111 ms·

The problem of multiple ambiguities in GDPR hasn't really been addressed here. Also, must be nice to live in a country where the regulator is as benevolent and

by raquo 8y ago

The problem of multiple ambiguities in GDPR hasn't really been addressed here. Also, must be nice to live in a country where the regulator is as benevolent and reasonable as is described in this article. I think it's ok for foreigners to be skeptical of this promise, as the article implies that this reasonableness is not encoded in law.

gcthomas 8y ago
The regulators have been running for two decades, and this is EXACTLY how they operate. Scepticism in this case is unreasonable, given the massive evidence base.
- wott 8y ago
  > The regulators have been running for two decades, Exactly 4 decades in France (it started in 1978).
- repolfx 8y ago
  But that's purely your own opinion. I do have some direct experience of working with EU data protection regulators. My experience has been that they vary wildly in "reasonableness". UK ICO is pretty OK, they want companies to succeed. France's CNIL is a joke. Petty, spiteful and utterly inconsistent. I watched as a company worked closely with them to get their sign-off on a change to their terms of service and privacy policy. CNIL were happy to be involved and taken so seriously, they were satisfied with the changes and even praised them in private. After the company announced the change, some journalists saw an opportunity to make some noise and did so. CNIL then immediately changed their mind and dished out a fine, despite having previously agreed to it. What a farce. That's at the national level. I can give many examples of cases where the EU has been anything but reasonable. The entire argument Jaques presents here boils down to his belief that everyone working in GDPR enforcement in the EU will not only be totally predictable and reasonable today but also going forward into the indefinite future. As pointed out in the other thread, this belief is itself unreasonable, because the nature of the GDPR means that even in the unlikely even it's true today, if in 10 years a new Commission arrives and changes their mind they can retroactively decide that things previously allowed were actually illegal. The GDPR says virtually nothing about anything so they'd certainly argue such a thing was merely a "clarification" and not a retroactive change to the law. There are plenty of examples of governments doing this sort of thing over time, including the EU, like with Apple's tax situation. Mr Mattheij appears to just write this possibility off entirely.
  - patricius 8y ago
    Furthermore, it imposes unbelievable costs on companies that in the end must be passed on to consumers. This is completely unnecessary legislation that will probably have no measurable positive effect at all. Bureaucracy and politics at its best.
    - matthewmacleod 8y ago
      Why is this unnecessary? We see daily announcements about personal data being leaked and misused. It’s plainly a problem.
  - AnabeeKnox 8y ago
    "his belief that everyone working in GDPR enforcement in the EU will not only be totally predictable and reasonable today but also going forward into the indefinite future." EXACTLY! There seems to be an almost cultish devotion to the benevolent institution that it can do no wrong, neither now nor henceforth. I understand WHY people have this belief. The EU is under constant attack at the moment from many sides, and people feel they need to defend it at all costs, even it they are wrong.
    - DanBC 8y ago
      But people aren't defending Europe, they're defending the national data protection regulators (eg ICO) which are not European bodies.
    - bkor 8y ago
      > The EU is under constant attack at the moment from many sides, and people feel they need to defend it at all costs, even it they are wrong. As you mention that "they are wrong" in reference to saying that the regulators aren't to be trusted, could you explain how the Dutch regulator behaved badly? I'm Dutch and have followed what they've been doing over at least 10+ years. I don't think I'm wrong in my assertion, but feel free to point out the details. Also, I'd like to know how often you've followed what the Dutch regulator has been doing. I get the feeling you're not aware of their name.
    - 8y ago
frereubu 8y ago
Law is by its nature open to interpretation and based on precedent. Otherwise there wouldn't be courts of appeal and supreme courts. What's so special about GDPR that makes you think it will be abused more than other laws?
- raquo 8y ago
  The "special" part is that it prescribes very specific things in very ambiguous terms. You have to change what you're doing to be compliant, but you don't know how. And for some aspects, no one knows how. And GDPR actually has teeth. It's ripe for selective enforcement and other bureaucracy failures.
- BjoernKW 8y ago
  What you're describing is the way common law works. Most European jurisdictions work under a civil law system.
  - icebraining 8y ago
    It's not black and white, precedent exists in civil law systems as well: https://en.wikipedia.org/wiki/Precedent#Civil_law_systems https://en.wikipedia.org/wiki/Precedent#Civil_law_systems
    - BjoernKW 8y ago
      Yes, common law and civil law systems have been converging to some extent. In common law systems you have increasing reliance on statutory law while civil law systems increasingly make use of precedents. Still, the basic principles remain.
Angostura 8y ago
> The problem of multiple ambiguities in GDPR hasn't really been addressed here. Such as? > Also, must be nice to live in a country where the regulator is as benevolent and reasonable as is described in this article. It is, thanks.
- raquo 8y ago
  OTOH - Scope outside of Europe – e.g. if a completely foreign entity that offers a Spanish or French translation of its service could potentially be covered by GDPR, even if they're not marketing to EU markets specifically. Too bad for Quebec I guess. Or what if you fly to speak at a conference in Europe – is that "marketing" to residents of EU? Depends on your slides? Or not? Who knows. - Consent – does X fall under "legitimate interest"? Is it essential to providing the service? These are not easy to definitively answer for any non-trivial application. And it's not like you can just err on the side of caution – you are not allowed to ask for more consent than you need IIRC. And if the regulator (one of them) disagrees with you after you've spent a few years building a business relying on a certain interpretation, tough luck I guess, try again? - How to deal with backups that contain personal information
  - Angostura 8y ago
    > If a completely foreign entity that offers a Spanish or French translation of its service could potentially be covered by GDPR, even if they're not marketing to EU markets specifically. No, the GDPR is clear that it is applicable if you are offering goods or services to Europeans. The fact you are speaking French in Quebec isn't relevant. > Or what if you fly to speak at a conference in Europe – is that "marketing" to residents of EU? Depends on your slides? Or not? Who knows. So, if you fly to the European conference and talk to a Europeam audience, you're not going to be covered by the GDPR until you actually supply goods or services within the EU.
    - raquo 8y ago
      > the processing of personal data of data subjects who are in the Union by a controller or a processor not established in the Union should be subject to this Regulation where the processing activities are related to offering goods or services to such data subjects > In order to determine whether such a controller or processor is offering goods or services to data subjects who are in the Union, it should be ascertained whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member States in the Union > factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union https://gdpr-info.eu/recitals/no-23/ https://gdpr-info.eu/recitals/no-23/ So you need to "offer" services, not "supply" them, and "to data subjects in the EU", not "within the EU". So you can't just run your business from Canada with no special emphasis on EU and call it a day. Or if you're advocating blocking European IPs, well that's exactly the "hysteria" the article argues against.
BjoernKW 8y ago
> that this reasonableness is not encoded in law. This is the main issue with this regulation in my opinion. Some of the recent statements by EU officials on that matter verge on absolutist notions of law: "Don't worry. Authorities will be lenient and benevolent." This is how absolutist kings argued why there shouldn't be a constitution or a state under the rule of law.

