21 ms·

‘Everyone is breaking the law right now’: GDPR compliance is falling short

217 points by ilamont 8y ago

helpme420 8y ago
I hope Jean Claude Juncker, our great leader of the EU, heavily sanctions the offenders who refuse to abide by the EU regulations and laws. Hopefully he will setup a GDPR 'police' so that offenders can be identified and punished swiftly.
davidhyde 8y ago
> Part of the issue, experts say, is the vague regulation has been interpreted in wildly different ways. GDPR consent-request messages vary wildly across sites What experts? I found the law to be pretty clear and there are plenty of summarized versions out there. What some companies find confusing is that the law has made their core business model illegal and no consent form can save them. You cannot get your users to opt out via a consent form, how many times do people have to repeat this? This is nothing like the cookie law. The only vague part of the law is the fining system which was done on purpose. If you have explicit fines then companies will have to make more money from your private data to cover the explicitly priced fine leading to a worse situation.
- scarejunba 8y ago
  If it is easy to follow the law, then the cost of a compliance expert on this topic would be low. It is not low. Compliance is expensive, even for companies who don't make their money from data. Therefore, I don't think it's that easy.
  - tjoff 8y ago
    It becomes hard when you try to get away with something that goes against the intent of the law. And that is exactly what sites are doing now. And there is noone on earth that will ever believe it isn't deliberate.
    - amarkov 8y ago
      If the GDPR was really intended to forbid business models which require collecting user data for ad targeting, why wouldn't it have just said that?
      - tjoff 8y ago
        Just because X violates GDPR doesn't mean the intent of GDPR is to forbid X.
  - TeMPOraL 8y ago
    Not necessarily. It's a seller's market due to huge demand, so prices alone may not be a good indicator of difficulty at this point.
  - s73v3r_ 8y ago
    That doesn't follow. It's easy to follow the law, but because a lot of companies were doing things that were against the law, and given that a lot of companies put things off til the last minute, it took a lot of work to come into compliance.
  - deleted 8y ago
    [deleted]
- tmikaeld 8y ago
  What I've found to be "confusing" is that some GDPR consultants say that when a single person cannot be identified in a blob of data, then it's not personal data. While others say the opposite, any data derived from a single individual is still considered personal data.
  - merb 8y ago
    well under the eu gdpr no data is called personal data if it is immpossible with the data to identify a person/company/person of law.
  - DanBC 8y ago
    GDPR seems clear on this: it's personal data if a natural person can be identified from it using reasonable means.
    - JumpCrisscross 8y ago
      > it's personal data if a natural person can be identified from it using reasonable means I could fit a planet into that "reasonable means" caveat.
      - DanBC 8y ago
        That's a good thing. It means the regulator can't issue instant fines for non-compliance except in the very worst most obvious cases. Because of this planet sized gap they need to ask everyone else to come into compliance before issuing the fine.
        JumpCrisscross 8y ago
        > It means the regulator can't issue instant fines for non-compliance The regulator interprets the gap. "Planet-sized gap" means the regulator can choose to be lenient or capricious based on their own preferences. That kind of uncertainty is anathema for modern businesses. (It's also beneficial to those who pay to build relationships with said regulators.)
- AndrewStephens 8y ago
  > What some companies find confusing is that the law has made their core business model illegal and no consent form can save them. Exactly this. Even the big reputable publishers (who wouldn't <em>dream</em> of breaking the law, oh no) accept money from companies directly targeted by the GDPR, who collect copious amounts of data on visitors across multiple sites. Do users on site A consent to company B collecting data through ads, even if they tick a box? Probably not. https://sheep.horse/2018/6/the_eu_general_data_protection_regulation_and_me_%28.html https://sheep.horse/2018/6/the_eu_general_data_protection_re...
- existencebox 8y ago
  I can't honestly agree. (re: ambiguity of interpretation, and cost being limited only to privacy-violating business models) Two reasons. 1. HN discussions themselves. Literally EVERY TIME this comes up, you see a massive back and forth from various crowds of GDPR; some of whom swear that it's perfectly comprehensible even as significant portions of the conversation are interpreting the same points in a variety of ways. (Are IPs PII? What exceptions can be allowed? What falls under "security requirement"? What forms of data are associated PII? What sort of deanonymization is sufficient? IS it sufficient? are some common questions I saw in the past, not even getting into the wonderful world of third party data processors.) This seems like enough pragmatic evidence that a (to give the benefit of the doubt) educated and professional community hasn't reached consensus, so to say there's a variety of interpretation seems very fair. 2. I implemented GDPR for a small corner of a notable BigCo. I do not consider myself an expert, but I certainly got my marching orders from experts, (The legal teams who interpreted the document and evaluated the implementation methods) and the sheer amount of horsepower put behind finding an interpretation we believed and were confident in was staggering. Granted this is something where we _really wanted to get it right_ but if it were really trivial to interpret I question if the process would have been as intensive as it was. (To preempt the inevitable; our (my team's) business model has _literally nothing_ to do with your data, but we had many of the same confusions/questions that I saw from companies who did, so I'd be hesitant to say that the burden isn't somewhat widespread.)
  - JumpCrisscross 8y ago
    > The legal teams...and the sheer amount of horsepower put behind finding an interpretation we believed and were confident in was staggering You shouldn't be getting down voted. I just went through a GDPR compliance review. We have a service model which is incredibly serious about customer confidentiality. We don't sell ads and, to my recollection, have never even bought them. Still required an army of lawyers. Two top London law firms ended up agreeing to disagree on major points, ultimately concluding the Polish data regulator would probably rule one way and the French the other. Complying with the spirit of a law doesn't mean complying with the statue of it. With GDPR, it's the latter that's a pain in the ass.
- sbov 8y ago
  Cool. If it's so clear, then are you willing to be held liable if my company is found in violation of it due to your misreading? I'm guessing not. People who are willing to put their reputation on the line, who are paid four figures per hour to understand this stuff, disagree with eachother on interpretations of GDPR.
  - JumpCrisscross 8y ago
    > be held liable if my company is found in violation Forget about violations. Even if you're in perfect compliance, any EU resident can complain to their data authorities if they think you're non-compliant. That then prompts a regulatory inquiry, which requires lawyers to competently respond to, which is distracting and expensive.
    - sureaboutthis 8y ago
      Hmm. Maybe we should violate this en masse and overload the system.
      - kybernetikos 8y ago
        That seems to be the approach that is being taken, albeit probably accidentally.
    - pierrebai 8y ago
      Which is different from other civil law in what ways? Anyone can sue you over any civil law. Then teh courts decides. GDPR is not magically different. This is a straw man. The flurry of activities is only driven by companies who keep data about their users. Of course "legitimate" will be defined by the courts. That's the price you have to pay now for all the abuses that have been going on for the past two or three decades. History has shown that to define "legitimate" the text of the law is to open the doors to avoidance. Sorry mate, we can't trust you to be honest. It's too late now.
      - JumpCrisscross 8y ago
- tomnipotent 8y ago
  No law is clear until it's been argued a few times in court and an army of legal professionals have duked it out. This is why - at least in the US - the branch of government that writes the law is separate from the one that interprets it.
  - j16sdiz 8y ago
    (Unlike US) Most of EU use civil law system. Precedent are not binding in civil law system
- MarkMc 8y ago
  Heres what the UK ICO says: "The GDPR does not define what factors to take into account when deciding if your purpose is a legitimate interest. It could be as simple as it being legitimate to start up a new business activity, or to grow your business." [1] Isn't that a little vague? It seems to imply that if a business can show that collecting your personal information will grow their business, they do not need to provide a way for you to 'opt out'. [1] https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/what-is-the-legitimate-interests-basis/ https://ico.org.uk/for-organisations/guide-to-the-general-da...
  - jiveturkey 8y ago
    Yes, it is a little bit vague. It's intentionally vague. The abuse of LI is designed to be like porn: I'll know it when I see it. It's totally fine for it to be vague. I very much doubt we'll see any cases where the general public disagrees with a DPA ruling of LI applicability. As a business owner, it means you need to strongly justify it and consider if a "reasonable person" would consider your use of LI to be justified. If you have doubt, you should seek consent instead. Do keep in mind, that growing your business by using PD for marketing purposes is explicitly excepted from LI.
    - kybernetikos 8y ago
      > If you have doubt, you should seek consent instead. Consent may not apply: > Consent is presumed not to be freely given if... the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.
- Moru 8y ago
  If you listen to the experts that are economically invested in the complexity of the law, you risk having more work.
  - sfifs 8y ago
    If you don't and some regulator fancies making an example of you, then your shareholders will fire and sue you.
    - bmer 8y ago
      Yeah, especially since we live in countries where corruption is rampant, along with unjust enforcement of regulations that completely violate their spirit. /s
      - sfifs 8y ago
        Are you assuming only European companies do business in Europe? EU prosecutors have a history of going after American tech companies much like US has a history of going after foreign companies - especially Chinese and now European (eg. Volkswagen). This is not about a moral stance, just business risk management.
