14 ms·

No one’s ready for GDPR

125 points by neuland 8y ago

whataretensors 8y ago
Intelligence agencies are. They are exempt from it and get a monopoly on data collection.
- falcon620 8y ago
  Are you suggesting EU intelligence agencies should abide by the GDPR?
  - sena 8y ago
    They already abide by the GDPR. There are exemptions on the GDPR for: national security; defence; public security; the prevention, investigation, detection or prosecution of criminal offences; etc.
  - whataretensors 8y ago
    I'm suggesting it's a power play from the governments using privacy as an excuse.
- PeterisP 8y ago
  Frankly, I don't see why any business should be competing with intelligence agencies in their "market". It's quite reasonable that our spy agencies which we create for spying have a monopoly on it - just as police should have a monopoly on putting people behind bars and not letting them out, IRS should have a monopoly on collecting taxes from people, and FDA has a monopoly on proclaiming which drugs are safe. If Facebook or Google are gaining some equivalence in capabilities to what the intelligence agencies are supposed to be doing, that's a bad thing and should be stopped.
Mononokay 8y ago
The EU has been way too overbearing lately. I have to say, it's made me a bit more welcome to Brexit happening; taking out one of the more economically-important countries from it should cut its power a bit, along with insuring that there's a decent chance of small businesses and the like to expand into Britain sanely.
- sgift 8y ago
  The UK implements GDPR like every other EU country. Maybe they roll it back when Brexit is done, but I wouldn't hold my breath for it.
  - jkaplowitz 8y ago
    I think Theresa May recently reaffirmed her commitment to GDPR. The UK was even heavily involved in drafting it.
- heavenlyblue 8y ago
  What else did the EU do bad for you?
  - WillPostForFood 8y ago
    Make me click throughly thousands of useless cookie warnings.
    - deleted 8y ago
      [deleted]
    - pjmlp 8y ago
      You know what a cookie is, most non technical people, those whose idea of Internet overlaps with Facebook, do not.
    - davegauer 8y ago
      You know, I used to get really aggravated at those. "This is silly!" I would rant. "Cookies are harmless!" But I've started to come around. Yes, they're still irritating. But I like the fact that site owners have to THINK about how they're irritating their users and I'd like to think they're questioning whether or not they _really_ need to use cookies to serve static content...
      - merinowool 8y ago
cs702 8y ago
Like everyone else, I've been bombarded with numerous "we've updated our privacy policy" emails over the past few weeks. I'm not sure updating privacy policies with CYA language will suffice. The evidence suggests European regulators really want companies to change their behavior.
- vidarh 8y ago
  Well, I've also gotten a ton of "please, please, please confirm that we can keep sending you the e-mails we're sure you really don't want to miss" from companies I don't remember ever dealing with, which I've gleefully ignored, so it seems quite a few companies are changing their behaviour in as much as they seem to be purging their mailing lists. Even if that's all that's achieved, it'd still be a big improvement/
  - neuland 8y ago
    I've got a ton of those too and am skeptical what they accomplish. A lot of the mailing list ones I've seen are opt-in. But, I a lot of the services ones have been "Agree or GTFO", and I don't know how doing that before GDPR drops is going to matter. From what I understand, they can't say that they have consent if it was mandatory to continue using the service.
  - stephengillie 8y ago
    I've gotten these emails from an MFA vendor. I haven't had the time to review and agree to the new privacy policy they've provided. I'm confused about why a business would be impacted by this law, if they are only storing the login data I'm paying for them to store for me. How does the GPDR impact employee auditing requirements? How do I delete your info from my system, and still prove that you only accessed systems to which you were authorized, while you worked for me?
    - bulatb 8y ago
      If the company is storing Personal Data (on people in the EU) or is present in the EU, GDPR applies. They might also be complying voluntarily for various reasons. Data Subjects' rights to their data aren't absolute. If you need it for legal/compliance reasons, or legitimately need to keep it for clearly defensible reasons like auditing, preventing fraud, etc., you aren't required to delete it. But if your only legal basis for processing the data was Subject consent, and they revoke their consent, you are required to delete it. Many companies are treating mailing lists this way and/or are confused and terrified in general, so everyone is getting emails. Some companies are also adding Data Processing Agreements to their terms of service that allow them to be Data Processors for customers. Maybe your MFA vendor is one of those.
captainbland 8y ago
Well it didn't make any odds last quarter so they're only preparing for it now...
tw1010 8y ago
Also true: The news maximizes fearmongering.
roel_v 8y ago
I happened to be looking into pinterest's 'updated privacy policy' for the last 30 mins. They just seems to wiggle and bend in every direction to make it seem like they're complying, but even my blind granny can see they're not. I wonder how companies like them will survive - because their whole existence is based on doing the exact things the gdpr wants to stop.
- Spearchucker 8y ago
  Not sure why the doom and gloom. Because they can carry on as always except in Europe. If that's 90% of their base then yes, they may have problems. For such companies GDPR simply shrinks profits, no?
  - kungtotte 8y ago
    GDPR applies for non-EU based operations as long as the users are EU-based. I guess theoretically they only have to comply with GDPR specifically for EU-based operations and/or EU citizens, so they could technically keep at it if their servers are outside the EU and for any non-EU users. But I think in the long run it'll be easier to have sitewide compliance.
    - dahdum 8y ago
      Sitewide compliance could reduce revenue worldwide, in those cases it could often make sense to exit the EU market entirely.
      - kungtotte 8y ago
        That is of course one alternative. Depending on your business it might be viable, but the EU is a pretty big market to skip out on assuming your business model itself doesn't violate the GDPR.
      - s73v3r_ 8y ago
        If the only reason you're making money is by disrespecting your user's privacy, then one has to question whether you should be in business in the first place.
kikki 8y ago
Apparently neither is The Verge, having a fixed footer popup with the only option being "I Accept" doesn't comply with the guidelines
- nwellnhof 8y ago
  Well, you have the option to leave their website. It's still unclear to me whether this violates the GDPR. Art. 7 (4) of the GDPR says: > When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract. You don't enter a contract when visiting a news site.
