12 ms·

What you are saying is: don't use the internet. Google, Facebook, Twitter, etc. got websites to implement their like buttons everywhere. The information gather

by foepys 8y ago

What you are saying is: don't use the internet. Google, Facebook, Twitter, etc. got websites to implement their like buttons everywhere. The information gathered by them is collected and everybody is being tracked wherever they go.

DoreenMichele 8y ago
If a few mega corporations like google, fb, and twitter are The Problem, why are we making a law that generally applies to everyone and will disproportionately impact smaller organizations instead of dealing with these mega corporations per se? If we aren't as a world terrified of what is being done by small groups like the open source organization announcing it is shutting down in the very post under discussion, why are you defending the GDPR on the idea that it somehow reins in the abuses of FB, Google, etc? Do you have evidence that it is, in fact, reining them in? Or are they just getting with their lawyers, finding cute ways around the problem and carrying on while entire organizations smaller than them suddenly shut down and die because the EU wrote words somewhere that these mega corps likely care relatively little about?
- foepys 8y ago
  If you make special laws for a few companies, you are fighting the hydra. There will come something after you fined Google or Facebook long enough for being too big. Defining a size for "mega corporations" is also quite arbitrary and I'd quite worse because it doesn't fight the underlying problem: every human should have the right of privacy. > Do you have evidence that it is, in fact, reining them in? We will see what happens. The first complaints against Facebook and Google have already been filed.
  - DoreenMichele 8y ago
    I said dealing with these mega corporations per se. This in no way suggests making special laws for a few companies. If the entire world currently agrees that a handful of companies are The Problem, then there should be some means to go after said handful of companies and get them to stop being The Problem without creating blanket laws negatively impacting the entire world, especially smaller organizations. Dealing directly with a problem company usually involves charging them under existing laws (anti-monopoly laws?) and things like that. It usually does not mean making unenforceable laws that name them by name or define things in a Jim Crow style that clearly targets them in specific and that is unlikely to stand up in court.
    - beagle3 8y ago
      The problem is, it's not a handful of companies, it's a few hundreds or even thousands, which makes rigorous laws sensible. Google, Facebook, Twitter have a roster of the web pages you have viewed, whether you interacted with them or not. Verizon, AT&T, T-Mobile and every other phone company has a complete log of your location history (for mobiles), message & call history, and unencrypted browsing history. They have no need for it to provide service (beyond the month or two in which these actions occured), but they do sell it to third parties, the list of which you have never seen. Your credit card company does the same with your credit transactions. This is already 30 companies or so, just in the US, and it is just the tip of the iceberg. GDPR says "a person's data is their own property", which is easy to understand and enforce. You may not like it, but it's along the line of copyrights and trademarks, except the beneficiary is mostly the common man.
- ulrikrasmussen 8y ago
  I can't comment on the effectiveness of GDPR on the large data farmers such as Facebook and Google. However, I think that the alternative that you are proposing for lawmakers to go specifically after the current infringers of privacy would set a scary precedent. We shouldn't have specific corporations operating under a different set of laws than the rest of society, as that would undermine the rule of law.
  - _Codemonkeyism 8y ago
    We should handle companies that have >1M data records differently from smaller companies. Most countries handle private persons with larger income differently, e.g. they need to pay more income tax. Most countries handle startups differently, e.g. they don't need to pay taxes in the first years. Most countries handle farms differently than other corps, e.g. they give subsidies to them. Most countries handle people with no income differently, e.g. they get social security payments. Most countries handle banks differently, e.g. they are regulated. Most countries handle health companies differenty, e.g. they are regulated.
    - hk__2 8y ago
      > We should handle companies that have >1M data records differently from smaller companies. What makes you think we don’t already do that? GDPR is about privacy 101; there’s nothing in it that shouldn’t apply to small companies. Do we allow small restaurants to poison their clients because they’re just starting and you-know-it’s-hard-to-build-a-restaurant-so-let’s-wait-a-bit-before-applying-regulation? Of course no.
      - _Codemonkeyism 8y ago
