10 ms·

You're completely ignoring the point of GDPR. The point is that users should be in control of their data, and when they give it to someone they have the right t

by cyphar 9y ago

You're completely ignoring the point of GDPR. The point is that users should be in control of their data, and when they give it to someone they have the right to know what it is used for and to be able to retract consent for its usage. Blaming users for providing their personal data is strange -- if the implication is that nobody should provide their personal data because it can be abused then is it not obvious that the use of personal data should be regulated? If the majority of banks lost your money regularly, would you blame customers of the bank for using banks -- or would you say that banks should have stricter regulations to stop people from being screwed? As for the Amazon bit, I think you're underselling it. Amazon tracks users in arguably unethical ways (due to the lack of consent, and the scope, and the inability to opt-out) and display their ads is inflicting that on your users. If you care about your users privacy (which is what GDPR is trying to enforce) then you would know that "just slapp[ing] some Amazon adds on [your] site" is not the correct approach to handling users' personal data. I do agree it's not trivial to handle GDPR if you don't have a lawyer (though you can get a data officer from a legal firm), but complying with laws is part of doing business.

closeparen 9y ago
>if the implication is that nobody should provide their personal data because it can be abused then is it not obvious that the use of personal data should be regulated? I honestly thought this kind of reasoning was a right-wing caricature. No, it is not obvious that choices with risks attached should always be regulated away. Disclosing information in proportion to trust is a basic life skill. I understand that many in the tech community are frustrated to see the general public failing to exercise this discipline, and maybe regulation is the best way to protect them from themselves, but that's not obvious. >If the majority banks lost your money regularly, would you blame customers of the bank for using banks -- or would you say that banks should have stricter regulations to stop people from being screwed? False dichotomy. You want a spectrum of financial products that depositors can choose from according to their risk tolerance. It's essential that we have stable, regulated, insured checking accounts. It's also essential that we have self-directed brokerage accounts. >"just slapp[ing] some Amazon adds on [your] site" is not the correct approach to handling users' personal data. A site sending your browser Amazon ads does not oblige it to execute or display them. And this isn't some secret backend upload. If someone is willing to use a site with this revenue model, why is that your business?
- cyphar 9y ago
  > No, it is not obvious that choices with risks attached should always be regulated away. The assumption is that all users are actively making a choice. Many are not aware of the choices they are making, and I think it's wrong to punish them for it -- when companies profit off this lack of literacy and people rush to their defense whenever people start talking about regulation. I don't want companies like Google and Amazon to be able to hoard massive amounts of personal information about a large portion of the world's population, and not have to respect the rights of the people whose information they have acquired. > You want a spectrum of financial products that depositors can choose from according to their risk tolerance. If effectively everyone of importance just uses Amazon (or Google) ads then you don't get a "spectrum" and there's no choice involved. You have an option to either use or not use a majority of the internet. Yes, you can use ad-blockers but that's not a long-term solution. > A site sending your browser Amazon ads does not oblige it to execute or display them. And this isn't some secret backend upload. If someone is willing to use a site with this revenue model, why is that your business? Most users are not aware of how these things work. I agree that if everyone knew how to block those ads and what the actual problems are with them, then things like GDPR might be less necessary (though the right to retract consent is something that should be enforced). But even then, ad-blockers are a defense against an industry that is over-stepping ethical boundaries every day. At which point do you say that companies which inflict systemic violations of ethics on billions of people should be held accountable? Or is it always the fault of the people because they didn't care enough about their personal information?
  - stef25 9y ago
    Seems to come down to having to protect users from their own lack of understanding. What ethical boundaries do you think are being overstepped through advertising?
    - Xylakant 9y ago
      It’s not advertising itself that is problematic. I’d be fine with an image loaded from the origin serevr. It’s the attached pervasive tracking and monitoring, coupled with the real security risks that come with the current incarnation of advertising technologies.
jimktrains2 9y ago
> The point is that users should be in control of their data, and when they give it to someone they have the right to know what it is used for and to be able to retract consent for its usage. See, I disagree with this very premise. Why is it true? It's _not_ my data; it's data about me. Even things like pictures, once shared, are no longer under my control. I actually feel it's fundamentally dangerous to make users think they actually control data they don't. > If you care about your users privacy (which is what GDPR is trying to enforce) I also disagree with this. The GDPR doesn't do anything to make companies handle my data more carefully or responsibly.