  - deleted 8y ago
    [deleted]
- davidhyde 8y ago
  The cookie law was flawed from the beginning because it allowed companies an opt-out mechanism (which we see via these cookie banners). This is even the case if the user does not consent. A company cannot force or even ask a user to opt out of GDPR so, unless a company misreads the law, we won't be seeing useless GDPR banners.
- anewhnaccount2 8y ago
  I believe it's the ePrivacy regulation rather than the GDPR that applies here. It's my understanding that you no longer need permission for certain usages of cookies where they're needed for certain functionality, such as shopping carts - and possibly some degree of tracking -- perhaps -- if some or all of the following are done: * The data isn't retained for too long * IP addresses are anonymised * Session cookies or cookies with a near future expiration date are used * First party cookies are used What exactly you need to do is not always totally clear, but usually the balancing test works like "is it required for legitimate business purposes that the user is likely to expect". If they don't need permission at all, then they're free to ask away. (Although it does show that people have failed to understand these changes in the law.)
gaius 8y ago
I am ready. I have a list of targets already in mind. I’m a big fan of EdX for example but it’s unacceptable that their app wants to talk to connect.facebook.net. I didn’t consent to that and it’s not required to deliver their services. And I did give them fair warning.
- leadingthenet 8y ago
  I hope people will be proactive about this. Even if regulators aren't all that interested, users can do a lot to enforce GDPR, thankfully.
Longhanks 8y ago
As a EU citizen, I certainly am. For too long companies have abused my trust and personal data without any consequences. The general fear shows how deeply necessary a stricter rule set was.
- rubicon33 8y ago
  Almost certainly the "companies" you speak of were entirely FREE services and the "abuse" was really just your lack of understanding that when a service is free, YOU are the product.
  - plussed_reader 8y ago
    Yeah, you're just holding the account wrong. /s
  - Analemma_ 8y ago
    "There has grown up in the minds of certain groups in this country the notion that because a man or corporation has made a profit out of the public for a number of years, the government and the courts are charged with the duty of guaranteeing such profit in the future, even in the face of changing circumstances and contrary to the public interest. This strange doctrine is not supported by statute not common law." - Robert Heinlein The EU is under no obligation to allow the business model of "free, but paid for by selling your data" to continue to exist, just because it has existed until now.
trqx 8y ago
Well, I cannot read the article on mobile without agreeing to being tracked, the popup takes 3/4th of the screen. Ain't it the browser's job to display an agree/deny message for cookie tracking per domain? This seems backward to me as the page is already asking the browser to agree to storing cookie. As of now I need an extension in order to block cookies by default and whitelist them accordingly to my needs. > We use cookies and other tracking technologies _to improve your browsing experience on our site_. That looks like a lie to me. Is there anything stopping them from creating a cookie only once/if I login?
- Crespyl 8y ago
  > improve your browsing experience In advertiser-speak, "relevant and interesting ads" are an "improvement to your browsing experience". Actual end-users may have a slightly different interpretation on what constitutes an "improvement".
  - aianus 8y ago
    As a childless man, for example, are relevant and interesting ads not an improvement over the tampon and diaper ads that are all over TV?
    - s73v3r_ 8y ago
      Not really, considering that means all my data is being scattered to the winds of the internet.
    - PeterisP 8y ago
      It certainly may be, and it's your choice to make (if you wish so) by opting in to targeted advertising. What's wrong (and, in a few days, illegal) is for the service provider to assume that everyone will prefer that.
mtgx 8y ago
They had two years to comply. But most weren't aware aware of it for the first year, and then they only started looking into being compliant with it a few months ago. It's not the EU's fault then are not ready. I don't think announcing the law 5 years earlier would have helped many more companies to comply before the due date.
dwrowe 8y ago
Genuine question as it pertains to US-based companies. How can a foreign law have such seemingly deep impact on US-based companies, let alone, situations where the visitor is not paying for services? Maybe this gets into International Law, but even if I'm not _targeting_ European visitors, say they cross some threshold by percentage compared to US visitors - why must I abide by a foreign law?
- kazen44 8y ago
  because the EU has enough global influence in terms of it economic power that it is able to hurt economic interests of US companies who want to operate in the EU. For most of the world, this has been true in regards to following US laws for a long time. (DMCA, copyright law) In the end, international law is mostly a game of (economic) influence, and the EU is economically significant enough for these companies for EU law to matter.
  - chimeracoder 8y ago
    > For most of the world, this has been true in regards to following US laws for a long time. (DMCA, copyright law) Let's not pretend that the US is unilaterally shoving copyright law onto the rest of the world. When the US made its last major overhaul of the copyright system, it was to harmonize copyright law with what already existed in Europe. In addition, the EU already signed onto the TTIP, which is a massive concession to the media industry on copyright. That wasn't due to US influence; in fact, the US backed out of the TPP.
    - kazen44 8y ago
      > the EU already signed the TTIP, which is a massive concession to the media industry on copyright. That wasn't due to US influence; in fact, the US backed out of the TPP. TTIP was NOT signed into law already. It is also a completely different treaty from TTP. (TTP has nothing to do with the EU btw).
      - chimeracoder 8y ago
kerrsclyde 8y ago
I have been helping a school who I do IT work for with their GDPR roll out - not because it is my area of expertise but because they had nobody else to turn to and the Local Authority who control the school have released zero guidance in preparation. There are many, many unresolved issues: We are supposed to employ a 'data officer' this basically cannot be anyone who works in the school at present. We sought volunteers but didn't get a single applicant. It is difficult to justify paying someone to do it (if you can find a qualified person) - the budget for things like school books is already paper thin. I contact external suppliers who use our data and receive a wall of silence. Things like publicly visible visitors books are outlawed (depending on how you read guidance), the alternative are electronic systems - more cost. Displaying certain sensitive information, prescriptions for pupils, are now outlawed, this could compromise safety. There seems to be a raft of GDPR training systems which are basically a single page questionnaire, costing upwards of £300. I don't have an issue with what the legislation is trying to do it just seems so vaguely implemented. Basically we all know that the organisations who need to clean up their act will be doing the least to comply.
