5 ms·

My biggest _annoyance_ with GDPR and its advocates is the constant touting of "giving users control over their data" when in reality it is hindering voluntary a

My biggest _annoyance_ with GDPR and its advocates is the constant touting of "giving users control over their data" when in reality it is hindering voluntary actions that by their nature require some of "my data". If I want to service a small group of people with, say, an XMPP network, and those users are willing and eager to just go with it without any of this bs with terms and three-letter EU dictated roles, then it should be possible. When you've made it prohibitive, then you've done something wrong IMO. My biggest _fear_ regarding GDPR is that, to me at least, it seems like a one-size-fits-all regulation for a world where only organisations are allowed to run services, and where all services are centralized. Which is not the world we live in (yet).

gerdesj 8y ago
The processing of personal data should be designed to serve mankind. The right to the protection of personal data is not an absolute right; it must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality. This Regulation respects all fundamental rights and observes the freedoms and principles recognised in the Charter as enshrined in the Treaties, in particular the respect for private and family life, home and communications, the protection of personal data, freedom of thought, conscience and religion, freedom of expression and information, freedom to conduct a business, the right to an effective remedy and to a fair trial, and cultural, religious and linguistic diversity. http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679 http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX... I suggest you read the rest of it before opining.
- manfredo 8y ago
  This basically boils down to, "just hope that all current and future EU member nation agree with you on what is and isn't morally right." Good thing different societies and cultures have never disagreed on what is and isn't morally just, amirite?
tomc1985 8y ago
I don't think it applies to individuals and noncommercial activity, though I have heard anecdotal reports of european cops hassling people shooting pictures on mobile phones
- hk__2 8y ago
  > I don't think it applies to individuals and noncommercial activity Why would these be unaffected? You have to comply with GDPR as soon as you start processing personal data.
  - tomc1985 8y ago
    This thread on Reddit seems to have some cogent discussion on exceptions https://www.reddit.com/r/sysadmin/comments/8litn7/gdpr_for_hobby_websites/dzg4neg/ https://www.reddit.com/r/sysadmin/comments/8litn7/gdpr_for_h...
  - Silhouette 8y ago
    That's not entirely true. Article 2 defines the scope in various respects, and categories such as "by a natural person in the course of a purely personal or household activity" are specifically not within that scope.
Sangermaine 8y ago
It hinders nothing. It ensures that what you're with user data doing is truly voluntary and that your users really are 'willing and eager" about it beyond you pinky-swearing you'll be good with what you're given. Be annoyed all you want, the only people whining about the GDPR are those showing their true colors when it comes to user privacy and agency. If you're complaining that it hinders you from using user data as you please, that's precisely the point.
- anfogoat 8y ago
  To be clear, I'm annoyed as a user too. Partly by the discrepancy between the claim that I now have control over my data, but can't actually use it since the small independently run services can't accept my data even if I wanted them to, because that acceptance comes with a set of requirements that are prohibitive, and which I, the user, would not want in this instance. However, judging by some of the other responses, I might be wrong about the effects on independently run services (and I'm happy to be). I'm going to ignore the part about my supposed true colors in respect to user privacy. Too tired.
  - bulatb 8y ago
    A system that preserves freedom—not your freedom in every particular case, but the prevalence of freedom in general for people in general—must restrict your freedom to give yours away. You're not allowed to sell yourself to slavers, even if you want to. Slavers can't exist at all. It's understood that if they did, the slavers would exploit your "freedom" to create a world where, in reality, the circumstances leave you no alternative except to "freely choose" to be a slave.
myhf 8y ago
If I want to service a small group of people with, say, a nuclear power plant, and those people are willing and eager to just go with it without any bs or roles, then it should be possible. When you make it prohibitive to handle hazardous materials, then you've done something wrong.
- anfogoat 8y ago
  If you and the small group of people are the only living creatures on the planet, then absolutely! That is to say, this isn't really comparable, for obvious reasons.
  - myhf 8y ago
    PII is a hazardous material, and it should be regulated like other hazardous materials, for obvious reasons.
    - ryanwaggoner 8y ago
      This is so hyperbolic. Hazardous material? So your old IP address that has since changed 27 times being in some forgotten log file somewhere is now basically like uranium or industrial waste. Makes sense.
viraptor 8y ago
So which parts of the GDPR do you actually disagree with in case of this XMPP service? Mostly you need to tell people what you collect, allow removing accounts and history, and tell them if you're sending the data to third-parties. If you're running a private service you most likely already fulfill those requirements. Where's the annoyance?
- anfogoat 8y ago
  In the specific case of XMPP, wouldn't I need to have an agreement with every other admin who federates their XMPP server and work out what exactly our roles are as defined by GDPR? XMPP still has active development community around it so this will no doubt get much easier with time, but that's just XMPP.
  - viraptor 8y ago
    IANAL, but unlikely. Sending messages is the primary purpose of the service. As long as users are made aware that messages going outside of your domain are shared with 3rd parties, it's on them to make that decision. Same would apply to email, phones, etc.
  - bcheung 8y ago
    Maybe not: You need to have a "Legal Basis" and only 1 of them is the "subject has given consent" one. There's another: "The processing is NECESSARY FOR THE PERFORMANCE OF A CONTRACT to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract;"
    - davorak 8y ago
      I thought you would have to al least all the admins to agree to follow the GDPR so that data can be retrieved, corrected, and deleted on demand right?
  - mandelbulb 8y ago
    Look at it this way: The service you're using needs a privacy policy, that is not new. The way that policy is organized or shared is no different now, just what rights the user and what obligations the service provider has.
partycoder 8y ago
GDPR is simply a response to abusive behavior. May not be the best response, but it was about time. Then, it is surprising to me that Americans are against a national id card, but are not OK with a privacy protection law.
- thisone 8y ago
  I believe it's because, in general, Americans distrust government and trust corporations
  - cabaalis 8y ago
    Giving someone money or trust in exchange for a service or good is a straightforward relationship that implies various social contracts. Americans' relationship with government is far more adversarial.
  - taysic 8y ago
    It's not about trusting corporations, but rather trusting in the benefit of the free market which offers more choices than a government which generally limits choices. A well intentioned government but still with too many unintended consequences
  - partycoder 8y ago
    Sounds like a good idea until corporations influence government.
  - casefields 8y ago
    We distrust both but only one has a monopoly on violence that can be pointed in our direction at any time.
    - throwawayxbz 8y ago
      I guess we’re just kind of ignoring things like credit bureaus, who sell finacial data about you whether you like it or not, and god help you if you miss a payment. But hey, even if you dont screw up, maybe something gets reported wrong, or maybe you just don’t spend like the algorithm wants you to, and your credit, and thus your life, is ruined. I guess we’re also ignoring private health insurance companies and how they can just kind of, you know, deny you for any reason. But it’s cool because your insurance is dependent on a benevolent private company providing you employment. See where I’m going with this? The Ayn Rand “government is violence” nonsense needs to stop. It’s not corporations vs. government, it’s powerful institutions vs. we, the plebes.
gerdesj 8y ago
This Regulation is intended to contribute to the accomplishment of an area of freedom, security and justice and of an economic union, to economic and social progress, to the strengthening and the convergence of the economies within the internal market, and to the well-being of natural persons.
pilsetnieks 8y ago
> network, and those users are willing and eager to just go with it without any of this bs How can you declare they're willing and eager, if you don't have their consent, and they're not informed about your actions?

