12 ms·

GDPR Hall of Shame

210 points by K0nserv 8y ago

mtgx 8y ago
Came here to mention Oath, but it seems the site has already covered it: http://gdprhallofshame.com/5-techcrunch-engadget-and-oath-cookie-gore/ http://gdprhallofshame.com/5-techcrunch-engadget-and-oath-co... Great idea for a site. I'm sure it won't lack content for quite some time.
- HelloNurse 8y ago
  I defied RSI to click all Yahoo partners, and opening a random sample of privacy policy links I found one that was written in Chinese. So much for consent.
pit2 8y ago
It looks like the witch-hunting is about to start.
- SmellyGeekBoy 8y ago
  It's about time.
jannemann 8y ago
My favourite at the moment is sendwithus. They said their service will never be GDPR compliant. But fortunately they have a new "enterprise grade" product called sendwithus dyspatch. Same feature set, new price plus GDPR compliance. This is a price jump from $79/Month to a minimum of $24.000/year. And this is with discount for former sendwithus users. I would consider this to be mafia methods.
- chrisper 8y ago
  Not sure why I keep reading that as sandwitchus.
- lovich 8y ago
  Why? This seems like good behavior. They're original product is supported by a business model that relies on user data. Now they are offering a similar product that doesn't make money off of user data but instead charges the user. I am all for the GPDR, but the regulations don't say you can't suck up all user data _and_ you still have to provide your service for free/discounted
  - ginko 8y ago
    So you're saying user's data is worth $23052 per year?
    - Kpourdeilami 8y ago
      User data could or could not be worth that much. Having a team of programmers implementing and maintaining features that make the software GDPR compliant is perhaps the biggest contributing factor the price increase
    - lovich 8y ago
      Maybe, maybe not. If it's not I assume they'll be forced to lower their prices and go out of business. I don't have a problem with a company charging money for their product though. The GDPR appears to be doing its job here because it's forcing a company out of a business model that is unethical and into one that's better for society, regardless of it's better or not for the company and some of its customers
    - bobcallme 8y ago
      No, that is just the cost of compliance.
    - deleted 8y ago
      [deleted]
  - zbentley 8y ago
    I work for a competitor to sendwithus, and, while I can't speak to specifics or the industry as a whole, I can definitely say that it is proven possible to run a company whose revenue model is to charge something comparable to sendwithus's previous monthly subscription fees, be profitable, grow steadily, and not make a single dime on the side selling data to advertisers.
- Sholmesy 8y ago
  If they are offering the $79/month service in the EU, it doesn't matter that they have a GDPR compliant version. They won't be able to sell the non-compliant version right?
  - jannemann 8y ago
    The problem is you won't get an Data Processing Agreement (DPA) from them. And since email and names are sent through the service the DPA is mandatory. If someone somehow manages to detect your are sending his data to a non-compliant service you can get sued.
  - PeterisP 8y ago
    If an EU company who holds private data of their customers ("data controller") is buying services from some third party service provider ("data processor"), then it's the data controller's responsibility to ensure that they handle the data responsibly and don't ever give it out to noncompliant processors. A B2B service can legally offer a non-compliant service in the EU, but then the buyer isn't allowed to put any privately identifiable data in it; GDPR article 28.1 "Where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject." So in the sendwithus case, GDPR would prohibit an EU company to use its $79/month service for handling private data, since it doesn't come with the required assurances.
xmodem 8y ago
The Instapaper one - #1 - is troubling for a non-obvious reason. One of the tenets of GDPR is that you have to be told how your data is being used. So the only explanation for this behaviour is that there's some shady shit going down that they want to stop before they have to admit to it. If I used Instapaper I'd be filing a complaint with my local DPA about this.
- dingo_bat 8y ago
  > So the only explanation for this behaviour is that there's some shady shit going down that they want to stop before they have to admit to it. No, it can something as simple as "we cannot guarantee that all your data is deleted with our current storage system". It would be a lot better if people stop being so alarmist.
  - xmodem 8y ago
    Why can't they comment on it? It's very suspect.
    - aeorgnoieang 8y ago
      I'd guess they're afraid of legal liability.
  - gregknicholson 8y ago
    If it were something that simple and reasonable, they'd be happy to say so. The fact of not giving an explanation implies that the real explanation is worse that you would expect.
  - kuschku 8y ago
    The deletion doesn’t have to happen immediately, just in a reasonable time frame. A few weeks is okay, too. So if it was just that, they wouldn’t shut down.
  - Silhouette 8y ago
    It would be a lot better if people stop being so alarmist. Indeed. It's odd looking at discussions about the GDPR on HN. On the one hand, we have people who argue that compliance isn't really that big a deal if you're not doing anything horribly wrong, most ethical businesses would already be mostly compliant anyway, etc. On the other hand, we have people who argue that even if that is the case, the length and ambiguity of the regulations and guidance combined with the potential penalties still cause significant overheads and risks, particularly for smaller businesses without dedicated resources to deal with compliance matters. There is some truth behind both of those positions, I think. But then I've seen so many comments now on HN and other geek-friendly forums that seem to be based on the premise that most/all businesses are somehow doing evil things with personal data and they must be stopped. A noticeable number of people are advocating obviously vexatious use of the new subject rights, not in response to any specific concern or after some unsatisfactory attempt to resolve concerns reasonably, but as a weapon with the clear goal of causing maximum disruption and cost to organisations. I wonder how anyone can think giving so much "legal ammunition" to these people is a good idea.
dominotw 8y ago
shaming seems to be down currently.
- enginaar 8y ago
  yea, still down
chrisper 8y ago
The #2 one seems a bit off. "RE:" stands for Regarding. Yes it makes people look at your email, but it isn't "fake."
- cryptoz 8y ago
  The GDPR is about not intentionally deceiving users. That practice is clearly deceptive and clearly violates GDPR.
- fiiv 8y ago
  Yes but it's most commonly used in the medium of email as an indication of a reply.
