7 ms·

The GDPR gets so much hate because it hits so many businesses where it hurts: data. GDPR "simply" gives you guidelines on how you can handle data from people wi

The GDPR gets so much hate because it hits so many businesses where it hurts: data. GDPR "simply" gives you guidelines on how you can handle data from people within the EU. And that that data cannot be handled so liberally as it has been before. Of course that's annoying from a business perspective, but from an individuals privacy perspective, it's fantastic.

zerostar07 8y ago
I think it gets "hate" from people who don't have much data but they still have to implement all the requirements, which go beyond than their own data storage. Ad-supported websites are probably the most common case here, even if the sites don't store any data themselves.
- sdoering 8y ago
  And that is a good thing. This >23 different trackers and adservers just to read crappy news content BS is so nice to be shaken. I really love the GDPR for just making the life for such business models way harder. Implementing data, analytics, tracking and stuff in a way that is compliant with GDPR (or its local equivalents) is doable and from an architectural point of view even interesting imho. I love building GDPR conforming data architectures with my clients right now.
  - zerostar07 8y ago
    i suggest you remove the 3 trackers from your blog, or at least let me see it without them. I m not trying to be snarky, just pointing out that removing everything is often very hard.
    - def_true_false 8y ago
      The site linked in their profile works just fine with all JS disabled.
      - sdoering 8y ago
        Thanks. I tried to achieve that. As I am surfing with a lot of JS being blocked/disabled, I wanted my own site to be usable for myself.
      - zerostar07 8y ago
        i did not mean that the site doesnt work without tracking, but according to the law i should have the option to access the site without being tracked.
        sdoering 8y ago
        No. That is just plainly wrong. GDPR allows for tracking without opt in. It just needs to enable you to opt out of being tracked with for example a link to opt out in the privacy policy page. Something I still plan to make more visible (in the footer or something like that), but is already there [0]. These so called cookie layers are not necessary for tracking. They are not even necessary for first party on site advertising. For that you also do not need consent if you read the GDPR/DSGVO (German version). In the DSGVO it is §6.1f [1] you would want to read about. There is even an elaborate explanation from the German legistlation [2] what "Berechtiges Interesse" ( legitimate interest) exactly means. So to make this short: direct marketing as well as tracking is totally fine even without consent. Give an option to opt out, explain why you need the data, what you do with it and how long you store it as well as a point of contact (for people wishing for their data to be deleted) and you are fine. As long as you do not do profiling or stuff like that. A personal blog/website is then totally fine with GDPR. Btw. you would need to add all of this to your privacy page even if you had no web tracking installed, as your webserver probably would have logging activated. Having an IP address in there make this data fall under the GDPR (at least in Germany). So you would need to explain all that stuff because of the log files non the less. [0]: https://schriftrolle.de/datenschutz https://schriftrolle.de/datenschutz [1]: https://dsgvo-gesetz.de/art-6-dsgvo/ https://dsgvo-gesetz.de/art-6-dsgvo/ [2]: https://dsgvo-gesetz.de/erwaegungsgruende/nr-47/ https://dsgvo-gesetz.de/erwaegungsgruende/nr-47/ [Edit:] Ordered the footnotes
        zerostar07 8y ago
    - sdoering 8y ago