- tzs 8y ago
  > I found the law to be pretty clear and there are plenty of summarized versions out there. What some companies find confusing is that the law has made their core business model illegal and no consent form can save them. What about Article 27? It's unclear, and you don't have to have a shady business model in order to have no idea how you are supposed to deal with it. All it takes is that your business is not established in the Union. This is the article that requires companies who are not in the Union but are subject to GDPR due to Article 3(2) to appoint a representative in the Union. The representative serves as a contact point that regulators and persons can communicate with instead of the company on all GDPR matters concerning the company. The representative is also required to keep a bunch of metadata about the company's data processing, according t Article 30. According to the recital for this article, "The designated representative should be subject to enforcement proceedings in the event of non-compliance by the controller or processor". What does that mean? Some people claim it means that your representative in the Union will be liable for any fines you incur from EU regulators or any damages a plaintiff wins in a private lawsuit over GDPR if the regulator or plaintiff is not able to force you to pay up. Others think it just means that if regulators or plaintiffs serve notice on the representative, that legally counts as if you were served, meaning that if you do not show up at the hearing or trial and lose by default, you cannot try to weasel out by claiming you had no notice of the hearing or trial. In other words, these people think that the representative is very similar to the "registered agent" that many jurisdictions require foreign businesses to have in order to do business in that jurisdiction. Personally, I was leaning toward the latter, as the idea of making the representative liable seemed pretty absurd...but it has been pointed out that in earlier drafts of Article 27 and the recitals, it did in fact actually clearly do so. That language was taken out before the final draft, but was that change because they wanted to remove that aspect, or because they decided "subject to enforcement proceedings" already implied it and they were just tightening the language? This is important because if representatives are actually liable for fines and damages, it is going to be a lot more expensive to hire people to be representatives than it will be if all they have to do is be a contact point and a repository of metadata. For small businesses outside the Union this could be a major expense if they must have a representative, perhaps a big enough expense that it will be worthwhile to just stop doing business in the EU. So we must ask, "Who needs a representative?". The answer, it turns out, involves still more vagueness. Basically, you are excused from needing a representative if you meet three conditions. Two of them most small businesses easily meet as long as they are not doing high volumes of certain particularly sensitive data, and their processing does not result in a risk to "the rights and freedoms of natural persons" (more vagueness!). The third condition is that your processing "is occasional". What is "occasional"? No one seems to know.
- shados 8y ago
  There are so many ambiguities and confusing situations. Eg: legitimate business use and free accounts. What do you define as the free account user to still be a customer? What if you nuke their account after some inactivity and then they come back? They're going to be pissed. Server log retention, message queues, etc and ip addresses (which may or may not be problematic depending on how they're stored and with what). Not fun. Third party vendors. Omg third party vendors. Many of them have no idea wtf they're doing. Ive seen some vendors swear up and down they didn't store any PII, just to realize eventually that they did and they didn't even know. Hope those DPAs are signed and in order! Hope you have good lawyers! It's insanely hard for any non-trivial systems. It gets even worse when american laws and GDPR conflict (eg: finance data retention laws. The definition of legitimate business need gets REAAAAALY fuzzy...)
  - Aengeuad 8y ago
    >There are so many ambiguities and confusing situations. Eg: legitimate business use and free accounts. What do you define as the free account user to still be a customer? What if you nuke their account after some inactivity and then they come back? They're going to be pissed. Processing of data is legitimate so long as you still have a reason to process that data, as well as if you have a contractual obligation with the subject to process that data. If that contract involves keeping an account registered indefinitely, until deletion is requested, then so be it. State it clearly and plainly when the user registers an account, and if you're that concerned about the ambiguity of the situation then the solution seems a simple one, no? Allow the user to choose to have their account deleted after a certain period of inactivity, or email users that their accounts will be deleted after lengthy periods of inactivity. It should be noted that 'inactivity' is industry specific, for something like free services online it could be industry standard to keep accounts for years, it's hard to imagine that a user would be upset about having an account they haven't used in 4 years be deleted, and really, do you need to keep that account after 1 year of inactivity? 3 Years? 5 Years? I realise the law is purposely ambiguous here especially when applied to things like user accounts, but it helps to understand that storage limitations and retention plans apply less to things like accounts and more to things like metadata that you may be collecting. It's perfectly reasonable to keep user accounts registered for years even after inactivity for example, it's less reasonable to collect data for marketing campaigns and keep that data for years. Retention limits are also far more relevant to processors of data rather than for controllers of data, if you're a third party service you shouldn't need to keep data for longer than your contract with the controller specifies, however controllers have far more of a legitimate need to process data for longer. The push to have retention limits may as well be seen as a push to anonymise data that no longer needs to be tied to an identified person rather than a need to delete everything that hasn't been touched in 90 days. >Server log retention, message queues, etc and ip addresses (which may or may not be problematic depending on how they're stored and with what). Not fun. IP addresses become problematic when you can tie them to an identified person, i.e., you're linking user accounts and IP addresses. As far as generic logs go, if the only personal information you're collecting is IP addresses then you shouldn't need to worry too much, treat the logs with some care as they still do contain personal information but don't sweat it too much. Make sure that if your logs are leaked that you inform users (i.e., through a blog post) that logs were leaked and the only personal information contained is IP addresses. IP addresses are one of the easiest things to justify needing to keep as a legitimate interest as well as needing keeping indefinitely, and if only IP addresses are leaked it's not really a big deal. If you have other personal information in your logs, especially if it's linked with more information, i.e., 'ip address 1.2.3.4 who has username asdf searched for jkl; [etc]', you should take steps to justify why you need to keep that extra information and maybe look at implementing a retention limit, or better yet, anonymise some of the extra data after you are finished processing it. If the metadata you're collecting is kept to a minimum and/or anonymised as much as possible, the need for a retention limit drops almost entirely, not that retention limits are entirely needed. >Third party vendors. Omg third party vendors. Many of them have no idea wtf they're doing. Ive seen some vendors swear up and down they didn't store any PII, just to realize eventually that they did and they didn't even know. Hope those DPAs are signed and in order! Hope you have good lawyers! In every other industry you are responsible for when you choose a shoddy third party vendor who makes a mistake, I fail to see why the tech industry should be any different. I realise there is going to be a lot of teething issues on this particular issue, but part of the reason GDPR has as much scope as it does is because of these clueless third party vendors who misuse and abuse data. Maybe look into using European third party vendors in the future, as they would be just as culpable for their mistakes as you would be and they would be liable for fines too. :-) >It's insanely hard for any non-trivial systems. It gets even worse when american laws and GDPR conflict (eg: finance data retention laws. The definition of legitimate business need gets REAAAAALY fuzzy...) For what it's worth, the GDPR makes explicit exemptions allowing for processing data where you have a legal obligation to do so. There is absolutely no conflict between financial laws and the GDPR in this respect.
- red75prime 8y ago
  Can I request to remove my face from a stored security camera footage? If not, why?
  - synotna 8y ago
    Read about legitimate interest, it's only a few sentences
    - red75prime 8y ago
      The document is 88 pages long. There are 31 mentions of 'legitimate interests'. I'm still not sure that recording everyone who walks past your store 24/7 is legitimate interest.
  - CaptainZapp 8y ago
    Security camera footage is overwritten and recycled on a regular basis. As a matter of fact: If you operate secutrity cameras in a public -, or semi public place you need a written procedure why something is captured, what is captured, how long it's kept, who can see the footage and under which conditions the footage is retained. "If not, why?" Because this is not a reasonable request if the footage is anyway deleted after, say, 72 hours.
  - Aengeuad 8y ago
    You cannot, part of the reasoning will be that the footage may need to be used in court therefore the integrity of the information needs to be maintained, another reason will be that it would be incredibly impractical and a burden for businesses to erase the faces of everyone that requests it. You cannot request that a business deletes CCTV footage of you either, probably for similar reasons. You can request a copy or to view that footage though. In another comment you posted: >I'm still not sure that recording everyone who walks past your store 24/7 is legitimate interest. Stores and businesses need to display signs for when they are recording in the areas they're recording, inside a store it may be obvious that the store is recording, so a sign may only be needed on a door. Outside of a store you may need more prominent signs. If it's not obvious that the area area is being recorded then even more signs need to be posted still. The degree to which stores and businesses can record outside of their businesses will vary by country, but for the UK the ICO provides information for consumers [0], and businesses [1]. [0] https://ico.org.uk/your-data-matters/cctv/ https://ico.org.uk/your-data-matters/cctv/ [1] https://ico.org.uk/for-organisations/police-justice/ https://ico.org.uk/for-organisations/police-justice/