- IncRnd 8y ago
  In every email program, RE: stands for Reply. RE: is prefixed to a subject for showing that the current email is a reply to an earlier email. That is what is deceptive. RE: is not Regarding in this context but appears designed to increase acceptance by lying about the recipient receiving a response to an earlier non-existent communication.
  - pc86 8y ago
    Email didn't magically change the meaning "Re" to "Reply." It still means regarding; it's regarding the subject of the previous email.
    - IncRnd 8y ago
      Don't argue for the sake of arguing. I didn't write that Email magically changed the meaning of a word! I wrote that email clients use RE: in a specific way. Re can mean regarding, but in an email subject line Re: has been taken for decades by email programs to mean something very specific, "Reply".
- SmellyGeekBoy 8y ago
  I had this thought too, but this isn't the common usage and therefore someone was being deliberately deceptive when they decided to use it.
deleted 8y ago
[deleted]
midasz 8y ago
Hugged to death already?
- piotrkubisa 8y ago
  Yup. http://archive.today/2018.05.24-124106/http://gdprhallofshame.com/ http://archive.today/2018.05.24-124106/http://gdprhallofsham... https://web.archive.org/web/20180524111054/http://gdprhallofshame.com/ https://web.archive.org/web/20180524111054/http://gdprhallof...
- owenwil 8y ago
  Sorry, had to go up a few sizes on DigitalOcean
  - adtac 8y ago
    Curious: what tier were you using and what tier did you move up to? In case I ever get to the frontpage, I'd like to be prepared :) And usually, what is it that causes outages like HN/reddit's hug of death? Number of open sockets / file descriptors? RAM? CPU? Network congestion?
    - Keats 8y ago
      If you have a static site, being on top of reddit/HN will barely be visible on the smallest instance you can find.
Drakim 8y ago
"Whoops, we can't secretly sell your data anymore! That means you can't control your smart wifi lightbulbs from now on!" For me, this is a refutation of the "If you don't pay for the product, you are the product." There is no inherent reason why a company would only do that for a free product. If it works for free products, it works just the same for paid products. Even if GDPR has flaws, and is gonna cause some disruption, I think we really needed something like this.
- matte_black 8y ago
  You are not the product. Exposure to you is the product.
  - some_account 8y ago
    No its not just showing you ads. Its selling any information they have on you to ad networks without you knowing about it.
    - matte_black 8y ago
      ...so that you can be shown more ads.
      - class4behavior 8y ago
        ...which is made possible by both directly and indirectly collecting, evaluating, sharing or trading, and concatenating data about you.
        matte_black 8y ago
        ...just so you can block and ignore the ads, all the same.
        class4behavior 8y ago
        You're conflating control over personal data with one of the purposes for doing so, i.e., the presentation of ads. That is by far not what privacy or data protection is limited to. Not to mention that blocking or hiding ads or trackers is not the same as preventing the collection of personal information. Unless you avoid visiting a service entirely, depending on the implementation you may not be able to inhibit any of it.
cift 8y ago
Mirror: http://archive.is/BCZCB http://archive.is/BCZCB EDIT: Updated with new post
pjc50 8y ago
Of these, the worst are the "embedded" ones: the IoT lightbulbs and the Razer devices. Nobody ever expected their lightbulbs to be processing personal data on behalf of third parties. The one that might be legitimate is the "cheap flights" one; after all, they require your consent for email marketing, and they can't offer you a discount flight without it.
- eli 8y ago
  If the definition of personal data includes IP addresses then I'd be surprised there are any internet-connected products that don't process personal data in some way.
  - jdietrich 8y ago
    >If the definition of personal data includes IP addresses Yes it does. > I'd be surprised there are any internet-connected products that don't process personal data in some way. Consent is one of six lawful grounds for processing personal data. Another ground is legitimate interests, described in Article 5 as follows: "Processing shall be lawful if... processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child." https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/ Recital 49 goes on to state: "The processing of personal data to the extent strictly necessary and proportionate for the purposes of ensuring network and information security, i.e. the ability of a network or an information system to resist, at a given level of confidence, accidental events or unlawful or malicious actions that compromise the availability, authenticity, integrity and confidentiality of stored or transmitted personal data, and the security of the related services offered by, or accessible via, those networks and systems, by public authorities, by computer emergency response teams (CERTs), computer security incident response teams (CSIRTs), by providers of electronic communications networks and services and by providers of security technologies and services, constitutes a legitimate interest of the data controller concerned. This could, for example, include preventing unauthorised access to electronic communications networks and malicious code distribution and stopping ‘denial of service’ attacks and damage to computer and electronic communication systems." Logging IPs for a reasonable period of time as part of your network security infrastructure is perfectly permissible under GDPR without consent. You can share your server logs with a third-party security company or pass data to a DDoS protection service if needed. If you use those IPs for any other purpose (ad tracking, analytics etc) then you'll need lawful grounds for those activities, which may or may not require consent.
some_account 8y ago
Ive been enjoying all the emails from companies and watching them put on a show how they support user privacy and just needs me to continue agreeing to accepting being the product. I dont think so. There are very few companies I actually use in my life, and less than a handful of them are online. The rest - bugger off.
- zamazingo 8y ago
  > Ive been enjoying all the emails from companies I've been receiving so many "here is our policy, if you continue your use, you accept it, kbye" emails... I truly hope EU will take the default-opt-in problem seriously.
bo1024 8y ago
I want to know if credit card companies Mastercard, Visa, etc. are subject to GDPR. They definitely sell or use your purchase data for purposes unrelated to the service.
- kgwgk 8y ago
  Do they? Non-aggregated data, I mean.
- PeterisP 8y ago
