8 ms·

The Next Privacy Battle in Europe Is Over the Proposed ePrivacy Regulation

41 points by rgbrenner 8y ago

ryanworl 8y ago
https://iapp.org/media/pdf/resource_center/Draft-ePriv-Reg-May-2018.pdf https://iapp.org/media/pdf/resource_center/Draft-ePriv-Reg-M... Here is the most recent draft if anyone wants to read it. Just to start a bit of a discussion, I read prior drafts and this one is MUCH better than previous drafts. Before very simple things like placing cookies for basic analytics, fraud detection, DDoS prevention, etc. were in a grey area. Now they are explicitly allowed by this draft. If prior versions would've passed as-is, I would be legitimately worried for the future of tech in Europe, but this seems quite similar to GDPR now.
mikestew 8y ago
"And requiring companies to provide equal communications services to people who opt out of data mining, they say, could cause sites or apps that rely on data-driven advertising to start charging fees or close down." This statement starts with the assumption that the data mining was okay in the first place. My metaphor is a bit hyperbolic, but it's like members of organized crime complaining about the passage of RICO in the U. S. "Well, now how are supposed to make a living?" Mmm, you weren't supposed to be making a living through organized crime in the first place.
- d1zzy 8y ago
  Let's not get hyperbolic and compare data mining to murder. If you think it's not OK that's your opinion, but do a survey among regular folk of "is it OK to have web sites mine your data to provide you with targeted ads and free services like search, maps, email or you wish to pay $5 a month" and see the results. Make sure to include there people from all walks of life and age and all over the world. Personally I like having choices. Data mining should be just another mechanism to pay for the services provided. I know for a fact that if these companies didn't have "data mining" as a mechanism to provide otherwise free services I would have never used those free services for the past 15 years or so, growing up in a country where electronic payments were available much later and the per capita yearly income was super low.
  - QasimK 8y ago
    Let’s not start giving false choices. I simply don’t believe your assertion that the choice is between free services or paying a monthly fee.
    - d1zzy 8y ago
      Like I said, I like choices. I never said that those are the _only_ 2 choices, but they are 2 choices. And one of them was easily available and made it possible to use those services wherever I was, no matter how much money I had or how old I was.
  - mikestew 8y ago
    Let's not get hyperbolic and compare data mining to murder. What, in your opinion, is the correct number of disclaimers before one is allowed to respond, "duh, I already covered that"? Besides, organized crime involves a much broader set of actions than just killing people. Traditionally it has included such mundane activities as trash collection. Nothing wrong with collecting the trash that people leave at the curb, right? Regardless, it's tech companies jumping on the hype (derived from the word "hyperbolic") train to tell us of the woes that will befall us should such a thing pass. The world hasn't yet come to an end with the passage of GDPR, I doubt it will should this regulation go through.
    - d1zzy 8y ago
      Just because we don't take the side of what the tech companies tell us (which obviously will try to portray it negatively, it's in their interest to do so) doesn't mean that we think GDPR or similar laws are perfect either. I think the true effects of GDPR will take 5-10 years to develop and we'll see then if it was a good idea. I'm just glad I grew up in a world where I had easy free access to very powerful online tools because I cannot say if the same will be true in the future.
  - alkonaut 8y ago
    > "is it OK to have web sites mine your data to provide you with targeted ads and free services like search, maps, email or you wish to pay $5 a month" and see the results. But is it right to let companies track users simply because the users say it's ok? To put it another way: I think the EU would be right to consider it's citizens not as adults that are able to make decisions on integrity or privacy.
