15 ms·

Europe’s New Privacy Rules Favor Google and Facebook

66 points by RestlessMind 9y ago

RestlessMind 9y ago
As suspected, smaller companies seem to be hurting a lot more than the giants. From the article: A digital-advertising firm called AdUX recently closed a service that harvested location data from people’s smartphone apps to show them targeted ads, said CEO Cyril Zimmermann, because his firm had little hope of asking for—much less getting—consent from users. Instead, AdUX will aggregate data from bigger companies. He said the shift has cut into revenue. “For them, it’s easy,” he said. “The problem is, who knows AdUX?”
- flukus 9y ago
  So a spyware producer had to shutdown a spyware based product because of the GDPR? That's working as intended. Hopefully it will bite the giants the same way.
  - RestlessMind 9y ago
    Giants have too much at stake and too many resources at their disposal. Either they will throw tons of resources to fend off the problem or they will take a few bites. As an example, Google's stock was unaffected even after being fined $2.6B last year.
    - Someone 9y ago
      That may be because the market already had accounted for it.
    - ryanlol 9y ago
      >As an example, Google's stock was unaffected even after being fined $2.6B last year. What is this supposed to be an example of?
      - RestlessMind 9y ago
        How government regulations and penalties won't really bite the giants. (to address GP's point)
        ryanlol 9y ago
        The fine didn't really come as a surprise, I'm not sure why you'd expect it to have a visible effect on the stock price?
- dvfjsdhgfv 9y ago
  Do you really feel sorry for them? I don't.
- jon_richards 9y ago
  How does GDPR affect selling personal data? Once I've given permission for a company to collect my data, can they just sell it to whoever they want? Is there any way to get rid of that data once it's been sold? Is there any way to find out who's bought it?
  - michaelbuckbee 9y ago
    That's a lot of questions. To sum up, the GDPR is forcing: - granular consent (like you might opt into a newsletter, but not retargeting ads) - right to request what a company knows about you - right to get that data in digital format (json, xml) - right to know when your data is exposed in a data breach - right to request that your data be deleted - right to request that an organization stop processing data about you fwiw - I wrote a bunch more about it (link) and am happy to answer questions. https://blog.varonis.com/gdpr-requirements-list-in-plain-english/ https://blog.varonis.com/gdpr-requirements-list-in-plain-eng...
    - jon_richards 9y ago
      So as long as there are 1000s of companies like AdUX that purchase my data without telling me or acquiring my consent, I don't really have any hope of actually having my information deleted. I suppose someone could make a service that lets you request every known company delete your info.
      - PeterStuer 9y ago
        If they want to comply all those 1000's of companies will have to get you to reaffirm your consent under the new GDPR rules. Didn't you notice already a lot of the services/sits you use asking you to re-agree ('We've updated our privacy policy etc.')
        jon_richards 9y ago
        Are you sure that all applies to companies that purchase personal information and not just companies that collect it?
- tjoff 9y ago
  That is exactly the kind of cancer that GDPR is intended to remove. As they explicitly said, there is no way anyone would volunteer this yet somehow they think it is ok to abuse it just because they could. This truly is wonderful.
montrose 9y ago
“It is paradoxical,” said Bill Simmons, co-founder and chief technology officer of Dataxu , Boston-based company that helps buy targeted ads. “The GDPR is actually consolidating the control of consumer data onto these tech giants.”
- rnnr 9y ago
  he probably haven't heard the term "Revolving door". Simple study of antitrust policies would reveal him that this is the case. https://en.wikipedia.org/wiki/Revolving_door_(politics) https://en.wikipedia.org/wiki/Revolving_door_(politics)
  - AstralStorm 9y ago
    I'm pretty sure previous privacy laws did little to EU businesses. (Some local more restrictive ones like German neither.) LThis one will not do anything much like you said either. There ate much mote critical laws that are being tampered with such as tax code and employment laws.
IBM 9y ago
I've posted this before: GDPR is good independent of any effects it has on competition. Governments already have the tools to deal with market dominance: antitrust enforcement. The EC has three antitrust cases against Google. One decision has already been given, and the Android decision will be made sometime within the next few months. The Federal Cartel Office in Germany has opened a probe into Facebook [1][2]. [1] https://www.politico.eu/article/facebook-data-collection-could-be-an-antitrust-abuse-in-germany/ https://www.politico.eu/article/facebook-data-collection-cou... [2] https://www.reuters.com/article/us-facebook-privacy-germany/facebooks-hidden-data-haul-troubles-german-cartel-regulator-idUSKBN1HU108 https://www.reuters.com/article/us-facebook-privacy-germany/...
- montrose 9y ago
  Antitrust enforcement is not sufficient to protect against market consolidation caused by burdensome regulations. A company that can afford to comply with the regulations can squash competitors who can't without being a monopoly. And even companies that are declared monopolies benefit from burdensome regulations in the sense that people thinking of starting startups that might compete with them decide not to.