        "GDPR is about privacy 101;" It looks like our experience on implementing GDPR is different. Essentially GDPR is like being PCI and SOX compliant from the first day - and looking at what companies go into to not be under PCI compliance, like use Stripe forms, this looks like significant overhead. After implementing GDPR, SOX and PCI in several companies, from an IT perspective they are comparable, with PCI the easiest to implement, especially on the process side, GDPR a little bit more than SOX on the documentation side but no monitoring of code changes and traceability. Paying 10.000+ EUR for a missing word in your data protection declaration is no problem for a multi billion dollar company, but can and will kill startups. If your GDPR is not on the same level as a SOX implementation, there will be a rude awakening if you get a review and are fined. Paying for a data protection officer is hindering small companies and startups. Updating your deletion infrastructure with every feature you implement is overhead. If you do not automate this and keep it updated and respond to information request by hand, plan for significant manual work. Having a process documentation of 100+ pages which needs to be updated with everything you do and every new feature that captures or transfers personal data or stores data is a huge overhead for iterating on your product. Do a risk analysis and data protection sign off for every test feature decreases your speed a lot. You need to document every process (what data, where stored, when deleted, what cloud/saas/systems involved, who has access, how it is protected, ...) - like sending marketing mails or cold calling or going to a conference collecting business cards or giving stuff away to winners on Facebook - if it touches personal data. Encryption in the database of personal data and encryption on the storage medium is a lot of operation stuff - this will lead to converging every startup to only use PG instead of being polystorage. Implementing access controls to your office (if you use Excel with personal data) as if you were a data center is a lot of overhead - no more starting at home or in the garage. Probably best to go to WeWork who have proper office access control, if you have the money. Investing into training days, planning and updating training material and managing training and with your staff is a lot of overhead for startups. Together with staying up to date with court decisions on GDPR will cost startups 1 FTE (see above). From now on instead of hiring that second developer I'd consult startups to hire a security officer first. Having a data processing contract for every prototype feature you test is a lot of overhead to being agile and lean. Marketing signing up with a credit card to try out some automation in a startup - these days are gone. I'd say it is significantly more difficult to follow the lean startup methodology than before. From working in some large companies and some startups, implenting GDRP, SOX and PCI, GDPR will help large companies who already have a large legal team, large compliance teams and who are SOX compliant against disruptive startups. Google and Facebook are the main beneficiaries from the GDPR.
- blub 8y ago
  An open source CI project shutting down its forum because it can't ensure the proper handling of the personal data of its members is neither terrifying, nor a tragedy, it's the law working as intended. People clueless about privacy and privacy abusers are no longer welcome to the data of EU citizens.
- bigbugbag 8y ago
  Because that's how laws work, they apply to everyone. Then again what you say is a misrepresentation and biased idea, what proof do you have that GDPR will disproportionately impact small organizations ? Have you read the actual annoucement posted here ? asking because it does not say that it is shutting down but that it is moving its community discussion from a self hosted discourse forum to a third party hosted subreddit because discourse lacks the ability to properly address GDPR request and lack of time to do so. Of course GDPR also applies to FB, Google, etc. Have you followed the discussions 5 years ago when GDPR was in the making and witnessed the intense lobbying from silicon valley against strong protection ? Probably not. Are you aware of the noyb.eu[1] initiative, Max Schrems again, currently targeting google, facebook, whatsapp and instagram for their "forced consent" (more to come) ? La Quadrature du Net a french internet rights organization is currently working on 12 class actions targeting google, facebook, amazon, apple and microsoft, etc. [1]: https://noyb.eu/ https://noyb.eu/ [2]: https://gafam.laquadrature.net/ https://gafam.laquadrature.net/
em3rgent0rdr 8y ago
You can neuter the like button, thanks to tools like Privacy Badger.
- oneeyedpigeon 8y ago
  It's more scalable to neuter the button server-side than client-side, though. That button is clearly so 'wrong' from the consumer's point - I hope this is the beginning of the end.
  - sunir 8y ago
    It is more scalable client-side. There are fewer browsers than Internet edges. The Internet is designed to circumvent any attempt to control the edges. You can hammer one app Facebook but you can’t hammer all apps. Just consider revery Chrome extension that is malware. You can though hammer Chrome to block functionality that enables malware.

