12 ms·

As a French guy, these type of comments make me smile. The GDPR is basically just the implementation of the French law "Informatique et Liberté" into the Europe

As a French guy, these type of comments make me smile. The GDPR is basically just the implementation of the French law "Informatique et Liberté" into the European Level. (You can read on HN many Germans saying that it's actually the implementation of the Datenschutzgesetzt. The truth is: these two laws are extremely similar.) This law has been in application since 1978 [1]. And in 2018, we have adtech companies like Criteo. [2] I have one of my best friend who started his adtech startup in France. Everything is good. There's is a lot of implicit contracts (you filled up our sign up form? Well, then you chose to give us your data. ...) The only things you have to do: know which data you collect and give the ability to people to update/delete their data. That's all. I don't understand the fear. I don't understand what is "vague" about it. It's so simple and low barrier that Microsoft decided to make it the rule for all of their users. But thanks to the hysteria, they made a PR stunt out of it. -- [1] https://en.wikipedia.org/w/index.php?title=Data_ownership&oldid=833932895#France https://en.wikipedia.org/w/index.php?title=Data_ownership&ol... [2] https://en.wikipedia.org/wiki/Criteo https://en.wikipedia.org/wiki/Criteo

manigandham 8y ago
You mean Criteo the company that has lost over 50% of their valuation since last year because of cookie and consent issues? Yea it's going really well for them. https://finance.yahoo.com/quote/CRTO/chart?p=CRTO https://finance.yahoo.com/quote/CRTO/chart?p=CRTO The difference is that France is insignificant in the adtech market. The real money is in the US and spread out across Europe, with Asia soon to overtake. The existing rules you point to weren't affecting global operations where Criteo and others made their money.
- dnomad 8y ago
  The entire adtech business is due for correction. It's strange that you think the business models are going to fly in Asia. China and many Asian countries are laying out privacy regimes that are even more strict than the GDPR. Take a look at China [1] or Thailand [2]. Pretty soon it will be the case only in America that adtech companies can collect and sell endless personal information without consequence. [2] https://www.bangkokpost.com/business/news/1455534/new-data-law-aimed-at-ensuring-privacy https://www.bangkokpost.com/business/news/1455534/new-data-l...
  - manigandham 8y ago
    What are you talking about? China with it's national real-time citizen tracking using 'social credit' scores, facial recognition, and internet firewalls really cares about your privacy? Ok, spend all your time going after the ad company and ignore the government which is 1000x worse and will control your life or toss you in a cell. Good luck with that.
    - kadenshep 8y ago
      He's not ignoring that? He's pointing out the laws are stricter when dealing with private companies. You are talking about two completely orthogonal laws or standards.
      - manigandham 8y ago
        It's connected to their other comment: https://news.ycombinator.com/item?id=17158209 https://news.ycombinator.com/item?id=17158209 The laws are not stricter (they arent even laws yet), and they are meaningless in those areas because the government itself already defies them.
        kadenshep 8y ago
        >they are meaningless in those areas because the government itself already defies them. That doesn't make laws meaningless.
        KirinDave 8y ago
        In this more specific case, it's very difficult to judge China's policies with an even tilt because private Chinese companies are ad hoc lifted to "public status" when they're convenient for the government to leverage. But China grants legal exemptions without especially good or consistent oversight over those countries. The net result is an awful lot of folks who get a legal exemption for a specific aspect of their business and then tend to run roughshod in other less scrutinized areas.
- acatton 8y ago
  First of all "insignificant" is far fetched. Small? Yes. But not insignificant. Second... I don't see how valuation matters. Did they loose money? Went out of business? No. VW lost valuation during the whole diesel gate scandal. Did that make VW a less relevant? No. And the last thing that I wanted to mention: I said "this is just an implementation of an old French law into the European Level". And I was mentioning the French law itself, not the European Law. The cookie issue that you're mentioning is related to the ePrivacy directive, which is solely European Law, that was passed one or two years before the whole lost of valuation. My point was just that the GDPR doesn't affect anybody.