gerdesj 8y ago

The processing of personal data should be designed to serve mankind. The right to the protection of personal data is not an absolute right; it must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality. This Regulation respects all fundamental rights and observes the freedoms and principles recognised in the Charter as enshrined in the Treaties, in particular the respect for private and family life, home and communications, the protection of personal data, freedom of thought, conscience and religion, freedom of expression and information, freedom to conduct a business, the right to an effective remedy and to a fair trial, and cultural, religious and linguistic diversity. http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679 http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX... I suggest you read the rest of it before opining.

manfredo 8y ago
This basically boils down to, "just hope that all current and future EU member nation agree with you on what is and isn't morally right." Good thing different societies and cultures have never disagreed on what is and isn't morally just, amirite?

tomc1985 8y ago

I don't think it applies to individuals and noncommercial activity, though I have heard anecdotal reports of european cops hassling people shooting pictures on mobile phones

hk__2 8y ago
> I don't think it applies to individuals and noncommercial activity Why would these be unaffected? You have to comply with GDPR as soon as you start processing personal data.
- tomc1985 8y ago
  This thread on Reddit seems to have some cogent discussion on exceptions https://www.reddit.com/r/sysadmin/comments/8litn7/gdpr_for_hobby_websites/dzg4neg/ https://www.reddit.com/r/sysadmin/comments/8litn7/gdpr_for_h...
- Silhouette 8y ago
  That's not entirely true. Article 2 defines the scope in various respects, and categories such as "by a natural person in the course of a purely personal or household activity" are specifically not within that scope.