  I believe that they do lots of internal analytics but do not sell identifiable data on a per-person level; the laws regarding nondisclosure of banking data are old, well established and much stricter - for starters, intentional disclosure of confidential banking information outside of certain (though many) particular exceptions is an actual maybe-go-to-jail crime, not just a civil matter with some fines. Surveillance violates the privacy of common folk and thus is somewhat permitted, but violation of banking privacy threatens the rich and influential people and their (shady?) dealings, so that has always been restricted and actually enforced.
  - bo1024 8y ago
    Does GDPR distinguish between "identifiable" data and "non-identifiable"? If so, how do you decide which is which? A list of credit card transactions is pretty easy to de-identify...
    - dx034 8y ago
      The information of how many people in a certain age range have shopped at supermarkets in London this week is not identifiable information. So all marketing/spending info they sell is fine. Could only be problematic if it's so granular that you can infer the person.
    - PeterisP 8y ago
      1) GDPR cares only about personally identifiable data, defined in https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/ as "‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;". Nonidentifiable data or aggregated data (even if derived from private data) are fully out of scope of GDPR if they can't be de-identified. 2) "A list of credit card transactions" is the kind of data that I'd assume that Visa/MC aren't selling to anyone ever, I'd expect any data sales to be on the level of "real time subscription to how (and how much) different demographic groups are shopping in company X or in location Y", but not on the level of individual transactions or individual accounts. Group them by zip-code and hour and you're fine even for GDPR requirements; and you can provide "individual" granularity for the merchants (e.g. for stock traders who want to predict revenues) since merchants generally have no privacy protections.
adtac 8y ago
The Yahoo! one [1] is definitely in violation of GDPR, right? GDPR doesn't cover me as I'm neither in the EU nor am I an EU citizen, so I really hope someone lets the regulators know about this. The first major penalty will be example setting. Which made me curious: could a service exist where citizens not covered by GDPR submit complaints, so that a GDPR-covered citizen could put the complaint in formally? [1] Hidden opt-out is non-compliant, but Yahoo! went ahead and opted you in to a hundred different ad services automatically: http://gdprhallofshame.com/content/images/2018/05/ouch.jpg http://gdprhallofshame.com/content/images/2018/05/ouch.jpg
- detuur 8y ago
  Yahoo is bad, especially concerning the opt-in, but by far not the worst. Those are Google and Facebook, which have made all of their services "all-or-nothing". If you don't accept every single bit of data processing, your only alternative is to delete your account. Literally runs counter to everything the GDPR stands for.
  - ioulian 8y ago
    You are right, no "normal" person would want to delete their google/facebook account, so they just "accept" the tracking. I mean, if you already have a android phone, NEST and use google everyday, would you want to delete your account? You can live without facebook, but google makes a lot of hardware that is quite useful. Let see how it all ends :D
  - aeorgnoieang 8y ago
    > Literally runs counter to everything the GDPR stands for. If the idea is that no one should be able to avoid complying with the GDPR, even if they decide they no longer want to do business with whomever it is exactly that's covered by it, then maybe the whole thing was a bad tradeoff. I'll grant that Google and Facebook might be acting in bad faith – hell, I'll just assume they are – but surely, for some not-necessarily-insignificant number of other entities, it should be perfectly fine if they decide that the costs of compliance exceed the corresponding benefits.
- 8y ago
cift 8y ago
It'll be interesting to see how the EU reacts to all of the companies like Oath that, by default, share your data with 300+ ad agencies. After the GDPR hype has died down, hopefully new tech companies will think twice about data privacy
- Arwill 8y ago
  To me, that one was the most striking. It shows how widespread data sharing is. In the end to whom did they NOT sell user data?
BjoernKW 8y ago
The EU Commission's very own website deserves an honourable mention at least. Last time I looked (just a few days ago) it was the epitome of "What you're not allowed to do anymore according to GDPR.": Tracking and other cookies with no way to opt out, no privacy policy etc. Then again, GDPR of course doesn't apply to them. The very least they could do in my opinion, however is to lead by example.
PeterisP 8y ago
I nominate Slate https://slate.com/privacy https://slate.com/privacy for a creative interpretation of GDPR article 7.3 "It shall be as easy to withdraw as to give consent" (the "consent" happens through an uncloseable window with no other options where a single click sets that cookie): "The Right to Withdraw Consent. If you would like to opt-out at any time, please delete the “gdpr_consent_1” cookie from your browser window. You will have to opt-in again in order to view Slate content."
- dx034 8y ago
  I'm pretty sure that no European court would accept that. I doubt most users (and most judges) even know how to delete cookies. I don't even know how to do that on my phone (not sure if that's possible?). And not allowing users with mobile browsers to withdraw consent is definitely a violation.
  - HelloNurse 8y ago
    It would be acceptable if consent involved manually adding a specific cookie (slightly harder than deleting an existing cookie). Thinking of it, adding cookies manually and maintaining a cookie whitelist could be a useful browser feature in the coming years. Most cookie-based tracking would be forced to disappear.
- spiralx 8y ago
  NPR has decided that you either agree to let them do whatever they want with your data, or you're only allowed to see a ridiculously bare-bones plain-text version of the site lacking any functionality beyond links. Ten minutes later I've got a user style set up and I'm quite happy with the plain version. But it's still a petty response from the organisation and shows that they don't feel they need to spend any time at all trying to help users control their own data. https://choice.npr.org https://choice.npr.org
deleted 8y ago
[deleted]
matte_black 8y ago
GDPR and policies like it are an existential threat to a Big Data future where so much can be possible if we are able to amass as much data as possible without fear of consequences. GDPR should be resisted by as many companies and startups as possible.
- bartvbl 8y ago
  Whatever the case might be, companies have shown themselves to not handle people's personal data properly, as shown by the massive leaks in the past. Whatever utopia you're thinking of, it's not happening anytime soon, and GDPR is a rightful measure to slightly apply the brakes on rampant data collection and misuse.