  - manigandham 8y ago
    > I don't see how valuation matters. Did they loose money? Do you know that they are a publicly traded company? Losing money is exactly what happens when the stock price falls. When you lose more than half of your value, going out of business is a serious risk.
    - acatton 8y ago
      The stock price usually reflect the "feeling" of the investors. But it does not make a company loose/win money. It's just what the investors think the company will make in the future, but investors (as often) can be wrong. It only affects the ability to make more money by issuing new shares. But the "bank account" of the company doesn't get divided by two. Customers don't start paying only half the price for their service.
wang_li 8y ago
Giving people the option to delete their data is a bit like allowing someone to get their money back two years after eating a meal at a restaurant. Given the EU assertion of global jurisdiction, the GDPR seems like a bit of a trade war and it's surprising more commentators aren't treating it as such. The US should be inspired by this and give online retailers the opportunity to collect and remit sales taxes.
- tomc1985 8y ago
  No it isn't. If your business relationship with the customer ends, so should your data relationship.
  - wang_li 8y ago
    Yes it is. The customer paid for their past use of the service with their data. Wanting to take that data away after having used the service is exactly like wanting a refund for a product you consumed.
    - welly 8y ago
      No it isn't.
    - tomc1985 8y ago
      Regardless, GDPR requires that you do this. Data's value is massively inflated in the minds of "technologists" and it is time that price came down to reflect the realities that the rest of the world wants. Sincerely hoping that this marks the end of the data gold rush
    - 8note 8y ago
      they aren't getting the service indefinitely, why should you get the data indefinitely?
      - wang_li 8y ago
        When you finish working at the end of the day, do you return your salary? When you leave college do you get your tuition back?
ziftface 8y ago
I looked up information on how to legally comply with GDPR and it's a lot more complicated than you're making it out to be. You have to show regulators the well-defined pipeline for any personal data, and justify to them why that data is being collected. There are also extra procedures you have to follow that could be really complicated depending on the business. This is even worse for small businesses. I can definitely understand those people who want to just wash their hands of it, especially if they don't get much business from Europe.
- acatton 8y ago
  When I read that, I don't know how to answer. As I said other comments, I'm not sure if people on HN have a problem with the GDPR, or just with the concept of regulation itself. Also, when I read about "complicated rules for small businesses". It reminds me about American republican politicians explaining how taxes on the rich will affect the average joe's taxes. The reality is that many rules only apply to big businesses. And small businesses are exempt of many rules. My favorite one is the "Data Protection Officer", everybody on the internet™ says that you need one. The reality? Most small business won't. The article 37 explains that the Data Protection Officer is when a business is "collecting data on a large scale" [1] Second of all, people interpret that as "Hiring somebody", you don't. It's just a role, take your CEO, and now he's your "Data Protection Officer", ... -- [1] https://gdpr-info.eu/art-37-gdpr/ https://gdpr-info.eu/art-37-gdpr/
  - takeda 8y ago
    I support GDPR, but to be fair about Data Protection Officer, that position sounds like a liability, no one will want that title unless they are appropriately compensated for it, so most likely this will be a dedicated person who will be paid just to be responsible for things being complaint. Perhaps in early stage of a startup a founder will take the title to save cost, but he/she will want to lose that responsibility as soon as possible.
    - tombone12 8y ago
      So like a CEO, that is liable for all violations employees do that they've not managed to put on someone else?
