5 ms·

So the lawyer provided a letter which demonstrates what would happen in the worst case due to the GDPR. How does that make him dumb?

jacquesm 8y ago
Because people then use that letter to increase the burden on companies 'just for kicks', it creates an asymmetry that the law did not intend. It forces attention away from the positive effects of the law and gives companies reasons to say 'see, this is what you get'. It's irresponsible.
- cm2012 8y ago
  This kind of thing is inevitable though. Within a month there will be online services that auto send an even more annoying version of this letter to every company on your contact list.
  - kasey_junk 8y ago
    They kicked off about a month ago. At work we could see them come online by the form letters they sent.
- Vinnl 8y ago
  The same happens unfortunately with FOI requests. I've seen a case of someone explicitly stating they're sending FOI requests to a municipality just to spite them, which led to that municipality having to hire four (!) people to process them and find the documents. This in turn led to a restriction of that law, which is a real shame.
  - jacquesm 8y ago
    Yes, we have the same here. The laws have been amended to take care of the 'volume letter writers'. The best part: I'm aware of one such a person and they're unemployed, so they use their state supported life to harass the state to cause damage.
- czardoz 8y ago
  There are plenty of well intentioned laws which actually suck (such as the Cookie law). Surely you agree that it's important to point these out?
  - jacquesm 8y ago
    There was absolutely nothing wrong with the cookie law. What was wrong is that companies then went out of their way to FUD it and to mis-interpret it to the point where the law lost much of its value. The GDPR is a response to that lawyering, but that's no reason why the public at large should now push the pendulum the other way. This law doesn't 'actually suck', but it can be made to 'actually suck' and then we all lose something of value.
    - cm2012 8y ago
      That's why vague laws are bad - you have to assume all laws will be abused unless the language specifically forbids it. It sucks, but its true.
    - czardoz 8y ago
      The not sucking part needs to be a part of the law. You cannot leave intentions up for interpretation and then call those who point it out "dumb". Of course GDPR is a well intentioned law. It's implementation is debatable though, and you're basically asking people to not talk about its problems.
      - jacquesm 8y ago
        > and you're basically asking people to not talk about its problems. On the contrary. I'd love to talk about those problems, but this isn't one of them. Data Subjects should have the right to make Data Subject Access Requests. But the context matters. If you want to really talk about the GDPR's problems then I think it would be better to focus on the Designated Representative bit, which is prohibitively expensive for small companies.
        8y ago
- sailfast 8y ago
  I know I’ve posted this before but the law does not intend anything. The law is written, and then stuff happens. People intend and make broad laws that then more precisely get to intent after legal battles / precedent. This is allowed under the law! If you don’t like it, change the law! The reason people have been complaining about GDPR this whole time is exactly this. Things take on a whole new meaning when complied with at scale when all you need to send is an email. This seems worse than FOIA (the US Freedom of Information Act) and Europe placed it on their entire private sector. EDIT: clarity.
  - jacquesm 8y ago
    This is a very US centric view of things, the EU and the US have a very different approach to legislation.
    - eadmund 8y ago
      s/very US centric/realistic/ A law allows what it allows. 'Let's pass a law that sets a maximum penalty of death, but promise just to impose $10 fines for the first decade' is a recipe for disaster. A law which purports to protect privacy but instead demands that any visitor be permitted to rewrite your year-old web server logs is beyond Orwellian.
      - deleted 8y ago
        [deleted]
    - sailfast 8y ago
      I admit that my view is somewhat US-centric but also has roots in Europe. I would challenge / I am asking: what is the real difference in the EU, that you could fall back on if sued because of these letters? You have to prepare for that if you want to be responsible, right? Is it because this is not law, but rather, regulation which is only selectively enforced and suits cannot be brought by individuals but rather by central regulators that will never keep up with the avalanche? Does the EU never enforce law by the letter, so the letters are unreliable and really more like a guideline? (If so, why bother with law? Lack of EU sovereignty over member states means it won't get enforced if it's really an inconvenience anyway? Something else?
r3bl 8y ago
The author of the nightmare letter didn't even claim that his nightmare letter was aimed at data subjects (AKA users), but specifically to companies that are trying to be compliant. Like, "if you can answer this letter, you're compliant". The author of this piece just twisted the meaning of the letter completely.
- jacquesm 8y ago
  That's not how it was spread around. The blog post is a response to this Ask HN: https://news.ycombinator.com/item?id=17161718 https://news.ycombinator.com/item?id=17161718

jacquesm 8y ago

Because people then use that letter to increase the burden on companies 'just for kicks', it creates an asymmetry that the law did not intend. It forces attention away from the positive effects of the law and gives companies reasons to say 'see, this is what you get'. It's irresponsible.