- deleted 8y ago
  [deleted]
- downandout 8y ago
  I found the law to be pretty clear If you think this, you've misinterpreted it. I don't think even the biggest GDPR advocates would claim that it is "pretty clear".
Sargos 8y ago
If everyone is breaking the law then no one is.
- JeremyBanks 8y ago
  I'm sympathetic to the dangerous of discretionary enforcement, but if you're making a dramatic change like this, it's pretty hard to avoid an awkward period while people get compliant or get shut down.
  - dfxm12 8y ago
    Like the period between April 2016 and May 2018?
    - nopriorarrests 8y ago
      Without any real court cases showing how GDPR will be actually enforced, this 'introductory period' was useless. It could last 4 years instead of 2, and it would not make any difference.
      - erik_seaberg 8y ago
        There should have been a phase of mock suits. "Here's what you're doing that's against the new rules, and you have two years to knock it off or lawyer up."
  - adrianratnapala 8y ago
    > ... dangerous of discretionary enforcement, but if you're making a dramatic change like this, it's pretty hard to avoid ... So what does that tell you about dramatic changes?
    - JeremyBanks 8y ago
      Nothing
- 8y ago
dmitrygr 8y ago
That was entirely the intent! If everyone is breaking the law, you can pick and choose whom to enforce against, for a variety of reasons, including political convenience, shakedowns, etc
- frockington 8y ago
  I believe it was largely a way to try and unify the EU to combat recent turmoil. By taking a stand against the evil American tech innovators, the EU can look to its populace and say they accomplished something that a single nation could not have
  - oblio 8y ago
    Because God forbid that us Europeans would actually want a law like this, it’s just the Bruxelles bureaucrats that are pushing an anti-US agenda. I’m being ironic, a decent chunk of Europeans want this (I’d say a majority but I don’t have hard numbers).
    - rleigh 8y ago
      I've yet to hear any complaints from anyone I've been talking too; it's been universally regarded as a good thing. I'd have to agree, and I'm not a particular fan of the EU. It's never been portrayed as "anti-US", and it isn't. It's pro-privacy, and that's an entirely different thing. While I think certain US companies have aggressively persued certain business strategies which are very much anti-privacy, so have many companies around the world, and this legislation is long overdue pushback against some very dubious business practices many people are very, very uncomfortable with.
      - smileypete 8y ago
        Well I'd like to complain. It's not that there's no need for improvement, but EU rules often end up imposing poor implementations, consequently with no scope for better solutions.
  - 8y ago
alkonaut 8y ago
Hopefully things will stabilize once a few big players with dark patterns are taken to court, establishing some precedents. For example, switches opting in by default or popups saying “by using the site you agree to x”.
- merinowool 8y ago
  Not every country in the EU has precedent based law, also what could be considered bad in one EU country not necessarily could be considered bad in another given how vague GDPR is.
  - chronial 8y ago
    Precedents matter everywhere. In countries where precedents are not law, decisions from higher-level courts are still guiding the decisions of lower-level courts – so the effect is somewhat similar.
  - curun1r 8y ago
    It's possible that the poster above isn't talking about legal precedents and instead talking about practical precedents. After spending about a month building a GDPR consent tool and now seeing many other "compliance" efforts on various sits around the web, it's become clear to me that most businesses are taking a wait-and-see approach. They're doing the minimum necessary to claim they tried to comply while changing absolutely nothing about the way they do business. They're waiting to see how serious enforcement of the law is before making changes that negatively impact their business. It's not about whether they'd lose in court or have a regulatory judgment against them, it's about the likelihood that non-compliance will get them in trouble. If EU regulators show a willingness to do the legwork to fine smaller companies, you'll start to see a lot of these site become much more compliant. But those companies are not going to spend all that time and money proactively only to see that the EU doesn't have the teeth to enforce the rules, so they need practical precedents of companies being hit with huge non-compliance fines to scare them into making the necessary changes.
- jiveturkey 8y ago
  Your example won't help at all. That type of thing would clearly be in violation (by letter of the regulation, no expert legal evaluation needed).
gist 8y ago
Was a big media workup (like y2k) leading up to it and now it has faded from memory. It's like everything else that is the issue of the day and then ceases to matter at least in any way as much as whatever you read seem to make it before hand 'sky is falling comply comply' so typical. After you have been through similar things you know the way this type of thing is overhyped (I mean by what will actually happen and who it will happen to way overblow ie 'shut down my shitty little website for fear' mode.)
- NeoBasilisk 8y ago
  The Y2K issue did actually require a significant amount of patching for some systems, and they absolutely would have failed if not for that patching. Complying with government regulation is not really in the same class of issues.
  - ghaff 8y ago
    It seems that "Y2K was much ado about nothing" is becoming an increasingly popular school of thought. There was certainly lots of hype at the time. But a huge amount of money and time went into mitigating problems. I don't know if there would have been widespread power grid, etc. collapses or not if everyone had taken the attitude of "Eh, we'll fix things if they break" but I'm pretty convinced people would have been missing paychecks, bank account statements would be wrong, and that sort of thing at least.
  - Moru 8y ago
    People keep saying "Look, the sky didn't fall, what was all the hubub about?!". A job well done!
  - gist 8y ago
    > The Y2K issue did actually require a significant amount of patching I am referring mainly to the media hype and how it becomes the issue de jure and then ceases to matter. The media jumps on it and amplifies anyone who chimes or confirms the fear. Why? So they can run a 'if it bleeds it leads' type headline. While there could have been stories after the fact of problems for unpatched systems I don't remember any of those stories. And it is not because everyone patched their systems either. I mean there were posts online about GDPR where some small insignificant company just folded up for fear of what would happen as if the EU was really going to go after that type of target. Anyone who has been in business for a long time knows that is not what is ever done. To your point you are right because this isn't even (for US companies) a US regulation and if they have no customers in the EU then it is a stretch to be concerned about it (at least relative which is my point to the attention given to it by the media).
Theodores 8y ago
The whole thing was a shambles, there was no reference design that you could just implement for your ecommerce store/blog/software service or anything else that required it. Instead we had people running around like headless chickens rushing to put in place some extra tick-box on their website. The funny thing was how people sent out those emails to their newsletter subscribers and I do wonder how decimated those lists became. People got GDPR fatigue and could not be bothered with the emails after a while. This particularly affected smaller businesses who had legitimate reasons to email customers. Does anyone here have any anecdotal data on how badly some of these email lists were purged?
- dingo_bat 8y ago
  Irony is that I never got that email from Facebook and Google. Only small websites bothered to try and obtain an agreement.
- throwawayqdhd 8y ago
  As I mentioned in another thread, the biggest winners from this entire GDPR saga are Google and Facebook. Email is control. You get someone's email once, you get to control how often you contact them. You can send them hundreds of messages for next to no cost - as long as they don't hit 'unsubscribe' But if you can't rely on email, what do you turn to? Ads, of course! I get that there are some nasty actors that abuse your privacy. But as a consumer, I've never felt that spam was that big an issue to begin with, at least not big enough to warrant small businesses ceding control and having to rely on Google and Facebook to reach their audiences.
- robryan 8y ago
  As I understand it, people had to only gain consent for email lists if they had never gained consent previously.
- DanBC 8y ago
  > The funny thing was how people sent out those emails to their newsletter subscribers and I do wonder how decimated those lists became. People got GDPR fatigue and could not be bothered with the emails after a while. This particularly affected smaller businesses who had legitimate reasons to email customers. We've had data protection laws for 20 years. Those companies were already breaking the law if they didn't have permission to send email, and if they had a legitimate need to send email they don't need consent under GDPR.
evancox100 8y ago
Speaking of opting out... as a non-EU citizen, is there any way I can opt out of the EU's internet regulation? Like some flag my browser can send so I don't have to deal with the meaningless cookie/privacy popups?
- wst_ 8y ago
  For some reason people can't get into agreement to use one library that provides consistent way of dealing with this consent. Then you could just automatically close it with some extension, or not even load it at all.
- andrewmackrodt 8y ago
  I'm an EU citizen and I've hoped for something similar since the cookie "law". Maybe a callback that gets fired when the consent popup appears and then a browser extension could hook into that and automatically accept. Edit: replied to an out of date tab, another poster commented the same idea.
  - navs 8y ago
    Maybe if there was a browser feature providing an API for marketing consent.
marcrosoft 8y ago
A lot of people are _not_ breaking their locals laws and "Confusion will continue to reign" because there is a disproportionate amount of people that think that EU laws apply to the entire world.