      Well. I know that I have GTM, GA with DC integration (currently) still active on my blog. DC integration will be dropped and the privacy page will be updated to describe, what I am tracking and how long data is being stored. As needed to comply with GDPR/DSGVO. As I am still having 7 days to go and that is just a personal blog, I plan on using my free time to do that (would just take 3 - 5 minutes to disable everything if I wanted to by removing GTM and redeploying). So removing everything is quite easy. It is way more difficult to selectively remove singular features - in this case the DoubleClick integration. As I am not doing that exact step all day (even being a data analyst with a focus on web data), I would have to look, where to configure that exactly. That would take longer. So be snarky - I don't care, as I am already preparing for GDPR compliance and will have my house in order come May, 25th. [Edit] Took 12 minutes in the end. Will take some time until caching catches up. Using a incognito instance all good to go regarding the trackers. "Only" the update for the privacy page remains for the weekend to do.
      - leereeves 8y ago
        > the privacy page will be updated to describe, what I am tracking and how long data is being stored. As needed to comply with GDPR/DSGVO. I thought the GDPR required users to opt-in to tracking (if consent is used as the lawful basis for processing), and if they choose not to opt-in, you must disable the tracking while still providing the service. Are you sure just updating your privacy page is enough? Then there are the requirements to allow users to download or delete their data.
  - hartator 8y ago
    Don’t go to this kind of websites then. There is nothing warranting you to kill them though.
- mstolpm 8y ago
  Or perhaps these people/businesses have much more data about you and don't want to share how they monetize their "free" services by selling/renting/aggregating/analyzing your data? Think of all the free apps: I was in a conference with startup founders bragging about the business they make selling the location data of app users by incorporating some third party libraries in their apps without the users knowing. Of course, everything is anonymized, is it? Add-supported websites on the other hand have only to document what is going on and get the consent of the user. That's a simple notification bar with a button, like the cookie notice, plus a page detailing the privacy policy. The GDPR even mentions legitime reasons for collecting, storing and transmitting personal identifiable data like technical or business needs. And in addition, almost all ad networks are going to anonymize IP addresses by stripping some bits and have opt-out features for being profiled.
  - zerostar07 8y ago
    I d wager for the vast amount of websites (>90%) it's just the ads, IPs and email addresses. Most websites have no monetizable use of your private info other than ads.
- rmc 8y ago
  > Ad-supported websites are probably the most common case here, even if the sites don't store any data themselves. Internet advertising is a viper pit of privacy invasion. They didn't get their house in order, and let it turn into the horrible mess it is today, so they shouldn't be surprised that the regulators stepped in.
omginternets 8y ago
I don't think that's fair. I rather think it gets a lot of hate because it leaves a lot to the discretion of the regulators. Overall, the SMEs I talk to don't have a problem with regulating data (most think it will pop the gangrenous ad-tech bubble). It's the lack of predictability that bothers them.
- DanBC 8y ago
  The "lack of predictability" is a good thing. "You're making efforts to comply with the regulations, but could you have a look at how you're storing this and that?" vs "You're not compliant with the regulation so we have to impose a fine" Are you really saying you'd prefer the second?
  - Nasrudith 8y ago
    It is the converse of the second that worries people. Look at an ironically US example of Slingbox forwarding TV antennas to other locations in a 1:1 fashion specifically to not count as rebroadcasting. That took a Supreme Court case and much legal maneuvering to sink something that was legal because they didn't like it. People are rightfully worried about "you followed the law completely but we don't like it so massive fines!".
    - shabble 8y ago
      > People are rightfully worried about "you followed the law completely but we don't like it so massive fines!" That seems largely independent of how precise/vague the laws are, if you're expecting the enforcing party to find a way to get you regardless. The 'defence' here seems to be that you can make a decent argument that you've taken appropriate measures to conform with your [reasonable] interpretation of the rules. The regulator can object (and possibly penalise you) if they think you're not acting in good faith, or you have a grossly unreasonable interpretation of those rules. You can object to an unfair interpretation of the rules by the regulator as well. Either way, if The Powers That Be want you nailed to a wall, they'll find a way, this particular regulation or not.
