8 ms·

"but I would like it a lot better if it said that in the actual law" Have you read the bloody law! http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELE

"but I would like it a lot better if it said that in the actual law" Have you read the bloody law! http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679 http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX... This is legislation designed to protect not only me (as an individual) but you as well (as a probable foreigner) from me!

eli 8y ago
Yes, indeed I have. But if there's something I've missed, I'd surely appreciate a quote or specific reference.
fanzhang 8y ago
Reading the law, I only see a single exception for small companies: Article 30.1 and 30.2 doesn't apply for companies less than 250 employees. Out of an 88 page law, 1% of an auxiliary middle of the law is carved out for small companies. I'm not sure that counts as differential application for small companies. In the US at least, large portions of entire key burdensome laws don't apply for employers below size 50, 10, 5, etc. This does not seem to be the case here. Does anyone know whether an official impact study on innovation was even done before its passage?
- camillomiller 8y ago
  You can be a company of ten people and still turn over millions by selling your users’ data in shadowy ways. Why shouldn’t you be stopped just because you’re small. How can the size a company be used as a rational differentiator in a law like this?
  - deleted 8y ago
    [deleted]
  - Clubber 8y ago
    Because the vast, vast, vast majority of small companies aren't turning over millions of dollars. That's the same logic as, "some people cheat on welfare, so lets defund it." This logic gets pushed around a lot by GOP pundits. The law may be good as a whole but be overly burdensome for small companies. You should at least acknowledge that instead of just dismissing that outright.
- phicoh 8y ago
  Similar laws have existed for many decades. In The Netherlands, privacy laws date back to the 1970s. At least my reading of the GDRP is that it tries very hard not be a big burden. If you are a small company or organisation and you collect a minimal amount of information (for example to contact them) there is not a lot you have to do. The main thing is, you are not allowed to be sloppy. If you collect personal data, you have to think about whether you should collect it at all, where to store it, process it, and when to delete it. And you have to tell people that before you ask them for personal data. Nothing like, we just collect a bunch of data, give copies to everybody, and have no idea what we collected. That attitude no longer works. If you set up food regulations, are you going to exempt restaurants with only one cook? Or have aviation regulations that do not apply to airlines with only one pilot? Given that the entire GDRP is less then a hundred pages, you can easily read it in one evening and get an idea of what you can do, have to do, and what the corner cases are that you may need to discuss with a lawyer.
  - tripzilch 8y ago
    > If you set up food regulations, are you going to exempt restaurants with only one cook? But restaurants with only one cook can't afford a $300/h lawyer to tell them how to keep their shit hygienic!
    - angus-prune 8y ago
      And in the EU we have a different way of working. In the UK you can literally phone up the ICO and get free advice, specific advice on how to stay compliant. If it turns out that you are in breach, they will write to you with information about what you're doign wrong and how to fix it. In the EU we don't rely on lawyers for a fraction of the stuff you do in the US.
- tripzilch 8y ago
  > Does anyone know whether an official impact study on innovation was even done before its passage? So if it's "innovative" a small 5-person startup should be able to wreak havoc to my personal data in whatever way they see fit? What is that nonsense. Are you seriously suggesting that "innovation" in startups should be more important than my privacy?
  - arthurofbabylon 8y ago
    Are you seriously proposing that regulations move forward without an understanding of their impacts? No matter what the ultimate decision is, no matter how sensitive the subject matter, impact studies are critical to making smart decisions.