- toomuchtodo 9y ago
  Data about me is my data, and if the government gives me the right to control it, I have that right. If I share a photo, it’s still my photo, I still own the copyright to it, and as an American I’ve used the DMCA to revoke access to photos when tech companies wouldn’t remove my photo when asked politely. The rest of my data is no different. I own my data and the data about me, not them. GDPR gives users the controls and governance over their data that should have always existed, but that tech companies gaslighted users into believing doesn’t exist.
  - kaseyb002 9y ago
    GDPR takes away the right to trade your data in exchange for services.
    - s73v3r_ 9y ago
      It absolutely does not. That is still entirely legal. All the GDPR does is make sure that the entity you're trading with is up front about what data they are collecting, and what it will be used for, giving you the ability to make an informed decision.
      - CryptoPunk 9y ago
        That's not all it does. Among the other things it does: It requires the entity to give you the ability to delete your personal data, which means a contract where you grant a service a permanent and irrevocable right to data about you in exchange for a service is illegal. It also requires the entity to provide an equivalent service to any site visitor that chooses to not grant their data to the entity, thus making the business model of trading even revocable access to one's data for a service unviable in the long run. It makes it illegal to offer a service in exchange for data that is stored without end-user retrievability. Therefore, it makes a contract where you grant a service irretrievable data about you in exchange for a service is illegal. All of these reduce the range of possible voluntary interactions. It's anti consent.
Silhouette 9y ago
You're completely ignoring the point of GDPR. The point is that users should be in control of their data, and when they give it to someone they have the right to know what it is used for and to be able to retract consent for its usage. That might be the theory, but there may be unintended consequences in practice. As others have said, introducing regulation always has a cost. In this case, the cost appears to be that a small side business that has been providing a useful service to the local community for several years will no longer be available. It doesn't matter whether the business was actually violating the GDPR. It doesn't matter if the person running it misunderstood the new regulations and formed an exaggerated view about the potential risks. The end result is still that his service isn't there any more.
- chii 9y ago
  If there's demand for said service, then there will be some new enterprising individual who will try to provide it at a profit. The level of risk and profit is going to adjust to the correct balance over time.
  - Silhouette 9y ago
    If there's demand for said service, then there will be some new enterprising individual who will try to provide it at a profit. It apparently wasn't running at a profit even before these new overheads. It was essentially being provided as a gift to the community by the person running it, and that person is not prepared to accept what he perceives to be a lot of extra risk just for doing people a favour. Why then is it reasonable to assume that someone else will step in and be willing to provide the same benefit to others despite the additional overheads? The level of risk and profit is going to adjust to the correct balance over time. Again, why should we make such a strong assumption in general? Previous ill-judged regulation of tech industries by the EU hasn't gotten any better with time. They still haven't fixed the "cookie law", which must be on the short list for most useless and widely ridiculed law in history! More seriously, they still haven't fixed the VAT mess, which finished too many microbusinesses and caused significant damage to many more slightly larger ones.
CryptoPunk 9y ago
>>The point is that users should be in control of their data Intentions and effects do not always align. The effect of GDPR is to make any business model where a user trades their personal data for a service illegal. Business models involving voluntary exchange should not be prohibited. The fact is, the free market already gives users control over their data. They are not obligated to use any service that requires private information from them.
- chii 9y ago
  GDPR doesn't make illegal the trading of personal data for services. It requires consent for each piece of data (in detail, not a catch all) , and requires an option to remove your data, or opt out of specific uses of said data.
  - CryptoPunk 9y ago
    If a party must provide a service for users that refuse to provide their personal data, as long as it provides that service for users that agree to provide their personal data, then there can be no business model based on trading personal data for a service. And by mandating an option to remove your data, it makes a contract where a user gives a permanent grant of their data to a service provider, in exchange for a service, illegal.
LoSboccacc 9y ago
you are ignoring the _actual_ point of gdpr, enshrine the right to be forgotten in law to bypass the right of reporting. they could have alredy fined current privacy abusers under the existing law framework. this will be used to stromgarm independent news sources.

