5 ms·

The Instapaper one - #1 - is troubling for a non-obvious reason. One of the tenets of GDPR is that you have to be told how your data is being used. So the only

by xmodem 8y ago

The Instapaper one - #1 - is troubling for a non-obvious reason. One of the tenets of GDPR is that you have to be told how your data is being used. So the only explanation for this behaviour is that there's some shady shit going down that they want to stop before they have to admit to it. If I used Instapaper I'd be filing a complaint with my local DPA about this.

dingo_bat 8y ago
> So the only explanation for this behaviour is that there's some shady shit going down that they want to stop before they have to admit to it. No, it can something as simple as "we cannot guarantee that all your data is deleted with our current storage system". It would be a lot better if people stop being so alarmist.
- xmodem 8y ago
  Why can't they comment on it? It's very suspect.
  - aeorgnoieang 8y ago
    I'd guess they're afraid of legal liability.
- gregknicholson 8y ago
  If it were something that simple and reasonable, they'd be happy to say so. The fact of not giving an explanation implies that the real explanation is worse that you would expect.
- kuschku 8y ago
  The deletion doesn’t have to happen immediately, just in a reasonable time frame. A few weeks is okay, too. So if it was just that, they wouldn’t shut down.
- Silhouette 8y ago
  It would be a lot better if people stop being so alarmist. Indeed. It's odd looking at discussions about the GDPR on HN. On the one hand, we have people who argue that compliance isn't really that big a deal if you're not doing anything horribly wrong, most ethical businesses would already be mostly compliant anyway, etc. On the other hand, we have people who argue that even if that is the case, the length and ambiguity of the regulations and guidance combined with the potential penalties still cause significant overheads and risks, particularly for smaller businesses without dedicated resources to deal with compliance matters. There is some truth behind both of those positions, I think. But then I've seen so many comments now on HN and other geek-friendly forums that seem to be based on the premise that most/all businesses are somehow doing evil things with personal data and they must be stopped. A noticeable number of people are advocating obviously vexatious use of the new subject rights, not in response to any specific concern or after some unsatisfactory attempt to resolve concerns reasonably, but as a weapon with the clear goal of causing maximum disruption and cost to organisations. I wonder how anyone can think giving so much "legal ammunition" to these people is a good idea.
  - 4684499 8y ago
    > so many comments now on HN and other geek-friendly forums that seem to be based on the premise that most/all businesses are somehow doing evil things with personal data and they must be stopped I think it's pretty reasonable to have that premise when those businesses can't tell their users what they did or will do with personal data. No one could even tell whether it's evil or good if you don't show me some details. And sometimes, you assume it's good for me, but I think it's bad for me. Thank you for your good intention but all I want is just an opt-in option, not opt-out, is that so hard to accept? When you drag me into something I don't want, why would I assume you are doing something good? Users being alarmist is not users' fault, data companies' unethical use of data made users react this way. > "we cannot guarantee that all your data is deleted with our current storage system". If so, just say it. But after that, you may want to explain to me why you can't even take care of my data while claiming you respect it. Did you collect my data then just forget where you store it? If the deletion is that hard, why should users trust such company in the first place? GDPR is an action of defense, not a weapon for invasion. Only predator would think it's a weapon and be afraid. GDPR is not perfect for now, but complaining the ambiguity of it doesn't make internet companies' vague ToS or Privacy Policy clear as crystal. Let's not play double standards here. I'm quite aware HN is full of people work in data industries, I just have to say it.
bthdonohue 8y ago
Hey there – Brian from Instapaper here – we have a pretty clear and accurate privacy policy around the data we collect and how we use it, you can find it here: https://instapaper.com/privacy https://instapaper.com/privacy
- fiiv 8y ago
  Hi Brian! Thanks for taking part in the discussion. But what part of GDPR was it that caused you to have to close off European Union users?
  - sleepyhead 8y ago
    close off European Union users? I don't see any info about that.
    - Sean1708 8y ago
      Am I misunderstanding you here? Instapaper's email literally starts with: > Starting tomorrow May 24, 2018, access to the Instapaper service will be temporarily unavailable for residents in Europe
  - TillE 8y ago
    It's worth noting that GDPR applies to EU citizens regardless of where they happen to be in the world (or if they're using a proxy), so an IP ban does absolutely nothing to help comply with the law. You'd think a real company would have talked to a lawyer about this.
    - kgwgk 8y ago
      No, it doesn't apply to EU citizens regardless of where they happen to be in the world.
    - ghaff 8y ago
      How would that even make sense? A country enacts some arbitrary rule such as "You are not allowed to provide access to social media for its citizens." How do you possibly enforce that for citizens visiting or living in the US? (Short of demanding all users to verify their citizenship to access the site.)
eli 8y ago
That's extremely uncharitable.
- crankylinuxuser 8y ago
  I think we should reserve opinion here until bthdonohue gets back with fiiv's comment of "But what part of GDPR was it that caused you to have to close off European Union users?"
  - deleted 8y ago
    [deleted]
  - aeorgnoieang 8y ago
    I'm not sure it's reasonable to expect an answer to that question; at least not from someone other than their legal representative.
    - crankylinuxuser 8y ago
      Well, i'm reading their silence as "We don't give a fuck about protecting customers' data.... cause its mine!" In the end, companies whom don't go through with the GDPR prep and implementation tell me precisely one thing: there's something in their process that makes it hard for them to comply. But not seeing "We're in progress to comply at $date" tells me that they're doing some pretty nefarious stuff. Is that actually the truth? Well, we don't know and can't figure that out. It's either you comply with the GDPR globally, or for $reasons you don't. I choose to work with GDPR compliant orgs first. I know how my data will be used. And if I buy European IoT hardware, I know its not a spy-station. Edit: FUCK rate limiting. Here's my response. Given that I'm an American who has had many accounts exfiltrated or otherwise leaked, I'm frankly sick of companies treating me as a data pinata. I could go on to cite countless examples, but that dead horse has been beaten time and again. And in many cases, my data is used even without my permission (sending to gmail addresses, facebook ghost profiles, etc). It might be charitable initially, but I've seen my own impact on bad data practices. It was the wild west... And now the GDPR finally puts a stop to a lot of badness.
bryanrasmussen 8y ago
I think the instapaper one is just they aren't compliant yet, realize it, and are shutting down EU access until they reach compliance. There can be ways they are not compliant without necessarily selling data.