by foepys 8y ago

DoreenMichele 8y ago

If a few mega corporations like google, fb, and twitter are The Problem, why are we making a law that generally applies to everyone and will disproportionately impact smaller organizations instead of dealing with these mega corporations per se? If we aren't as a world terrified of what is being done by small groups like the open source organization announcing it is shutting down in the very post under discussion, why are you defending the GDPR on the idea that it somehow reins in the abuses of FB, Google, etc? Do you have evidence that it is, in fact, reining them in? Or are they just getting with their lawyers, finding cute ways around the problem and carrying on while entire organizations smaller than them suddenly shut down and die because the EU wrote words somewhere that these mega corps likely care relatively little about?

foepys 8y ago
If you make special laws for a few companies, you are fighting the hydra. There will come something after you fined Google or Facebook long enough for being too big. Defining a size for "mega corporations" is also quite arbitrary and I'd quite worse because it doesn't fight the underlying problem: every human should have the right of privacy. > Do you have evidence that it is, in fact, reining them in? We will see what happens. The first complaints against Facebook and Google have already been filed.
- DoreenMichele 8y ago
  I said dealing with these mega corporations per se. This in no way suggests making special laws for a few companies. If the entire world currently agrees that a handful of companies are The Problem, then there should be some means to go after said handful of companies and get them to stop being The Problem without creating blanket laws negatively impacting the entire world, especially smaller organizations. Dealing directly with a problem company usually involves charging them under existing laws (anti-monopoly laws?) and things like that. It usually does not mean making unenforceable laws that name them by name or define things in a Jim Crow style that clearly targets them in specific and that is unlikely to stand up in court.
  - beagle3 8y ago
    The problem is, it's not a handful of companies, it's a few hundreds or even thousands, which makes rigorous laws sensible. Google, Facebook, Twitter have a roster of the web pages you have viewed, whether you interacted with them or not. Verizon, AT&T, T-Mobile and every other phone company has a complete log of your location history (for mobiles), message & call history, and unencrypted browsing history. They have no need for it to provide service (beyond the month or two in which these actions occured), but they do sell it to third parties, the list of which you have never seen. Your credit card company does the same with your credit transactions. This is already 30 companies or so, just in the US, and it is just the tip of the iceberg. GDPR says "a person's data is their own property", which is easy to understand and enforce. You may not like it, but it's along the line of copyrights and trademarks, except the beneficiary is mostly the common man.
ulrikrasmussen 8y ago
I can't comment on the effectiveness of GDPR on the large data farmers such as Facebook and Google. However, I think that the alternative that you are proposing for lawmakers to go specifically after the current infringers of privacy would set a scary precedent. We shouldn't have specific corporations operating under a different set of laws than the rest of society, as that would undermine the rule of law.
- _Codemonkeyism 8y ago
  We should handle companies that have >1M data records differently from smaller companies. Most countries handle private persons with larger income differently, e.g. they need to pay more income tax. Most countries handle startups differently, e.g. they don't need to pay taxes in the first years. Most countries handle farms differently than other corps, e.g. they give subsidies to them. Most countries handle people with no income differently, e.g. they get social security payments. Most countries handle banks differently, e.g. they are regulated. Most countries handle health companies differenty, e.g. they are regulated.
  - hk__2 8y ago
    > We should handle companies that have >1M data records differently from smaller companies. What makes you think we don’t already do that? GDPR is about privacy 101; there’s nothing in it that shouldn’t apply to small companies. Do we allow small restaurants to poison their clients because they’re just starting and you-know-it’s-hard-to-build-a-restaurant-so-let’s-wait-a-bit-before-applying-regulation? Of course no.
    - _Codemonkeyism 8y ago