- keithnz 8y ago
  I'm curious about this aspect. If you run and operate a website outside of Europe, if a European then uses that site, you aren't breaking local laws. What does the GDPR mean for these people? The europeans will still believe you have broken their laws and try to use whatever international agreements they have to go after you? Or if you enter europe they will hold you to account? Google / Facebook have operations in Europe, so I can understand why they are concerned, but what does it mean if you don't operate in Europe but have Europeans using your site?
  - mgkimsal 8y ago
    > but what does it mean if you don't operate in Europe but have Europeans using your site? My limited understanding is that generally, it doesn't mean much. However, if you are actively targeting/marketing to Europeans, then you might fall afoul of this, but probably won't be affected legally without hitting some sort of moderate commercial size.
  - chii 8y ago
    If your site is intended for Europeans, then you need to comply. It's not clear what test is used to determine this. My guess is, if you include translations, or region drop-down in a signup form, or is selling goods/services that only apply to Europe, then you'd have to comply.
  - jonhendry18 8y ago
    And what counts as "operations in Europe"? Would a magazine's Paris correspondent count?
- AmericanChopper 8y ago
  >there is a disproportionate amount of people that think that EU laws apply to the entire world I think one of the problems is that too many of those people are MEPs.
williesleg 8y ago
That's part of the strategy. Then they'll just go after some of them and fine them lots of cash. Or at least hold them hostage in lieu of fining them.
eulers__number 8y ago
Any kind of regulation will harm small businesses and create monopolies of large companies who have teams of lawyers to del with this kind of situation
- programmarchy 8y ago
  Counterexample: Anti-trust regulation
megous 8y ago
I'm quite happay, my phone number and addresses slowly disappeared from the google/bing/duckduckgo/... searchable internet over the past month. Often times without my involvement. Searches for my real name now vs prior to GDPR enforcement are like day/night. Prior, it was all topped by aggressive (SEO wise) companies who clone public registries and republish them en-masse without adding any value whatsoever. They just use this as a trick to drive people searching for various people's names to their online magazines and whatever. They basically parasite on other people's names to prop up their revenue at those people's expense. Now the searches are actually starting to return relevant things near the top, like my past OSS contributions, etc. For me, this side of GDPR compliance is working fine, and almost all comapnies are pretty good at responding to requests. That is a law working pretty well from the side of the data subject.
- baxtr 8y ago
  > Now the searches are actually starting to return relevant things near the top How were the prior top search results not relevant before? Either google and others are lousy or relevance means something different to you than most other people when searching for your name.
  - inetknght 8y ago
    What's relevant to someone can change over time, even at different parts of the day. I know of no search engine which has always shown what I'm trying to find.
  - megous 8y ago
    Top 10 or so results just contained the same info repeated over and over on different websites. Half of the time outdated (old addresses, etc.). Yes, google is lousy sometimes. It was the result of name squatting, as I described earlier.
mgkimsal 8y ago
I was onsite at a client's retail location and got chatting to a customer. They learned I was in IT and said "I hope you're all set for GDPR!" and I said "it doesn't affect us". "Oh yes it does! There's a lot of people living in this area (in the US) who are European citizens - this affects you right here!" I tried to argue back politely that it didn't affect us, and she started getting a bit... agitated, and the voice started to raise a bit. I tried to de-escalate - other customers in the store would have started paying attention once the raised voice went on. But... man on man... my comeback question I was ready to put back - then stopped short - was "Do you think a 20 person brick and mortar in the middle of Spain is required to abide by US laws? They're not, even when serving customers who happen to be US citizens." I would have hoped it would have made it clear, but... stopped short of getting in to a shouting match with my client's customers. :)
- cletus 8y ago
  I hate to be the one to break it to you but just being in another country and being small doesn't automatically exempt you from other countries' laws. Some examples: - Australia has laws that about child sex tourism aimed at those that go to Asian countries with lax laws or enforcement. These crimes are committed in other countries [1] - Foreign financial institutions are subject to FATCA when serving US customers, an issue that has made it difficult for US expats to even open bank accounts in some jurisdictions [2] - Australia has some pretty strict insider trading laws such that two foreigners who trade in inside information about an ASX listed company while they're on foreign soil (may) have commited a crime in Australia - Sanctions on the likes of Iran and North Korea prevent US companies or persons from trading with entities from sanctioned states even if such transactions take place entirely on foreign soil. - US citizens living in other countries are required to file taxes with the IRS even though during the tax year the citizen may never have stepped foot on US soil and any income is earned and paid entirely in foreign jurisdictions. So I'm not saying GDPR applies or doesn't. I honestly don't know. I'm just saying not being in Europe and being small aren't the automatic defenses you seem to think they are. [1]: http://www.thejakartapost.com/news/2017/12/13/australia-introduces-tough-new-laws-on-child-sex-tourism.html http://www.thejakartapost.com/news/2017/12/13/australia-intr... [2]: https://en.wikipedia.org/wiki/Foreign_Account_Tax_Compliance_Act https://en.wikipedia.org/wiki/Foreign_Account_Tax_Compliance...
ghosterrific 8y ago
GDPR is totalitarian control in disguise. Allow me to make the case... Thr beautiful thing about the internet before was about not having to ask for permission to create, to connect and to run a business. We now have to ask the government inspectors for permission, we have the threat of being hauled off to court or prison for "not keeping good records" in the name of 'safeguarding people's privacy" And this from a government thst is doing wholesome, Orwellian style wire tapping of Everything. Notice how the government is EXCEMPT from having to fulfill GDPR requirements? Why does this law apply to private individuals and businesses, but completely exempts countries and the EU itself from complying? If you trade a bit of security for freedom, you will get neither. The government tske over of the internet is almost complete, in the name of 'safety' anf 'privacy'. Since when did the government give a fuck about our right to: - not be spied on incessantly - not be stolen from at gunpoint via oppressive taxation - not be harassed by corrupt politicians ask for more "donations" If they so care about protecting us from evil, then why do they not make these laws apply to the state as well? We know from history that the greatest abuses of personal information is at the hands of the state.... rounding up dissendents from the dossiers they have built up. There is nothing wrong with Facebook or any company selling your data, when they said they would, in the contract you signed in exchange for a free product. Who is the government to tell me that I cannot give my personal information to a comoany in exchange for a product? The government takes my info and I'm fine with that... they do far more nefarious things eith my info than any private company can: - steal money via corrupt tax code - confiscate my property - confiscate my children - threaten violence and prison time The private corporation does none of this. It is the state that is the biggest abuser of personal information and they are conveniently exempt. Mark my words. There will be more laws written cuz "muh privacy protections" Watch.
kisstheblade 8y ago
Isn't the intent of the law quite easy to understand? Do not track/store anything by default. And your site works perfectly and without questions. If you then have a legitimate need for some data, without which your site doesnät work (eg. gps location data for a map), then you ask for it. And if you need to use ads, then have some opt in button somewhere deep in the settings where the user can go and click "please track me aggressively" if he so chooses.
smileypete 8y ago
I'd like to see some sort of browser request header that can set or deny permissions on a global basis, dealt with by an options page in the web browser. Then sites only need to serve up the annoying dialogs if they need a permission you haven't set, otherwise clearing cookies periodically means being plagued by the dreaded things. >;-(
- JaceLightning 8y ago
  I feel like this is against the spirit of the law.
duxup 8y ago
I feel like I'll have a way better idea of what is up once we see actual enforcement.
jillesvangurp 8y ago
Gdpr is very straightforward to comply with. Yes there are fines but you pretty much only get them at the end of an escalation process with plenty of opportunity to fix things. If your business was breaking the pre gdpr laws by doing things that were dodgy already, then, yes, this is now more likely to happen. That's a good thing. As for legislation and jurisdiction, doing business internationally has always been complicated. Many big corporations have legal entities across the world and funneling revenue via the eu is a popular way to dodge taxes in the us. If you do business with such companies, that makes gdpr relevant for you even if you have no direct eu ties as these companies may be forced to reconsider their relationship with you otherwise. Think anything involving ad based revenue, e-commerce, and other sectors involving non trivial revenue from the EU. Anyway, read the law text. It's surprisingly easy to find and digest and it puts all the idiots interpreting each other's interpretations a bit in perspective. Good summaries are available.
techsin101 8y ago
I feel US companies should have protection against badly implemented laws from forgein governments. Regardless of treaties. I'd love to see someone quantify loss of innovation, added cost of operation, and total delays cost by GDPR to companies he re
- Thiez 8y ago
  What would this protection look like, in your ideal world? How would it work?
Paianni 8y ago
Everytime I see the GDPR acronym I immediately think 'German Democratic Peoples Republic' and I can't think straight about it.

