5 ms·

This is the crux of the problems with how companies are interpreting the GDPR. Every service I've seen with a privacy policy pop up within the last 24 hours has

This is the crux of the problems with how companies are interpreting the GDPR. Every service I've seen with a privacy policy pop up within the last 24 hours has basically justified all of their current data collecting practices as being necessary for their business. The spirit of the GDPR is to improve privacy, not just make Terms of Service pages longer.

tomrod 8y ago
Yeah, but the law of unintended consequences is sure to apply. The GDPR hits adtech companies fundamentally.
- Certhas 8y ago
  This is not "unintended consequences", it is explicitly anticipated by the law. Which is why people can and are suing. We'll see how it shakes out in the courts.
  - tomrod 8y ago
    The law explicitly said "within hours of taking effect, these specific companies are to be sued due to not preparing sufficiently for GDPR"?
    - tzahola 8y ago
      “Within hours” You mean “within the 2 years probation period + a few hours”
      - peteretep 8y ago
        GDPR has been law for two years, since 25 May 2016, a point your downvoters seem to be missing.
        NullPrefix 8y ago
        Yeah, that may be true, but it doesn't matter. Nobody was talking about it back then. /s
        tzahola 8y ago
        Let them downvote. I’d be downvoting left and right too, if those pesky EU bureaucrats had ruined my moneymaking scamvertising scheme.
    - salvar 8y ago
      What a refreshingly honest question.
      - tomrod 8y ago
        I know it seems like a stupid question, but I wanted to make sure I understood the parent commenter's point.
    - pjc50 8y ago
      The law is explicitly aimed at direct marketing. It's mentioned in the text: (article 21) "Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing. 3. Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes." (also I think "In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, the data subject may exercise his or her right to object by automated means using technical specifications." means that suddenly people are required to respect Do Not Track, which will be .. entertaining) All laws enable action to be taken against people who are not following them at the time they come into effect. That's what "coming into effect" means.
      - tomrod 8y ago
        Fair. I appreciate the input.
  - craigsmansion 8y ago
    People are not "suing," they're filing complaints. It's a small but important difference, since a lot of the uncertainty and doubt around the GDPR seems to revolve around being sued out of existence in courts of law, which is not a thing: you can't get sued randomly by disgruntled users.
    - Certhas 8y ago
      You are absolutely right, sorry for the imprecise/misleading language.
  - henrikschroder 8y ago
    They're not being sued, and it's not a case for the courts. They're being reported to the Data Protection Agencies in various EU countries.
    - akie 8y ago
      Yes, but that's the first step to being sued.
      - henrikschroder 8y ago
        No, if a company gets reported, the DPA is supposed to investigate, and help the company get compliant if it finds that it isn't. If the company is willfully refusing to become compliant, the DPA can slap the company with a proportional fine to make non-compliance more expensive than complying. And if the company is fined, the company can probably sue the DPA in question if they think the fine was unreasonable or unapplicable or no good very bad and unfair.
        frockington 8y ago
        Does the DPA also get to choose who is making a strong effort and who isn't. Reporters can probably start pre-typing the corruption scandal articles.
- jonathanstrange 8y ago
  > The GDPR hits adtech companies fundamentally. Hopefully...
  - Ygg2 8y ago
    I'm not holding my breath. To paraphrase Jurassic Park "Money finds a way".
sleepyhead 8y ago
Actually the spirit of GDPR is also to make Terms of Service shorter by being clear and understandable. If you as a user is unable to understand what you are agreeing to then it is a violation of GDPR.
- mirko22 8y ago
  > unable to understand What if he is not very smart? Or even better, what if he is very dumb? At which level should those be written then?
  - contravariant 8y ago
    The literal text of the GDPR is as follows: >the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language
    - mirko22 8y ago
      Yes, and before that it says ` If the data subject's consent is given in the context of a written declaration which also concerns other matters,` which means i can use legalese but only if it does not concern other matters in the same document? :)
      - contravariant 8y ago
        You'd hope not, but I also thought the phrasing in that sentence was sloppy.
        mirko22 8y ago
        that’s the whole issue with the regulation unfortunately :(
- sontek 8y ago
  Our policies got much longer with GDPR. We only collect information for legitimate reasons (i.e we need it for the service they are using), we ask for it, and we never target it / sell the data. It helps that our customers are paying customers and not using a free service. So our TOS used to be quite simple in plain english that all the data we request is only for the purpose of providing the service. Now we had to outline all the information we collection (even though they are the ones who provide it, so they know what we collect) and outline all our services we use where that data we collect ends up (AWS, Sentry, Loggly, etc... the services we need to run our system and support them). Most of our clients have no idea what any of the information we added is because its all technical details about how we are providing the service to them. GDPR required us to do a lot of work that ended up costing us time and money and literally nothing changed because we were already making sure we protected our users privacy. Hopefully some bad actors get hit but for now GDPR has left a bad impression on me.
jacquesm 8y ago
Twitter got it right.

tomrod 8y ago

Yeah, but the law of unintended consequences is sure to apply. The GDPR hits adtech companies fundamentally.