      "GDPR is about privacy 101;" It looks like our experience on implementing GDPR is different. Essentially GDPR is like being PCI and SOX compliant from the first day - and looking at what companies go into to not be under PCI compliance, like use Stripe forms, this looks like significant overhead. After implementing GDPR, SOX and PCI in several companies, from an IT perspective they are comparable, with PCI the easiest to implement, especially on the process side, GDPR a little bit more than SOX on the documentation side but no monitoring of code changes and traceability. Paying 10.000+ EUR for a missing word in your data protection declaration is no problem for a multi billion dollar company, but can and will kill startups. If your GDPR is not on the same level as a SOX implementation, there will be a rude awakening if you get a review and are fined. Paying for a data protection officer is hindering small companies and startups. Updating your deletion infrastructure with every feature you implement is overhead. If you do not automate this and keep it updated and respond to information request by hand, plan for significant manual work. Having a process documentation of 100+ pages which needs to be updated with everything you do and every new feature that captures or transfers personal data or stores data is a huge overhead for iterating on your product. Do a risk analysis and data protection sign off for every test feature decreases your speed a lot. You need to document every process (what data, where stored, when deleted, what cloud/saas/systems involved, who has access, how it is protected, ...) - like sending marketing mails or cold calling or going to a conference collecting business cards or giving stuff away to winners on Facebook - if it touches personal data. Encryption in the database of personal data and encryption on the storage medium is a lot of operation stuff - this will lead to converging every startup to only use PG instead of being polystorage. Implementing access controls to your office (if you use Excel with personal data) as if you were a data center is a lot of overhead - no more starting at home or in the garage. Probably best to go to WeWork who have proper office access control, if you have the money. Investing into training days, planning and updating training material and managing training and with your staff is a lot of overhead for startups. Together with staying up to date with court decisions on GDPR will cost startups 1 FTE (see above). From now on instead of hiring that second developer I'd consult startups to hire a security officer first. Having a data processing contract for every prototype feature you test is a lot of overhead to being agile and lean. Marketing signing up with a credit card to try out some automation in a startup - these days are gone. I'd say it is significantly more difficult to follow the lean startup methodology than before. From working in some large companies and some startups, implenting GDRP, SOX and PCI, GDPR will help large companies who already have a large legal team, large compliance teams and who are SOX compliant against disruptive startups. Google and Facebook are the main beneficiaries from the GDPR.
blub 8y ago
An open source CI project shutting down its forum because it can't ensure the proper handling of the personal data of its members is neither terrifying, nor a tragedy, it's the law working as intended. People clueless about privacy and privacy abusers are no longer welcome to the data of EU citizens.
bigbugbag 8y ago
Because that's how laws work, they apply to everyone. Then again what you say is a misrepresentation and biased idea, what proof do you have that GDPR will disproportionately impact small organizations ? Have you read the actual annoucement posted here ? asking because it does not say that it is shutting down but that it is moving its community discussion from a self hosted discourse forum to a third party hosted subreddit because discourse lacks the ability to properly address GDPR request and lack of time to do so. Of course GDPR also applies to FB, Google, etc. Have you followed the discussions 5 years ago when GDPR was in the making and witnessed the intense lobbying from silicon valley against strong protection ? Probably not. Are you aware of the noyb.eu[1] initiative, Max Schrems again, currently targeting google, facebook, whatsapp and instagram for their "forced consent" (more to come) ? La Quadrature du Net a french internet rights organization is currently working on 12 class actions targeting google, facebook, amazon, apple and microsoft, etc. [1]: https://noyb.eu/ https://noyb.eu/ [2]: https://gafam.laquadrature.net/ https://gafam.laquadrature.net/

em3rgent0rdr 8y ago

You can neuter the like button, thanks to tools like Privacy Badger.

oneeyedpigeon 8y ago
It's more scalable to neuter the button server-side than client-side, though. That button is clearly so 'wrong' from the consumer's point - I hope this is the beginning of the end.
- sunir 8y ago
  It is more scalable client-side. There are fewer browsers than Internet edges. The Internet is designed to circumvent any attempt to control the edges. You can hammer one app Facebook but you can’t hammer all apps. Just consider revery Chrome extension that is malware. You can though hammer Chrome to block functionality that enables malware.