by cyphar 9y ago

closeparen 9y ago

>if the implication is that nobody should provide their personal data because it can be abused then is it not obvious that the use of personal data should be regulated? I honestly thought this kind of reasoning was a right-wing caricature. No, it is not obvious that choices with risks attached should always be regulated away. Disclosing information in proportion to trust is a basic life skill. I understand that many in the tech community are frustrated to see the general public failing to exercise this discipline, and maybe regulation is the best way to protect them from themselves, but that's not obvious. >If the majority banks lost your money regularly, would you blame customers of the bank for using banks -- or would you say that banks should have stricter regulations to stop people from being screwed? False dichotomy. You want a spectrum of financial products that depositors can choose from according to their risk tolerance. It's essential that we have stable, regulated, insured checking accounts. It's also essential that we have self-directed brokerage accounts. >"just slapp[ing] some Amazon adds on [your] site" is not the correct approach to handling users' personal data. A site sending your browser Amazon ads does not oblige it to execute or display them. And this isn't some secret backend upload. If someone is willing to use a site with this revenue model, why is that your business?

cyphar 9y ago
> No, it is not obvious that choices with risks attached should always be regulated away. The assumption is that all users are actively making a choice. Many are not aware of the choices they are making, and I think it's wrong to punish them for it -- when companies profit off this lack of literacy and people rush to their defense whenever people start talking about regulation. I don't want companies like Google and Amazon to be able to hoard massive amounts of personal information about a large portion of the world's population, and not have to respect the rights of the people whose information they have acquired. > You want a spectrum of financial products that depositors can choose from according to their risk tolerance. If effectively everyone of importance just uses Amazon (or Google) ads then you don't get a "spectrum" and there's no choice involved. You have an option to either use or not use a majority of the internet. Yes, you can use ad-blockers but that's not a long-term solution. > A site sending your browser Amazon ads does not oblige it to execute or display them. And this isn't some secret backend upload. If someone is willing to use a site with this revenue model, why is that your business? Most users are not aware of how these things work. I agree that if everyone knew how to block those ads and what the actual problems are with them, then things like GDPR might be less necessary (though the right to retract consent is something that should be enforced). But even then, ad-blockers are a defense against an industry that is over-stepping ethical boundaries every day. At which point do you say that companies which inflict systemic violations of ethics on billions of people should be held accountable? Or is it always the fault of the people because they didn't care enough about their personal information?
- stef25 9y ago
  Seems to come down to having to protect users from their own lack of understanding. What ethical boundaries do you think are being overstepped through advertising?
  - Xylakant 9y ago
    It’s not advertising itself that is problematic. I’d be fine with an image loaded from the origin serevr. It’s the attached pervasive tracking and monitoring, coupled with the real security risks that come with the current incarnation of advertising technologies.

jimktrains2 9y ago

> The point is that users should be in control of their data, and when they give it to someone they have the right to know what it is used for and to be able to retract consent for its usage. See, I disagree with this very premise. Why is it true? It's _not_ my data; it's data about me. Even things like pictures, once shared, are no longer under my control. I actually feel it's fundamentally dangerous to make users think they actually control data they don't. > If you care about your users privacy (which is what GDPR is trying to enforce) I also disagree with this. The GDPR doesn't do anything to make companies handle my data more carefully or responsibly.