Certhas 8y ago
This is not "unintended consequences", it is explicitly anticipated by the law. Which is why people can and are suing. We'll see how it shakes out in the courts.
- tomrod 8y ago
  The law explicitly said "within hours of taking effect, these specific companies are to be sued due to not preparing sufficiently for GDPR"?
  - tzahola 8y ago
    “Within hours” You mean “within the 2 years probation period + a few hours”
    - peteretep 8y ago
      GDPR has been law for two years, since 25 May 2016, a point your downvoters seem to be missing.
      - NullPrefix 8y ago
        Yeah, that may be true, but it doesn't matter. Nobody was talking about it back then. /s
      - tzahola 8y ago
        Let them downvote. I’d be downvoting left and right too, if those pesky EU bureaucrats had ruined my moneymaking scamvertising scheme.
  - salvar 8y ago
    What a refreshingly honest question.
    - tomrod 8y ago
      I know it seems like a stupid question, but I wanted to make sure I understood the parent commenter's point.
  - pjc50 8y ago
    The law is explicitly aimed at direct marketing. It's mentioned in the text: (article 21) "Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing. 3. Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes." (also I think "In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, the data subject may exercise his or her right to object by automated means using technical specifications." means that suddenly people are required to respect Do Not Track, which will be .. entertaining) All laws enable action to be taken against people who are not following them at the time they come into effect. That's what "coming into effect" means.
    - tomrod 8y ago
      Fair. I appreciate the input.
- craigsmansion 8y ago
  People are not "suing," they're filing complaints. It's a small but important difference, since a lot of the uncertainty and doubt around the GDPR seems to revolve around being sued out of existence in courts of law, which is not a thing: you can't get sued randomly by disgruntled users.
  - Certhas 8y ago
    You are absolutely right, sorry for the imprecise/misleading language.
- henrikschroder 8y ago
  They're not being sued, and it's not a case for the courts. They're being reported to the Data Protection Agencies in various EU countries.
  - akie 8y ago
    Yes, but that's the first step to being sued.
    - henrikschroder 8y ago
      No, if a company gets reported, the DPA is supposed to investigate, and help the company get compliant if it finds that it isn't. If the company is willfully refusing to become compliant, the DPA can slap the company with a proportional fine to make non-compliance more expensive than complying. And if the company is fined, the company can probably sue the DPA in question if they think the fine was unreasonable or unapplicable or no good very bad and unfair.
      - frockington 8y ago
        Does the DPA also get to choose who is making a strong effort and who isn't. Reporters can probably start pre-typing the corruption scandal articles.
jonathanstrange 8y ago
> The GDPR hits adtech companies fundamentally. Hopefully...
- Ygg2 8y ago
  I'm not holding my breath. To paraphrase Jurassic Park "Money finds a way".

sleepyhead 8y ago

Actually the spirit of GDPR is also to make Terms of Service shorter by being clear and understandable. If you as a user is unable to understand what you are agreeing to then it is a violation of GDPR.

mirko22 8y ago
> unable to understand What if he is not very smart? Or even better, what if he is very dumb? At which level should those be written then?
- contravariant 8y ago
  The literal text of the GDPR is as follows: >the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language
  - mirko22 8y ago
    Yes, and before that it says ` If the data subject's consent is given in the context of a written declaration which also concerns other matters,` which means i can use legalese but only if it does not concern other matters in the same document? :)
    - contravariant 8y ago
      You'd hope not, but I also thought the phrasing in that sentence was sloppy.
      - mirko22 8y ago
        that’s the whole issue with the regulation unfortunately :(
sontek 8y ago
Our policies got much longer with GDPR. We only collect information for legitimate reasons (i.e we need it for the service they are using), we ask for it, and we never target it / sell the data. It helps that our customers are paying customers and not using a free service. So our TOS used to be quite simple in plain english that all the data we request is only for the purpose of providing the service. Now we had to outline all the information we collection (even though they are the ones who provide it, so they know what we collect) and outline all our services we use where that data we collect ends up (AWS, Sentry, Loggly, etc... the services we need to run our system and support them). Most of our clients have no idea what any of the information we added is because its all technical details about how we are providing the service to them. GDPR required us to do a lot of work that ended up costing us time and money and literally nothing changed because we were already making sure we protected our users privacy. Hopefully some bad actors get hit but for now GDPR has left a bad impression on me.

jacquesm 8y ago

Twitter got it right.