- jakeogh 9y ago
  Are there other instances where I can demand people's time without compensation? Where I can demand they forget something all the way down to the fact someone visited their location? I see this is as a move in the WOGPC.
  - ballenf 9y ago
    Pressing the crosswalk button as a pedestrian and making traffic stop? In fact the law requires us to do many things for other people without compensation. Part of the give and take of living in society.
    - jakeogh 9y ago
      Interesting counterexample, if you have more I would love to hear them. Where I live, I am required to render help if someone needs water etc. I like that law very much. Back to your example: In one case, I can press the button and then cross or not (I could stand there all day pressing the button). Without getting into local law, I bet that attack is illegal in most places, I suspect it is where I live. In the GDPR case, I can press every button in an entire union, apparently every 40 days. EDIT: regarding response times, I found a breakdown: https://www.burges-salmon.com/news-and-insight/legal-updates/gdpr-subject-access-requests/ https://www.burges-salmon.com/news-and-insight/legal-updates... Obviously this kinda-example ignores the point about forced forgetting which will be interesting in many ways; the astroturf market for example.
bencollier49 9y ago
This strikes me as a fluff PR piece to try to head off similar legislation in the US.
msravi 9y ago
I still don't understand how this is going to be enforced. If I'm a website or app provider in China or Philippines or Russia or India, and I collect information on EU residents who visit/use my website/service, how is GDPR going to be enforced? How are they going to fine me 4% of my revenue?
- woolvalley 9y ago
  You arrest company officers flying into the EU (even for a layover, even for emergency landings) for default judgements. You block their companies from doing business in the EU. You confiscate bank accounts set in the EU, you confiscate shipments to/from the EU.
  - riffraff 9y ago
    And obviously, you block the service in the EU. Most users are not technically proficient, and a simple DNS block is enough.
    - astkaasa 9y ago
      Then Chinese people can teach them how to cross the 'WALL'.
      - riffraff 9y ago
        you don't need the chinese, DNS blocking is used in many european countries even today, to block torrent or streaming sites.
      - AstralStorm 9y ago
        As is the case with the Chinese firewall, most people will not bother. They will instead use alternate sane businesses offering similar services.
  - msravi 9y ago
    Hmm.. might work if it's not a one-person shop with no company name, etc.
IloveHN84 9y ago
Why do people keep posting WSJ paywalled content here?
- montrose 9y ago
  You can read it via archive.is.
- nemothekid 9y ago
  They often have quality content.
  - tjoff 9y ago
    This sure doesn't seem like it.
M_Bakhtiari 9y ago
Fine by me. Do we really need more “small ad firms”?
shiado 9y ago
How will GDPR interact with the goals of intelligence agencies and their contractors? Is there going to be a wave of problems for intelligence contractors and their possession of data or are European countries going to let it slide?
- woolvalley 9y ago
  Isn't what most intelligence agencies do illegal in other countries already?
  - shiado 9y ago
    Probably. Although there is the Five Eyes style arrangement where you don't spy on your own citizens and instead spy on citizens of other countries and then share the data between each other so it all becomes legit. This is described here: https://en.wikipedia.org/wiki/Five_Eyes#Domestic_espionage_sharing_controversy https://en.wikipedia.org/wiki/Five_Eyes#Domestic_espionage_s...
    - woolvalley 9y ago
      I think those agreements come from the fact that the agencies cannot 'spy' inside their home country, but can get information from other agencies that happen to have info about their country. I still think it is illegal for those other agencies to spy within the home country. Not to mention countries they don't have agreements with. The home agency does not do anything illegal itself, but the other agency does illegal stuff for them.
- PeterStuer 9y ago
  The GDPR has special exemptions for legal compliance such as data retention and lawful intercept.
- techacolyte42 9y ago
  Follow up question if anyone feels like speculating, can GDPR compliance be used as a stick when intelligence agencies and law enforcement are looking to collect information on individuals? "Now that all your user information is definitely queryable give us everything you have"? I generally feel positive about the law but I'm curious how this feels from a position of paranoia. (Very tangential followup this is just the first time I've seen intelligence agencies and GDPR mentioned at the same time).
paulgerhardt 9y ago
