8 ms·

GDPR seemed unnecessarily overburdensome and limiting last time I looked into it. I don't think we should have anything like it. I don't really buy this concep

GDPR seemed unnecessarily overburdensome and limiting last time I looked into it. I don't think we should have anything like it. I don't really buy this concept that you have a reasonable expectation of privacy on other people's websites and the site owners don't own data collected on their services unless the EULA specifically says something to the contrary. As a practical matter, if we make it even harder to target advertisements then we'll end up with even more of these "you've run out of articles" type sites. I don't want to have to pay the ISP and then also pay every individual website. Collect all the data on me you want to make it so.

bognition 9y ago
> GDPR seemed unnecessarily overburdensome and limiting last time I looked into it. I don't think we should have anything like it. Can you provide some more color here? Without concrete examples this statements is pointless.
- dominotw 9y ago
  Staffing and training a department to answer legal queries regarding how a particular algorithm came to a particular conclusion
  - jimnotgym 9y ago
    Serious question, you do have documentation that explains how your algorithms work don't you? I mean somenone in your company knows how they work?
    - dominotw 9y ago
      Serious answer, those people are not in the business of responding to legal enquires from customers. Even if they did it is still an example of "burdensome".
      - jimnotgym 9y ago
        1) You write it once and put it in your privacy policy 2) Enquiries would be from people who are a) concerned that the decision you made was unfair and would like it reviewed by a human. b) would like an explanation of the decision. Personally I welcome this. Sitting in a bank and being refused a mortgage because 'computer says no'[0] with no recourse or reason is tough. If you are profiling for marketing reasons I wonder what kind of enquiries you are expecting? [0]:https://www.youtube.com/watch?v=AJQ3TM-p2QI https://www.youtube.com/watch?v=AJQ3TM-p2QI
        dominotw 9y ago
        I am not saying its write or wrong. I agree that it makes sense. I was simply responding to GP asking whats an example of 'burdensome'.
    - tetromino_ 9y ago
      Consider the common situation where the algorithm is a machine learning model. Nobody knows how it works; the best you can hope for is a bit of documentation for how the algorithm came to be created.
      - jimnotgym 9y ago
        I don't think that is quite the answer. I think you would explain that the algorithm considers the past data on x to make decisions based on x. So then if you say 'we consider factors like your name in order to work out ethnicity and then use that to determine your credit risk' you get a big fine. If you say 'we use data about the previous likelyhood of people in your profession and age group having an accident in order to analyze the risk....in order to price your insurance' then you are on safe ground
_red 9y ago
Its a thorny legal issue, and frankly I think there is very little support for GDPR in common-law. If you voluntarily walk into someones private shop, can you demand that the shop owner doesn't catalog that event? Is there an expectation of privacy while walking on the public street? If you voluntarily agree to receive access to a service in exchange for data collection, can that legal contract be invalidated by decree? Don't take this as some sort of support for Facebook, I personally have never bought into the idea of social media. Luckily for me, I was a full adult long before social media appeared, so I was able to rationally see that the mass privacy invasion vs "free stuff" calculation wasn't worth it. Having said that, you can't stop people from voluntarily submitting their data in exchange for services - there is simply no legal theory in support of banning that.
- rowyourboat 9y ago
  > If you voluntarily walk into someones private shop, can you demand that the shop owner doesn't catalog that event? Unless you know the shop owner, you would not be personally identified, and yes, in fact, it would be illegal to use technology that personally identifies you when you walk into a shop. The event that _somebody_ walked into a shop can be recorded. > Is there an expectation of privacy while walking on the public street? Insofar as no records are made of your movement, yes. It is illegal to record somebody else's presence in a public space, although fair use examples exist (in the background of a personal vacation photo, for example). There are zones with video surveillance, but those are generally clearly marked. The general expectation is that nobody who does not happen to be in the same place as you at the same time knows that you have been there. That is, in very broad strokes, the current legal situation in Germany pre-GDPR.
  - brainwad 9y ago
    Doesn't anyone who walks into a shop more than once 'know' the staff? I recognised repeat customers when I worked in retail, even though I didn't know their names, and customised my service to them (e.g "how's the XXX you bought last time?"). That's illegal in Germany?
    - 9y ago
ams6110 9y ago
I agree with you to a point. When I sign up for a Facebook or LinkedIn type of service and give them a bunch of my personal information, I did that voluntarily and I don't think I should really expect a lot of privacy there. Unless there was an explicit promise otherwise. Then you have cases like Equifax, where they have a bunch of data about me that I never gave them and they are doing a poor job protecting it. You could argue that I did consent to it as it was probably buried in the terms of credit cards or other credit documents but it's a reasonable expectation in my view that such data would be protected particularly since it includes critical identifying information such as SSN, account numbers, etc.
- r3bl 9y ago
  When I don't sign up for Facebook or LinkedIn, but they do get my data because some user of theirs has my contact info[0], that's when they become pretty much equal to Equifax from an ethical perspective. [0] LinkedIn with its dark pattern of getting access to people's emails and Facebook with its upload of contact lists on older Android devices.
  - jimmaswell 9y ago
    I don't think the likes of Facebook "ghost profiles" are really a big deal. They do provide some benefit to the users of the services.
    - r3bl 9y ago
      It's data about me being shared with someone I didn't want it to be shared with without my consent. As such, it's a really big deal to me. It's also a really big deal that one can't protect (him|her)self from such data being shared with Facebook. That's why I've compared them with Equifax from a moral standpoint, since the parent comment specifically mentioned Facebook and LinkedIn as an opposition to what Equifax was doing. Whether or not they do provide some benefit to actual Facebook users is completely irrelevant.
GordonS 9y ago
> GDPR seemed unnecessarily overburdensome and limiting last time I looked into it That's what I assumed before I looked into it, but after I did it actually seemed quite reasonable. Can you say what parts you find "overburdensome"?
- jimmaswell 9y ago
  For a few examples, -The "Right to Erasure" for one - any user can force you to delete some of your data at any time. -Being forced to appoint a "Data Protection Officer" can definitely be burdensome to small businesses or startups that are already on the margin. More reasons the US startup scene will probably remain stronger. -Heightened standard for "consent" to use of user data
  - jimnotgym 9y ago
    > Being forced to appoint a "Data Protection Officer" can definitely be burdensome to small businesses or startups that are already on the margin. You don't have to. Someone needs this responsibility but is doesn't have to be a specific person. For us the DPO only exists as a mailing address for a subject access request, the role is shared. > -The "Right to Erasure" for one - any user can force you to delete some of your data at any time. But only for data you have no real use for, or it would be exempt. The flexibility of the wording works both ways.
  - GordonS 9y ago
    > The "Right to Erasure" for one - any user can force you to delete some of your data at any time Sorry, don't see how this is really a burden. Any small business is going to get such requests so rarely that they can be handled manually. In any case, it's also unlikely that implementing a feature to allow users to do this themselves would have any real cost. As a consumer I absolutely want this right. As a business owner, I absolutely want to do right by end users. I just don't see any issue with this.
- gray_-_wolf 9y ago
  Doesn't "right to erasure" make block-chain based business illegal (since you cannot erase from block-chain)?

