6 ms·

This may be an edgy and rebellious sentiment that makes me a radical anti-privacy activist, but unless you're storing levels of information on me that are simil

by strken 8y ago

This may be an edgy and rebellious sentiment that makes me a radical anti-privacy activist, but unless you're storing levels of information on me that are similar to facebook/google/etc., I do not give a damn whether you're soft-deleting or hard-deleting my IP address and my user account. If your web app is just a web app, and not one component of a vast surveillance octopus which puts tentacles on almost every website using social media buttons and GA.js, I don't think it matters in the slightest. It feels like all these tiny companies, one-man shops, and early-stage startups are going to be collateral damage to a regulation designed to stop facebook and google from knowing a horrific amount about everyone. In fact, it feels like a regulatory moat that will do very little to impede any big tech company while forcing me to do twice as much work for any side project I try to develop. There's so much smugness about the GDPR being a "good reflecting moment", etc. which makes me think that people who support the GDPR believe that there's no way detractors could disagree with it in good faith or for good reasons.

hekfu 8y ago
> This may be an edgy and rebellious sentiment that makes me a radical anti-privacy activist, but unless you're storing levels of information on me that are similar to facebook/google/etc., I do not give a damn whether you're soft-deleting or hard-deleting my IP address and my user account. If your web app is just a web app, and not one component of a vast surveillance octopus which puts tentacles on almost every website using social media buttons and GA.js, I don't think it matters in the slightest. > It feels like all these tiny companies, one-man shops, and early-stage startups are going to be collateral damage to a regulation designed to stop facebook and google from knowing a horrific amount about everyone. In fact, it feels like a regulatory moat that will do very little to impede any big tech company while forcing me to do twice as much work for any side project I try to develop. If you don't store PII, you don't have to do any work. Done. If you need to have PII for your webapp to function, you barely have to do any work besides giving the that care people their rights > There's so much smugness about the GDPR being a "good reflecting moment", etc. which makes me think that people who support the GDPR believe that there's no way detractors could disagree with it in good faith or for good reasons. I think it's mainly a difference in viewpoint: this is my data for me. Not yours. GDPR makes it easier for me to enforce that. From my perspective I don't care about you violating my rights "in good faith", just like most people don't cares if you trespass on my property and steal something "in good faith".
- strken 8y ago
  If you don't store PII, you don't have to do any work. Done. If you need to have PII for your webapp to function, you barely have to do any work besides giving the that care people their rights The problem is not the work that the GDPR requires, the problem is the work I'll have to put into understanding the GDPR. I think it's mainly a difference in viewpoint: this is my data for me. Not yours. This is the part that I don't understand. If I own a shop, and you come in and buy something, you have absolutely no right to demand that I forget your face and your purchase. In the real world, it's not your data, it's my memory. If I go home and write in my diary that today hekfu bought lots of broccoli, you don't have the right to come to me in five years and demand that I remove all mention of you from my diary at my own cost. I don't understand the concept of data ownership, because it does not align with how I understand the real world to work.
  - powvans 8y ago
    If I go home and write in my diary that today hekfu bought lots of broccoli, you don't have the right to come to me in five years and demand that I remove all mention of you from my diary at my own cost. I asked this question in a comment [1] here on HN a few weeks ago. There were affirmative responses that yes, the shopkeeper should in fact be held to account for keeping notes on who came into his store. [1] https://news.ycombinator.com/item?id=16509598 https://news.ycombinator.com/item?id=16509598
    - Spivak 8y ago
      This is largely because the law doesn't care about implementation details. If a grocery store had a system which meticulously logged every customer that came into their store, when, and what they bought (i.e. loyalty card profiles) then we have to deal with issues related to privacy and data protection. Doing the same thing with pen and paper won't be seen as a meaningful difference.
  - ryanwaggoner 8y ago
    Many of these people would happily give their government the power to wipe your memory if the technology to do so existed. It's insane.
krschultz 8y ago
TBH location tracking is the most sensitive PII I've seen anywhere, and plenty of 1 man shops are doing it. It takes like 100 lines of code.
pilsetnieks 8y ago
> I do not give a damn whether you're soft-deleting or hard-deleting my IP address and my user account You don't give a damn; neither do those computer illiterate people who use the same email address and password for everything, and one leak of some shitty inconsequential website may obliterate their entire online presence.
- strken 8y ago
  I'm not sure how the GDPR fixes anything, since those people aren't going to be capable of finding the hidden "delete account" button five pages into a big tech company's byzantine privacy settings.
  - pilsetnieks 8y ago
    Wait, I thought we were talking about tiny inconsequential websites here? You moving the goalposts or what?
  - jdietrich 8y ago
    The GDPR says "It shall be as easy to withdraw as to give consent". If you're hiding the "delete account" button, you're breaking the law. https://gdpr-info.eu/art-7-gdpr/ https://gdpr-info.eu/art-7-gdpr/