by xmodem 8y ago

dingo_bat 8y ago

> So the only explanation for this behaviour is that there's some shady shit going down that they want to stop before they have to admit to it. No, it can something as simple as "we cannot guarantee that all your data is deleted with our current storage system". It would be a lot better if people stop being so alarmist.

xmodem 8y ago
Why can't they comment on it? It's very suspect.
- aeorgnoieang 8y ago
  I'd guess they're afraid of legal liability.
gregknicholson 8y ago
If it were something that simple and reasonable, they'd be happy to say so. The fact of not giving an explanation implies that the real explanation is worse that you would expect.
kuschku 8y ago
The deletion doesn’t have to happen immediately, just in a reasonable time frame. A few weeks is okay, too. So if it was just that, they wouldn’t shut down.
Silhouette 8y ago
It would be a lot better if people stop being so alarmist. Indeed. It's odd looking at discussions about the GDPR on HN. On the one hand, we have people who argue that compliance isn't really that big a deal if you're not doing anything horribly wrong, most ethical businesses would already be mostly compliant anyway, etc. On the other hand, we have people who argue that even if that is the case, the length and ambiguity of the regulations and guidance combined with the potential penalties still cause significant overheads and risks, particularly for smaller businesses without dedicated resources to deal with compliance matters. There is some truth behind both of those positions, I think. But then I've seen so many comments now on HN and other geek-friendly forums that seem to be based on the premise that most/all businesses are somehow doing evil things with personal data and they must be stopped. A noticeable number of people are advocating obviously vexatious use of the new subject rights, not in response to any specific concern or after some unsatisfactory attempt to resolve concerns reasonably, but as a weapon with the clear goal of causing maximum disruption and cost to organisations. I wonder how anyone can think giving so much "legal ammunition" to these people is a good idea.
- 4684499 8y ago
  > so many comments now on HN and other geek-friendly forums that seem to be based on the premise that most/all businesses are somehow doing evil things with personal data and they must be stopped I think it's pretty reasonable to have that premise when those businesses can't tell their users what they did or will do with personal data. No one could even tell whether it's evil or good if you don't show me some details. And sometimes, you assume it's good for me, but I think it's bad for me. Thank you for your good intention but all I want is just an opt-in option, not opt-out, is that so hard to accept? When you drag me into something I don't want, why would I assume you are doing something good? Users being alarmist is not users' fault, data companies' unethical use of data made users react this way. > "we cannot guarantee that all your data is deleted with our current storage system". If so, just say it. But after that, you may want to explain to me why you can't even take care of my data while claiming you respect it. Did you collect my data then just forget where you store it? If the deletion is that hard, why should users trust such company in the first place? GDPR is an action of defense, not a weapon for invasion. Only predator would think it's a weapon and be afraid. GDPR is not perfect for now, but complaining the ambiguity of it doesn't make internet companies' vague ToS or Privacy Policy clear as crystal. Let's not play double standards here. I'm quite aware HN is full of people work in data industries, I just have to say it.