bognition 9y ago

> GDPR seemed unnecessarily overburdensome and limiting last time I looked into it. I don't think we should have anything like it. Can you provide some more color here? Without concrete examples this statements is pointless.

dominotw 9y ago
Staffing and training a department to answer legal queries regarding how a particular algorithm came to a particular conclusion
- jimnotgym 9y ago
  Serious question, you do have documentation that explains how your algorithms work don't you? I mean somenone in your company knows how they work?
  - dominotw 9y ago
    Serious answer, those people are not in the business of responding to legal enquires from customers. Even if they did it is still an example of "burdensome".
    - jimnotgym 9y ago
      1) You write it once and put it in your privacy policy 2) Enquiries would be from people who are a) concerned that the decision you made was unfair and would like it reviewed by a human. b) would like an explanation of the decision. Personally I welcome this. Sitting in a bank and being refused a mortgage because 'computer says no'[0] with no recourse or reason is tough. If you are profiling for marketing reasons I wonder what kind of enquiries you are expecting? [0]:https://www.youtube.com/watch?v=AJQ3TM-p2QI https://www.youtube.com/watch?v=AJQ3TM-p2QI
      - dominotw 9y ago
        I am not saying its write or wrong. I agree that it makes sense. I was simply responding to GP asking whats an example of 'burdensome'.
  - tetromino_ 9y ago
    Consider the common situation where the algorithm is a machine learning model. Nobody knows how it works; the best you can hope for is a bit of documentation for how the algorithm came to be created.
    - jimnotgym 9y ago
      I don't think that is quite the answer. I think you would explain that the algorithm considers the past data on x to make decisions based on x. So then if you say 'we consider factors like your name in order to work out ethnicity and then use that to determine your credit risk' you get a big fine. If you say 'we use data about the previous likelyhood of people in your profession and age group having an accident in order to analyze the risk....in order to price your insurance' then you are on safe ground