ocdtrekkie 8y ago
Now that GDPR hysteria has passed, the Internet has survived, and we're all still here, it's time to start ePrivacy hysteria. The sheer number of lobbying groups each of these tech companies is involved in is amazing. Google doesn't seem to publish an EU counterpart to this that I know of, but here's how many organizations Google is backing: https://www.google.com/publicpolicy/transparency.html https://www.google.com/publicpolicy/transparency.html
- wooter 8y ago
  I'm not a lobbying group and I find the law to be abhorrent. Did you expect all opposition to roll over and disappear?
- chris_engel 8y ago
  The problem - and thats the reason the GDPRs try to improve the world will fail - is that if you as a company to say: "if you don't consent you cannot use this great service all your friends are using. The people will consent even if they don't like it so you need to remove this force factor. Its like here in germany its prohibited that you let an employee work for more than 8hrs straight. In special cases you may extend this to 10hrs but only with good reasons. Everything above is just plain illegal, even if the employee states he did it voluntarily. The company is still liable then.
- sqdbps 8y ago
  The jury is still out on the effects of GDPR and claiming Google as the only opposition here is incorrect and is a tired scare tactic, the "developer alliance" isn't 'big tech lobbying' and this piece of legislative madness includes this gem: "The bill also requires companies to offer people the same communications services whether or not they agree to have their data collected." So consent isn't enough anymore.
  - ocdtrekkie 8y ago
    The requirement to provide service with or without tracking consent is already a part of GDPR. And it's a key feature, because without it, companies would use the "agree to it or you just can't use our service" nonsense we've already suffered.
sqdbps 8y ago
"The bill also requires companies to offer people the same communications services whether or not they agree to have their data collected." This is the most insane part of this clueless and destructive law. It's like europe has resigned to the notion that they don't have a significant internet company so they are determined to destroy the whole industry. They don't seem to be as petty or as prolific in churning out regulations and limitations on other industries.
- Latty 8y ago
  Or maybe people have realised this business model is dangerous and damaging and we are better off going to alternatives? Companies can simply start charging for services rather than selling data in the EU, if it's really that bad. Personally, as a British person, I fear companies doing bad things far more than I fear the government overstepping with regulation. People have been making these same claims about regulation destroying industries for some time, and it never actually happens. Instead, most of the time they actually end up being good.
  - sqdbps 8y ago
    They don't 'sell data' they show you ads based on relevant data, it's a deliberate mistake that defeats the argument. The major issue here is that user consent won't be sufficient anymore, I don't mind the business model in question and I'm not alone so let us have it, and those who won't consent they're free to take their business elsewhere. This degree of micro managing the industry is unprecedented in a supposed free market system, and ad targeting is far from only benefit to the data, it's just potential killing legislation.
    - dmitriid 8y ago
      > They don't 'sell data' they show you ads based on relevant data What they do to show these ads is to sell your data, wholesale.
      - xxpor 8y ago
starbugs 8y ago