  - matte_black 8y ago
    Massive leaks are a security issue, and have nothing to do with users being able to delete their data at will.
    - PeterisP 8y ago
      It certainly is related. One core argument is that the vast majority of currently stored personal data has no good reason whatsoever to be there, the company should not be collecting, using and storing any personal data. If half of the companies remove that private data which they shouldn't have, then that will reduce the impact of breaches, as there'll be twice less breaches where's something sensitive to leak.
      - aeorgnoieang 8y ago
        I can't think of massive leaks that involved data that wasn't 'legitimate'. What's your go-to example?
        PeterisP 8y ago
        No particular single example in mind, but just going through random large leaks: The Republican National Committee leak (https://gizmodo.com/gop-data-firm-accidentally-leaks-personal-details-of-ne-1796211612 https://gizmodo.com/gop-data-firm-accidentally-leaks-persona...) - all the involved companies which swapped data records to make up this trove would not have had the permission to have much of that data under GDPR. World Wrestling Entertainment 2017 leak - the leaked data included home and email addresses, birthdates, as well as customers' children's age ranges and genders where supplied, and even ethnicity; there's simply no reasonable reason why they should have had data like that in the first place. It it hadn't be collected, it couldn't have been leaked. Joblink breach (https://www.identityforce.com/blog/americas-joblink-data-breach https://www.identityforce.com/blog/americas-joblink-data-bre...) leaked among other things birthdate and social security number. There's no good reason to ask the birthdate in the first place, and to store the social security number after you've run whatever verification they do (presumably it gets used for background screening). The big point is that almost always data minimization would have reduced the consequences. Companies keep old data forever, and that creates extra risk; Companies ask for and store more data than they need and that creates extra risk; Companies buy and sell data that shouldn't be bought and sold, and so the data copied in multiple organizations and again, creates extra risk.
gerbilly 8y ago
I've been in the internet since the 80s. Man what a nice thing we've built. We have turned the internet into a network where people snitch on each other to marketers for fractions of a penny.
- pc86 8y ago
  The 80s? Were you involved in ARPANet or something?
  - robin_reala 8y ago
    I first went onto the internet in 1990 when my BBS got a connection. It was quite well developed by the end of the 80s.
    - ghaff 8y ago
      80s were still fairly early for Internet access. I was on the ARPANET as early as 1979 or so but just trading the occasional email in a lab. "Real" internet access, first at work and then through my BBS, was probably more like the early 1990s.
      - robin_reala 8y ago
        Oh yeah, I didn’t do anything on the Internet in 1990 apart from typing ‘go internet’ into CIX (my BBS at the time), sitting there wondering what you could do with it, then killing the connection when my dad pointed out that we paid by the minute for the phone line :) I don’t think I knew anyone online that wasn’t on CIX either.
        ghaff 8y ago
        I used CIS for some things but as you say the charges were pretty high. I mostly used a private local BBS at the time. I’m guessing it was more like 1994 or thereabouts when I started FTPing files and getting into Usenet.
        8y ago
owenwil 8y ago
Hey! I made this, mostly just to poke fun at my inbox being here in Europe and experiencing it first hand. Feel free to fire me a reply with any good ones you've spotted; I'll be actively adding through tomorrow and beyond.
- bencollier49 8y ago
  The Endomondo app is a doozy. They require opt-in to two items to carry on using the app, but then also say that by clicking continue, you're agreeing to their privacy policy, which indemnifies them against GDPR. It's slightly clever misdirection, in my opinion. I clicked 'OK' in the end because the EULA appears to be invalid anyway; by borking the consent process they have no legal basis for processing my data.
  - owenwil 8y ago
    Wow - got a screenshot of that one?
- vorpalhex 8y ago
  Judging from the CloudFlare 502s, you have successfully been HN'd. Might be time to add in a static cache in front of the site.
- zamazingo 8y ago
  Could you take another look at Yahoo? I don't see the link you mentioned to walk through the huge list --I couldn't find any link that gets me to those two pages. Thanks! :) Edit: Thank you for making this!!
umbrellaman 8y ago
CCleaner deserves a special spot in this hall after the recent change with the "You cannot opt-out" privacy option in the free version of the program. [1]https://www.ghacks.net/2018/05/24/ccleaner-update-introduces-privacy-options/ https://www.ghacks.net/2018/05/24/ccleaner-update-introduces... [2] https://forum.piriform.com/topic/51913-ccleaner-5436520-cannot-opt-out-of-privacy-exposing-compulsions/ https://forum.piriform.com/topic/51913-ccleaner-5436520-cann...
- letsgetphysITal 8y ago
  That's not how GDPR works. You're not allowed to make use of your product / service require acceptance of collection of data. You must either offer it without data collection as an option, or simply refuse service.
  - aeorgnoieang 8y ago
    I'm guessing, if that's enforced, that a lot of these same organizations will opt to refuse service.
    - letsgetphysITal 8y ago
      A lot are. GDPR Hall of Shame looks like a list of these companies.
      - aeorgnoieang 8y ago
        Which ones? The list looks like a bunch of organizations trying to do a clumsy end-run around the intent of the law instead of refusing service.
ToastyMallows 8y ago
I'd love an RSS feed of this site :)
downandout 8y ago
Could somebody help me understand the criticism in this article of companies like Instapaper blocking EU users? When you face fines of up to 20M EUR, you’re not going to take on that liability if you have a choice. Most companies outside the EU will eventually block EU traffic. GDPR is just too big of a liability. It has nothing to do with “selling user data” or bad intentions with user privacy. I won’t take EU traffic for the same reason that I don’t drive at 140mph in a 25mph zone - it’s irresponsibly dangerous.
- icebraining 8y ago
  Blocking EU users temporarily doesn't remove the need to comply - they're still holding data from these users.
zerostar07 8y ago
OK but maybe your website should not use cookies without asking? You don't have a privacy policy either so not clear how u re going to use them. And maybe don't use google analytics without a privacy policy? Or at least anonymize the IP?