_red 9y ago

Its a thorny legal issue, and frankly I think there is very little support for GDPR in common-law. If you voluntarily walk into someones private shop, can you demand that the shop owner doesn't catalog that event? Is there an expectation of privacy while walking on the public street? If you voluntarily agree to receive access to a service in exchange for data collection, can that legal contract be invalidated by decree? Don't take this as some sort of support for Facebook, I personally have never bought into the idea of social media. Luckily for me, I was a full adult long before social media appeared, so I was able to rationally see that the mass privacy invasion vs "free stuff" calculation wasn't worth it. Having said that, you can't stop people from voluntarily submitting their data in exchange for services - there is simply no legal theory in support of banning that.

rowyourboat 9y ago
> If you voluntarily walk into someones private shop, can you demand that the shop owner doesn't catalog that event? Unless you know the shop owner, you would not be personally identified, and yes, in fact, it would be illegal to use technology that personally identifies you when you walk into a shop. The event that _somebody_ walked into a shop can be recorded. > Is there an expectation of privacy while walking on the public street? Insofar as no records are made of your movement, yes. It is illegal to record somebody else's presence in a public space, although fair use examples exist (in the background of a personal vacation photo, for example). There are zones with video surveillance, but those are generally clearly marked. The general expectation is that nobody who does not happen to be in the same place as you at the same time knows that you have been there. That is, in very broad strokes, the current legal situation in Germany pre-GDPR.
- brainwad 9y ago
  Doesn't anyone who walks into a shop more than once 'know' the staff? I recognised repeat customers when I worked in retail, even though I didn't know their names, and customised my service to them (e.g "how's the XXX you bought last time?"). That's illegal in Germany?
  - 9y ago

ams6110 9y ago

I agree with you to a point. When I sign up for a Facebook or LinkedIn type of service and give them a bunch of my personal information, I did that voluntarily and I don't think I should really expect a lot of privacy there. Unless there was an explicit promise otherwise. Then you have cases like Equifax, where they have a bunch of data about me that I never gave them and they are doing a poor job protecting it. You could argue that I did consent to it as it was probably buried in the terms of credit cards or other credit documents but it's a reasonable expectation in my view that such data would be protected particularly since it includes critical identifying information such as SSN, account numbers, etc.

r3bl 9y ago
When I don't sign up for Facebook or LinkedIn, but they do get my data because some user of theirs has my contact info[0], that's when they become pretty much equal to Equifax from an ethical perspective. [0] LinkedIn with its dark pattern of getting access to people's emails and Facebook with its upload of contact lists on older Android devices.
- jimmaswell 9y ago
  I don't think the likes of Facebook "ghost profiles" are really a big deal. They do provide some benefit to the users of the services.
  - r3bl 9y ago
    It's data about me being shared with someone I didn't want it to be shared with without my consent. As such, it's a really big deal to me. It's also a really big deal that one can't protect (him|her)self from such data being shared with Facebook. That's why I've compared them with Equifax from a moral standpoint, since the parent comment specifically mentioned Facebook and LinkedIn as an opposition to what Equifax was doing. Whether or not they do provide some benefit to actual Facebook users is completely irrelevant.

GordonS 9y ago

> GDPR seemed unnecessarily overburdensome and limiting last time I looked into it That's what I assumed before I looked into it, but after I did it actually seemed quite reasonable. Can you say what parts you find "overburdensome"?

jimmaswell 9y ago
For a few examples, -The "Right to Erasure" for one - any user can force you to delete some of your data at any time. -Being forced to appoint a "Data Protection Officer" can definitely be burdensome to small businesses or startups that are already on the margin. More reasons the US startup scene will probably remain stronger. -Heightened standard for "consent" to use of user data
- jimnotgym 9y ago
  > Being forced to appoint a "Data Protection Officer" can definitely be burdensome to small businesses or startups that are already on the margin. You don't have to. Someone needs this responsibility but is doesn't have to be a specific person. For us the DPO only exists as a mailing address for a subject access request, the role is shared. > -The "Right to Erasure" for one - any user can force you to delete some of your data at any time. But only for data you have no real use for, or it would be exempt. The flexibility of the wording works both ways.
- GordonS 9y ago
  > The "Right to Erasure" for one - any user can force you to delete some of your data at any time Sorry, don't see how this is really a burden. Any small business is going to get such requests so rarely that they can be handled manually. In any case, it's also unlikely that implementing a feature to allow users to do this themselves would have any real cost. As a consumer I absolutely want this right. As a business owner, I absolutely want to do right by end users. I just don't see any issue with this.
gray_-_wolf 9y ago
Doesn't "right to erasure" make block-chain based business illegal (since you cannot erase from block-chain)?