7 ms·
This is a reasonable observation but I doubt anyone will care. Moreover it misses the point of GDPR. The goal is not to improve people's privacy. It's too vagu
by repolfx 8y ago
This is a reasonable observation but I doubt anyone will care. Moreover it misses the point of GDPR.
The goal is not to improve people's privacy. It's too vague to achieve that. Obviously the EU doesn't care as even its own websites aren't in compliance - assuming this guy's definition of compliance is the same as theirs. How likely is it the rest of the EU's operations are? Zero likelyhood of that.
But that's OK. GDPR doesn't even have a concrete notion of what privacy or personal information actually are. The goal is not to improve privacy, that's just a fig leaf. The goal is to grant the EU large new powers over the private sector and in particular over American tech firms, who will repeatedly be fined and treated as, effectively, a new source of tax income. GDPR is so vague and open ended that there's no way they can ever be compliant, meaning the EU has a new source of cash for years to come. Very useful at a time when they are asking for budget increases despite years of austerity, and facing a budget hole due to Brexit, and member states are getting upset at their financial demands.
GDPR enforcement will be very similar to EU anti-trust policy - deeply political and immediately controversial. It is best understood not as a law but as a political move, sort of like how China uses laws against pornography to justify blocking foreign search engines, or how it uses a law against 'spreading rumours' to censor domestic social media.
- yulaow 8y agoThis is stupid, if they wanted to give the finger to American tech firms they could have wrote the GDPR as affecting only foreign firms using EU citizen data without requiring the same level of control over the EU-based tech firms, far easier.
- Xeoncross 8y agoFining everyone makes sense to me. Why limit income? Cities do the same non-discriminate ticketing/fining as well.
- frockington 8y agoAre there any EU based tech firms? As an American I honestly can't think of any besides Nokia and that's more manufacturing
- Vogtinator 8y agoQuite a lot. Most sell software and support and not cloud services or similiar though.
- chunkyslink 8y agoSome music based ones that I use daily - spotify.com - soundcloud.com - mixcloud.com Others - Raspberry Pi - Wix.com
- diggan 8y agoMakes sense, as Americans tend to live in a bubble :) Some of them from the top of my head, that you might or might not recognize: Asos, JustEat, Skyscanner, SoundCloud, LastFM, DailyMotion, Raspberry PI (foundation more than company though), Shazam, Mojang, Skype, King, Spotify, Klarna, Trivago, Xing and BlaBlaCar. I'm pretty sure some of these are quite popular in even the US. (maybe some of them are not having their HQ in EU anymore, but they certainly had at one point)
- orf 8y agoAnd SAP, with 22 billion Euros in revenue
- repolfx 8y agoYou probably shouldn't insult Americans and then make statements you already know to be erroneous. As you are apparently well aware, Skype is owned by Microsoft. It's an American product now (from the perspective of who pays any fines). Mojang sold to Microsoft. It and Minecraft are owned by the Americans now. Asos is an online fashion and beauty retailer. Having a website doesn't make you a tech firm. Ditto for JustEat. Raspberry Pi - as you note - isn't even a firm at all, let alone a tech firm. Shazam is in the process of being bought by Apple, although the EU appear to be trying to block it. You tried to name tech firms that are based inside the EU and mostly ended up listing firms that either aren't tech firms by any conventional definition, or are now owned by US companies. I think that proves the original point.
- 8y ago
- menacingly 8y agoThat's not at all how these things work in the west. You define them as broadly as possible, then arbitrarily enforce them, because that gives you both plausible deniability and the widest potential application of your political power.
- midasz 8y agoIt HAS to be broad. The courts will narrow it down (jurisprudence). And why do you think it will be arbitrarily enforced? It isn't even the 25th of may and people are already feeling violated.
- menacingly 8y agoOh, I don't have a strong opinion on the GDPR and its intent, I was addressing yulaow's simplistic dismissal of what is actually a well-trodden political playbook
- PunchTornado 8y agoDo you have any examples of cases where American companies were fined unjustly by EU? These companies can attack any fines they receive in the courts.
- blunte 8y agoI disagree. I believe it is an attempt to put a stop to (mostly) US collection of EU citizen data - or at least to give EU citizens some ability to control what foreign entities are collecting (and monetizing) about them. The EU uses large fines as a fairly effective threat to dissuade organizations from doing things that the EU believes are not beneficial to its members. Of course it's not perfect, and of course there are political motivations as well... but Europe (and other lower corruption countries, for that matter) have grown tired with the US and its money-above-all behavior. US citizens will benefit from GDPR because it will force some change in behaviors of profit-seeking entities.
- frockington 8y agoI have no idea how European court systems work so sorry in advance for what may be stupid questions. What is stopping any company they try to sue from levying investigations against the EU itself if they are not compliant? Does the EU have any sort of executive power that would investigate companys or will it be another VW incident where each company will check the box saying they comply regardless of actual status
- midasz 8y agoCompanies cannot sue over GDPR violations (neither can individuals). People can report violations to the GDPR watchdogs who will investigate and could eventually hand out fines.