toomuchtodo 9y ago
Data about me is my data, and if the government gives me the right to control it, I have that right. If I share a photo, it’s still my photo, I still own the copyright to it, and as an American I’ve used the DMCA to revoke access to photos when tech companies wouldn’t remove my photo when asked politely. The rest of my data is no different. I own my data and the data about me, not them. GDPR gives users the controls and governance over their data that should have always existed, but that tech companies gaslighted users into believing doesn’t exist.
- kaseyb002 9y ago
  GDPR takes away the right to trade your data in exchange for services.
  - s73v3r_ 9y ago
    It absolutely does not. That is still entirely legal. All the GDPR does is make sure that the entity you're trading with is up front about what data they are collecting, and what it will be used for, giving you the ability to make an informed decision.
    - CryptoPunk 9y ago
      That's not all it does. Among the other things it does: It requires the entity to give you the ability to delete your personal data, which means a contract where you grant a service a permanent and irrevocable right to data about you in exchange for a service is illegal. It also requires the entity to provide an equivalent service to any site visitor that chooses to not grant their data to the entity, thus making the business model of trading even revocable access to one's data for a service unviable in the long run. It makes it illegal to offer a service in exchange for data that is stored without end-user retrievability. Therefore, it makes a contract where you grant a service irretrievable data about you in exchange for a service is illegal. All of these reduce the range of possible voluntary interactions. It's anti consent.

Silhouette 9y ago

You're completely ignoring the point of GDPR. The point is that users should be in control of their data, and when they give it to someone they have the right to know what it is used for and to be able to retract consent for its usage. That might be the theory, but there may be unintended consequences in practice. As others have said, introducing regulation always has a cost. In this case, the cost appears to be that a small side business that has been providing a useful service to the local community for several years will no longer be available. It doesn't matter whether the business was actually violating the GDPR. It doesn't matter if the person running it misunderstood the new regulations and formed an exaggerated view about the potential risks. The end result is still that his service isn't there any more.

chii 9y ago
If there's demand for said service, then there will be some new enterprising individual who will try to provide it at a profit. The level of risk and profit is going to adjust to the correct balance over time.
- Silhouette 9y ago
  If there's demand for said service, then there will be some new enterprising individual who will try to provide it at a profit. It apparently wasn't running at a profit even before these new overheads. It was essentially being provided as a gift to the community by the person running it, and that person is not prepared to accept what he perceives to be a lot of extra risk just for doing people a favour. Why then is it reasonable to assume that someone else will step in and be willing to provide the same benefit to others despite the additional overheads? The level of risk and profit is going to adjust to the correct balance over time. Again, why should we make such a strong assumption in general? Previous ill-judged regulation of tech industries by the EU hasn't gotten any better with time. They still haven't fixed the "cookie law", which must be on the short list for most useless and widely ridiculed law in history! More seriously, they still haven't fixed the VAT mess, which finished too many microbusinesses and caused significant damage to many more slightly larger ones.

CryptoPunk 9y ago

>>The point is that users should be in control of their data Intentions and effects do not always align. The effect of GDPR is to make any business model where a user trades their personal data for a service illegal. Business models involving voluntary exchange should not be prohibited. The fact is, the free market already gives users control over their data. They are not obligated to use any service that requires private information from them.

chii 9y ago
GDPR doesn't make illegal the trading of personal data for services. It requires consent for each piece of data (in detail, not a catch all) , and requires an option to remove your data, or opt out of specific uses of said data.
- CryptoPunk 9y ago
  If a party must provide a service for users that refuse to provide their personal data, as long as it provides that service for users that agree to provide their personal data, then there can be no business model based on trading personal data for a service. And by mandating an option to remove your data, it makes a contract where a user gives a permanent grant of their data to a service provider, in exchange for a service, illegal.

LoSboccacc 9y ago

you are ignoring the _actual_ point of gdpr, enshrine the right to be forgotten in law to bypass the right of reporting. they could have alredy fined current privacy abusers under the existing law framework. this will be used to stromgarm independent news sources.