dnomad 8y ago
Yes, none of this is new or surprising. The irony here is that American users are so used to being endlessly surveiled without consequence that they are genuinely shocked that the rest of the world refuses to put up with this bullshit. This is completely normal to them. The GDPR is just another step in a global fight by people all over the world to regain their data sovereignty and protect themselves from endless surveillance. The momentum at the international level is very clearly for data sovereignty. Russia and many Asian countries are following closely behind. And while everybody was freaking out about the GDPR nobody seemed to notice that China passed even stricter online privacy laws [1] earlier this month. Singapore [3] and Malaysia [4] are up to speed and even Thailand [2] will likely soon require minimum standards. (Edited to add more links.) The end result is like so many other things: American companies will end up blocking everybody but American users who they know they can exploit without consequence. American users will celebrate their exploitation as freedom from Big Government. Everybody else will move on and just shake their heads. [1] https://www.csis.org/analysis/new-china-data-privacy-standard-looks-more-far-reaching-gdpr https://www.csis.org/analysis/new-china-data-privacy-standar... [2] https://www.bangkokpost.com/business/news/1455534/new-data-law-aimed-at-ensuring-privacy https://www.bangkokpost.com/business/news/1455534/new-data-l... [3] https://www.pdpc.gov.sg/Legislation-and-Guidelines/Personal-Data-Protection-Act-Overview https://www.pdpc.gov.sg/Legislation-and-Guidelines/Personal-... [4] https://www.hg.org/article.asp?id=33273 https://www.hg.org/article.asp?id=33273
- manigandham 8y ago
  Read the thread again. Nobody has a problem with data protection but the fact that the regulation is not actually clear, hence creating more work while simultaneously being rather ineffective. How is that good for the user? Also it's hilarious to claim China has better privacy when that government tracks everyone using facial regulation with real-time threat scoring and national social rankings called a "citizen score". A late payment on a single bill gets your face and contact info on a giant billboard so go ahead and try complaining about your data over there and see how far that goes.
  - dnomad 8y ago
    How can the regulation already be ineffective? It's literally been in effect for one day. You'll have to refine the standard anti-regulatory tropes in this case. Get this: not everybody is consumed by paranoid fantasies concerning their government. And while your shallow understanding of China based off a few western-oriented articles here and there may validate your own biases do understand they have no real relation to reality. In reality, there are no extraordinary consequences for missing a single bill. On the other hand if you're sued in court over a debt the judge -- not unlike American judges (!) -- can use public humiliation to try to modify your behavior.
droopybuns 8y ago
Every time you log data to solve a problem, you now need to review and decide if that data needs to be accessible for review and deletion. It is a blocker that slows down your efforts to work on the next feature. It is not hacker friendly. It is a huge pain in the ass. Edit: btw, I don’t really blame the EU. Google and Facebook got us into this mess.
pbhjpbhj 8y ago
>There's is a lot of implicit contracts (you filled up our sign up form? Well, then you chose to give us your data. ...) // AIUI that's one of the main changes, that explicit consent is now needed to retain data and specific details of how it will be secured, who it might be passed to, must be given. Also that if the service being offered doesn't need the data, that the company offering the service can't insist on having it. It is a big thing for micro-businesses and SMEs in the UK - despite having data protection laws already - it does change the complexion of how one handles PII and the embedded assumptions. We're talking about businesses many of whom have paper bookings diaries - the diary apparently needs to now be secured, whilst it's always sat on the counter before; that's a costly structural/workflow change (unlock the diary for every phone call!).
- disgruntledphd2 8y ago
  I think that we'll probably need some changes around non-digital records. Mind you, these exemptions existed in Irish law and were horribly abused :(