    - Marysville 8y ago
      If a regulation is going to impact "innovative" startups that sell my data, I am totally for it. I don't want more innovative ways to sell my personal information.
      - arthurofbabylon 8y ago
        So without curiosity or concern for any other impact you say yes... I might say yes but I still want an impact study. I prefer governing bodies operate with an awareness of how their actions affect society.
        Marysville 8y ago
        I don't think we're going to lose as many "well intentioned" websites as much as we'll get rid of bad intentioned businesses.
        arthurofbabylon 8y ago
        You’re missing the point. One last time: it is ideal to operate with an awareness of consequences.
Matticus_Rex 8y ago
In the history of laws, many of the ones designed with good intentions have been quite harmful. And yes, I've read the law. It's typical of legislation in that it obviously wasn't written by people who knew what it looked like to perform that in a real life business.
- usr1106 8y ago
  > And yes, I've read the law. Have you read recital 1? https://gdpr-info.eu/recitals/no-1/ https://gdpr-info.eu/recitals/no-1/ ? The starting point of the law is that data protoection is a fundamental human right,. The data subject owns their PII, not some company collecting it. It's all up whether you are willing to accept that as a fundamental right or not. I mean there is a billion of Chinese that live with the fact that free speech is not a fundamental human right. Most Westerners have a problem with that. Now many US based IT professionals seems to have problems with accepting that nobody else can own the data about a human. > It's typical of legislation in that it obviously wasn't written by people who knew what it looked like to perform that in a real life business. That's what a cotton farmer could have said when they made slavery illegal. Obviously respecting other's human rights makes some business models illegal.
  - manigandham 8y ago
    We're going in circles. Let me repeat: nobody has a problem with increased data protection and privacy. We're all better off for it. But the laws regarding it are not clear for an actual operating business. Instead of being simple and straightforward to implement, they are an ambiguous mess that are wasteful and misplaced. Laws designed that way almost never actually accomplish what they set out to do.
    - usr1106 8y ago
      > Instead of being simple and straightforward to implement, I am not sure I can fully follow you here. If implementers accepted that they only collect what is absolutely necessary and they delete what the they are not legally requited to keep things would be much easier. Problems start when the business model is that customers'/users' data is our product/an asset and we somehow try the find the minimum possible implementation that just meets the requirements of the law while still using all loopholes it might possibly leave. I agree that the law is not very clear for how you should code it. Nor very detailed what you can do with a certain piece of data. So it depends on your approach: If you take a conservative approach that if in doubt, we don't keep the data it suddenly gets much clearer. If you start fiddling maybe I could still do it if we did it like this and that you end up in endless work. And of course if you have an existing system that never had the requirement of deleting anything there is a lot of work. But the law has been in force for 2 years, so businesses that wake up now when the transition period has ended it can be a mess. >Laws designed that way almost never actually accomplish what they set out to do. How would you have written the law? Do you have counter-examples of laws being written so clearly that you could recommend them? The key point really is: Many business models and practices on the internet are incompatible with the spirit of GDPR. It's a fundamental right that the users own their data and businesses are not allowed to do with it whatever they want. Lawmakers did not want it write it that so clearly, because lobbyists would not have accepted it. And business owners still don't want to accept any suich fundamental right. So complaining about the law being too complicated is somewhat canting.
Myrmornis 8y ago
Please point to the specific section you’re referring to.