- castlecrasher2 8y ago
  > Things like publicly visible visitors books are outlawed Does this mean the quaint guest book visitors could sign at the hotel I stayed in a couple weeks ago would be illegal under the GDPR?
  - kerrsclyde 8y ago
    We have been told so, if you are publicly displaying personal information about an individual without their permission. Of course their are ways around this, using a single sheet for each person for example.
  - guitarbill 8y ago
    FFS, no. It's optional, you volunteered the data, and the data is used for it's intended purposes. This is still fine. (What wouldn't be fine is scraping the guest book, and then using that info)
trothamel 8y ago
I think the EU just kind of tipped their hand when questioning Zuckerberg, German MEP Manfred Weber asked whether the Facebook CEO could name a single European alternative to his “empire”. https://www.theverge.com/2018/5/22/17380982/mark-zuckerberg-european-parliament-meeting-monopoly-antitrust-breakup-question https://www.theverge.com/2018/5/22/17380982/mark-zuckerberg-... This sure seems like the EU trying to toss up arbitrary laws because they can't compete with American companies.
- Vinnl 8y ago
  I don't think the EU is such a monolithic entity as you seem to presume by referring to a single MEP's comment...
- deleted 8y ago
  [deleted]
davidhyde 8y ago
It's refreshing to see an objective article written about this subject. They presented plenty of facts from both sides of the argument and left the subjectivity up to the reader. Well done.
joering2 8y ago
I already benefit from GDPR - here is a constant spammer of my maiblox from channelwisewq.im and now I wanted to know whos behind. Ups... https://snag.gy/4nAZOw.jpg https://snag.gy/4nAZOw.jpg
mykull 8y ago
Lots of companies are ready for GDPR, i.e. the ones that handle user information responsibly in the first place, and aren't opaque data hoarders as a central part of their business model. I'm personally not a fan of the "lets collect it because we can" mentality. "Data is the new oil" is a great analogy because not only is it valuable, the industry of data gathering is booming with little to no care about the side effects or long term consequences. Had the right to privacy been enshrined in protective laws much earlier, requiring explicit consent to profile peoples behavior as it pertains to technology, things would obviously be a lot different. Obstacles often represent opportunities for improvement. Hypothesizing: 1. Alternatives to traditional advertising as a method for creating markets for products and services would have a better chance of taking off. A world where we have a relationship with the source of product/service introductions, where we can discriminate and depend on them to discriminate, could prevent a lot of manipulative, misleading and damaging crap from reaching people, and ensure demand goes to the highest quality products/services. 2. The difficulty of gathering would drive the value of peoples personal information higher, likely leading to better protection i.e. more careful handling, fewer data breaches and leaks. 3. A lot of "wasted effort" gathering and storing information as part of this data frenzy that ultimately doesn't provide value to anyone, despite all the moving money, could have been avoided.
- andybak 8y ago
  > the ones that handle user information responsibly in the first place, and aren't opaque data hoarders as a central part of their business model. Do you only acknowledge the existence of these two categories? So only "data hoarders" would struggle with becoming GDPR compliant? I've got clients in the charitable sector having to reconfirm their entire contact list - 99% of whom would be happy to stay in touch - because the provenance isn't up to GDPR standards. We're expecting to lose most of those because people forget to respond to yet another GDPR request. Expensive audits and code reviews, re-architecting parts of the system that accidentally record fairly innocent personal data (IP addresses in logs and backups, historical shop order data, Test data copied from live data. Staging servers and all the other places that data ends up in when a website has been around for a decade or more) Yes - this data could potentially be misused and it would have been wonderful to have anticipated when the system was originally built but that was in a more innocent age and nobody could have made a business case for it back then. I would argue that the cost to organisations (many of whom are non-profit) vs the benefits to users is fairly out of kilter. Protecting user data perfectly is a noble aim but perfection costs.
the_watcher 8y ago
Only tangentially related but I've found it somewhat ironic that GDPR has resulted in an extreme increase in communications from companies whose email marketing I've unsubscribed from as every company with my email address sends me their updated terms of service, most of which contain marketing surrounding their "transactional" email.
waiseristy 8y ago
“Companies, especially US companies, are definitely scrambling here in the last month to get themselves ready.” https://en.wikipedia.org/wiki/General_Data_Protection_Regulation#Timeline https://en.wikipedia.org/wiki/General_Data_Protection_Regula... They had two years to prepare for this
- dmitriid 8y ago
  I love the "especially US companies" bit. US companies have long assumed any laws are just words on paper that don't apply to them. I really truly hope GDPR hits many of these (and similar companies) really hard.
Quanttek 8y ago
> After four years of deliberation, the General Data Protection Regulation (GDPR) was officially adopted by the European Union in 2016. The regulation gave companies a two-year runway to get compliant, which is theoretically plenty of time to get shipshape. The reality is messier. Like term papers and tax returns, there are people who get it done early, and then there’s the rest of us. That gets me the most. It seems like most companies didn't give a single f*ck about the legislation until maybe the beginning of this year - many far later. Of course, they are scrambling now to comply because they didn't start early enough
- js8 8y ago
  Come on, that's just the markets being rational. I, for one, am glad that my procrastination problem is finally validated as rational by market forces! (I find it very intriguing to find parallels between human, supposedly irrational, behavior, and organizational behavior that results as a consequence of rational - or at least explainable - behavior of many selfish actors.)