Currently going through GDPR certification/signoff as a primarily US based company. As a hacker, I enjoy the spirit of the thing. It’s nowhere near as dumb as the cookie pop-up law. Categorically I would prefer default third party services to flush logs rather than retain. As a founder, the cruel business logic very much favors removing support/refusing to onboard European users. Your exposure is in a fine for 4% of global revenue or 20 million euros. Whichever is greater. No big deal. Europe may make up 10% of your revenue. The effort is going to decrease resources by 20%+ in the short term, add unknown long term complexity and overhead, and longer term employing a compliance officer. Also can we go back to the 20 million Euro fine thing for a second? Any potential acquirer is going to want to double down on diligence before assuming risk like that. The requirements initially seem innocent enough - ability to hard delete/export user history. Easy right. Some notes from my meeting with legal: Well what about backups? Do you retroactively go through your backups and remove R2BF users? Do you only keep backups for 6 days? What happens if you delete the user and restore from a 5 day old backup? Do you keep a second list of users who requested you delete their data - and if so how do you store that? How do you now represent activity that materially effected other users still on the platform? Is this subbed out with a “blank shadow” user? The legislation very much does not solve for the recursive logic of “how do you track users who’ve requested deletion”. Counter-intuitively we would now have to log more user activity so we can gracefully handle rendering deleted data. Why do we have to file with a third party that we’ve deleted info on a user that requested we remove all trace of them?? What if a user enter’s PII in table entries owned by other users through that other users account? What if they do it through a third party API? Speaking of, how do you ensure your third party API partners are in compliance? What if a user enters in PII in a field that you thought should have no PII in it? How do you treat EU citizens using your service outside the EU vs inside it? What if they use it in both places? What if you have an American user who happens to be located... Sure most of these are solvable along with the another hundred edge cases not illustrated, but for bigger apps at 50+ person companies almost every one of those points is a bullet point in a meeting that requires nuanced development from multiple stakeholders. Don’t think it’s hard? Try roll into a meeting a Twitter and explain to them how easy it would be to add a button that lets you edit tweets. Some requirements are a BFD - you can imagine how things went over in a meeting where we half-jokingly suggested we no longer make backups rather than take on the burden of implementing a backup policy that may or may not be compliant with a new law that has no precedents in court to guide drafting a spec. The net result is implementing it with the least effort and suddenly it’s just this dogpile of cludgey UI popover screens that people click through without reading and TOS updates and mandatory log outs and a lot of other things besides that add overhead to make it “non-trivial.” It’s a big deal because pre-series A startups will choose to avoid these waters rather than navigate them.
car_invasion 9y ago
I believe GDPR is like a pre-annoucement of GFoC but for Europeans.
Buge 9y ago
>Unlike the giants, the ad tech firms have no direct relationship with consumers. They say Google’s and Facebook’s response pressures publishers to seek consent on behalf of dozens of ad tech firms that people have never heard of. This is exactly what I said back in November. https://news.ycombinator.com/item?id=15769544 https://news.ycombinator.com/item?id=15769544
- tjoff 9y ago
  Target the site, not the users. Simple as that, arguably you'd have much better accuracy targeting an interest rather than trying to profile each IP anyway.
ThatHNGuy 9y ago
why do you keep posting paywalled content?
nickpp 9y ago
The true cost of GDPR doesn't come from compliance itself. It comes from trying to protect oneselef from the legal vulnerability it creates for businesses. Like any regulation, once enacted, it creates yet another reason to harass, burden and encumber businesses - no matter what business model they have or if they are shady or not. Large companies truly love this. Their already considerable legal departments chew any new regulation the moment it appears while the newly erected walls keep those pesky startups away. Small business do not even pay the price - they simply cease to exist, to be founded. It's a chilling effect. The prospective founder says "why bother with this shit when I can simply get a job"? The visible end result: an Europe more and more hostile to startups staying on the sidelines while the US wins the innovation race for the future. Fewer startups means also fewer large business (just look at the most valuable companies in the world, how many of those are European?) and thus fewer well paid jobs in the future (just check out the difference between an IT salary in USA vs Europe).
- AstralStorm 9y ago
  Yes, let's allow companies process personal data indiscriminately because it will help small businesses. /s Please provide actual evidence that it will do so and that small data processing businesses actually had to endure big legal fees due to privacy protections. The lack of start-up scene in most of Europe is caused by very different factors, mostly more conservative and less wealthy investors.
havkom 9y ago