217 points by ilamont 8y ago

I hope Jean Claude Juncker, our great leader of the EU, heavily sanctions the offenders who refuse to abide by the EU regulations and laws. Hopefully he will setup a GDPR 'police' so that offenders can be identified and punished swiftly.

davidhyde 8y ago

> Part of the issue, experts say, is the vague regulation has been interpreted in wildly different ways. GDPR consent-request messages vary wildly across sites What experts? I found the law to be pretty clear and there are plenty of summarized versions out there. What some companies find confusing is that the law has made their core business model illegal and no consent form can save them. You cannot get your users to opt out via a consent form, how many times do people have to repeat this? This is nothing like the cookie law. The only vague part of the law is the fining system which was done on purpose. If you have explicit fines then companies will have to make more money from your private data to cover the explicitly priced fine leading to a worse situation.

scarejunba 8y ago
If it is easy to follow the law, then the cost of a compliance expert on this topic would be low. It is not low. Compliance is expensive, even for companies who don't make their money from data. Therefore, I don't think it's that easy.
- tjoff 8y ago
  It becomes hard when you try to get away with something that goes against the intent of the law. And that is exactly what sites are doing now. And there is noone on earth that will ever believe it isn't deliberate.
  - amarkov 8y ago
    If the GDPR was really intended to forbid business models which require collecting user data for ad targeting, why wouldn't it have just said that?
    - tjoff 8y ago
      Just because X violates GDPR doesn't mean the intent of GDPR is to forbid X.
- TeMPOraL 8y ago
  Not necessarily. It's a seller's market due to huge demand, so prices alone may not be a good indicator of difficulty at this point.
- s73v3r_ 8y ago
  That doesn't follow. It's easy to follow the law, but because a lot of companies were doing things that were against the law, and given that a lot of companies put things off til the last minute, it took a lot of work to come into compliance.
- deleted 8y ago
  [deleted]
tmikaeld 8y ago
What I've found to be "confusing" is that some GDPR consultants say that when a single person cannot be identified in a blob of data, then it's not personal data. While others say the opposite, any data derived from a single individual is still considered personal data.
- merb 8y ago
  well under the eu gdpr no data is called personal data if it is immpossible with the data to identify a person/company/person of law.
- DanBC 8y ago
  GDPR seems clear on this: it's personal data if a natural person can be identified from it using reasonable means.
  - JumpCrisscross 8y ago
    > it's personal data if a natural person can be identified from it using reasonable means I could fit a planet into that "reasonable means" caveat.
    - DanBC 8y ago
      That's a good thing. It means the regulator can't issue instant fines for non-compliance except in the very worst most obvious cases. Because of this planet sized gap they need to ask everyone else to come into compliance before issuing the fine.
      - JumpCrisscross 8y ago
        > It means the regulator can't issue instant fines for non-compliance The regulator interprets the gap. "Planet-sized gap" means the regulator can choose to be lenient or capricious based on their own preferences. That kind of uncertainty is anathema for modern businesses. (It's also beneficial to those who pay to build relationships with said regulators.)
AndrewStephens 8y ago
> What some companies find confusing is that the law has made their core business model illegal and no consent form can save them. Exactly this. Even the big reputable publishers (who wouldn't <em>dream</em> of breaking the law, oh no) accept money from companies directly targeted by the GDPR, who collect copious amounts of data on visitors across multiple sites. Do users on site A consent to company B collecting data through ads, even if they tick a box? Probably not. https://sheep.horse/2018/6/the_eu_general_data_protection_regulation_and_me_%28.html https://sheep.horse/2018/6/the_eu_general_data_protection_re...
existencebox 8y ago
I can't honestly agree. (re: ambiguity of interpretation, and cost being limited only to privacy-violating business models) Two reasons. 1. HN discussions themselves. Literally EVERY TIME this comes up, you see a massive back and forth from various crowds of GDPR; some of whom swear that it's perfectly comprehensible even as significant portions of the conversation are interpreting the same points in a variety of ways. (Are IPs PII? What exceptions can be allowed? What falls under "security requirement"? What forms of data are associated PII? What sort of deanonymization is sufficient? IS it sufficient? are some common questions I saw in the past, not even getting into the wonderful world of third party data processors.) This seems like enough pragmatic evidence that a (to give the benefit of the doubt) educated and professional community hasn't reached consensus, so to say there's a variety of interpretation seems very fair. 2. I implemented GDPR for a small corner of a notable BigCo. I do not consider myself an expert, but I certainly got my marching orders from experts, (The legal teams who interpreted the document and evaluated the implementation methods) and the sheer amount of horsepower put behind finding an interpretation we believed and were confident in was staggering. Granted this is something where we _really wanted to get it right_ but if it were really trivial to interpret I question if the process would have been as intensive as it was. (To preempt the inevitable; our (my team's) business model has _literally nothing_ to do with your data, but we had many of the same confusions/questions that I saw from companies who did, so I'd be hesitant to say that the burden isn't somewhat widespread.)
- JumpCrisscross 8y ago
  > The legal teams...and the sheer amount of horsepower put behind finding an interpretation we believed and were confident in was staggering You shouldn't be getting down voted. I just went through a GDPR compliance review. We have a service model which is incredibly serious about customer confidentiality. We don't sell ads and, to my recollection, have never even bought them. Still required an army of lawyers. Two top London law firms ended up agreeing to disagree on major points, ultimately concluding the Polish data regulator would probably rule one way and the French the other. Complying with the spirit of a law doesn't mean complying with the statue of it. With GDPR, it's the latter that's a pain in the ass.
sbov 8y ago
Cool. If it's so clear, then are you willing to be held liable if my company is found in violation of it due to your misreading? I'm guessing not. People who are willing to put their reputation on the line, who are paid four figures per hour to understand this stuff, disagree with eachother on interpretations of GDPR.
- JumpCrisscross 8y ago
  > be held liable if my company is found in violation Forget about violations. Even if you're in perfect compliance, any EU resident can complain to their data authorities if they think you're non-compliant. That then prompts a regulatory inquiry, which requires lawyers to competently respond to, which is distracting and expensive.
  - sureaboutthis 8y ago
    Hmm. Maybe we should violate this en masse and overload the system.
    - kybernetikos 8y ago
      That seems to be the approach that is being taken, albeit probably accidentally.
  - pierrebai 8y ago
    Which is different from other civil law in what ways? Anyone can sue you over any civil law. Then teh courts decides. GDPR is not magically different. This is a straw man. The flurry of activities is only driven by companies who keep data about their users. Of course "legitimate" will be defined by the courts. That's the price you have to pay now for all the abuses that have been going on for the past two or three decades. History has shown that to define "legitimate" the text of the law is to open the doors to avoidance. Sorry mate, we can't trust you to be honest. It's too late now.
    - JumpCrisscross 8y ago
tomnipotent 8y ago
No law is clear until it's been argued a few times in court and an army of legal professionals have duked it out. This is why - at least in the US - the branch of government that writes the law is separate from the one that interprets it.
- j16sdiz 8y ago
  (Unlike US) Most of EU use civil law system. Precedent are not binding in civil law system
MarkMc 8y ago
Heres what the UK ICO says: "The GDPR does not define what factors to take into account when deciding if your purpose is a legitimate interest. It could be as simple as it being legitimate to start up a new business activity, or to grow your business." [1] Isn't that a little vague? It seems to imply that if a business can show that collecting your personal information will grow their business, they do not need to provide a way for you to 'opt out'. [1] https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/what-is-the-legitimate-interests-basis/ https://ico.org.uk/for-organisations/guide-to-the-general-da...
- jiveturkey 8y ago
  Yes, it is a little bit vague. It's intentionally vague. The abuse of LI is designed to be like porn: I'll know it when I see it. It's totally fine for it to be vague. I very much doubt we'll see any cases where the general public disagrees with a DPA ruling of LI applicability. As a business owner, it means you need to strongly justify it and consider if a "reasonable person" would consider your use of LI to be justified. If you have doubt, you should seek consent instead. Do keep in mind, that growing your business by using PD for marketing purposes is explicitly excepted from LI.
  - kybernetikos 8y ago
    > If you have doubt, you should seek consent instead. Consent may not apply: > Consent is presumed not to be freely given if... the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.
Moru 8y ago
If you listen to the experts that are economically invested in the complexity of the law, you risk having more work.
- sfifs 8y ago
  If you don't and some regulator fancies making an example of you, then your shareholders will fire and sue you.
  - bmer 8y ago
    Yeah, especially since we live in countries where corruption is rampant, along with unjust enforcement of regulations that completely violate their spirit. /s
    - sfifs 8y ago
      Are you assuming only European companies do business in Europe? EU prosecutors have a history of going after American tech companies much like US has a history of going after foreign companies - especially Chinese and now European (eg. Volkswagen). This is not about a moral stance, just business risk management.
tzs 8y ago