padolsey 8y ago
I feel really bad for smaller companies/orgs. I've received countless emails from various businesses I've had interactions with over the years. I've seen the full gamut of messaging -- from "changes in our privacy policy" to "please fill out this entire sign-up form again with your details" to "please send us an email if you wish to unsubscribe". It's obvious that it's entirely unclear to businesses what they should be doing here. So they're all just cargo-culting off each-other, hoping that they're sufficiently covered. I feel bad because I know those who don't have the time, money or knowledge to properly deal with this are going to end up losing their only communication avenue with customers. Customers, too, do not understand the gravity of these new opt-in affirmations. It seems utterly beholden on our regulators to not only regulate, but to regulate clearly so that the 'reasonable person' has a chance in hell of abiding to-the-letter.
- lovich 8y ago
  European companies don't appear to be having this problem. This seems more like a case of US companies having no experience with being forced to follow other groups laws if they want money. We've gone off of what, 60-70 years of the US forcing other countries time make it easier for our businesses? The only other time I've seen something similar is when China started enforcing their laws heavily, and many companies just pulled out
  - test525 8y ago
    > European companies don't appear to be having this problem Did you miss the articles of EU based small projects shutting down operations? Also, do small web based tech companies even exist in Europe? When I look all I see are medium to large 90s era b2b tech companies.
- ekianjo 8y ago
  > I feel really bad for smaller companies/orgs. Just like everywhere else, the (continuous) addition of regulations favors the larger, entrenched actors who can afford to deal with them. That's always the pernicious effect of too much regulatory load that states should be really aware of.
aaronbwebber 8y ago
This quote is bonkers: > like “an oblique reference, like the tall bald guy who lives on East 18th Street. If someone said that in an email, that would be information you’d need to provide me with access to under the GDPR,” says Straight. I have no idea how anyone who deal with user-generated content can possibly comply with that. Even if you had an actual person reading through all your content to try and find data related to "Jason Straight", without personally knowing him there's no way they would know that this is referring to that person. I see a lot of complaints about 1500 page bills in front of Congress and so on, but this kind of nonsense is exactly why you need 1500 pages of dense, precise language to define these laws.
teamhappy 8y ago
Talked to my mother the other day. She works at a tiny local (German) home care company. (That means 5 middle-aged women in an office and a bunch of nurses on wheels.) They've been ready for GDPR for a year now, including sending their new data officer to the required seminars and whatnot.
ddlatham 8y ago
Many grocery stores offer memberships where they offer customers discounts in exchange for the customers using an ID to help the store track their purchases. Such arrangements appear to be voluntary and desirable for both consumers and stores. Would such an arrangement fly under the GDPR? It would seem that if consent has to be freely given, and not conditioned on something like a cheaper price, then the GDPR would not allow the grocery stores to give discounts only to people who agreed to the membership and tracking.
- PeterisP 8y ago
  Yes, there are a bunch of problems with that business model now. 1. GDPR prohibits "bundling" of consent. Usage of your private data for, say, physically making a membership card should have separate consent than using that same data for tracking you; the fact that you want membership (and consent to it) cannot imply that you must also want tracking. 2. GDPR requests that you must be able to withdraw consent without detriment. That ties in directly to cheaper price. 3. In general, GDPR declares that permission to use your data is not something that can be "traded away" in a contract, that privacy is a core right and thus you can't enter into a voluntary contract saying, for example "I give Bob $5, Bob allows me to use his data" - or, more exactly, you may sign the contract, but the clause that gives permission to use data would automatically be null and void, and Bob could revoke consent without detriment anyway. Exactly as it is with binding arbitration and many other clauses in consumer contracts; in EU there are many aspects that can't really be given away in voluntary contracts - as far as I understand, common law has a bit different approach and tradition regarding contracts in this aspect than civil law in core EU countries, EU law doesn't shy away from regulating what a contract may include (or what can be binding if included) even if both parties agree to it.
  - ddlatham 8y ago
    That seems unfortunate for businesses like those grocery stores, and for their consumers.
    - PeterisP 8y ago
ggg9990 8y ago
The GDPR exists for the EU to help itself to some $billion of the >$1 trillion increase in the value of US tech companies over the last three years. If you live in the real world, and not in the theoretical world of law as written, you don’t have to worry about a thing unless you’ve got a business as profitable as Facebook or as abusive as Unroll.me.
xiangservices 8y ago
Hello there for any cyber hacking service Xiang services delivers a quality service in various platforms of hacking. Hacking Services : -Mspy application ( Features > Call logs, Location, messages, images emails). The application allows you spy on targets cell phone. - Crediting an account (Terms and conditions applied). - Changing database information. - Changing school grades . -Money transfer. -Activation of firewalls. - Retrieval of deleted message. All hacking services above, for service rendered. Contact xiangvadm98090 @gmail. com Text no: +1(423)-212-6649. Whatsapp no:+1(781)-720-7259. Keep in touch
paxunix 8y ago
So when does the cottage industry of companies spring up that take data deletion requests in bulk from classes of EU citizens and batch them up for submission en masse to BigCo? And then also sell you a monitoring service to make sure that BigCo actually did go and delete all the data they were using (at least, that which is publicly visible)? And then when they find that one piece of data that wasn't deleted, sue BigCo? It's probably far-fetched to think there's DDOS potential here for a company's data officer(s), but when do the bot farm service vendors craft significant numbers of realistic user accounts and then use the above companies to drown BigCo in deletion requests for those fake users?
tango12 8y ago
I've been getting opt-out emails instead of opt-in? Isn't that exactly what GDPR said not to do?