Not related to the ads industry but GDPR compliance in general for smaller companies (which is discussed in various other comments to this article), I would like to add these remarks: I think ”GDPR compliance” is not a binary thing - there are levels of compliance. No smaller normal company or Google or Facebook will be able to “fully comply” at any point in time. There will always have to be incremental improvements over time, hopefully in the right direction. Also recognize that the obligations in GDPR “scales” with the size of operation/amount of data that is processed. For example smaller companies: - are exempted from some of the record keeping obligations, - may not have to appoint a data protection officer, - may often not have to do data protection impact assessments, - may not have to set up and implement some policies relating to data protection - may also have less obligations when it comes to Privacy by Design (since reasonable costs are a recognized factor) - may generally have fewer data processing activities that requires consent (most normal personal data processing does not) I would also forget about scares of 4% fines unless you are doing something really bad or do not care at all even after a fine, repremand or warning from a Data Protection Authority. My guess is that the “normal level of fine amount” will not change with GDPR for data protection violations in the EU (compared to current UK levels). This seems to be what the UK:s Data Protection Authroity (ICO) is going around and telling everyone as well (if I have not misunderstood).
- downandout 9y ago
  No smaller normal company or Google or Facebook will be able to “fully comply” at any point in time. Which makes it ripe for abuse. By making a regulation that is impossible to fully comply with, they have created a situation where any (or all) of the 28 countries in the EU can fine any company at will, because they're never fully in compliance. Further, individual users can seek compensation under GDPR - companies will be deluged with such claims. Just having to depend on the goodwill of regulators who you think will just be attempting to enforce the spirit of the law is a terrible position to put companies in. When these countries and individual citizens are starved for cash, all of a sudden the letter of the law will be the only thing that matters, as is always the case with regulations that put all market participants in violation by default.
  - 9y ago
bkor 9y ago
Due to the GDPR Facebook added all kinds of new controls. I looked through them today. Stuff Facebook has tracked, despite not using their app on my phone (preloaded but completely disabled) and using their website only with uBlock Origin): a) everywhere you ever used Facebook to login to a website. I thought I never did this but apparently I still had 5+ websites linked to this. They seem to use this to profile you. Facebook mentions about this _"These are active apps and websites. This means that you recently logged in to them using Facebook, and they can request information you've chosen to share with them."_ I never wanted to share anything, but Facebook often changes settings or pretends I did b) every time you connected an app to your Facebook account. Apparently I again did at a few times (to easily upload some photos). I also saw old phones in here, Runkeeper (don't recall using that), Tinder (haven't used in years). All of those seem to forever be able to get information from you. c) topics (yet another new name). Not sure how they figured things like that out. Fortunately you can completely disable the personal tracking, though you need to do that in various different places. d) advertisers whom added their contact list to Facebook. Really!! So some other company shared my details with Facebook. Which means they've also shared details of people not using Facebook with Facebook. e) used websites and apps. This is surprisingly accurate and complete (hundreds of sites+apps!), despite having the Fb app disabled plus always using uBlock Origin. I really wonder if they somehow are able to retrieve the browser history. It seems Facebook also tracks you using "apps using Facebook technology", which I guess is a library to show ads or something which uses the app permissions to further track the user. f) it uses your profile (relationship status, employer, job title, education) to targets ads g) somehow puts you into categories. E.g. "uses a mobile device (xx to xx months)". I disabled this crap yesterday, it updated it today with more information. I assume through Whatsapp/Instagram or maybe some kind of Facebook ad library? Again, I don't want it to track me, yet they seem to be easily able to do this. I turned off all the settings but apparently still missed a few. i) ads topics. Not sure how topics differs from the 3 other ways they call this. j) your location. It doesn't show what it does with this. You cannot disable the location tracking; it suggests to turn it off in the phone settings (which is a cop-out). I'll need to download my data to further determine this. I'm pretty sure Facebook is big enough to figure out additional ways of location tracking than just what Android/iPhone allows. k) websites visited. I assume any link clicked. This is somehow different than all the other ways it already showed websites. l) the existing "Who can contact you using email address / phone number". It says "Who", but it is used for the API as well, that's not a user so I find the usage of "Who" misleading. Despite doing all of this, still not sure how to prevent something like Cambridge Analytica from downloading my data through others ("friend"). Further as I already mentioned it seems to continue tracking me despite turning everything off. Not cool.
zmyrgel 9y ago
By looking through the comments it seems many seem to think that smallest GDPR violation will immidiately see 20M fine. Isn't it the last method if previous methods are ignored like giving a warning, smaller fines etc. So you don't have to do every single perfectly, just that you the basics done properly and your filling to fix things as they are shown to be broken. Well, unless your broken system leaks millions of users data into the wild I'd guess you're pretty safe.