manigandham 8y ago

You mean Criteo the company that has lost over 50% of their valuation since last year because of cookie and consent issues? Yea it's going really well for them. https://finance.yahoo.com/quote/CRTO/chart?p=CRTO https://finance.yahoo.com/quote/CRTO/chart?p=CRTO The difference is that France is insignificant in the adtech market. The real money is in the US and spread out across Europe, with Asia soon to overtake. The existing rules you point to weren't affecting global operations where Criteo and others made their money.

dnomad 8y ago
The entire adtech business is due for correction. It's strange that you think the business models are going to fly in Asia. China and many Asian countries are laying out privacy regimes that are even more strict than the GDPR. Take a look at China [1] or Thailand [2]. Pretty soon it will be the case only in America that adtech companies can collect and sell endless personal information without consequence. [2] https://www.bangkokpost.com/business/news/1455534/new-data-law-aimed-at-ensuring-privacy https://www.bangkokpost.com/business/news/1455534/new-data-l...
- manigandham 8y ago
  What are you talking about? China with it's national real-time citizen tracking using 'social credit' scores, facial recognition, and internet firewalls really cares about your privacy? Ok, spend all your time going after the ad company and ignore the government which is 1000x worse and will control your life or toss you in a cell. Good luck with that.
  - kadenshep 8y ago
    He's not ignoring that? He's pointing out the laws are stricter when dealing with private companies. You are talking about two completely orthogonal laws or standards.
    - manigandham 8y ago
      It's connected to their other comment: https://news.ycombinator.com/item?id=17158209 https://news.ycombinator.com/item?id=17158209 The laws are not stricter (they arent even laws yet), and they are meaningless in those areas because the government itself already defies them.
      - kadenshep 8y ago
        >they are meaningless in those areas because the government itself already defies them. That doesn't make laws meaningless.
        KirinDave 8y ago
        In this more specific case, it's very difficult to judge China's policies with an even tilt because private Chinese companies are ad hoc lifted to "public status" when they're convenient for the government to leverage. But China grants legal exemptions without especially good or consistent oversight over those countries. The net result is an awful lot of folks who get a legal exemption for a specific aspect of their business and then tend to run roughshod in other less scrutinized areas.
acatton 8y ago
First of all "insignificant" is far fetched. Small? Yes. But not insignificant. Second... I don't see how valuation matters. Did they loose money? Went out of business? No. VW lost valuation during the whole diesel gate scandal. Did that make VW a less relevant? No. And the last thing that I wanted to mention: I said "this is just an implementation of an old French law into the European Level". And I was mentioning the French law itself, not the European Law. The cookie issue that you're mentioning is related to the ePrivacy directive, which is solely European Law, that was passed one or two years before the whole lost of valuation. My point was just that the GDPR doesn't affect anybody.
- manigandham 8y ago
  > I don't see how valuation matters. Did they loose money? Do you know that they are a publicly traded company? Losing money is exactly what happens when the stock price falls. When you lose more than half of your value, going out of business is a serious risk.
  - acatton 8y ago
    The stock price usually reflect the "feeling" of the investors. But it does not make a company loose/win money. It's just what the investors think the company will make in the future, but investors (as often) can be wrong. It only affects the ability to make more money by issuing new shares. But the "bank account" of the company doesn't get divided by two. Customers don't start paying only half the price for their service.

wang_li 8y ago

Giving people the option to delete their data is a bit like allowing someone to get their money back two years after eating a meal at a restaurant. Given the EU assertion of global jurisdiction, the GDPR seems like a bit of a trade war and it's surprising more commentators aren't treating it as such. The US should be inspired by this and give online retailers the opportunity to collect and remit sales taxes.

tomc1985 8y ago
No it isn't. If your business relationship with the customer ends, so should your data relationship.
- wang_li 8y ago
  Yes it is. The customer paid for their past use of the service with their data. Wanting to take that data away after having used the service is exactly like wanting a refund for a product you consumed.
  - welly 8y ago
    No it isn't.
  - tomc1985 8y ago
    Regardless, GDPR requires that you do this. Data's value is massively inflated in the minds of "technologists" and it is time that price came down to reflect the realities that the rest of the world wants. Sincerely hoping that this marks the end of the data gold rush
  - 8note 8y ago
    they aren't getting the service indefinitely, why should you get the data indefinitely?
    - wang_li 8y ago
      When you finish working at the end of the day, do you return your salary? When you leave college do you get your tuition back?

ziftface 8y ago

I looked up information on how to legally comply with GDPR and it's a lot more complicated than you're making it out to be. You have to show regulators the well-defined pipeline for any personal data, and justify to them why that data is being collected. There are also extra procedures you have to follow that could be really complicated depending on the business. This is even worse for small businesses. I can definitely understand those people who want to just wash their hands of it, especially if they don't get much business from Europe.

acatton 8y ago
When I read that, I don't know how to answer. As I said other comments, I'm not sure if people on HN have a problem with the GDPR, or just with the concept of regulation itself. Also, when I read about "complicated rules for small businesses". It reminds me about American republican politicians explaining how taxes on the rich will affect the average joe's taxes. The reality is that many rules only apply to big businesses. And small businesses are exempt of many rules. My favorite one is the "Data Protection Officer", everybody on the internet™ says that you need one. The reality? Most small business won't. The article 37 explains that the Data Protection Officer is when a business is "collecting data on a large scale" [1] Second of all, people interpret that as "Hiring somebody", you don't. It's just a role, take your CEO, and now he's your "Data Protection Officer", ... -- [1] https://gdpr-info.eu/art-37-gdpr/ https://gdpr-info.eu/art-37-gdpr/
- takeda 8y ago
  I support GDPR, but to be fair about Data Protection Officer, that position sounds like a liability, no one will want that title unless they are appropriately compensated for it, so most likely this will be a dedicated person who will be paid just to be responsible for things being complaint. Perhaps in early stage of a startup a founder will take the title to save cost, but he/she will want to lose that responsibility as soon as possible.
  - tombone12 8y ago
    So like a CEO, that is liable for all violations employees do that they've not managed to put on someone else?