125 points by neuland 8y ago

whataretensors 8y ago

Intelligence agencies are. They are exempt from it and get a monopoly on data collection.

falcon620 8y ago
Are you suggesting EU intelligence agencies should abide by the GDPR?
- sena 8y ago
  They already abide by the GDPR. There are exemptions on the GDPR for: national security; defence; public security; the prevention, investigation, detection or prosecution of criminal offences; etc.
- whataretensors 8y ago
  I'm suggesting it's a power play from the governments using privacy as an excuse.
PeterisP 8y ago
Frankly, I don't see why any business should be competing with intelligence agencies in their "market". It's quite reasonable that our spy agencies which we create for spying have a monopoly on it - just as police should have a monopoly on putting people behind bars and not letting them out, IRS should have a monopoly on collecting taxes from people, and FDA has a monopoly on proclaiming which drugs are safe. If Facebook or Google are gaining some equivalence in capabilities to what the intelligence agencies are supposed to be doing, that's a bad thing and should be stopped.

Mononokay 8y ago

The EU has been way too overbearing lately. I have to say, it's made me a bit more welcome to Brexit happening; taking out one of the more economically-important countries from it should cut its power a bit, along with insuring that there's a decent chance of small businesses and the like to expand into Britain sanely.

sgift 8y ago
The UK implements GDPR like every other EU country. Maybe they roll it back when Brexit is done, but I wouldn't hold my breath for it.
- jkaplowitz 8y ago
  I think Theresa May recently reaffirmed her commitment to GDPR. The UK was even heavily involved in drafting it.
heavenlyblue 8y ago
What else did the EU do bad for you?
- WillPostForFood 8y ago
  Make me click throughly thousands of useless cookie warnings.
  - deleted 8y ago
    [deleted]
  - pjmlp 8y ago
    You know what a cookie is, most non technical people, those whose idea of Internet overlaps with Facebook, do not.
  - davegauer 8y ago
    You know, I used to get really aggravated at those. "This is silly!" I would rant. "Cookies are harmless!" But I've started to come around. Yes, they're still irritating. But I like the fact that site owners have to THINK about how they're irritating their users and I'd like to think they're questioning whether or not they _really_ need to use cookies to serve static content...
    - merinowool 8y ago

cs702 8y ago

Like everyone else, I've been bombarded with numerous "we've updated our privacy policy" emails over the past few weeks. I'm not sure updating privacy policies with CYA language will suffice. The evidence suggests European regulators really want companies to change their behavior.

vidarh 8y ago
Well, I've also gotten a ton of "please, please, please confirm that we can keep sending you the e-mails we're sure you really don't want to miss" from companies I don't remember ever dealing with, which I've gleefully ignored, so it seems quite a few companies are changing their behaviour in as much as they seem to be purging their mailing lists. Even if that's all that's achieved, it'd still be a big improvement/
- neuland 8y ago
  I've got a ton of those too and am skeptical what they accomplish. A lot of the mailing list ones I've seen are opt-in. But, I a lot of the services ones have been "Agree or GTFO", and I don't know how doing that before GDPR drops is going to matter. From what I understand, they can't say that they have consent if it was mandatory to continue using the service.
- stephengillie 8y ago
  I've gotten these emails from an MFA vendor. I haven't had the time to review and agree to the new privacy policy they've provided. I'm confused about why a business would be impacted by this law, if they are only storing the login data I'm paying for them to store for me. How does the GPDR impact employee auditing requirements? How do I delete your info from my system, and still prove that you only accessed systems to which you were authorized, while you worked for me?
  - bulatb 8y ago
    If the company is storing Personal Data (on people in the EU) or is present in the EU, GDPR applies. They might also be complying voluntarily for various reasons. Data Subjects' rights to their data aren't absolute. If you need it for legal/compliance reasons, or legitimately need to keep it for clearly defensible reasons like auditing, preventing fraud, etc., you aren't required to delete it. But if your only legal basis for processing the data was Subject consent, and they revoke their consent, you are required to delete it. Many companies are treating mailing lists this way and/or are confused and terrified in general, so everyone is getting emails. Some companies are also adding Data Processing Agreements to their terms of service that allow them to be Data Processors for customers. Maybe your MFA vendor is one of those.

captainbland 8y ago

Well it didn't make any odds last quarter so they're only preparing for it now...

tw1010 8y ago

Also true: The news maximizes fearmongering.

roel_v 8y ago

I happened to be looking into pinterest's 'updated privacy policy' for the last 30 mins. They just seems to wiggle and bend in every direction to make it seem like they're complying, but even my blind granny can see they're not. I wonder how companies like them will survive - because their whole existence is based on doing the exact things the gdpr wants to stop.

Spearchucker 8y ago
Not sure why the doom and gloom. Because they can carry on as always except in Europe. If that's 90% of their base then yes, they may have problems. For such companies GDPR simply shrinks profits, no?
- kungtotte 8y ago
  GDPR applies for non-EU based operations as long as the users are EU-based. I guess theoretically they only have to comply with GDPR specifically for EU-based operations and/or EU citizens, so they could technically keep at it if their servers are outside the EU and for any non-EU users. But I think in the long run it'll be easier to have sitewide compliance.
  - dahdum 8y ago
    Sitewide compliance could reduce revenue worldwide, in those cases it could often make sense to exit the EU market entirely.
    - kungtotte 8y ago
      That is of course one alternative. Depending on your business it might be viable, but the EU is a pretty big market to skip out on assuming your business model itself doesn't violate the GDPR.
    - s73v3r_ 8y ago
      If the only reason you're making money is by disrespecting your user's privacy, then one has to question whether you should be in business in the first place.

