier to deploy, it seems to me that trying to preserve an assumption of universal privacy and anonymity trying to swim up a waterfall. Cameras are becoming so cheap they're practically disposable. Facial recognition software and the big data tools to manage all this data are also becoming more widely available. Are we going to legislate against all that? It's one thing to monitor high profile corporations like Google and Facebook, but if surveillance is cheap enough, how do you make sure that no one is amassing reams of private information? The worst case scenario is that while corporations and criminal organizations continue to discretely gather private data, the rich and powerful will be able to afford the cost of privacy but the rest of us won't have a grasp on who knows what about us. The alternative to working against the tools that technology affords us is to work with them. In some cases this means embracing radical transparency. We define a narrow range of places that really are private, and assume that anything that happens outside of those spaces is public. For example, what happens inside of one's bedroom is private, but what happens outside of one's front door is public. This information wouldn't be available only to the powerful or well-connected, it should be available to everyone. In particular, society should keep a close eye on the richest and most powerful people. Not necessarily on their private lives, but certainly on their finances. I'm not arguing that we should give up all privacy. Encryption works and is difficult to defeat, so we should default to encrypting all interpersonal communication. We don't need to give up privacy, but we do need to prioritize what aspects of our lives should remain the most private. I do think that if that we're going to expect twentieth century notions of privacy and anonymity with twenty-first century technology, we're going to have a very hard time of it.

scrollaway 9y ago
I think part of what I adore most about GDPR is how it gives me, as a user, control over how corporations are storing my data in their database. I don't necessarily have any expectation of privacy. A lot of it is public data (my email for example). But maybe I just don't want my email to be in a particular database and be used every which way, because I never consented to that particular corporation using my personal data as part of their business strategy. I'm not just talking about "I signed up to Facebook". I'm talking about "I explicitly didn't sign up to facebook, and yet their Like button is tracking me across the web". It's also things like the right to rectify that I appreciate a lot. Less so on startups, who nowadays have a clue how to do simple user profile forms, and more so for, once again, big corporations who have decided that real names never change, even if the CSR who signed you up over the phone completely misspelled it. I don't think GDPR is as much about privacy as it is about control.

bowlofpetunias 9y ago

It's not the law that's the difference here. The clue is under the headline: > The GDPR’s premise, that consumers should be in charge of their own personal data, is the right one That's not just the GDPR's premise, that's the very foundation privacy as a civil right in Europe, and has been for a very long time. The GDPR is just yet another attempt to force companies who have wilfully ignored the rights of millions of Europeans to start complying with laws we already had in place. It's not something new, just an iteration in enforcement. America should make laws that suit America's values and principles, but as it stands, America has no deep concept of privacy. The GDPR is alien to American values. (BTW, that quote is subtly wrong but illustrates the huge gap in perception: it should be "citizens", not "consumers"...)

jrgaston 9y ago

While I agree with the Economist, the idea that the US look outside its borders for advice is laughable. American exceptionalism and all that.

paulie_a 9y ago

America should have data privacy laws too begin with and a way too completely opt out of Equifax etc

zerotolerance 9y ago

As far as I'm concerned the Internet is public infrastructure and you should never expect privacy of your behavior in public places. Besides, "identifying" information should be useless, but it isn't today. What if we stopped using "identifying" information as authenticating information? PII is only useful because the authentications systems we have in place are such sh*t. Changing this is a much more achievable scope, and would actually address the core value of stolen PII.

golemotron 9y ago

In the US is there a possibility of a 1st Amendment challenge? The act of recording information could be seen as speech or publication. If we take computers out of the argument it would look like this: the government telling people that they can not take notes or make records of information that they hear. Case law has found, for instance, that photography in public (which is making records) can not be banned.