dnomad 8y ago

Yes, none of this is new or surprising. The irony here is that American users are so used to being endlessly surveiled without consequence that they are genuinely shocked that the rest of the world refuses to put up with this bullshit. This is completely normal to them. The GDPR is just another step in a global fight by people all over the world to regain their data sovereignty and protect themselves from endless surveillance. The momentum at the international level is very clearly for data sovereignty. Russia and many Asian countries are following closely behind. And while everybody was freaking out about the GDPR nobody seemed to notice that China passed even stricter online privacy laws [1] earlier this month. Singapore [3] and Malaysia [4] are up to speed and even Thailand [2] will likely soon require minimum standards. (Edited to add more links.) The end result is like so many other things: American companies will end up blocking everybody but American users who they know they can exploit without consequence. American users will celebrate their exploitation as freedom from Big Government. Everybody else will move on and just shake their heads. [1] https://www.csis.org/analysis/new-china-data-privacy-standard-looks-more-far-reaching-gdpr https://www.csis.org/analysis/new-china-data-privacy-standar... [2] https://www.bangkokpost.com/business/news/1455534/new-data-law-aimed-at-ensuring-privacy https://www.bangkokpost.com/business/news/1455534/new-data-l... [3] https://www.pdpc.gov.sg/Legislation-and-Guidelines/Personal-Data-Protection-Act-Overview https://www.pdpc.gov.sg/Legislation-and-Guidelines/Personal-... [4] https://www.hg.org/article.asp?id=33273 https://www.hg.org/article.asp?id=33273

manigandham 8y ago
Read the thread again. Nobody has a problem with data protection but the fact that the regulation is not actually clear, hence creating more work while simultaneously being rather ineffective. How is that good for the user? Also it's hilarious to claim China has better privacy when that government tracks everyone using facial regulation with real-time threat scoring and national social rankings called a "citizen score". A late payment on a single bill gets your face and contact info on a giant billboard so go ahead and try complaining about your data over there and see how far that goes.
- dnomad 8y ago
  How can the regulation already be ineffective? It's literally been in effect for one day. You'll have to refine the standard anti-regulatory tropes in this case. Get this: not everybody is consumed by paranoid fantasies concerning their government. And while your shallow understanding of China based off a few western-oriented articles here and there may validate your own biases do understand they have no real relation to reality. In reality, there are no extraordinary consequences for missing a single bill. On the other hand if you're sued in court over a debt the judge -- not unlike American judges (!) -- can use public humiliation to try to modify your behavior.

droopybuns 8y ago

Every time you log data to solve a problem, you now need to review and decide if that data needs to be accessible for review and deletion. It is a blocker that slows down your efforts to work on the next feature. It is not hacker friendly. It is a huge pain in the ass. Edit: btw, I don’t really blame the EU. Google and Facebook got us into this mess.

pbhjpbhj 8y ago

>There's is a lot of implicit contracts (you filled up our sign up form? Well, then you chose to give us your data. ...) // AIUI that's one of the main changes, that explicit consent is now needed to retain data and specific details of how it will be secured, who it might be passed to, must be given. Also that if the service being offered doesn't need the data, that the company offering the service can't insist on having it. It is a big thing for micro-businesses and SMEs in the UK - despite having data protection laws already - it does change the complexion of how one handles PII and the embedded assumptions. We're talking about businesses many of whom have paper bookings diaries - the diary apparently needs to now be secured, whilst it's always sat on the counter before; that's a costly structural/workflow change (unlock the diary for every phone call!).

disgruntledphd2 8y ago
I think that we'll probably need some changes around non-digital records. Mind you, these exemptions existed in Irish law and were horribly abused :(