Is it maybe finally time to get a real business model? As with any regulation, there are issues which need to be sorted out. But one thing is crystal clear to me: this helps making people aware of what is happening to their data and their lifes. There is no excuse for not being able to come up with a viable business model without productizing users and making them subject to social and political manipulation. I wonder why no one writes about how products could use GDPR and other regulations to their advantage instead of whining about the demise of the ad industry.
- zerostar07 8y ago
  > There is no excuse for not being able to come up with a viable business model without productizing users and making them subject to social and political manipulation. How so? TV and media have been doing it since forever - not as efficient but still. It's a valid model if you want open, pluralistic services.
  - starbugs 8y ago
    If old media advertising is so great, then why is it necessary to collect more and more data about individuals, up to the point where you can target them personally? Would you call TV advertising a productization of the consumer? Why do e.g. FB not offer a level of service that is viable without personally identifiable information being used for targeting? There seems to be a BIG difference in the effectiveness and mechanisms of statistical target groups vs. individual targeting. If you've followed the Cambridge Analytica scandal, you know to what degree this information can be abused.
    - zerostar07 8y ago
      I agree that there have to be limits , but it's not an 0/1 question. Facebook should even be treated as a special case because it's a monopoly, but again it's not 0/1. I doubt they can offer the same service without targetting - facebook makes $100+ from each user in US or western europe. If they made 10% of that they couldn't offer to e.g. store all your photos and vids for free. And lets not kid ourselves, very few people would pay $100+ for facebook, even though it would be interesting to see them offer that option.
deleted 8y ago
[deleted]
probably_wrong 8y ago
After seeing that "App-ocalypse" video, I realised: the intersection between "people that like the new privacy law" and "people who can make a cool video" is probably much smaller than the intersection with people who don't like the new privacy law. EA (say) can probably make a much more effective campaign than (say) Stallman. This worries me in this case in particular, but it's a worry in general: how to reach audiences outside the science/tech sphere. Not many programmers want to be Youtubers, but that seems to be the only reasonable choice.
zerostar07 8y ago
> The bill also requires companies to offer people the same communications services whether or not they agree to have their data collected Again with this madness. Please convince me how this does not violate the right of people to come into contracts with each other? The internet is not a private space as the EU's lawmakers seem to want it to be, but a public space like the real world. If you want privacy, you buy a house, and similarly you get a subscription service online. I appreciate that everyone is sensitive with their privacy these months, but please try to be rational. FWIW, as an EU citizen i am sometimes offended by the stupidity of our lawmakers.
- starbugs 8y ago
  Difference is that in a public space in the real world you clearly and easily recognize what is happening around you. On the internet, you are being ripped off without even noticing thanks to UX that is optimized by companies to get what they want – not what is good for you, the user.
  - zerostar07 8y ago
    Sure, put a sign "We are tracking you" on the page header in bold red. I'm all for transparency. Now you know that when you enter the space you 're tracked. Why are you able to demand that it's turned off?
- eveningcoffee 8y ago
  This is not madness. Many (if not all) EU countries have a law that regulates contracts. One principle is that the one in the weaker position in the contract should have some protections. This can be seen as an extension to such a law. It appears that consumers are in the weaker position in the contract here because major ISP can in (silent) agreement to refuse to provide a fair contracts. For example they are in such position because majority of consumers do not care.
  - deleted 8y ago
    [deleted]
  - 8y ago