- ozim 8y agoI think you actually can sue for whatever reason you like but court can say it does not make sense and they will not run the case. It is your responsibility to get enough evidence but it is hard and no one cares enough. If your data was used without your knowledge you might have had some damage and you could request compensation, removal or other way of fixing damage - with court help of course. GDPR violations can be used as base for court case. So GDPR does not really bring anything new because I believe you already could sue companies for selling your data, but in practice it is not possible to get evidence, prove damage, put price on damage, and it takes too long. What changes is that if you don't have all data usages listed for user to view it is enough for some action so offended users can suspect something. If watchdog goes and checks you might be in problem with fines and then with court cases from offended users.
- Someone 8y ago”I think you actually can sue for whatever reason you like but court can say it does not make sense and they will not run the case.” True. ”It is your responsibility to get enough evidence but it is hard and no one cares enough.” In this case, every “doesn’t comply with the GDPR” case a company starts will be immediately dismissed because: a) you can’t start a lawsuit on the GDPR. The only way is through a national data protection authority. b) even if you could, companies wouldn’t be interested parties in such a case. (By the way, I think the national data protection authorities are the sore spot in the GDPR. I don’t think it is good that they are both prosecutor, jury, and executioner)
- rossdavidh 8y agoAnother interpretation: IT is really hard, especially for people who don't do it for a living, who thus have less time to learn about it. Writing legislation about IT is equally hard, if not more so. The EU may honestly care about the impact of IT on privacy, but not have the technical ability to write adequately precise legislation about it, or even insure that their own institutional IT is in compliance (assuming it really isn't, and I am not a lawyer). Do not ascribe to conspiracy, what is adequately explained by incompetence.
- midasz 8y ago> GDPR is so vague and open ended that there's no way they can ever be compliant This is nonsense. I really don't see what's so difficult to understand. Personal information is information to which the person can be identified.
- tchock23 8y agoThe definition of personal information is easy to understand (albeit broad). However, the vagueness seeps in other areas of the regulation. For example, additional restrictions are in place for “large scale” processing of personal information, yet “large scale” is never defined. Is that hundreds, thousands or millions of records? As the owner of a very small SaaS business (that does not sell personal information of its users) I found it tremendously difficult to figure out how to comply given the vagueness of it all.
- midasz 8y agoYeah I get that. I googled around a bit and apparently there were concrete figures in the initial draft. I don't know if the EU has a contactperson to whom you can ask these questions, if they do, you can simply ask them to clarify. If you've done that, you're in the clear because you've put in the effort to comply. But yeah in this case they should just give you a number.
- pjc50 8y ago> I don't know if the EU has a contactperson to whom you can ask these questions, if they do, you can simply ask them to clarify. lol of course there isn't an office you can ring to help you with this! If there were we wouldn't be spending quite so much effort working out what it all means.
- M2Ys4U 8y agoEach of the 28 member states of the EU has a data protection authority. Those are the people one rings to get advice.
- englishrookie 8y agoI'm pretty sure the GDPR is enforced at the national level, by national data protection agencies. The one in the Netherlands is severely understaffed and no match for the lawyers of the likes of Google and Facebook.
- pjc50 8y agoThis is rather paranoid: remember that enforcement is done by national authorities like the ICO not europe-wide ones. It's not as radically different from the previous data protection principles as people seem to think, and how much enforcement of those was actually seen? > EU anti-trust policy - deeply political and immediately controversial [citation needed]; it's not as if American industrial policy is apolitical and uncontroversial, e.g. https://www.theguardian.com/business/2018/jan/26/bombardier-us-tariffs-imports-uk-trump-jobs-belfast https://www.theguardian.com/business/2018/jan/26/bombardier-...
- repolfx 8y agoIt's well known that the Obama administration felt the EU was using anti-trust law to implement protectionism: https://www.wired.com/story/google-big-eu-fine/ https://www.wired.com/story/google-big-eu-fine/ For his part, President Barack Obama called the EU's actions protectionism. "[Americans] have owned the Internet. Our companies have created it, expanded it, perfected it in ways that [European companies] can’t compete," Obama said in an interview with Recode in 2015. "And oftentimes what is portrayed as high-minded positions on issues sometimes is just designed to carve out some of their commercial interests."
- Bizarro 8y agoThe goal is to grant the EU large new powers over the private sector and in particular over American tech firms, who will repeatedly be fined and treated as, effectively, a new source of tax income I'm guessing the rest of the world will just pull their operations out of the EU and then ignore the law. It obviously has no jurisdiction outside of the EU...despite what EUrocrats and some propaganda here on HN would have you believe. The rest of the world could also impose sanctions on the EU for illegally claiming global jurisdiction.
- pjc50 8y agoThe US claims global jurisdiction over e.g. Megaupload without sanctions.
- grey-area 8y agoThe goal is to grant the EU large new powers over the private sector and in particular over American tech firms, who will repeatedly be fined and treated as, effectively, a new source of tax income. No, it really is intended to provide greater control for citizens over their privacy and data stored by corporations.