210 points by K0nserv 8y ago

mtgx 8y ago

Came here to mention Oath, but it seems the site has already covered it: http://gdprhallofshame.com/5-techcrunch-engadget-and-oath-cookie-gore/ http://gdprhallofshame.com/5-techcrunch-engadget-and-oath-co... Great idea for a site. I'm sure it won't lack content for quite some time.

HelloNurse 8y ago
I defied RSI to click all Yahoo partners, and opening a random sample of privacy policy links I found one that was written in Chinese. So much for consent.

pit2 8y ago

It looks like the witch-hunting is about to start.

SmellyGeekBoy 8y ago
It's about time.

jannemann 8y ago

My favourite at the moment is sendwithus. They said their service will never be GDPR compliant. But fortunately they have a new "enterprise grade" product called sendwithus dyspatch. Same feature set, new price plus GDPR compliance. This is a price jump from $79/Month to a minimum of $24.000/year. And this is with discount for former sendwithus users. I would consider this to be mafia methods.

chrisper 8y ago
Not sure why I keep reading that as sandwitchus.
lovich 8y ago
Why? This seems like good behavior. They're original product is supported by a business model that relies on user data. Now they are offering a similar product that doesn't make money off of user data but instead charges the user. I am all for the GPDR, but the regulations don't say you can't suck up all user data _and_ you still have to provide your service for free/discounted
- ginko 8y ago
  So you're saying user's data is worth $23052 per year?
  - Kpourdeilami 8y ago
    User data could or could not be worth that much. Having a team of programmers implementing and maintaining features that make the software GDPR compliant is perhaps the biggest contributing factor the price increase
  - lovich 8y ago
    Maybe, maybe not. If it's not I assume they'll be forced to lower their prices and go out of business. I don't have a problem with a company charging money for their product though. The GDPR appears to be doing its job here because it's forcing a company out of a business model that is unethical and into one that's better for society, regardless of it's better or not for the company and some of its customers
  - bobcallme 8y ago
    No, that is just the cost of compliance.
  - deleted 8y ago
    [deleted]
- zbentley 8y ago
  I work for a competitor to sendwithus, and, while I can't speak to specifics or the industry as a whole, I can definitely say that it is proven possible to run a company whose revenue model is to charge something comparable to sendwithus's previous monthly subscription fees, be profitable, grow steadily, and not make a single dime on the side selling data to advertisers.
Sholmesy 8y ago
If they are offering the $79/month service in the EU, it doesn't matter that they have a GDPR compliant version. They won't be able to sell the non-compliant version right?
- jannemann 8y ago
  The problem is you won't get an Data Processing Agreement (DPA) from them. And since email and names are sent through the service the DPA is mandatory. If someone somehow manages to detect your are sending his data to a non-compliant service you can get sued.
- PeterisP 8y ago
  If an EU company who holds private data of their customers ("data controller") is buying services from some third party service provider ("data processor"), then it's the data controller's responsibility to ensure that they handle the data responsibly and don't ever give it out to noncompliant processors. A B2B service can legally offer a non-compliant service in the EU, but then the buyer isn't allowed to put any privately identifiable data in it; GDPR article 28.1 "Where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject." So in the sendwithus case, GDPR would prohibit an EU company to use its $79/month service for handling private data, since it doesn't come with the required assurances.

xmodem 8y ago

The Instapaper one - #1 - is troubling for a non-obvious reason. One of the tenets of GDPR is that you have to be told how your data is being used. So the only explanation for this behaviour is that there's some shady shit going down that they want to stop before they have to admit to it. If I used Instapaper I'd be filing a complaint with my local DPA about this.

dingo_bat 8y ago
> So the only explanation for this behaviour is that there's some shady shit going down that they want to stop before they have to admit to it. No, it can something as simple as "we cannot guarantee that all your data is deleted with our current storage system". It would be a lot better if people stop being so alarmist.
- xmodem 8y ago
  Why can't they comment on it? It's very suspect.
  - aeorgnoieang 8y ago
    I'd guess they're afraid of legal liability.
- gregknicholson 8y ago
  If it were something that simple and reasonable, they'd be happy to say so. The fact of not giving an explanation implies that the real explanation is worse that you would expect.
- kuschku 8y ago
  The deletion doesn’t have to happen immediately, just in a reasonable time frame. A few weeks is okay, too. So if it was just that, they wouldn’t shut down.
- Silhouette 8y ago
  It would be a lot better if people stop being so alarmist. Indeed. It's odd looking at discussions about the GDPR on HN. On the one hand, we have people who argue that compliance isn't really that big a deal if you're not doing anything horribly wrong, most ethical businesses would already be mostly compliant anyway, etc. On the other hand, we have people who argue that even if that is the case, the length and ambiguity of the regulations and guidance combined with the potential penalties still cause significant overheads and risks, particularly for smaller businesses without dedicated resources to deal with compliance matters. There is some truth behind both of those positions, I think. But then I've seen so many comments now on HN and other geek-friendly forums that seem to be based on the premise that most/all businesses are somehow doing evil things with personal data and they must be stopped. A noticeable number of people are advocating obviously vexatious use of the new subject rights, not in response to any specific concern or after some unsatisfactory attempt to resolve concerns reasonably, but as a weapon with the clear goal of causing maximum disruption and cost to organisations. I wonder how anyone can think giving so much "legal ammunition" to these people is a good idea.

dominotw 8y ago

shaming seems to be down currently.

enginaar 8y ago
yea, still down

chrisper 8y ago

The #2 one seems a bit off. "RE:" stands for Regarding. Yes it makes people look at your email, but it isn't "fake."