kikki 8y ago

Apparently neither is The Verge, having a fixed footer popup with the only option being "I Accept" doesn't comply with the guidelines

nwellnhof 8y ago
Well, you have the option to leave their website. It's still unclear to me whether this violates the GDPR. Art. 7 (4) of the GDPR says: > When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract. You don't enter a contract when visiting a news site.
- deleted 8y ago
  [deleted]
davidhyde 8y ago
The cookie law was flawed from the beginning because it allowed companies an opt-out mechanism (which we see via these cookie banners). This is even the case if the user does not consent. A company cannot force or even ask a user to opt out of GDPR so, unless a company misreads the law, we won't be seeing useless GDPR banners.
anewhnaccount2 8y ago
I believe it's the ePrivacy regulation rather than the GDPR that applies here. It's my understanding that you no longer need permission for certain usages of cookies where they're needed for certain functionality, such as shopping carts - and possibly some degree of tracking -- perhaps -- if some or all of the following are done: * The data isn't retained for too long * IP addresses are anonymised * Session cookies or cookies with a near future expiration date are used * First party cookies are used What exactly you need to do is not always totally clear, but usually the balancing test works like "is it required for legitimate business purposes that the user is likely to expect". If they don't need permission at all, then they're free to ask away. (Although it does show that people have failed to understand these changes in the law.)

gaius 8y ago

I am ready. I have a list of targets already in mind. I’m a big fan of EdX for example but it’s unacceptable that their app wants to talk to connect.facebook.net. I didn’t consent to that and it’s not required to deliver their services. And I did give them fair warning.

leadingthenet 8y ago
I hope people will be proactive about this. Even if regulators aren't all that interested, users can do a lot to enforce GDPR, thankfully.

Longhanks 8y ago

As a EU citizen, I certainly am. For too long companies have abused my trust and personal data without any consequences. The general fear shows how deeply necessary a stricter rule set was.

rubicon33 8y ago
Almost certainly the "companies" you speak of were entirely FREE services and the "abuse" was really just your lack of understanding that when a service is free, YOU are the product.
- plussed_reader 8y ago
  Yeah, you're just holding the account wrong. /s
- Analemma_ 8y ago
  "There has grown up in the minds of certain groups in this country the notion that because a man or corporation has made a profit out of the public for a number of years, the government and the courts are charged with the duty of guaranteeing such profit in the future, even in the face of changing circumstances and contrary to the public interest. This strange doctrine is not supported by statute not common law." - Robert Heinlein The EU is under no obligation to allow the business model of "free, but paid for by selling your data" to continue to exist, just because it has existed until now.

trqx 8y ago

Well, I cannot read the article on mobile without agreeing to being tracked, the popup takes 3/4th of the screen. Ain't it the browser's job to display an agree/deny message for cookie tracking per domain? This seems backward to me as the page is already asking the browser to agree to storing cookie. As of now I need an extension in order to block cookies by default and whitelist them accordingly to my needs. > We use cookies and other tracking technologies _to improve your browsing experience on our site_. That looks like a lie to me. Is there anything stopping them from creating a cookie only once/if I login?

Crespyl 8y ago
> improve your browsing experience In advertiser-speak, "relevant and interesting ads" are an "improvement to your browsing experience". Actual end-users may have a slightly different interpretation on what constitutes an "improvement".
- aianus 8y ago
  As a childless man, for example, are relevant and interesting ads not an improvement over the tampon and diaper ads that are all over TV?
  - s73v3r_ 8y ago
    Not really, considering that means all my data is being scattered to the winds of the internet.
  - PeterisP 8y ago
    It certainly may be, and it's your choice to make (if you wish so) by opting in to targeted advertising. What's wrong (and, in a few days, illegal) is for the service provider to assume that everyone will prefer that.

mtgx 8y ago

They had two years to comply. But most weren't aware aware of it for the first year, and then they only started looking into being compliant with it a few months ago. It's not the EU's fault then are not ready. I don't think announcing the law 5 years earlier would have helped many more companies to comply before the due date.

dwrowe 8y ago

Genuine question as it pertains to US-based companies. How can a foreign law have such seemingly deep impact on US-based companies, let alone, situations where the visitor is not paying for services? Maybe this gets into International Law, but even if I'm not _targeting_ European visitors, say they cross some threshold by percentage compared to US visitors - why must I abide by a foreign law?

kazen44 8y ago
because the EU has enough global influence in terms of it economic power that it is able to hurt economic interests of US companies who want to operate in the EU. For most of the world, this has been true in regards to following US laws for a long time. (DMCA, copyright law) In the end, international law is mostly a game of (economic) influence, and the EU is economically significant enough for these companies for EU law to matter.
- chimeracoder 8y ago
  > For most of the world, this has been true in regards to following US laws for a long time. (DMCA, copyright law) Let's not pretend that the US is unilaterally shoving copyright law onto the rest of the world. When the US made its last major overhaul of the copyright system, it was to harmonize copyright law with what already existed in Europe. In addition, the EU already signed onto the TTIP, which is a massive concession to the media industry on copyright. That wasn't due to US influence; in fact, the US backed out of the TPP.
  - kazen44 8y ago
    > the EU already signed the TTIP, which is a massive concession to the media industry on copyright. That wasn't due to US influence; in fact, the US backed out of the TPP. TTIP was NOT signed into law already. It is also a completely different treaty from TTP. (TTP has nothing to do with the EU btw).
    - chimeracoder 8y ago

kerrsclyde 8y ago

I have been helping a school who I do IT work for with their GDPR roll out - not because it is my area of expertise but because they had nobody else to turn to and the Local Authority who control the school have released zero guidance in preparation. There are many, many unresolved issues: We are supposed to employ a 'data officer' this basically cannot be anyone who works in the school at present. We sought volunteers but didn't get a single applicant. It is difficult to justify paying someone to do it (if you can find a qualified person) - the budget for things like school books is already paper thin. I contact external suppliers who use our data and receive a wall of silence. Things like publicly visible visitors books are outlawed (depending on how you read guidance), the alternative are electronic systems - more cost. Displaying certain sensitive information, prescriptions for pupils, are now outlawed, this could compromise safety. There seems to be a raft of GDPR training systems which are basically a single page questionnaire, costing upwards of £300. I don't have an issue with what the legislation is trying to do it just seems so vaguely implemented. Basically we all know that the organisations who need to clean up their act will be doing the least to comply.