66 points by RestlessMind 9y ago

As suspected, smaller companies seem to be hurting a lot more than the giants. From the article: A digital-advertising firm called AdUX recently closed a service that harvested location data from people’s smartphone apps to show them targeted ads, said CEO Cyril Zimmermann, because his firm had little hope of asking for—much less getting—consent from users. Instead, AdUX will aggregate data from bigger companies. He said the shift has cut into revenue. “For them, it’s easy,” he said. “The problem is, who knows AdUX?”

flukus 9y ago
So a spyware producer had to shutdown a spyware based product because of the GDPR? That's working as intended. Hopefully it will bite the giants the same way.
- RestlessMind 9y ago
  Giants have too much at stake and too many resources at their disposal. Either they will throw tons of resources to fend off the problem or they will take a few bites. As an example, Google's stock was unaffected even after being fined $2.6B last year.
  - Someone 9y ago
    That may be because the market already had accounted for it.
  - ryanlol 9y ago
    >As an example, Google's stock was unaffected even after being fined $2.6B last year. What is this supposed to be an example of?
    - RestlessMind 9y ago
      How government regulations and penalties won't really bite the giants. (to address GP's point)
      - ryanlol 9y ago
        The fine didn't really come as a surprise, I'm not sure why you'd expect it to have a visible effect on the stock price?
dvfjsdhgfv 9y ago
Do you really feel sorry for them? I don't.
jon_richards 9y ago
How does GDPR affect selling personal data? Once I've given permission for a company to collect my data, can they just sell it to whoever they want? Is there any way to get rid of that data once it's been sold? Is there any way to find out who's bought it?
- michaelbuckbee 9y ago
  That's a lot of questions. To sum up, the GDPR is forcing: - granular consent (like you might opt into a newsletter, but not retargeting ads) - right to request what a company knows about you - right to get that data in digital format (json, xml) - right to know when your data is exposed in a data breach - right to request that your data be deleted - right to request that an organization stop processing data about you fwiw - I wrote a bunch more about it (link) and am happy to answer questions. https://blog.varonis.com/gdpr-requirements-list-in-plain-english/ https://blog.varonis.com/gdpr-requirements-list-in-plain-eng...
  - jon_richards 9y ago
    So as long as there are 1000s of companies like AdUX that purchase my data without telling me or acquiring my consent, I don't really have any hope of actually having my information deleted. I suppose someone could make a service that lets you request every known company delete your info.
    - PeterStuer 9y ago
      If they want to comply all those 1000's of companies will have to get you to reaffirm your consent under the new GDPR rules. Didn't you notice already a lot of the services/sits you use asking you to re-agree ('We've updated our privacy policy etc.')
      - jon_richards 9y ago
        Are you sure that all applies to companies that purchase personal information and not just companies that collect it?
tjoff 9y ago
That is exactly the kind of cancer that GDPR is intended to remove. As they explicitly said, there is no way anyone would volunteer this yet somehow they think it is ok to abuse it just because they could. This truly is wonderful.

montrose 9y ago

“It is paradoxical,” said Bill Simmons, co-founder and chief technology officer of Dataxu , Boston-based company that helps buy targeted ads. “The GDPR is actually consolidating the control of consumer data onto these tech giants.”

rnnr 9y ago
he probably haven't heard the term "Revolving door". Simple study of antitrust policies would reveal him that this is the case. https://en.wikipedia.org/wiki/Revolving_door_(politics) https://en.wikipedia.org/wiki/Revolving_door_(politics)
- AstralStorm 9y ago
  I'm pretty sure previous privacy laws did little to EU businesses. (Some local more restrictive ones like German neither.) LThis one will not do anything much like you said either. There ate much mote critical laws that are being tampered with such as tax code and employment laws.

IBM 9y ago

I've posted this before: GDPR is good independent of any effects it has on competition. Governments already have the tools to deal with market dominance: antitrust enforcement. The EC has three antitrust cases against Google. One decision has already been given, and the Android decision will be made sometime within the next few months. The Federal Cartel Office in Germany has opened a probe into Facebook [1][2]. [1] https://www.politico.eu/article/facebook-data-collection-could-be-an-antitrust-abuse-in-germany/ https://www.politico.eu/article/facebook-data-collection-cou... [2] https://www.reuters.com/article/us-facebook-privacy-germany/facebooks-hidden-data-haul-troubles-german-cartel-regulator-idUSKBN1HU108 https://www.reuters.com/article/us-facebook-privacy-germany/...