eli 8y ago

Yes, indeed I have. But if there's something I've missed, I'd surely appreciate a quote or specific reference.

fanzhang 8y ago

Reading the law, I only see a single exception for small companies: Article 30.1 and 30.2 doesn't apply for companies less than 250 employees. Out of an 88 page law, 1% of an auxiliary middle of the law is carved out for small companies. I'm not sure that counts as differential application for small companies. In the US at least, large portions of entire key burdensome laws don't apply for employers below size 50, 10, 5, etc. This does not seem to be the case here. Does anyone know whether an official impact study on innovation was even done before its passage?

camillomiller 8y ago
You can be a company of ten people and still turn over millions by selling your users’ data in shadowy ways. Why shouldn’t you be stopped just because you’re small. How can the size a company be used as a rational differentiator in a law like this?
- deleted 8y ago
  [deleted]
- Clubber 8y ago
  Because the vast, vast, vast majority of small companies aren't turning over millions of dollars. That's the same logic as, "some people cheat on welfare, so lets defund it." This logic gets pushed around a lot by GOP pundits. The law may be good as a whole but be overly burdensome for small companies. You should at least acknowledge that instead of just dismissing that outright.
phicoh 8y ago
Similar laws have existed for many decades. In The Netherlands, privacy laws date back to the 1970s. At least my reading of the GDRP is that it tries very hard not be a big burden. If you are a small company or organisation and you collect a minimal amount of information (for example to contact them) there is not a lot you have to do. The main thing is, you are not allowed to be sloppy. If you collect personal data, you have to think about whether you should collect it at all, where to store it, process it, and when to delete it. And you have to tell people that before you ask them for personal data. Nothing like, we just collect a bunch of data, give copies to everybody, and have no idea what we collected. That attitude no longer works. If you set up food regulations, are you going to exempt restaurants with only one cook? Or have aviation regulations that do not apply to airlines with only one pilot? Given that the entire GDRP is less then a hundred pages, you can easily read it in one evening and get an idea of what you can do, have to do, and what the corner cases are that you may need to discuss with a lawyer.
- tripzilch 8y ago
  > If you set up food regulations, are you going to exempt restaurants with only one cook? But restaurants with only one cook can't afford a $300/h lawyer to tell them how to keep their shit hygienic!
  - angus-prune 8y ago
    And in the EU we have a different way of working. In the UK you can literally phone up the ICO and get free advice, specific advice on how to stay compliant. If it turns out that you are in breach, they will write to you with information about what you're doign wrong and how to fix it. In the EU we don't rely on lawyers for a fraction of the stuff you do in the US.
tripzilch 8y ago
> Does anyone know whether an official impact study on innovation was even done before its passage? So if it's "innovative" a small 5-person startup should be able to wreak havoc to my personal data in whatever way they see fit? What is that nonsense. Are you seriously suggesting that "innovation" in startups should be more important than my privacy?
- arthurofbabylon 8y ago
  Are you seriously proposing that regulations move forward without an understanding of their impacts? No matter what the ultimate decision is, no matter how sensitive the subject matter, impact studies are critical to making smart decisions.
  - Marysville 8y ago
    If a regulation is going to impact "innovative" startups that sell my data, I am totally for it. I don't want more innovative ways to sell my personal information.
    - arthurofbabylon 8y ago
      So without curiosity or concern for any other impact you say yes... I might say yes but I still want an impact study. I prefer governing bodies operate with an awareness of how their actions affect society.
      - Marysville 8y ago
        I don't think we're going to lose as many "well intentioned" websites as much as we'll get rid of bad intentioned businesses.
        arthurofbabylon 8y ago
        You’re missing the point. One last time: it is ideal to operate with an awareness of consequences.

Matticus_Rex 8y ago

In the history of laws, many of the ones designed with good intentions have been quite harmful. And yes, I've read the law. It's typical of legislation in that it obviously wasn't written by people who knew what it looked like to perform that in a real life business.

usr1106 8y ago
> And yes, I've read the law. Have you read recital 1? https://gdpr-info.eu/recitals/no-1/ https://gdpr-info.eu/recitals/no-1/ ? The starting point of the law is that data protoection is a fundamental human right,. The data subject owns their PII, not some company collecting it. It's all up whether you are willing to accept that as a fundamental right or not. I mean there is a billion of Chinese that live with the fact that free speech is not a fundamental human right. Most Westerners have a problem with that. Now many US based IT professionals seems to have problems with accepting that nobody else can own the data about a human. > It's typical of legislation in that it obviously wasn't written by people who knew what it looked like to perform that in a real life business. That's what a cotton farmer could have said when they made slavery illegal. Obviously respecting other's human rights makes some business models illegal.
- manigandham 8y ago
  We're going in circles. Let me repeat: nobody has a problem with increased data protection and privacy. We're all better off for it. But the laws regarding it are not clear for an actual operating business. Instead of being simple and straightforward to implement, they are an ambiguous mess that are wasteful and misplaced. Laws designed that way almost never actually accomplish what they set out to do.
  - usr1106 8y ago
    > Instead of being simple and straightforward to implement, I am not sure I can fully follow you here. If implementers accepted that they only collect what is absolutely necessary and they delete what the they are not legally requited to keep things would be much easier. Problems start when the business model is that customers'/users' data is our product/an asset and we somehow try the find the minimum possible implementation that just meets the requirements of the law while still using all loopholes it might possibly leave. I agree that the law is not very clear for how you should code it. Nor very detailed what you can do with a certain piece of data. So it depends on your approach: If you take a conservative approach that if in doubt, we don't keep the data it suddenly gets much clearer. If you start fiddling maybe I could still do it if we did it like this and that you end up in endless work. And of course if you have an existing system that never had the requirement of deleting anything there is a lot of work. But the law has been in force for 2 years, so businesses that wake up now when the transition period has ended it can be a mess. >Laws designed that way almost never actually accomplish what they set out to do. How would you have written the law? Do you have counter-examples of laws being written so clearly that you could recommend them? The key point really is: Many business models and practices on the internet are incompatible with the spirit of GDPR. It's a fundamental right that the users own their data and businesses are not allowed to do with it whatever they want. Lawmakers did not want it write it that so clearly, because lobbyists would not have accepted it. And business owners still don't want to accept any suich fundamental right. So complaining about the law being too complicated is somewhat canting.

Myrmornis 8y ago

Please point to the specific section you’re referring to.