cm2012 8y ago
This kind of thing is inevitable though. Within a month there will be online services that auto send an even more annoying version of this letter to every company on your contact list.
- kasey_junk 8y ago
  They kicked off about a month ago. At work we could see them come online by the form letters they sent.
Vinnl 8y ago
The same happens unfortunately with FOI requests. I've seen a case of someone explicitly stating they're sending FOI requests to a municipality just to spite them, which led to that municipality having to hire four (!) people to process them and find the documents. This in turn led to a restriction of that law, which is a real shame.
- jacquesm 8y ago
  Yes, we have the same here. The laws have been amended to take care of the 'volume letter writers'. The best part: I'm aware of one such a person and they're unemployed, so they use their state supported life to harass the state to cause damage.
czardoz 8y ago
There are plenty of well intentioned laws which actually suck (such as the Cookie law). Surely you agree that it's important to point these out?
- jacquesm 8y ago
  There was absolutely nothing wrong with the cookie law. What was wrong is that companies then went out of their way to FUD it and to mis-interpret it to the point where the law lost much of its value. The GDPR is a response to that lawyering, but that's no reason why the public at large should now push the pendulum the other way. This law doesn't 'actually suck', but it can be made to 'actually suck' and then we all lose something of value.
  - cm2012 8y ago
    That's why vague laws are bad - you have to assume all laws will be abused unless the language specifically forbids it. It sucks, but its true.
  - czardoz 8y ago
    The not sucking part needs to be a part of the law. You cannot leave intentions up for interpretation and then call those who point it out "dumb". Of course GDPR is a well intentioned law. It's implementation is debatable though, and you're basically asking people to not talk about its problems.
    - jacquesm 8y ago
      > and you're basically asking people to not talk about its problems. On the contrary. I'd love to talk about those problems, but this isn't one of them. Data Subjects should have the right to make Data Subject Access Requests. But the context matters. If you want to really talk about the GDPR's problems then I think it would be better to focus on the Designated Representative bit, which is prohibitively expensive for small companies.
      - 8y ago
sailfast 8y ago
I know I’ve posted this before but the law does not intend anything. The law is written, and then stuff happens. People intend and make broad laws that then more precisely get to intent after legal battles / precedent. This is allowed under the law! If you don’t like it, change the law! The reason people have been complaining about GDPR this whole time is exactly this. Things take on a whole new meaning when complied with at scale when all you need to send is an email. This seems worse than FOIA (the US Freedom of Information Act) and Europe placed it on their entire private sector. EDIT: clarity.
- jacquesm 8y ago
  This is a very US centric view of things, the EU and the US have a very different approach to legislation.
  - eadmund 8y ago
    s/very US centric/realistic/ A law allows what it allows. 'Let's pass a law that sets a maximum penalty of death, but promise just to impose $10 fines for the first decade' is a recipe for disaster. A law which purports to protect privacy but instead demands that any visitor be permitted to rewrite your year-old web server logs is beyond Orwellian.
    - deleted 8y ago
      [deleted]
  - sailfast 8y ago
    I admit that my view is somewhat US-centric but also has roots in Europe. I would challenge / I am asking: what is the real difference in the EU, that you could fall back on if sued because of these letters? You have to prepare for that if you want to be responsible, right? Is it because this is not law, but rather, regulation which is only selectively enforced and suits cannot be brought by individuals but rather by central regulators that will never keep up with the avalanche? Does the EU never enforce law by the letter, so the letters are unreliable and really more like a guideline? (If so, why bother with law? Lack of EU sovereignty over member states means it won't get enforced if it's really an inconvenience anyway? Something else?

r3bl 8y ago

The author of the nightmare letter didn't even claim that his nightmare letter was aimed at data subjects (AKA users), but specifically to companies that are trying to be compliant. Like, "if you can answer this letter, you're compliant". The author of this piece just twisted the meaning of the letter completely.

jacquesm 8y ago
That's not how it was spread around. The blog post is a response to this Ask HN: https://news.ycombinator.com/item?id=17161718 https://news.ycombinator.com/item?id=17161718