cryptoz 8y ago
The GDPR is about not intentionally deceiving users. That practice is clearly deceptive and clearly violates GDPR.
fiiv 8y ago
Yes but it's most commonly used in the medium of email as an indication of a reply.
IncRnd 8y ago
In every email program, RE: stands for Reply. RE: is prefixed to a subject for showing that the current email is a reply to an earlier email. That is what is deceptive. RE: is not Regarding in this context but appears designed to increase acceptance by lying about the recipient receiving a response to an earlier non-existent communication.
- pc86 8y ago
  Email didn't magically change the meaning "Re" to "Reply." It still means regarding; it's regarding the subject of the previous email.
  - IncRnd 8y ago
    Don't argue for the sake of arguing. I didn't write that Email magically changed the meaning of a word! I wrote that email clients use RE: in a specific way. Re can mean regarding, but in an email subject line Re: has been taken for decades by email programs to mean something very specific, "Reply".
SmellyGeekBoy 8y ago
I had this thought too, but this isn't the common usage and therefore someone was being deliberately deceptive when they decided to use it.

deleted 8y ago

[deleted]

midasz 8y ago

Hugged to death already?

piotrkubisa 8y ago
Yup. http://archive.today/2018.05.24-124106/http://gdprhallofshame.com/ http://archive.today/2018.05.24-124106/http://gdprhallofsham... https://web.archive.org/web/20180524111054/http://gdprhallofshame.com/ https://web.archive.org/web/20180524111054/http://gdprhallof...
owenwil 8y ago
Sorry, had to go up a few sizes on DigitalOcean
- adtac 8y ago
  Curious: what tier were you using and what tier did you move up to? In case I ever get to the frontpage, I'd like to be prepared :) And usually, what is it that causes outages like HN/reddit's hug of death? Number of open sockets / file descriptors? RAM? CPU? Network congestion?
  - Keats 8y ago
    If you have a static site, being on top of reddit/HN will barely be visible on the smallest instance you can find.

Drakim 8y ago

"Whoops, we can't secretly sell your data anymore! That means you can't control your smart wifi lightbulbs from now on!" For me, this is a refutation of the "If you don't pay for the product, you are the product." There is no inherent reason why a company would only do that for a free product. If it works for free products, it works just the same for paid products. Even if GDPR has flaws, and is gonna cause some disruption, I think we really needed something like this.

matte_black 8y ago
You are not the product. Exposure to you is the product.
- some_account 8y ago
  No its not just showing you ads. Its selling any information they have on you to ad networks without you knowing about it.
  - matte_black 8y ago
    ...so that you can be shown more ads.
    - class4behavior 8y ago
      ...which is made possible by both directly and indirectly collecting, evaluating, sharing or trading, and concatenating data about you.
      - matte_black 8y ago
        ...just so you can block and ignore the ads, all the same.
        class4behavior 8y ago
        You're conflating control over personal data with one of the purposes for doing so, i.e., the presentation of ads. That is by far not what privacy or data protection is limited to. Not to mention that blocking or hiding ads or trackers is not the same as preventing the collection of personal information. Unless you avoid visiting a service entirely, depending on the implementation you may not be able to inhibit any of it.

cift 8y ago

Mirror: http://archive.is/BCZCB http://archive.is/BCZCB EDIT: Updated with new post

pjc50 8y ago

Of these, the worst are the "embedded" ones: the IoT lightbulbs and the Razer devices. Nobody ever expected their lightbulbs to be processing personal data on behalf of third parties. The one that might be legitimate is the "cheap flights" one; after all, they require your consent for email marketing, and they can't offer you a discount flight without it.

eli 8y ago
If the definition of personal data includes IP addresses then I'd be surprised there are any internet-connected products that don't process personal data in some way.
- jdietrich 8y ago
  >If the definition of personal data includes IP addresses Yes it does. > I'd be surprised there are any internet-connected products that don't process personal data in some way. Consent is one of six lawful grounds for processing personal data. Another ground is legitimate interests, described in Article 5 as follows: "Processing shall be lawful if... processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child." https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/ Recital 49 goes on to state: "The processing of personal data to the extent strictly necessary and proportionate for the purposes of ensuring network and information security, i.e. the ability of a network or an information system to resist, at a given level of confidence, accidental events or unlawful or malicious actions that compromise the availability, authenticity, integrity and confidentiality of stored or transmitted personal data, and the security of the related services offered by, or accessible via, those networks and systems, by public authorities, by computer emergency response teams (CERTs), computer security incident response teams (CSIRTs), by providers of electronic communications networks and services and by providers of security technologies and services, constitutes a legitimate interest of the data controller concerned. This could, for example, include preventing unauthorised access to electronic communications networks and malicious code distribution and stopping ‘denial of service’ attacks and damage to computer and electronic communication systems." Logging IPs for a reasonable period of time as part of your network security infrastructure is perfectly permissible under GDPR without consent. You can share your server logs with a third-party security company or pass data to a DDoS protection service if needed. If you use those IPs for any other purpose (ad tracking, analytics etc) then you'll need lawful grounds for those activities, which may or may not require consent.

some_account 8y ago

Ive been enjoying all the emails from companies and watching them put on a show how they support user privacy and just needs me to continue agreeing to accepting being the product. I dont think so. There are very few companies I actually use in my life, and less than a handful of them are online. The rest - bugger off.

zamazingo 8y ago
> Ive been enjoying all the emails from companies I've been receiving so many "here is our policy, if you continue your use, you accept it, kbye" emails... I truly hope EU will take the default-opt-in problem seriously.

bo1024 8y ago

I want to know if credit card companies Mastercard, Visa, etc. are subject to GDPR. They definitely sell or use your purchase data for purposes unrelated to the service.