bthdonohue 8y ago

Hey there – Brian from Instapaper here – we have a pretty clear and accurate privacy policy around the data we collect and how we use it, you can find it here: https://instapaper.com/privacy https://instapaper.com/privacy

fiiv 8y ago
Hi Brian! Thanks for taking part in the discussion. But what part of GDPR was it that caused you to have to close off European Union users?
- sleepyhead 8y ago
  close off European Union users? I don't see any info about that.
  - Sean1708 8y ago
    Am I misunderstanding you here? Instapaper's email literally starts with: > Starting tomorrow May 24, 2018, access to the Instapaper service will be temporarily unavailable for residents in Europe
- TillE 8y ago
  It's worth noting that GDPR applies to EU citizens regardless of where they happen to be in the world (or if they're using a proxy), so an IP ban does absolutely nothing to help comply with the law. You'd think a real company would have talked to a lawyer about this.
  - kgwgk 8y ago
    No, it doesn't apply to EU citizens regardless of where they happen to be in the world.
  - ghaff 8y ago
    How would that even make sense? A country enacts some arbitrary rule such as "You are not allowed to provide access to social media for its citizens." How do you possibly enforce that for citizens visiting or living in the US? (Short of demanding all users to verify their citizenship to access the site.)

eli 8y ago

That's extremely uncharitable.

crankylinuxuser 8y ago
I think we should reserve opinion here until bthdonohue gets back with fiiv's comment of "But what part of GDPR was it that caused you to have to close off European Union users?"
- deleted 8y ago
  [deleted]
- aeorgnoieang 8y ago
  I'm not sure it's reasonable to expect an answer to that question; at least not from someone other than their legal representative.
  - crankylinuxuser 8y ago
    Well, i'm reading their silence as "We don't give a fuck about protecting customers' data.... cause its mine!" In the end, companies whom don't go through with the GDPR prep and implementation tell me precisely one thing: there's something in their process that makes it hard for them to comply. But not seeing "We're in progress to comply at $date" tells me that they're doing some pretty nefarious stuff. Is that actually the truth? Well, we don't know and can't figure that out. It's either you comply with the GDPR globally, or for $reasons you don't. I choose to work with GDPR compliant orgs first. I know how my data will be used. And if I buy European IoT hardware, I know its not a spy-station. Edit: FUCK rate limiting. Here's my response. Given that I'm an American who has had many accounts exfiltrated or otherwise leaked, I'm frankly sick of companies treating me as a data pinata. I could go on to cite countless examples, but that dead horse has been beaten time and again. And in many cases, my data is used even without my permission (sending to gmail addresses, facebook ghost profiles, etc). It might be charitable initially, but I've seen my own impact on bad data practices. It was the wild west... And now the GDPR finally puts a stop to a lot of badness.

bryanrasmussen 8y ago

I think the instapaper one is just they aren't compliant yet, realize it, and are shutting down EU access until they reach compliance. There can be ways they are not compliant without necessarily selling data.