    - 8y ago
hartator 8y ago
What’s fantastic about it? Worst abusers of privacy are goverments, and nothing has been done in this law to restrict it.
thomaskcr 8y ago
It's not that it's annoying, it's that I literally cannot answer "are we GDPR compliant?". If you search for GDPR IP address, you get a ton of different opinions. Do I need to sanitize logs? How does that fit in with the requirements for security compliance we are also subject to? At the end of the day, I am the one person who has to answer that question/is responsible for being GDPR compliant. I've spent hours doing research, figuring out what we need to do and implementing it -- and it's a hollow victory because even though I've said yes and have 100s of articles/white papers/opinions that back up the decisions I've made, the real answer is still "I don't know". And I absolutely know I'm not alone in this. I got GDPR compliance dropped on my lap because I did security compliance -- if you contrast NIST 800-53/800-171 against GDPR you'll see why people are pissed off. One has clear guidelines with enough room for evolving best practices written by obviously competent/experienced professionals, the other is written as basically "we'll know it when we see it".
- guitarbill 8y ago
  So everything should be written out explicitly, because you'd rather complete a checkbox-ticking exercise rather than thinking about it and do the correct, ethical thing in good faith? Sounds like a win for the GDPR to me, we know rigid checkbox-ticking is ineffective. Apart from that, NIST 800-53/800-171 are catalogs of "security controls and associated assessment procedures" for "Federal Information Systems and Organizations". GDPR is a data protection regulation in the context of the EU legal system. Apples to oranges.
  - spelunker 8y ago
    If I'm going to be fined or penalized for not being compliant then yes, explicit would be nice. Checkboxes sound great.
    - guitarbill 8y ago
      Fair enough. As an implementer at a company, I can understand that sentiment. But the GDPR isn't for companies, it's for users. Laws and regulations tend to stick around for longer than expected, and they're static. Technology and "cyber criminals" are dynamic. For better or worse, the GDPR acknowledges this. I think that's a testament to the Article 29 Working Party, in a world where most politicians are clueless about technology.
Sangermaine 8y ago
> Of course that's annoying from a business perspective, but from an individuals privacy perspective, it's fantastic. So many people are pro-privacy until it affects their bottom line.
gist 8y ago
> The GDPR gets so much hate Hate? Try to think of it from a business in the US perspective that wants to know why they have to (for lack of a better way to put it) bogu to an entity that does not represent them in any way. And the fact that you might sell something or service customers in Europe does not mean you should have to answer to any rules that they setup either. Should the town that I live in and operate a web site out of be able to have rules in place and then go after citizens in the EU for not abiding by them? And actually it's one step further since many of the procedures and rules are being taken broadly and universally even against entities (businesses and us persons) that aren't even covered by the GDPR. And no it's not like 'oh if you want to sell a car in Europe you need to certify this and that' that is not the same thing. Why? Well for one thing the golden rule. If you want that car allowed through the port you need to do what they tell you to do or they have a right to not allow it on their land. In this case their citizens are utilizing US websites and therefore it's on them to determine if they feel the service or product they are getting is fit. I am referring to US businesses that don't have an office or physical presence in Europe. To those that do the 'golden rule' applies.
- ckocagil 8y ago
  There have been many people extradited to the US for infringing US copyright laws.