> I found the law to be pretty clear and there are plenty of summarized versions out there. What some companies find confusing is that the law has made their core business model illegal and no consent form can save them. What about Article 27? It's unclear, and you don't have to have a shady business model in order to have no idea how you are supposed to deal with it. All it takes is that your business is not established in the Union. This is the article that requires companies who are not in the Union but are subject to GDPR due to Article 3(2) to appoint a representative in the Union. The representative serves as a contact point that regulators and persons can communicate with instead of the company on all GDPR matters concerning the company. The representative is also required to keep a bunch of metadata about the company's data processing, according t Article 30. According to the recital for this article, "The designated representative should be subject to enforcement proceedings in the event of non-compliance by the controller or processor". What does that mean? Some people claim it means that your representative in the Union will be liable for any fines you incur from EU regulators or any damages a plaintiff wins in a private lawsuit over GDPR if the regulator or plaintiff is not able to force you to pay up. Others think it just means that if regulators or plaintiffs serve notice on the representative, that legally counts as if you were served, meaning that if you do not show up at the hearing or trial and lose by default, you cannot try to weasel out by claiming you had no notice of the hearing or trial. In other words, these people think that the representative is very similar to the "registered agent" that many jurisdictions require foreign businesses to have in order to do business in that jurisdiction. Personally, I was leaning toward the latter, as the idea of making the representative liable seemed pretty absurd...but it has been pointed out that in earlier drafts of Article 27 and the recitals, it did in fact actually clearly do so. That language was taken out before the final draft, but was that change because they wanted to remove that aspect, or because they decided "subject to enforcement proceedings" already implied it and they were just tightening the language? This is important because if representatives are actually liable for fines and damages, it is going to be a lot more expensive to hire people to be representatives than it will be if all they have to do is be a contact point and a repository of metadata. For small businesses outside the Union this could be a major expense if they must have a representative, perhaps a big enough expense that it will be worthwhile to just stop doing business in the EU. So we must ask, "Who needs a representative?". The answer, it turns out, involves still more vagueness. Basically, you are excused from needing a representative if you meet three conditions. Two of them most small businesses easily meet as long as they are not doing high volumes of certain particularly sensitive data, and their processing does not result in a risk to "the rights and freedoms of natural persons" (more vagueness!). The third condition is that your processing "is occasional". What is "occasional"? No one seems to know.
shados 8y ago
There are so many ambiguities and confusing situations. Eg: legitimate business use and free accounts. What do you define as the free account user to still be a customer? What if you nuke their account after some inactivity and then they come back? They're going to be pissed. Server log retention, message queues, etc and ip addresses (which may or may not be problematic depending on how they're stored and with what). Not fun. Third party vendors. Omg third party vendors. Many of them have no idea wtf they're doing. Ive seen some vendors swear up and down they didn't store any PII, just to realize eventually that they did and they didn't even know. Hope those DPAs are signed and in order! Hope you have good lawyers! It's insanely hard for any non-trivial systems. It gets even worse when american laws and GDPR conflict (eg: finance data retention laws. The definition of legitimate business need gets REAAAAALY fuzzy...)
- Aengeuad 8y ago
  >There are so many ambiguities and confusing situations. Eg: legitimate business use and free accounts. What do you define as the free account user to still be a customer? What if you nuke their account after some inactivity and then they come back? They're going to be pissed. Processing of data is legitimate so long as you still have a reason to process that data, as well as if you have a contractual obligation with the subject to process that data. If that contract involves keeping an account registered indefinitely, until deletion is requested, then so be it. State it clearly and plainly when the user registers an account, and if you're that concerned about the ambiguity of the situation then the solution seems a simple one, no? Allow the user to choose to have their account deleted after a certain period of inactivity, or email users that their accounts will be deleted after lengthy periods of inactivity. It should be noted that 'inactivity' is industry specific, for something like free services online it could be industry standard to keep accounts for years, it's hard to imagine that a user would be upset about having an account they haven't used in 4 years be deleted, and really, do you need to keep that account after 1 year of inactivity? 3 Years? 5 Years? I realise the law is purposely ambiguous here especially when applied to things like user accounts, but it helps to understand that storage limitations and retention plans apply less to things like accounts and more to things like metadata that you may be collecting. It's perfectly reasonable to keep user accounts registered for years even after inactivity for example, it's less reasonable to collect data for marketing campaigns and keep that data for years. Retention limits are also far more relevant to processors of data rather than for controllers of data, if you're a third party service you shouldn't need to keep data for longer than your contract with the controller specifies, however controllers have far more of a legitimate need to process data for longer. The push to have retention limits may as well be seen as a push to anonymise data that no longer needs to be tied to an identified person rather than a need to delete everything that hasn't been touched in 90 days. >Server log retention, message queues, etc and ip addresses (which may or may not be problematic depending on how they're stored and with what). Not fun. IP addresses become problematic when you can tie them to an identified person, i.e., you're linking user accounts and IP addresses. As far as generic logs go, if the only personal information you're collecting is IP addresses then you shouldn't need to worry too much, treat the logs with some care as they still do contain personal information but don't sweat it too much. Make sure that if your logs are leaked that you inform users (i.e., through a blog post) that logs were leaked and the only personal information contained is IP addresses. IP addresses are one of the easiest things to justify needing to keep as a legitimate interest as well as needing keeping indefinitely, and if only IP addresses are leaked it's not really a big deal. If you have other personal information in your logs, especially if it's linked with more information, i.e., 'ip address 1.2.3.4 who has username asdf searched for jkl; [etc]', you should take steps to justify why you need to keep that extra information and maybe look at implementing a retention limit, or better yet, anonymise some of the extra data after you are finished processing it. If the metadata you're collecting is kept to a minimum and/or anonymised as much as possible, the need for a retention limit drops almost entirely, not that retention limits are entirely needed. >Third party vendors. Omg third party vendors. Many of them have no idea wtf they're doing. Ive seen some vendors swear up and down they didn't store any PII, just to realize eventually that they did and they didn't even know. Hope those DPAs are signed and in order! Hope you have good lawyers! In every other industry you are responsible for when you choose a shoddy third party vendor who makes a mistake, I fail to see why the tech industry should be any different. I realise there is going to be a lot of teething issues on this particular issue, but part of the reason GDPR has as much scope as it does is because of these clueless third party vendors who misuse and abuse data. Maybe look into using European third party vendors in the future, as they would be just as culpable for their mistakes as you would be and they would be liable for fines too. :-) >It's insanely hard for any non-trivial systems. It gets even worse when american laws and GDPR conflict (eg: finance data retention laws. The definition of legitimate business need gets REAAAAALY fuzzy...) For what it's worth, the GDPR makes explicit exemptions allowing for processing data where you have a legal obligation to do so. There is absolutely no conflict between financial laws and the GDPR in this respect.
red75prime 8y ago
Can I request to remove my face from a stored security camera footage? If not, why?
- synotna 8y ago
  Read about legitimate interest, it's only a few sentences
  - red75prime 8y ago
    The document is 88 pages long. There are 31 mentions of 'legitimate interests'. I'm still not sure that recording everyone who walks past your store 24/7 is legitimate interest.
- CaptainZapp 8y ago
  Security camera footage is overwritten and recycled on a regular basis. As a matter of fact: If you operate secutrity cameras in a public -, or semi public place you need a written procedure why something is captured, what is captured, how long it's kept, who can see the footage and under which conditions the footage is retained. "If not, why?" Because this is not a reasonable request if the footage is anyway deleted after, say, 72 hours.
- Aengeuad 8y ago
  You cannot, part of the reasoning will be that the footage may need to be used in court therefore the integrity of the information needs to be maintained, another reason will be that it would be incredibly impractical and a burden for businesses to erase the faces of everyone that requests it. You cannot request that a business deletes CCTV footage of you either, probably for similar reasons. You can request a copy or to view that footage though. In another comment you posted: >I'm still not sure that recording everyone who walks past your store 24/7 is legitimate interest. Stores and businesses need to display signs for when they are recording in the areas they're recording, inside a store it may be obvious that the store is recording, so a sign may only be needed on a door. Outside of a store you may need more prominent signs. If it's not obvious that the area area is being recorded then even more signs need to be posted still. The degree to which stores and businesses can record outside of their businesses will vary by country, but for the UK the ICO provides information for consumers [0], and businesses [1]. [0] https://ico.org.uk/your-data-matters/cctv/ https://ico.org.uk/your-data-matters/cctv/ [1] https://ico.org.uk/for-organisations/police-justice/ https://ico.org.uk/for-organisations/police-justice/
deleted 8y ago
[deleted]
downandout 8y ago
I found the law to be pretty clear If you think this, you've misinterpreted it. I don't think even the biggest GDPR advocates would claim that it is "pretty clear".