by raquo 8y ago

gcthomas 8y ago

The regulators have been running for two decades, and this is EXACTLY how they operate. Scepticism in this case is unreasonable, given the massive evidence base.

wott 8y ago
> The regulators have been running for two decades, Exactly 4 decades in France (it started in 1978).
repolfx 8y ago
But that's purely your own opinion. I do have some direct experience of working with EU data protection regulators. My experience has been that they vary wildly in "reasonableness". UK ICO is pretty OK, they want companies to succeed. France's CNIL is a joke. Petty, spiteful and utterly inconsistent. I watched as a company worked closely with them to get their sign-off on a change to their terms of service and privacy policy. CNIL were happy to be involved and taken so seriously, they were satisfied with the changes and even praised them in private. After the company announced the change, some journalists saw an opportunity to make some noise and did so. CNIL then immediately changed their mind and dished out a fine, despite having previously agreed to it. What a farce. That's at the national level. I can give many examples of cases where the EU has been anything but reasonable. The entire argument Jaques presents here boils down to his belief that everyone working in GDPR enforcement in the EU will not only be totally predictable and reasonable today but also going forward into the indefinite future. As pointed out in the other thread, this belief is itself unreasonable, because the nature of the GDPR means that even in the unlikely even it's true today, if in 10 years a new Commission arrives and changes their mind they can retroactively decide that things previously allowed were actually illegal. The GDPR says virtually nothing about anything so they'd certainly argue such a thing was merely a "clarification" and not a retroactive change to the law. There are plenty of examples of governments doing this sort of thing over time, including the EU, like with Apple's tax situation. Mr Mattheij appears to just write this possibility off entirely.
- patricius 8y ago
  Furthermore, it imposes unbelievable costs on companies that in the end must be passed on to consumers. This is completely unnecessary legislation that will probably have no measurable positive effect at all. Bureaucracy and politics at its best.
  - matthewmacleod 8y ago
    Why is this unnecessary? We see daily announcements about personal data being leaked and misused. It’s plainly a problem.
- AnabeeKnox 8y ago
  "his belief that everyone working in GDPR enforcement in the EU will not only be totally predictable and reasonable today but also going forward into the indefinite future." EXACTLY! There seems to be an almost cultish devotion to the benevolent institution that it can do no wrong, neither now nor henceforth. I understand WHY people have this belief. The EU is under constant attack at the moment from many sides, and people feel they need to defend it at all costs, even it they are wrong.
  - DanBC 8y ago
    But people aren't defending Europe, they're defending the national data protection regulators (eg ICO) which are not European bodies.
  - bkor 8y ago
    > The EU is under constant attack at the moment from many sides, and people feel they need to defend it at all costs, even it they are wrong. As you mention that "they are wrong" in reference to saying that the regulators aren't to be trusted, could you explain how the Dutch regulator behaved badly? I'm Dutch and have followed what they've been doing over at least 10+ years. I don't think I'm wrong in my assertion, but feel free to point out the details. Also, I'd like to know how often you've followed what the Dutch regulator has been doing. I get the feeling you're not aware of their name.
  - 8y ago