castlecrasher2 8y ago
> Things like publicly visible visitors books are outlawed Does this mean the quaint guest book visitors could sign at the hotel I stayed in a couple weeks ago would be illegal under the GDPR?
- kerrsclyde 8y ago
  We have been told so, if you are publicly displaying personal information about an individual without their permission. Of course their are ways around this, using a single sheet for each person for example.
- guitarbill 8y ago
  FFS, no. It's optional, you volunteered the data, and the data is used for it's intended purposes. This is still fine. (What wouldn't be fine is scraping the guest book, and then using that info)

trothamel 8y ago

I think the EU just kind of tipped their hand when questioning Zuckerberg, German MEP Manfred Weber asked whether the Facebook CEO could name a single European alternative to his “empire”. https://www.theverge.com/2018/5/22/17380982/mark-zuckerberg-european-parliament-meeting-monopoly-antitrust-breakup-question https://www.theverge.com/2018/5/22/17380982/mark-zuckerberg-... This sure seems like the EU trying to toss up arbitrary laws because they can't compete with American companies.

Vinnl 8y ago
I don't think the EU is such a monolithic entity as you seem to presume by referring to a single MEP's comment...
deleted 8y ago
[deleted]

davidhyde 8y ago

It's refreshing to see an objective article written about this subject. They presented plenty of facts from both sides of the argument and left the subjectivity up to the reader. Well done.

joering2 8y ago

I already benefit from GDPR - here is a constant spammer of my maiblox from channelwisewq.im and now I wanted to know whos behind. Ups... https://snag.gy/4nAZOw.jpg https://snag.gy/4nAZOw.jpg

mykull 8y ago

Lots of companies are ready for GDPR, i.e. the ones that handle user information responsibly in the first place, and aren't opaque data hoarders as a central part of their business model. I'm personally not a fan of the "lets collect it because we can" mentality. "Data is the new oil" is a great analogy because not only is it valuable, the industry of data gathering is booming with little to no care about the side effects or long term consequences. Had the right to privacy been enshrined in protective laws much earlier, requiring explicit consent to profile peoples behavior as it pertains to technology, things would obviously be a lot different. Obstacles often represent opportunities for improvement. Hypothesizing: 1. Alternatives to traditional advertising as a method for creating markets for products and services would have a better chance of taking off. A world where we have a relationship with the source of product/service introductions, where we can discriminate and depend on them to discriminate, could prevent a lot of manipulative, misleading and damaging crap from reaching people, and ensure demand goes to the highest quality products/services. 2. The difficulty of gathering would drive the value of peoples personal information higher, likely leading to better protection i.e. more careful handling, fewer data breaches and leaks. 3. A lot of "wasted effort" gathering and storing information as part of this data frenzy that ultimately doesn't provide value to anyone, despite all the moving money, could have been avoided.

andybak 8y ago
> the ones that handle user information responsibly in the first place, and aren't opaque data hoarders as a central part of their business model. Do you only acknowledge the existence of these two categories? So only "data hoarders" would struggle with becoming GDPR compliant? I've got clients in the charitable sector having to reconfirm their entire contact list - 99% of whom would be happy to stay in touch - because the provenance isn't up to GDPR standards. We're expecting to lose most of those because people forget to respond to yet another GDPR request. Expensive audits and code reviews, re-architecting parts of the system that accidentally record fairly innocent personal data (IP addresses in logs and backups, historical shop order data, Test data copied from live data. Staging servers and all the other places that data ends up in when a website has been around for a decade or more) Yes - this data could potentially be misused and it would have been wonderful to have anticipated when the system was originally built but that was in a more innocent age and nobody could have made a business case for it back then. I would argue that the cost to organisations (many of whom are non-profit) vs the benefits to users is fairly out of kilter. Protecting user data perfectly is a noble aim but perfection costs.

the_watcher 8y ago

Only tangentially related but I've found it somewhat ironic that GDPR has resulted in an extreme increase in communications from companies whose email marketing I've unsubscribed from as every company with my email address sends me their updated terms of service, most of which contain marketing surrounding their "transactional" email.

waiseristy 8y ago

“Companies, especially US companies, are definitely scrambling here in the last month to get themselves ready.” https://en.wikipedia.org/wiki/General_Data_Protection_Regulation#Timeline https://en.wikipedia.org/wiki/General_Data_Protection_Regula... They had two years to prepare for this

dmitriid 8y ago
I love the "especially US companies" bit. US companies have long assumed any laws are just words on paper that don't apply to them. I really truly hope GDPR hits many of these (and similar companies) really hard.