montrose 9y ago
Antitrust enforcement is not sufficient to protect against market consolidation caused by burdensome regulations. A company that can afford to comply with the regulations can squash competitors who can't without being a monopoly. And even companies that are declared monopolies benefit from burdensome regulations in the sense that people thinking of starting startups that might compete with them decide not to.
jakeogh 9y ago
Are there other instances where I can demand people's time without compensation? Where I can demand they forget something all the way down to the fact someone visited their location? I see this is as a move in the WOGPC.
- ballenf 9y ago
  Pressing the crosswalk button as a pedestrian and making traffic stop? In fact the law requires us to do many things for other people without compensation. Part of the give and take of living in society.
  - jakeogh 9y ago
    Interesting counterexample, if you have more I would love to hear them. Where I live, I am required to render help if someone needs water etc. I like that law very much. Back to your example: In one case, I can press the button and then cross or not (I could stand there all day pressing the button). Without getting into local law, I bet that attack is illegal in most places, I suspect it is where I live. In the GDPR case, I can press every button in an entire union, apparently every 40 days. EDIT: regarding response times, I found a breakdown: https://www.burges-salmon.com/news-and-insight/legal-updates/gdpr-subject-access-requests/ https://www.burges-salmon.com/news-and-insight/legal-updates... Obviously this kinda-example ignores the point about forced forgetting which will be interesting in many ways; the astroturf market for example.

bencollier49 9y ago

This strikes me as a fluff PR piece to try to head off similar legislation in the US.

msravi 9y ago

I still don't understand how this is going to be enforced. If I'm a website or app provider in China or Philippines or Russia or India, and I collect information on EU residents who visit/use my website/service, how is GDPR going to be enforced? How are they going to fine me 4% of my revenue?

woolvalley 9y ago
You arrest company officers flying into the EU (even for a layover, even for emergency landings) for default judgements. You block their companies from doing business in the EU. You confiscate bank accounts set in the EU, you confiscate shipments to/from the EU.
- riffraff 9y ago
  And obviously, you block the service in the EU. Most users are not technically proficient, and a simple DNS block is enough.
  - astkaasa 9y ago
    Then Chinese people can teach them how to cross the 'WALL'.
    - riffraff 9y ago
      you don't need the chinese, DNS blocking is used in many european countries even today, to block torrent or streaming sites.
    - AstralStorm 9y ago
      As is the case with the Chinese firewall, most people will not bother. They will instead use alternate sane businesses offering similar services.
- msravi 9y ago
  Hmm.. might work if it's not a one-person shop with no company name, etc.

IloveHN84 9y ago

Why do people keep posting WSJ paywalled content here?

montrose 9y ago
You can read it via archive.is.
nemothekid 9y ago
They often have quality content.
- tjoff 9y ago
  This sure doesn't seem like it.

M_Bakhtiari 9y ago

Fine by me. Do we really need more “small ad firms”?

shiado 9y ago

How will GDPR interact with the goals of intelligence agencies and their contractors? Is there going to be a wave of problems for intelligence contractors and their possession of data or are European countries going to let it slide?

woolvalley 9y ago
Isn't what most intelligence agencies do illegal in other countries already?
- shiado 9y ago
  Probably. Although there is the Five Eyes style arrangement where you don't spy on your own citizens and instead spy on citizens of other countries and then share the data between each other so it all becomes legit. This is described here: https://en.wikipedia.org/wiki/Five_Eyes#Domestic_espionage_sharing_controversy https://en.wikipedia.org/wiki/Five_Eyes#Domestic_espionage_s...
  - woolvalley 9y ago
    I think those agreements come from the fact that the agencies cannot 'spy' inside their home country, but can get information from other agencies that happen to have info about their country. I still think it is illegal for those other agencies to spy within the home country. Not to mention countries they don't have agreements with. The home agency does not do anything illegal itself, but the other agency does illegal stuff for them.
PeterStuer 9y ago
The GDPR has special exemptions for legal compliance such as data retention and lawful intercept.
techacolyte42 9y ago
Follow up question if anyone feels like speculating, can GDPR compliance be used as a stick when intelligence agencies and law enforcement are looking to collect information on individuals? "Now that all your user information is definitely queryable give us everything you have"? I generally feel positive about the law but I'm curious how this feels from a position of paranoia. (Very tangential followup this is just the first time I've seen intelligence agencies and GDPR mentioned at the same time).