by strken 8y ago

hekfu 8y ago

> This may be an edgy and rebellious sentiment that makes me a radical anti-privacy activist, but unless you're storing levels of information on me that are similar to facebook/google/etc., I do not give a damn whether you're soft-deleting or hard-deleting my IP address and my user account. If your web app is just a web app, and not one component of a vast surveillance octopus which puts tentacles on almost every website using social media buttons and GA.js, I don't think it matters in the slightest. > It feels like all these tiny companies, one-man shops, and early-stage startups are going to be collateral damage to a regulation designed to stop facebook and google from knowing a horrific amount about everyone. In fact, it feels like a regulatory moat that will do very little to impede any big tech company while forcing me to do twice as much work for any side project I try to develop. If you don't store PII, you don't have to do any work. Done. If you need to have PII for your webapp to function, you barely have to do any work besides giving the that care people their rights > There's so much smugness about the GDPR being a "good reflecting moment", etc. which makes me think that people who support the GDPR believe that there's no way detractors could disagree with it in good faith or for good reasons. I think it's mainly a difference in viewpoint: this is my data for me. Not yours. GDPR makes it easier for me to enforce that. From my perspective I don't care about you violating my rights "in good faith", just like most people don't cares if you trespass on my property and steal something "in good faith".

strken 8y ago
If you don't store PII, you don't have to do any work. Done. If you need to have PII for your webapp to function, you barely have to do any work besides giving the that care people their rights The problem is not the work that the GDPR requires, the problem is the work I'll have to put into understanding the GDPR. I think it's mainly a difference in viewpoint: this is my data for me. Not yours. This is the part that I don't understand. If I own a shop, and you come in and buy something, you have absolutely no right to demand that I forget your face and your purchase. In the real world, it's not your data, it's my memory. If I go home and write in my diary that today hekfu bought lots of broccoli, you don't have the right to come to me in five years and demand that I remove all mention of you from my diary at my own cost. I don't understand the concept of data ownership, because it does not align with how I understand the real world to work.
- powvans 8y ago
  If I go home and write in my diary that today hekfu bought lots of broccoli, you don't have the right to come to me in five years and demand that I remove all mention of you from my diary at my own cost. I asked this question in a comment [1] here on HN a few weeks ago. There were affirmative responses that yes, the shopkeeper should in fact be held to account for keeping notes on who came into his store. [1] https://news.ycombinator.com/item?id=16509598 https://news.ycombinator.com/item?id=16509598
  - Spivak 8y ago
    This is largely because the law doesn't care about implementation details. If a grocery store had a system which meticulously logged every customer that came into their store, when, and what they bought (i.e. loyalty card profiles) then we have to deal with issues related to privacy and data protection. Doing the same thing with pen and paper won't be seen as a meaningful difference.
- ryanwaggoner 8y ago
  Many of these people would happily give their government the power to wipe your memory if the technology to do so existed. It's insane.

krschultz 8y ago

TBH location tracking is the most sensitive PII I've seen anywhere, and plenty of 1 man shops are doing it. It takes like 100 lines of code.

pilsetnieks 8y ago

> I do not give a damn whether you're soft-deleting or hard-deleting my IP address and my user account You don't give a damn; neither do those computer illiterate people who use the same email address and password for everything, and one leak of some shitty inconsequential website may obliterate their entire online presence.

strken 8y ago
I'm not sure how the GDPR fixes anything, since those people aren't going to be capable of finding the hidden "delete account" button five pages into a big tech company's byzantine privacy settings.
- pilsetnieks 8y ago
  Wait, I thought we were talking about tiny inconsequential websites here? You moving the goalposts or what?
- jdietrich 8y ago
  The GDPR says "It shall be as easy to withdraw as to give consent". If you're hiding the "delete account" button, you're breaking the law. https://gdpr-info.eu/art-7-gdpr/ https://gdpr-info.eu/art-7-gdpr/