41 points by rgbrenner 8y ago

https://iapp.org/media/pdf/resource_center/Draft-ePriv-Reg-May-2018.pdf https://iapp.org/media/pdf/resource_center/Draft-ePriv-Reg-M... Here is the most recent draft if anyone wants to read it. Just to start a bit of a discussion, I read prior drafts and this one is MUCH better than previous drafts. Before very simple things like placing cookies for basic analytics, fraud detection, DDoS prevention, etc. were in a grey area. Now they are explicitly allowed by this draft. If prior versions would've passed as-is, I would be legitimately worried for the future of tech in Europe, but this seems quite similar to GDPR now.

mikestew 8y ago

"And requiring companies to provide equal communications services to people who opt out of data mining, they say, could cause sites or apps that rely on data-driven advertising to start charging fees or close down." This statement starts with the assumption that the data mining was okay in the first place. My metaphor is a bit hyperbolic, but it's like members of organized crime complaining about the passage of RICO in the U. S. "Well, now how are supposed to make a living?" Mmm, you weren't supposed to be making a living through organized crime in the first place.

d1zzy 8y ago
Let's not get hyperbolic and compare data mining to murder. If you think it's not OK that's your opinion, but do a survey among regular folk of "is it OK to have web sites mine your data to provide you with targeted ads and free services like search, maps, email or you wish to pay $5 a month" and see the results. Make sure to include there people from all walks of life and age and all over the world. Personally I like having choices. Data mining should be just another mechanism to pay for the services provided. I know for a fact that if these companies didn't have "data mining" as a mechanism to provide otherwise free services I would have never used those free services for the past 15 years or so, growing up in a country where electronic payments were available much later and the per capita yearly income was super low.
- QasimK 8y ago
  Let’s not start giving false choices. I simply don’t believe your assertion that the choice is between free services or paying a monthly fee.
  - d1zzy 8y ago
    Like I said, I like choices. I never said that those are the _only_ 2 choices, but they are 2 choices. And one of them was easily available and made it possible to use those services wherever I was, no matter how much money I had or how old I was.
- mikestew 8y ago
  Let's not get hyperbolic and compare data mining to murder. What, in your opinion, is the correct number of disclaimers before one is allowed to respond, "duh, I already covered that"? Besides, organized crime involves a much broader set of actions than just killing people. Traditionally it has included such mundane activities as trash collection. Nothing wrong with collecting the trash that people leave at the curb, right? Regardless, it's tech companies jumping on the hype (derived from the word "hyperbolic") train to tell us of the woes that will befall us should such a thing pass. The world hasn't yet come to an end with the passage of GDPR, I doubt it will should this regulation go through.
  - d1zzy 8y ago
    Just because we don't take the side of what the tech companies tell us (which obviously will try to portray it negatively, it's in their interest to do so) doesn't mean that we think GDPR or similar laws are perfect either. I think the true effects of GDPR will take 5-10 years to develop and we'll see then if it was a good idea. I'm just glad I grew up in a world where I had easy free access to very powerful online tools because I cannot say if the same will be true in the future.
- alkonaut 8y ago
  > "is it OK to have web sites mine your data to provide you with targeted ads and free services like search, maps, email or you wish to pay $5 a month" and see the results. But is it right to let companies track users simply because the users say it's ok? To put it another way: I think the EU would be right to consider it's citizens not as adults that are able to make decisions on integrity or privacy.

ocdtrekkie 8y ago

Now that GDPR hysteria has passed, the Internet has survived, and we're all still here, it's time to start ePrivacy hysteria. The sheer number of lobbying groups each of these tech companies is involved in is amazing. Google doesn't seem to publish an EU counterpart to this that I know of, but here's how many organizations Google is backing: https://www.google.com/publicpolicy/transparency.html https://www.google.com/publicpolicy/transparency.html

wooter 8y ago
I'm not a lobbying group and I find the law to be abhorrent. Did you expect all opposition to roll over and disappear?
chris_engel 8y ago
The problem - and thats the reason the GDPRs try to improve the world will fail - is that if you as a company to say: "if you don't consent you cannot use this great service all your friends are using. The people will consent even if they don't like it so you need to remove this force factor. Its like here in germany its prohibited that you let an employee work for more than 8hrs straight. In special cases you may extend this to 10hrs but only with good reasons. Everything above is just plain illegal, even if the employee states he did it voluntarily. The company is still liable then.
sqdbps 8y ago
The jury is still out on the effects of GDPR and claiming Google as the only opposition here is incorrect and is a tired scare tactic, the "developer alliance" isn't 'big tech lobbying' and this piece of legislative madness includes this gem: "The bill also requires companies to offer people the same communications services whether or not they agree to have their data collected." So consent isn't enough anymore.
- ocdtrekkie 8y ago
  The requirement to provide service with or without tracking consent is already a part of GDPR. And it's a key feature, because without it, companies would use the "agree to it or you just can't use our service" nonsense we've already suffered.

sqdbps 8y ago

"The bill also requires companies to offer people the same communications services whether or not they agree to have their data collected." This is the most insane part of this clueless and destructive law. It's like europe has resigned to the notion that they don't have a significant internet company so they are determined to destroy the whole industry. They don't seem to be as petty or as prolific in churning out regulations and limitations on other industries.