paulgerhardt 9y ago

Currently going through GDPR certification/signoff as a primarily US based company. As a hacker, I enjoy the spirit of the thing. It’s nowhere near as dumb as the cookie pop-up law. Categorically I would prefer default third party services to flush logs rather than retain. As a founder, the cruel business logic very much favors removing support/refusing to onboard European users. Your exposure is in a fine for 4% of global revenue or 20 million euros. Whichever is greater. No big deal. Europe may make up 10% of your revenue. The effort is going to decrease resources by 20%+ in the short term, add unknown long term complexity and overhead, and longer term employing a compliance officer. Also can we go back to the 20 million Euro fine thing for a second? Any potential acquirer is going to want to double down on diligence before assuming risk like that. The requirements initially seem innocent enough - ability to hard delete/export user history. Easy right. Some notes from my meeting with legal: Well what about backups? Do you retroactively go through your backups and remove R2BF users? Do you only keep backups for 6 days? What happens if you delete the user and restore from a 5 day old backup? Do you keep a second list of users who requested you delete their data - and if so how do you store that? How do you now represent activity that materially effected other users still on the platform? Is this subbed out with a “blank shadow” user? The legislation very much does not solve for the recursive logic of “how do you track users who’ve requested deletion”. Counter-intuitively we would now have to log more user activity so we can gracefully handle rendering deleted data. Why do we have to file with a third party that we’ve deleted info on a user that requested we remove all trace of them?? What if a user enter’s PII in table entries owned by other users through that other users account? What if they do it through a third party API? Speaking of, how do you ensure your third party API partners are in compliance? What if a user enters in PII in a field that you thought should have no PII in it? How do you treat EU citizens using your service outside the EU vs inside it? What if they use it in both places? What if you have an American user who happens to be located... Sure most of these are solvable along with the another hundred edge cases not illustrated, but for bigger apps at 50+ person companies almost every one of those points is a bullet point in a meeting that requires nuanced development from multiple stakeholders. Don’t think it’s hard? Try roll into a meeting a Twitter and explain to them how easy it would be to add a button that lets you edit tweets. Some requirements are a BFD - you can imagine how things went over in a meeting where we half-jokingly suggested we no longer make backups rather than take on the burden of implementing a backup policy that may or may not be compliant with a new law that has no precedents in court to guide drafting a spec. The net result is implementing it with the least effort and suddenly it’s just this dogpile of cludgey UI popover screens that people click through without reading and TOS updates and mandatory log outs and a lot of other things besides that add overhead to make it “non-trivial.” It’s a big deal because pre-series A startups will choose to avoid these waters rather than navigate them.

car_invasion 9y ago

I believe GDPR is like a pre-annoucement of GFoC but for Europeans.

Buge 9y ago

>Unlike the giants, the ad tech firms have no direct relationship with consumers. They say Google’s and Facebook’s response pressures publishers to seek consent on behalf of dozens of ad tech firms that people have never heard of. This is exactly what I said back in November. https://news.ycombinator.com/item?id=15769544 https://news.ycombinator.com/item?id=15769544

tjoff 9y ago
Target the site, not the users. Simple as that, arguably you'd have much better accuracy targeting an interest rather than trying to profile each IP anyway.

ThatHNGuy 9y ago

why do you keep posting paywalled content?

nickpp 9y ago

The true cost of GDPR doesn't come from compliance itself. It comes from trying to protect oneselef from the legal vulnerability it creates for businesses. Like any regulation, once enacted, it creates yet another reason to harass, burden and encumber businesses - no matter what business model they have or if they are shady or not. Large companies truly love this. Their already considerable legal departments chew any new regulation the moment it appears while the newly erected walls keep those pesky startups away. Small business do not even pay the price - they simply cease to exist, to be founded. It's a chilling effect. The prospective founder says "why bother with this shit when I can simply get a job"? The visible end result: an Europe more and more hostile to startups staying on the sidelines while the US wins the innovation race for the future. Fewer startups means also fewer large business (just look at the most valuable companies in the world, how many of those are European?) and thus fewer well paid jobs in the future (just check out the difference between an IT salary in USA vs Europe).