kgwgk 8y ago
Do they? Non-aggregated data, I mean.
PeterisP 8y ago
I believe that they do lots of internal analytics but do not sell identifiable data on a per-person level; the laws regarding nondisclosure of banking data are old, well established and much stricter - for starters, intentional disclosure of confidential banking information outside of certain (though many) particular exceptions is an actual maybe-go-to-jail crime, not just a civil matter with some fines. Surveillance violates the privacy of common folk and thus is somewhat permitted, but violation of banking privacy threatens the rich and influential people and their (shady?) dealings, so that has always been restricted and actually enforced.
- bo1024 8y ago
  Does GDPR distinguish between "identifiable" data and "non-identifiable"? If so, how do you decide which is which? A list of credit card transactions is pretty easy to de-identify...
  - dx034 8y ago
    The information of how many people in a certain age range have shopped at supermarkets in London this week is not identifiable information. So all marketing/spending info they sell is fine. Could only be problematic if it's so granular that you can infer the person.
  - PeterisP 8y ago
    1) GDPR cares only about personally identifiable data, defined in https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/ as "‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;". Nonidentifiable data or aggregated data (even if derived from private data) are fully out of scope of GDPR if they can't be de-identified. 2) "A list of credit card transactions" is the kind of data that I'd assume that Visa/MC aren't selling to anyone ever, I'd expect any data sales to be on the level of "real time subscription to how (and how much) different demographic groups are shopping in company X or in location Y", but not on the level of individual transactions or individual accounts. Group them by zip-code and hour and you're fine even for GDPR requirements; and you can provide "individual" granularity for the merchants (e.g. for stock traders who want to predict revenues) since merchants generally have no privacy protections.

adtac 8y ago

The Yahoo! one [1] is definitely in violation of GDPR, right? GDPR doesn't cover me as I'm neither in the EU nor am I an EU citizen, so I really hope someone lets the regulators know about this. The first major penalty will be example setting. Which made me curious: could a service exist where citizens not covered by GDPR submit complaints, so that a GDPR-covered citizen could put the complaint in formally? [1] Hidden opt-out is non-compliant, but Yahoo! went ahead and opted you in to a hundred different ad services automatically: http://gdprhallofshame.com/content/images/2018/05/ouch.jpg http://gdprhallofshame.com/content/images/2018/05/ouch.jpg

detuur 8y ago
Yahoo is bad, especially concerning the opt-in, but by far not the worst. Those are Google and Facebook, which have made all of their services "all-or-nothing". If you don't accept every single bit of data processing, your only alternative is to delete your account. Literally runs counter to everything the GDPR stands for.
- ioulian 8y ago
  You are right, no "normal" person would want to delete their google/facebook account, so they just "accept" the tracking. I mean, if you already have a android phone, NEST and use google everyday, would you want to delete your account? You can live without facebook, but google makes a lot of hardware that is quite useful. Let see how it all ends :D
- aeorgnoieang 8y ago
  > Literally runs counter to everything the GDPR stands for. If the idea is that no one should be able to avoid complying with the GDPR, even if they decide they no longer want to do business with whomever it is exactly that's covered by it, then maybe the whole thing was a bad tradeoff. I'll grant that Google and Facebook might be acting in bad faith – hell, I'll just assume they are – but surely, for some not-necessarily-insignificant number of other entities, it should be perfectly fine if they decide that the costs of compliance exceed the corresponding benefits.
8y ago

cift 8y ago

It'll be interesting to see how the EU reacts to all of the companies like Oath that, by default, share your data with 300+ ad agencies. After the GDPR hype has died down, hopefully new tech companies will think twice about data privacy

Arwill 8y ago
To me, that one was the most striking. It shows how widespread data sharing is. In the end to whom did they NOT sell user data?

BjoernKW 8y ago

The EU Commission's very own website deserves an honourable mention at least. Last time I looked (just a few days ago) it was the epitome of "What you're not allowed to do anymore according to GDPR.": Tracking and other cookies with no way to opt out, no privacy policy etc. Then again, GDPR of course doesn't apply to them. The very least they could do in my opinion, however is to lead by example.

PeterisP 8y ago

I nominate Slate https://slate.com/privacy https://slate.com/privacy for a creative interpretation of GDPR article 7.3 "It shall be as easy to withdraw as to give consent" (the "consent" happens through an uncloseable window with no other options where a single click sets that cookie): "The Right to Withdraw Consent. If you would like to opt-out at any time, please delete the “gdpr_consent_1” cookie from your browser window. You will have to opt-in again in order to view Slate content."

dx034 8y ago
I'm pretty sure that no European court would accept that. I doubt most users (and most judges) even know how to delete cookies. I don't even know how to do that on my phone (not sure if that's possible?). And not allowing users with mobile browsers to withdraw consent is definitely a violation.
- HelloNurse 8y ago
  It would be acceptable if consent involved manually adding a specific cookie (slightly harder than deleting an existing cookie). Thinking of it, adding cookies manually and maintaining a cookie whitelist could be a useful browser feature in the coming years. Most cookie-based tracking would be forced to disappear.
spiralx 8y ago
NPR has decided that you either agree to let them do whatever they want with your data, or you're only allowed to see a ridiculously bare-bones plain-text version of the site lacking any functionality beyond links. Ten minutes later I've got a user style set up and I'm quite happy with the plain version. But it's still a petty response from the organisation and shows that they don't feel they need to spend any time at all trying to help users control their own data. https://choice.npr.org https://choice.npr.org

deleted 8y ago

[deleted]

matte_black 8y ago

GDPR and policies like it are an existential threat to a Big Data future where so much can be possible if we are able to amass as much data as possible without fear of consequences. GDPR should be resisted by as many companies and startups as possible.