zerostar07 8y ago

I think it gets "hate" from people who don't have much data but they still have to implement all the requirements, which go beyond than their own data storage. Ad-supported websites are probably the most common case here, even if the sites don't store any data themselves.

sdoering 8y ago
And that is a good thing. This >23 different trackers and adservers just to read crappy news content BS is so nice to be shaken. I really love the GDPR for just making the life for such business models way harder. Implementing data, analytics, tracking and stuff in a way that is compliant with GDPR (or its local equivalents) is doable and from an architectural point of view even interesting imho. I love building GDPR conforming data architectures with my clients right now.
- zerostar07 8y ago
  i suggest you remove the 3 trackers from your blog, or at least let me see it without them. I m not trying to be snarky, just pointing out that removing everything is often very hard.
  - def_true_false 8y ago
    The site linked in their profile works just fine with all JS disabled.
    - sdoering 8y ago
      Thanks. I tried to achieve that. As I am surfing with a lot of JS being blocked/disabled, I wanted my own site to be usable for myself.
    - zerostar07 8y ago
      i did not mean that the site doesnt work without tracking, but according to the law i should have the option to access the site without being tracked.
      - sdoering 8y ago
        No. That is just plainly wrong. GDPR allows for tracking without opt in. It just needs to enable you to opt out of being tracked with for example a link to opt out in the privacy policy page. Something I still plan to make more visible (in the footer or something like that), but is already there [0]. These so called cookie layers are not necessary for tracking. They are not even necessary for first party on site advertising. For that you also do not need consent if you read the GDPR/DSGVO (German version). In the DSGVO it is §6.1f [1] you would want to read about. There is even an elaborate explanation from the German legistlation [2] what "Berechtiges Interesse" ( legitimate interest) exactly means. So to make this short: direct marketing as well as tracking is totally fine even without consent. Give an option to opt out, explain why you need the data, what you do with it and how long you store it as well as a point of contact (for people wishing for their data to be deleted) and you are fine. As long as you do not do profiling or stuff like that. A personal blog/website is then totally fine with GDPR. Btw. you would need to add all of this to your privacy page even if you had no web tracking installed, as your webserver probably would have logging activated. Having an IP address in there make this data fall under the GDPR (at least in Germany). So you would need to explain all that stuff because of the log files non the less. [0]: https://schriftrolle.de/datenschutz https://schriftrolle.de/datenschutz [1]: https://dsgvo-gesetz.de/art-6-dsgvo/ https://dsgvo-gesetz.de/art-6-dsgvo/ [2]: https://dsgvo-gesetz.de/erwaegungsgruende/nr-47/ https://dsgvo-gesetz.de/erwaegungsgruende/nr-47/ [Edit:] Ordered the footnotes
        zerostar07 8y ago
  - sdoering 8y ago
    Well. I know that I have GTM, GA with DC integration (currently) still active on my blog. DC integration will be dropped and the privacy page will be updated to describe, what I am tracking and how long data is being stored. As needed to comply with GDPR/DSGVO. As I am still having 7 days to go and that is just a personal blog, I plan on using my free time to do that (would just take 3 - 5 minutes to disable everything if I wanted to by removing GTM and redeploying). So removing everything is quite easy. It is way more difficult to selectively remove singular features - in this case the DoubleClick integration. As I am not doing that exact step all day (even being a data analyst with a focus on web data), I would have to look, where to configure that exactly. That would take longer. So be snarky - I don't care, as I am already preparing for GDPR compliance and will have my house in order come May, 25th. [Edit] Took 12 minutes in the end. Will take some time until caching catches up. Using a incognito instance all good to go regarding the trackers. "Only" the update for the privacy page remains for the weekend to do.
    - leereeves 8y ago
      > the privacy page will be updated to describe, what I am tracking and how long data is being stored. As needed to comply with GDPR/DSGVO. I thought the GDPR required users to opt-in to tracking (if consent is used as the lawful basis for processing), and if they choose not to opt-in, you must disable the tracking while still providing the service. Are you sure just updating your privacy page is enough? Then there are the requirements to allow users to download or delete their data.
- hartator 8y ago
  Don’t go to this kind of websites then. There is nothing warranting you to kill them though.
mstolpm 8y ago
Or perhaps these people/businesses have much more data about you and don't want to share how they monetize their "free" services by selling/renting/aggregating/analyzing your data? Think of all the free apps: I was in a conference with startup founders bragging about the business they make selling the location data of app users by incorporating some third party libraries in their apps without the users knowing. Of course, everything is anonymized, is it? Add-supported websites on the other hand have only to document what is going on and get the consent of the user. That's a simple notification bar with a button, like the cookie notice, plus a page detailing the privacy policy. The GDPR even mentions legitime reasons for collecting, storing and transmitting personal identifiable data like technical or business needs. And in addition, almost all ad networks are going to anonymize IP addresses by stripping some bits and have opt-out features for being profiled.
- zerostar07 8y ago
  I d wager for the vast amount of websites (>90%) it's just the ads, IPs and email addresses. Most websites have no monetizable use of your private info other than ads.
rmc 8y ago
> Ad-supported websites are probably the most common case here, even if the sites don't store any data themselves. Internet advertising is a viper pit of privacy invasion. They didn't get their house in order, and let it turn into the horrible mess it is today, so they shouldn't be surprised that the regulators stepped in.

omginternets 8y ago

I don't think that's fair. I rather think it gets a lot of hate because it leaves a lot to the discretion of the regulators. Overall, the SMEs I talk to don't have a problem with regulating data (most think it will pop the gangrenous ad-tech bubble). It's the lack of predictability that bothers them.