AstralStorm 9y ago
Yes, let's allow companies process personal data indiscriminately because it will help small businesses. /s Please provide actual evidence that it will do so and that small data processing businesses actually had to endure big legal fees due to privacy protections. The lack of start-up scene in most of Europe is caused by very different factors, mostly more conservative and less wealthy investors.

havkom 9y ago

Not related to the ads industry but GDPR compliance in general for smaller companies (which is discussed in various other comments to this article), I would like to add these remarks: I think ”GDPR compliance” is not a binary thing - there are levels of compliance. No smaller normal company or Google or Facebook will be able to “fully comply” at any point in time. There will always have to be incremental improvements over time, hopefully in the right direction. Also recognize that the obligations in GDPR “scales” with the size of operation/amount of data that is processed. For example smaller companies: - are exempted from some of the record keeping obligations, - may not have to appoint a data protection officer, - may often not have to do data protection impact assessments, - may not have to set up and implement some policies relating to data protection - may also have less obligations when it comes to Privacy by Design (since reasonable costs are a recognized factor) - may generally have fewer data processing activities that requires consent (most normal personal data processing does not) I would also forget about scares of 4% fines unless you are doing something really bad or do not care at all even after a fine, repremand or warning from a Data Protection Authority. My guess is that the “normal level of fine amount” will not change with GDPR for data protection violations in the EU (compared to current UK levels). This seems to be what the UK:s Data Protection Authroity (ICO) is going around and telling everyone as well (if I have not misunderstood).

downandout 9y ago
No smaller normal company or Google or Facebook will be able to “fully comply” at any point in time. Which makes it ripe for abuse. By making a regulation that is impossible to fully comply with, they have created a situation where any (or all) of the 28 countries in the EU can fine any company at will, because they're never fully in compliance. Further, individual users can seek compensation under GDPR - companies will be deluged with such claims. Just having to depend on the goodwill of regulators who you think will just be attempting to enforce the spirit of the law is a terrible position to put companies in. When these countries and individual citizens are starved for cash, all of a sudden the letter of the law will be the only thing that matters, as is always the case with regulations that put all market participants in violation by default.
- 9y ago

bkor 9y ago

Due to the GDPR Facebook added all kinds of new controls. I looked through them today. Stuff Facebook has tracked, despite not using their app on my phone (preloaded but completely disabled) and using their website only with uBlock Origin): a) everywhere you ever used Facebook to login to a website. I thought I never did this but apparently I still had 5+ websites linked to this. They seem to use this to profile you. Facebook mentions about this _"These are active apps and websites. This means that you recently logged in to them using Facebook, and they can request information you've chosen to share with them."_ I never wanted to share anything, but Facebook often changes settings or pretends I did b) every time you connected an app to your Facebook account. Apparently I again did at a few times (to easily upload some photos). I also saw old phones in here, Runkeeper (don't recall using that), Tinder (haven't used in years). All of those seem to forever be able to get information from you. c) topics (yet another new name). Not sure how they figured things like that out. Fortunately you can completely disable the personal tracking, though you need to do that in various different places. d) advertisers whom added their contact list to Facebook. Really!! So some other company shared my details with Facebook. Which means they've also shared details of people not using Facebook with Facebook. e) used websites and apps. This is surprisingly accurate and complete (hundreds of sites+apps!), despite having the Fb app disabled plus always using uBlock Origin. I really wonder if they somehow are able to retrieve the browser history. It seems Facebook also tracks you using "apps using Facebook technology", which I guess is a library to show ads or something which uses the app permissions to further track the user. f) it uses your profile (relationship status, employer, job title, education) to targets ads g) somehow puts you into categories. E.g. "uses a mobile device (xx to xx months)". I disabled this crap yesterday, it updated it today with more information. I assume through Whatsapp/Instagram or maybe some kind of Facebook ad library? Again, I don't want it to track me, yet they seem to be easily able to do this. I turned off all the settings but apparently still missed a few. i) ads topics. Not sure how topics differs from the 3 other ways they call this. j) your location. It doesn't show what it does with this. You cannot disable the location tracking; it suggests to turn it off in the phone settings (which is a cop-out). I'll need to download my data to further determine this. I'm pretty sure Facebook is big enough to figure out additional ways of location tracking than just what Android/iPhone allows. k) websites visited. I assume any link clicked. This is somehow different than all the other ways it already showed websites. l) the existing "Who can contact you using email address / phone number". It says "Who", but it is used for the API as well, that's not a user so I find the usage of "Who" misleading. Despite doing all of this, still not sure how to prevent something like Cambridge Analytica from downloading my data through others ("friend"). Further as I already mentioned it seems to continue tracking me despite turning everything off. Not cool.

zmyrgel 9y ago

By looking through the comments it seems many seem to think that smallest GDPR violation will immidiately see 20M fine. Isn't it the last method if previous methods are ignored like giving a warning, smaller fines etc. So you don't have to do every single perfectly, just that you the basics done properly and your filling to fix things as they are shown to be broken. Well, unless your broken system leaks millions of users data into the wild I'd guess you're pretty safe.