Latty 8y ago
Or maybe people have realised this business model is dangerous and damaging and we are better off going to alternatives? Companies can simply start charging for services rather than selling data in the EU, if it's really that bad. Personally, as a British person, I fear companies doing bad things far more than I fear the government overstepping with regulation. People have been making these same claims about regulation destroying industries for some time, and it never actually happens. Instead, most of the time they actually end up being good.
- sqdbps 8y ago
  They don't 'sell data' they show you ads based on relevant data, it's a deliberate mistake that defeats the argument. The major issue here is that user consent won't be sufficient anymore, I don't mind the business model in question and I'm not alone so let us have it, and those who won't consent they're free to take their business elsewhere. This degree of micro managing the industry is unprecedented in a supposed free market system, and ad targeting is far from only benefit to the data, it's just potential killing legislation.
  - dmitriid 8y ago
    > They don't 'sell data' they show you ads based on relevant data What they do to show these ads is to sell your data, wholesale.
    - xxpor 8y ago

starbugs 8y ago

Is it maybe finally time to get a real business model? As with any regulation, there are issues which need to be sorted out. But one thing is crystal clear to me: this helps making people aware of what is happening to their data and their lifes. There is no excuse for not being able to come up with a viable business model without productizing users and making them subject to social and political manipulation. I wonder why no one writes about how products could use GDPR and other regulations to their advantage instead of whining about the demise of the ad industry.

zerostar07 8y ago
> There is no excuse for not being able to come up with a viable business model without productizing users and making them subject to social and political manipulation. How so? TV and media have been doing it since forever - not as efficient but still. It's a valid model if you want open, pluralistic services.
- starbugs 8y ago
  If old media advertising is so great, then why is it necessary to collect more and more data about individuals, up to the point where you can target them personally? Would you call TV advertising a productization of the consumer? Why do e.g. FB not offer a level of service that is viable without personally identifiable information being used for targeting? There seems to be a BIG difference in the effectiveness and mechanisms of statistical target groups vs. individual targeting. If you've followed the Cambridge Analytica scandal, you know to what degree this information can be abused.
  - zerostar07 8y ago
    I agree that there have to be limits , but it's not an 0/1 question. Facebook should even be treated as a special case because it's a monopoly, but again it's not 0/1. I doubt they can offer the same service without targetting - facebook makes $100+ from each user in US or western europe. If they made 10% of that they couldn't offer to e.g. store all your photos and vids for free. And lets not kid ourselves, very few people would pay $100+ for facebook, even though it would be interesting to see them offer that option.

deleted 8y ago

[deleted]

probably_wrong 8y ago

After seeing that "App-ocalypse" video, I realised: the intersection between "people that like the new privacy law" and "people who can make a cool video" is probably much smaller than the intersection with people who don't like the new privacy law. EA (say) can probably make a much more effective campaign than (say) Stallman. This worries me in this case in particular, but it's a worry in general: how to reach audiences outside the science/tech sphere. Not many programmers want to be Youtubers, but that seems to be the only reasonable choice.

zerostar07 8y ago

> The bill also requires companies to offer people the same communications services whether or not they agree to have their data collected Again with this madness. Please convince me how this does not violate the right of people to come into contracts with each other? The internet is not a private space as the EU's lawmakers seem to want it to be, but a public space like the real world. If you want privacy, you buy a house, and similarly you get a subscription service online. I appreciate that everyone is sensitive with their privacy these months, but please try to be rational. FWIW, as an EU citizen i am sometimes offended by the stupidity of our lawmakers.

starbugs 8y ago
Difference is that in a public space in the real world you clearly and easily recognize what is happening around you. On the internet, you are being ripped off without even noticing thanks to UX that is optimized by companies to get what they want – not what is good for you, the user.
- zerostar07 8y ago
  Sure, put a sign "We are tracking you" on the page header in bold red. I'm all for transparency. Now you know that when you enter the space you 're tracked. Why are you able to demand that it's turned off?
eveningcoffee 8y ago
This is not madness. Many (if not all) EU countries have a law that regulates contracts. One principle is that the one in the weaker position in the contract should have some protections. This can be seen as an extension to such a law. It appears that consumers are in the weaker position in the contract here because major ISP can in (silent) agreement to refuse to provide a fair contracts. For example they are in such position because majority of consumers do not care.
- deleted 8y ago
  [deleted]
- 8y ago