Quanttek 8y ago

> After four years of deliberation, the General Data Protection Regulation (GDPR) was officially adopted by the European Union in 2016. The regulation gave companies a two-year runway to get compliant, which is theoretically plenty of time to get shipshape. The reality is messier. Like term papers and tax returns, there are people who get it done early, and then there’s the rest of us. That gets me the most. It seems like most companies didn't give a single f*ck about the legislation until maybe the beginning of this year - many far later. Of course, they are scrambling now to comply because they didn't start early enough

js8 8y ago
Come on, that's just the markets being rational. I, for one, am glad that my procrastination problem is finally validated as rational by market forces! (I find it very intriguing to find parallels between human, supposedly irrational, behavior, and organizational behavior that results as a consequence of rational - or at least explainable - behavior of many selfish actors.)

padolsey 8y ago

I feel really bad for smaller companies/orgs. I've received countless emails from various businesses I've had interactions with over the years. I've seen the full gamut of messaging -- from "changes in our privacy policy" to "please fill out this entire sign-up form again with your details" to "please send us an email if you wish to unsubscribe". It's obvious that it's entirely unclear to businesses what they should be doing here. So they're all just cargo-culting off each-other, hoping that they're sufficiently covered. I feel bad because I know those who don't have the time, money or knowledge to properly deal with this are going to end up losing their only communication avenue with customers. Customers, too, do not understand the gravity of these new opt-in affirmations. It seems utterly beholden on our regulators to not only regulate, but to regulate clearly so that the 'reasonable person' has a chance in hell of abiding to-the-letter.

lovich 8y ago
European companies don't appear to be having this problem. This seems more like a case of US companies having no experience with being forced to follow other groups laws if they want money. We've gone off of what, 60-70 years of the US forcing other countries time make it easier for our businesses? The only other time I've seen something similar is when China started enforcing their laws heavily, and many companies just pulled out
- test525 8y ago
  > European companies don't appear to be having this problem Did you miss the articles of EU based small projects shutting down operations? Also, do small web based tech companies even exist in Europe? When I look all I see are medium to large 90s era b2b tech companies.
ekianjo 8y ago
> I feel really bad for smaller companies/orgs. Just like everywhere else, the (continuous) addition of regulations favors the larger, entrenched actors who can afford to deal with them. That's always the pernicious effect of too much regulatory load that states should be really aware of.

aaronbwebber 8y ago

This quote is bonkers: > like “an oblique reference, like the tall bald guy who lives on East 18th Street. If someone said that in an email, that would be information you’d need to provide me with access to under the GDPR,” says Straight. I have no idea how anyone who deal with user-generated content can possibly comply with that. Even if you had an actual person reading through all your content to try and find data related to "Jason Straight", without personally knowing him there's no way they would know that this is referring to that person. I see a lot of complaints about 1500 page bills in front of Congress and so on, but this kind of nonsense is exactly why you need 1500 pages of dense, precise language to define these laws.

teamhappy 8y ago

Talked to my mother the other day. She works at a tiny local (German) home care company. (That means 5 middle-aged women in an office and a bunch of nurses on wheels.) They've been ready for GDPR for a year now, including sending their new data officer to the required seminars and whatnot.

ddlatham 8y ago

Many grocery stores offer memberships where they offer customers discounts in exchange for the customers using an ID to help the store track their purchases. Such arrangements appear to be voluntary and desirable for both consumers and stores. Would such an arrangement fly under the GDPR? It would seem that if consent has to be freely given, and not conditioned on something like a cheaper price, then the GDPR would not allow the grocery stores to give discounts only to people who agreed to the membership and tracking.

PeterisP 8y ago
Yes, there are a bunch of problems with that business model now. 1. GDPR prohibits "bundling" of consent. Usage of your private data for, say, physically making a membership card should have separate consent than using that same data for tracking you; the fact that you want membership (and consent to it) cannot imply that you must also want tracking. 2. GDPR requests that you must be able to withdraw consent without detriment. That ties in directly to cheaper price. 3. In general, GDPR declares that permission to use your data is not something that can be "traded away" in a contract, that privacy is a core right and thus you can't enter into a voluntary contract saying, for example "I give Bob $5, Bob allows me to use his data" - or, more exactly, you may sign the contract, but the clause that gives permission to use data would automatically be null and void, and Bob could revoke consent without detriment anyway. Exactly as it is with binding arbitration and many other clauses in consumer contracts; in EU there are many aspects that can't really be given away in voluntary contracts - as far as I understand, common law has a bit different approach and tradition regarding contracts in this aspect than civil law in core EU countries, EU law doesn't shy away from regulating what a contract may include (or what can be binding if included) even if both parties agree to it.
- ddlatham 8y ago
  That seems unfortunate for businesses like those grocery stores, and for their consumers.
  - PeterisP 8y ago

ggg9990 8y ago

The GDPR exists for the EU to help itself to some $billion of the >$1 trillion increase in the value of US tech companies over the last three years. If you live in the real world, and not in the theoretical world of law as written, you don’t have to worry about a thing unless you’ve got a business as profitable as Facebook or as abusive as Unroll.me.

xiangservices 8y ago

Hello there for any cyber hacking service Xiang services delivers a quality service in various platforms of hacking. Hacking Services : -Mspy application ( Features > Call logs, Location, messages, images emails). The application allows you spy on targets cell phone. - Crediting an account (Terms and conditions applied). - Changing database information. - Changing school grades . -Money transfer. -Activation of firewalls. - Retrieval of deleted message. All hacking services above, for service rendered. Contact xiangvadm98090 @gmail. com Text no: +1(423)-212-6649. Whatsapp no:+1(781)-720-7259. Keep in touch

paxunix 8y ago

So when does the cottage industry of companies spring up that take data deletion requests in bulk from classes of EU citizens and batch them up for submission en masse to BigCo? And then also sell you a monitoring service to make sure that BigCo actually did go and delete all the data they were using (at least, that which is publicly visible)? And then when they find that one piece of data that wasn't deleted, sue BigCo? It's probably far-fetched to think there's DDOS potential here for a company's data officer(s), but when do the bot farm service vendors craft significant numbers of realistic user accounts and then use the above companies to drown BigCo in deletion requests for those fake users?

tango12 8y ago

I've been getting opt-out emails instead of opt-in? Isn't that exactly what GDPR said not to do?