bartvbl 8y ago
Whatever the case might be, companies have shown themselves to not handle people's personal data properly, as shown by the massive leaks in the past. Whatever utopia you're thinking of, it's not happening anytime soon, and GDPR is a rightful measure to slightly apply the brakes on rampant data collection and misuse.
- matte_black 8y ago
  Massive leaks are a security issue, and have nothing to do with users being able to delete their data at will.
  - PeterisP 8y ago
    It certainly is related. One core argument is that the vast majority of currently stored personal data has no good reason whatsoever to be there, the company should not be collecting, using and storing any personal data. If half of the companies remove that private data which they shouldn't have, then that will reduce the impact of breaches, as there'll be twice less breaches where's something sensitive to leak.
    - aeorgnoieang 8y ago
      I can't think of massive leaks that involved data that wasn't 'legitimate'. What's your go-to example?
      - PeterisP 8y ago
        No particular single example in mind, but just going through random large leaks: The Republican National Committee leak (https://gizmodo.com/gop-data-firm-accidentally-leaks-personal-details-of-ne-1796211612 https://gizmodo.com/gop-data-firm-accidentally-leaks-persona...) - all the involved companies which swapped data records to make up this trove would not have had the permission to have much of that data under GDPR. World Wrestling Entertainment 2017 leak - the leaked data included home and email addresses, birthdates, as well as customers' children's age ranges and genders where supplied, and even ethnicity; there's simply no reasonable reason why they should have had data like that in the first place. It it hadn't be collected, it couldn't have been leaked. Joblink breach (https://www.identityforce.com/blog/americas-joblink-data-breach https://www.identityforce.com/blog/americas-joblink-data-bre...) leaked among other things birthdate and social security number. There's no good reason to ask the birthdate in the first place, and to store the social security number after you've run whatever verification they do (presumably it gets used for background screening). The big point is that almost always data minimization would have reduced the consequences. Companies keep old data forever, and that creates extra risk; Companies ask for and store more data than they need and that creates extra risk; Companies buy and sell data that shouldn't be bought and sold, and so the data copied in multiple organizations and again, creates extra risk.

gerbilly 8y ago

I've been in the internet since the 80s. Man what a nice thing we've built. We have turned the internet into a network where people snitch on each other to marketers for fractions of a penny.

pc86 8y ago
The 80s? Were you involved in ARPANet or something?
- robin_reala 8y ago
  I first went onto the internet in 1990 when my BBS got a connection. It was quite well developed by the end of the 80s.
  - ghaff 8y ago
    80s were still fairly early for Internet access. I was on the ARPANET as early as 1979 or so but just trading the occasional email in a lab. "Real" internet access, first at work and then through my BBS, was probably more like the early 1990s.
    - robin_reala 8y ago
      Oh yeah, I didn’t do anything on the Internet in 1990 apart from typing ‘go internet’ into CIX (my BBS at the time), sitting there wondering what you could do with it, then killing the connection when my dad pointed out that we paid by the minute for the phone line :) I don’t think I knew anyone online that wasn’t on CIX either.
      - ghaff 8y ago
        I used CIS for some things but as you say the charges were pretty high. I mostly used a private local BBS at the time. I’m guessing it was more like 1994 or thereabouts when I started FTPing files and getting into Usenet.
      - 8y ago

owenwil 8y ago

Hey! I made this, mostly just to poke fun at my inbox being here in Europe and experiencing it first hand. Feel free to fire me a reply with any good ones you've spotted; I'll be actively adding through tomorrow and beyond.

bencollier49 8y ago
The Endomondo app is a doozy. They require opt-in to two items to carry on using the app, but then also say that by clicking continue, you're agreeing to their privacy policy, which indemnifies them against GDPR. It's slightly clever misdirection, in my opinion. I clicked 'OK' in the end because the EULA appears to be invalid anyway; by borking the consent process they have no legal basis for processing my data.
- owenwil 8y ago
  Wow - got a screenshot of that one?
vorpalhex 8y ago
Judging from the CloudFlare 502s, you have successfully been HN'd. Might be time to add in a static cache in front of the site.
zamazingo 8y ago
Could you take another look at Yahoo? I don't see the link you mentioned to walk through the huge list --I couldn't find any link that gets me to those two pages. Thanks! :) Edit: Thank you for making this!!

umbrellaman 8y ago

CCleaner deserves a special spot in this hall after the recent change with the "You cannot opt-out" privacy option in the free version of the program. [1]https://www.ghacks.net/2018/05/24/ccleaner-update-introduces-privacy-options/ https://www.ghacks.net/2018/05/24/ccleaner-update-introduces... [2] https://forum.piriform.com/topic/51913-ccleaner-5436520-cannot-opt-out-of-privacy-exposing-compulsions/ https://forum.piriform.com/topic/51913-ccleaner-5436520-cann...

letsgetphysITal 8y ago
That's not how GDPR works. You're not allowed to make use of your product / service require acceptance of collection of data. You must either offer it without data collection as an option, or simply refuse service.
- aeorgnoieang 8y ago
  I'm guessing, if that's enforced, that a lot of these same organizations will opt to refuse service.
  - letsgetphysITal 8y ago
    A lot are. GDPR Hall of Shame looks like a list of these companies.
    - aeorgnoieang 8y ago
      Which ones? The list looks like a bunch of organizations trying to do a clumsy end-run around the intent of the law instead of refusing service.

ToastyMallows 8y ago

I'd love an RSS feed of this site :)

downandout 8y ago

Could somebody help me understand the criticism in this article of companies like Instapaper blocking EU users? When you face fines of up to 20M EUR, you’re not going to take on that liability if you have a choice. Most companies outside the EU will eventually block EU traffic. GDPR is just too big of a liability. It has nothing to do with “selling user data” or bad intentions with user privacy. I won’t take EU traffic for the same reason that I don’t drive at 140mph in a 25mph zone - it’s irresponsibly dangerous.

icebraining 8y ago
Blocking EU users temporarily doesn't remove the need to comply - they're still holding data from these users.

zerostar07 8y ago

OK but maybe your website should not use cookies without asking? You don't have a privacy policy either so not clear how u re going to use them. And maybe don't use google analytics without a privacy policy? Or at least anonymize the IP?