Sangermaine 8y ago

It hinders nothing. It ensures that what you're with user data doing is truly voluntary and that your users really are 'willing and eager" about it beyond you pinky-swearing you'll be good with what you're given. Be annoyed all you want, the only people whining about the GDPR are those showing their true colors when it comes to user privacy and agency. If you're complaining that it hinders you from using user data as you please, that's precisely the point.

anfogoat 8y ago
To be clear, I'm annoyed as a user too. Partly by the discrepancy between the claim that I now have control over my data, but can't actually use it since the small independently run services can't accept my data even if I wanted them to, because that acceptance comes with a set of requirements that are prohibitive, and which I, the user, would not want in this instance. However, judging by some of the other responses, I might be wrong about the effects on independently run services (and I'm happy to be). I'm going to ignore the part about my supposed true colors in respect to user privacy. Too tired.
- bulatb 8y ago
  A system that preserves freedom—not your freedom in every particular case, but the prevalence of freedom in general for people in general—must restrict your freedom to give yours away. You're not allowed to sell yourself to slavers, even if you want to. Slavers can't exist at all. It's understood that if they did, the slavers would exploit your "freedom" to create a world where, in reality, the circumstances leave you no alternative except to "freely choose" to be a slave.

myhf 8y ago

If I want to service a small group of people with, say, a nuclear power plant, and those people are willing and eager to just go with it without any bs or roles, then it should be possible. When you make it prohibitive to handle hazardous materials, then you've done something wrong.

anfogoat 8y ago
If you and the small group of people are the only living creatures on the planet, then absolutely! That is to say, this isn't really comparable, for obvious reasons.
- myhf 8y ago
  PII is a hazardous material, and it should be regulated like other hazardous materials, for obvious reasons.
  - ryanwaggoner 8y ago
    This is so hyperbolic. Hazardous material? So your old IP address that has since changed 27 times being in some forgotten log file somewhere is now basically like uranium or industrial waste. Makes sense.

viraptor 8y ago

So which parts of the GDPR do you actually disagree with in case of this XMPP service? Mostly you need to tell people what you collect, allow removing accounts and history, and tell them if you're sending the data to third-parties. If you're running a private service you most likely already fulfill those requirements. Where's the annoyance?

anfogoat 8y ago
In the specific case of XMPP, wouldn't I need to have an agreement with every other admin who federates their XMPP server and work out what exactly our roles are as defined by GDPR? XMPP still has active development community around it so this will no doubt get much easier with time, but that's just XMPP.
- viraptor 8y ago
  IANAL, but unlikely. Sending messages is the primary purpose of the service. As long as users are made aware that messages going outside of your domain are shared with 3rd parties, it's on them to make that decision. Same would apply to email, phones, etc.
- bcheung 8y ago
  Maybe not: You need to have a "Legal Basis" and only 1 of them is the "subject has given consent" one. There's another: "The processing is NECESSARY FOR THE PERFORMANCE OF A CONTRACT to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract;"
  - davorak 8y ago
    I thought you would have to al least all the admins to agree to follow the GDPR so that data can be retrieved, corrected, and deleted on demand right?
- mandelbulb 8y ago
  Look at it this way: The service you're using needs a privacy policy, that is not new. The way that policy is organized or shared is no different now, just what rights the user and what obligations the service provider has.

partycoder 8y ago

GDPR is simply a response to abusive behavior. May not be the best response, but it was about time. Then, it is surprising to me that Americans are against a national id card, but are not OK with a privacy protection law.

thisone 8y ago
I believe it's because, in general, Americans distrust government and trust corporations
- cabaalis 8y ago
  Giving someone money or trust in exchange for a service or good is a straightforward relationship that implies various social contracts. Americans' relationship with government is far more adversarial.
- taysic 8y ago
  It's not about trusting corporations, but rather trusting in the benefit of the free market which offers more choices than a government which generally limits choices. A well intentioned government but still with too many unintended consequences
- partycoder 8y ago
  Sounds like a good idea until corporations influence government.
- casefields 8y ago
  We distrust both but only one has a monopoly on violence that can be pointed in our direction at any time.
  - throwawayxbz 8y ago
    I guess we’re just kind of ignoring things like credit bureaus, who sell finacial data about you whether you like it or not, and god help you if you miss a payment. But hey, even if you dont screw up, maybe something gets reported wrong, or maybe you just don’t spend like the algorithm wants you to, and your credit, and thus your life, is ruined. I guess we’re also ignoring private health insurance companies and how they can just kind of, you know, deny you for any reason. But it’s cool because your insurance is dependent on a benevolent private company providing you employment. See where I’m going with this? The Ayn Rand “government is violence” nonsense needs to stop. It’s not corporations vs. government, it’s powerful institutions vs. we, the plebes.

gerdesj 8y ago

This Regulation is intended to contribute to the accomplishment of an area of freedom, security and justice and of an economic union, to economic and social progress, to the strengthening and the convergence of the economies within the internal market, and to the well-being of natural persons.

pilsetnieks 8y ago

> network, and those users are willing and eager to just go with it without any of this bs How can you declare they're willing and eager, if you don't have their consent, and they're not informed about your actions?