frereubu 8y ago

Law is by its nature open to interpretation and based on precedent. Otherwise there wouldn't be courts of appeal and supreme courts. What's so special about GDPR that makes you think it will be abused more than other laws?

raquo 8y ago
The "special" part is that it prescribes very specific things in very ambiguous terms. You have to change what you're doing to be compliant, but you don't know how. And for some aspects, no one knows how. And GDPR actually has teeth. It's ripe for selective enforcement and other bureaucracy failures.
BjoernKW 8y ago
What you're describing is the way common law works. Most European jurisdictions work under a civil law system.
- icebraining 8y ago
  It's not black and white, precedent exists in civil law systems as well: https://en.wikipedia.org/wiki/Precedent#Civil_law_systems https://en.wikipedia.org/wiki/Precedent#Civil_law_systems
  - BjoernKW 8y ago
    Yes, common law and civil law systems have been converging to some extent. In common law systems you have increasing reliance on statutory law while civil law systems increasingly make use of precedents. Still, the basic principles remain.

Angostura 8y ago

> The problem of multiple ambiguities in GDPR hasn't really been addressed here. Such as? > Also, must be nice to live in a country where the regulator is as benevolent and reasonable as is described in this article. It is, thanks.

raquo 8y ago
OTOH - Scope outside of Europe – e.g. if a completely foreign entity that offers a Spanish or French translation of its service could potentially be covered by GDPR, even if they're not marketing to EU markets specifically. Too bad for Quebec I guess. Or what if you fly to speak at a conference in Europe – is that "marketing" to residents of EU? Depends on your slides? Or not? Who knows. - Consent – does X fall under "legitimate interest"? Is it essential to providing the service? These are not easy to definitively answer for any non-trivial application. And it's not like you can just err on the side of caution – you are not allowed to ask for more consent than you need IIRC. And if the regulator (one of them) disagrees with you after you've spent a few years building a business relying on a certain interpretation, tough luck I guess, try again? - How to deal with backups that contain personal information
- Angostura 8y ago
  > If a completely foreign entity that offers a Spanish or French translation of its service could potentially be covered by GDPR, even if they're not marketing to EU markets specifically. No, the GDPR is clear that it is applicable if you are offering goods or services to Europeans. The fact you are speaking French in Quebec isn't relevant. > Or what if you fly to speak at a conference in Europe – is that "marketing" to residents of EU? Depends on your slides? Or not? Who knows. So, if you fly to the European conference and talk to a Europeam audience, you're not going to be covered by the GDPR until you actually supply goods or services within the EU.
  - raquo 8y ago
    > the processing of personal data of data subjects who are in the Union by a controller or a processor not established in the Union should be subject to this Regulation where the processing activities are related to offering goods or services to such data subjects > In order to determine whether such a controller or processor is offering goods or services to data subjects who are in the Union, it should be ascertained whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member States in the Union > factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union https://gdpr-info.eu/recitals/no-23/ https://gdpr-info.eu/recitals/no-23/ So you need to "offer" services, not "supply" them, and "to data subjects in the EU", not "within the EU". So you can't just run your business from Canada with no special emphasis on EU and call it a day. Or if you're advocating blocking European IPs, well that's exactly the "hysteria" the article argues against.

BjoernKW 8y ago

> that this reasonableness is not encoded in law. This is the main issue with this regulation in my opinion. Some of the recent statements by EU officials on that matter verge on absolutist notions of law: "Don't worry. Authorities will be lenient and benevolent." This is how absolutist kings argued why there shouldn't be a constitution or a state under the rule of law.