Sargos 8y ago

If everyone is breaking the law then no one is.

JeremyBanks 8y ago
I'm sympathetic to the dangerous of discretionary enforcement, but if you're making a dramatic change like this, it's pretty hard to avoid an awkward period while people get compliant or get shut down.
- dfxm12 8y ago
  Like the period between April 2016 and May 2018?
  - nopriorarrests 8y ago
    Without any real court cases showing how GDPR will be actually enforced, this 'introductory period' was useless. It could last 4 years instead of 2, and it would not make any difference.
    - erik_seaberg 8y ago
      There should have been a phase of mock suits. "Here's what you're doing that's against the new rules, and you have two years to knock it off or lawyer up."
- adrianratnapala 8y ago
  > ... dangerous of discretionary enforcement, but if you're making a dramatic change like this, it's pretty hard to avoid ... So what does that tell you about dramatic changes?
  - JeremyBanks 8y ago
    Nothing
8y ago

dmitrygr 8y ago

That was entirely the intent! If everyone is breaking the law, you can pick and choose whom to enforce against, for a variety of reasons, including political convenience, shakedowns, etc

frockington 8y ago
I believe it was largely a way to try and unify the EU to combat recent turmoil. By taking a stand against the evil American tech innovators, the EU can look to its populace and say they accomplished something that a single nation could not have
- oblio 8y ago
  Because God forbid that us Europeans would actually want a law like this, it’s just the Bruxelles bureaucrats that are pushing an anti-US agenda. I’m being ironic, a decent chunk of Europeans want this (I’d say a majority but I don’t have hard numbers).
  - rleigh 8y ago
    I've yet to hear any complaints from anyone I've been talking too; it's been universally regarded as a good thing. I'd have to agree, and I'm not a particular fan of the EU. It's never been portrayed as "anti-US", and it isn't. It's pro-privacy, and that's an entirely different thing. While I think certain US companies have aggressively persued certain business strategies which are very much anti-privacy, so have many companies around the world, and this legislation is long overdue pushback against some very dubious business practices many people are very, very uncomfortable with.
    - smileypete 8y ago
      Well I'd like to complain. It's not that there's no need for improvement, but EU rules often end up imposing poor implementations, consequently with no scope for better solutions.
- 8y ago

alkonaut 8y ago

Hopefully things will stabilize once a few big players with dark patterns are taken to court, establishing some precedents. For example, switches opting in by default or popups saying “by using the site you agree to x”.