DanBC 8y ago
The "lack of predictability" is a good thing. "You're making efforts to comply with the regulations, but could you have a look at how you're storing this and that?" vs "You're not compliant with the regulation so we have to impose a fine" Are you really saying you'd prefer the second?
- Nasrudith 8y ago
  It is the converse of the second that worries people. Look at an ironically US example of Slingbox forwarding TV antennas to other locations in a 1:1 fashion specifically to not count as rebroadcasting. That took a Supreme Court case and much legal maneuvering to sink something that was legal because they didn't like it. People are rightfully worried about "you followed the law completely but we don't like it so massive fines!".
  - shabble 8y ago
    > People are rightfully worried about "you followed the law completely but we don't like it so massive fines!" That seems largely independent of how precise/vague the laws are, if you're expecting the enforcing party to find a way to get you regardless. The 'defence' here seems to be that you can make a decent argument that you've taken appropriate measures to conform with your [reasonable] interpretation of the rules. The regulator can object (and possibly penalise you) if they think you're not acting in good faith, or you have a grossly unreasonable interpretation of those rules. You can object to an unfair interpretation of the rules by the regulator as well. Either way, if The Powers That Be want you nailed to a wall, they'll find a way, this particular regulation or not.
  - 8y ago

hartator 8y ago

What’s fantastic about it? Worst abusers of privacy are goverments, and nothing has been done in this law to restrict it.

thomaskcr 8y ago

It's not that it's annoying, it's that I literally cannot answer "are we GDPR compliant?". If you search for GDPR IP address, you get a ton of different opinions. Do I need to sanitize logs? How does that fit in with the requirements for security compliance we are also subject to? At the end of the day, I am the one person who has to answer that question/is responsible for being GDPR compliant. I've spent hours doing research, figuring out what we need to do and implementing it -- and it's a hollow victory because even though I've said yes and have 100s of articles/white papers/opinions that back up the decisions I've made, the real answer is still "I don't know". And I absolutely know I'm not alone in this. I got GDPR compliance dropped on my lap because I did security compliance -- if you contrast NIST 800-53/800-171 against GDPR you'll see why people are pissed off. One has clear guidelines with enough room for evolving best practices written by obviously competent/experienced professionals, the other is written as basically "we'll know it when we see it".

guitarbill 8y ago
So everything should be written out explicitly, because you'd rather complete a checkbox-ticking exercise rather than thinking about it and do the correct, ethical thing in good faith? Sounds like a win for the GDPR to me, we know rigid checkbox-ticking is ineffective. Apart from that, NIST 800-53/800-171 are catalogs of "security controls and associated assessment procedures" for "Federal Information Systems and Organizations". GDPR is a data protection regulation in the context of the EU legal system. Apples to oranges.
- spelunker 8y ago
  If I'm going to be fined or penalized for not being compliant then yes, explicit would be nice. Checkboxes sound great.
  - guitarbill 8y ago
    Fair enough. As an implementer at a company, I can understand that sentiment. But the GDPR isn't for companies, it's for users. Laws and regulations tend to stick around for longer than expected, and they're static. Technology and "cyber criminals" are dynamic. For better or worse, the GDPR acknowledges this. I think that's a testament to the Article 29 Working Party, in a world where most politicians are clueless about technology.

Sangermaine 8y ago

> Of course that's annoying from a business perspective, but from an individuals privacy perspective, it's fantastic. So many people are pro-privacy until it affects their bottom line.

gist 8y ago

> The GDPR gets so much hate Hate? Try to think of it from a business in the US perspective that wants to know why they have to (for lack of a better way to put it) bogu to an entity that does not represent them in any way. And the fact that you might sell something or service customers in Europe does not mean you should have to answer to any rules that they setup either. Should the town that I live in and operate a web site out of be able to have rules in place and then go after citizens in the EU for not abiding by them? And actually it's one step further since many of the procedures and rules are being taken broadly and universally even against entities (businesses and us persons) that aren't even covered by the GDPR. And no it's not like 'oh if you want to sell a car in Europe you need to certify this and that' that is not the same thing. Why? Well for one thing the golden rule. If you want that car allowed through the port you need to do what they tell you to do or they have a right to not allow it on their land. In this case their citizens are utilizing US websites and therefore it's on them to determine if they feel the service or product they are getting is fit. I am referring to US businesses that don't have an office or physical presence in Europe. To those that do the 'golden rule' applies.

ckocagil 8y ago
There have been many people extradited to the US for infringing US copyright laws.