merinowool 8y ago
Not every country in the EU has precedent based law, also what could be considered bad in one EU country not necessarily could be considered bad in another given how vague GDPR is.
- chronial 8y ago
  Precedents matter everywhere. In countries where precedents are not law, decisions from higher-level courts are still guiding the decisions of lower-level courts – so the effect is somewhat similar.
- curun1r 8y ago
  It's possible that the poster above isn't talking about legal precedents and instead talking about practical precedents. After spending about a month building a GDPR consent tool and now seeing many other "compliance" efforts on various sits around the web, it's become clear to me that most businesses are taking a wait-and-see approach. They're doing the minimum necessary to claim they tried to comply while changing absolutely nothing about the way they do business. They're waiting to see how serious enforcement of the law is before making changes that negatively impact their business. It's not about whether they'd lose in court or have a regulatory judgment against them, it's about the likelihood that non-compliance will get them in trouble. If EU regulators show a willingness to do the legwork to fine smaller companies, you'll start to see a lot of these site become much more compliant. But those companies are not going to spend all that time and money proactively only to see that the EU doesn't have the teeth to enforce the rules, so they need practical precedents of companies being hit with huge non-compliance fines to scare them into making the necessary changes.
jiveturkey 8y ago
Your example won't help at all. That type of thing would clearly be in violation (by letter of the regulation, no expert legal evaluation needed).

gist 8y ago

Was a big media workup (like y2k) leading up to it and now it has faded from memory. It's like everything else that is the issue of the day and then ceases to matter at least in any way as much as whatever you read seem to make it before hand 'sky is falling comply comply' so typical. After you have been through similar things you know the way this type of thing is overhyped (I mean by what will actually happen and who it will happen to way overblow ie 'shut down my shitty little website for fear' mode.)

NeoBasilisk 8y ago
The Y2K issue did actually require a significant amount of patching for some systems, and they absolutely would have failed if not for that patching. Complying with government regulation is not really in the same class of issues.
- ghaff 8y ago
  It seems that "Y2K was much ado about nothing" is becoming an increasingly popular school of thought. There was certainly lots of hype at the time. But a huge amount of money and time went into mitigating problems. I don't know if there would have been widespread power grid, etc. collapses or not if everyone had taken the attitude of "Eh, we'll fix things if they break" but I'm pretty convinced people would have been missing paychecks, bank account statements would be wrong, and that sort of thing at least.
- Moru 8y ago
  People keep saying "Look, the sky didn't fall, what was all the hubub about?!". A job well done!
- gist 8y ago
  > The Y2K issue did actually require a significant amount of patching I am referring mainly to the media hype and how it becomes the issue de jure and then ceases to matter. The media jumps on it and amplifies anyone who chimes or confirms the fear. Why? So they can run a 'if it bleeds it leads' type headline. While there could have been stories after the fact of problems for unpatched systems I don't remember any of those stories. And it is not because everyone patched their systems either. I mean there were posts online about GDPR where some small insignificant company just folded up for fear of what would happen as if the EU was really going to go after that type of target. Anyone who has been in business for a long time knows that is not what is ever done. To your point you are right because this isn't even (for US companies) a US regulation and if they have no customers in the EU then it is a stretch to be concerned about it (at least relative which is my point to the attention given to it by the media).

Theodores 8y ago

The whole thing was a shambles, there was no reference design that you could just implement for your ecommerce store/blog/software service or anything else that required it. Instead we had people running around like headless chickens rushing to put in place some extra tick-box on their website. The funny thing was how people sent out those emails to their newsletter subscribers and I do wonder how decimated those lists became. People got GDPR fatigue and could not be bothered with the emails after a while. This particularly affected smaller businesses who had legitimate reasons to email customers. Does anyone here have any anecdotal data on how badly some of these email lists were purged?

dingo_bat 8y ago
Irony is that I never got that email from Facebook and Google. Only small websites bothered to try and obtain an agreement.
throwawayqdhd 8y ago
As I mentioned in another thread, the biggest winners from this entire GDPR saga are Google and Facebook. Email is control. You get someone's email once, you get to control how often you contact them. You can send them hundreds of messages for next to no cost - as long as they don't hit 'unsubscribe' But if you can't rely on email, what do you turn to? Ads, of course! I get that there are some nasty actors that abuse your privacy. But as a consumer, I've never felt that spam was that big an issue to begin with, at least not big enough to warrant small businesses ceding control and having to rely on Google and Facebook to reach their audiences.
robryan 8y ago
As I understand it, people had to only gain consent for email lists if they had never gained consent previously.
DanBC 8y ago
> The funny thing was how people sent out those emails to their newsletter subscribers and I do wonder how decimated those lists became. People got GDPR fatigue and could not be bothered with the emails after a while. This particularly affected smaller businesses who had legitimate reasons to email customers. We've had data protection laws for 20 years. Those companies were already breaking the law if they didn't have permission to send email, and if they had a legitimate need to send email they don't need consent under GDPR.

evancox100 8y ago

Speaking of opting out... as a non-EU citizen, is there any way I can opt out of the EU's internet regulation? Like some flag my browser can send so I don't have to deal with the meaningless cookie/privacy popups?

wst_ 8y ago
For some reason people can't get into agreement to use one library that provides consistent way of dealing with this consent. Then you could just automatically close it with some extension, or not even load it at all.
andrewmackrodt 8y ago
I'm an EU citizen and I've hoped for something similar since the cookie "law". Maybe a callback that gets fired when the consent popup appears and then a browser extension could hook into that and automatically accept. Edit: replied to an out of date tab, another poster commented the same idea.
- navs 8y ago
  Maybe if there was a browser feature providing an API for marketing consent.

marcrosoft 8y ago

A lot of people are _not_ breaking their locals laws and "Confusion will continue to reign" because there is a disproportionate amount of people that think that EU laws apply to the entire world.

keithnz 8y ago
I'm curious about this aspect. If you run and operate a website outside of Europe, if a European then uses that site, you aren't breaking local laws. What does the GDPR mean for these people? The europeans will still believe you have broken their laws and try to use whatever international agreements they have to go after you? Or if you enter europe they will hold you to account? Google / Facebook have operations in Europe, so I can understand why they are concerned, but what does it mean if you don't operate in Europe but have Europeans using your site?
- mgkimsal 8y ago
  > but what does it mean if you don't operate in Europe but have Europeans using your site? My limited understanding is that generally, it doesn't mean much. However, if you are actively targeting/marketing to Europeans, then you might fall afoul of this, but probably won't be affected legally without hitting some sort of moderate commercial size.
- chii 8y ago
  If your site is intended for Europeans, then you need to comply. It's not clear what test is used to determine this. My guess is, if you include translations, or region drop-down in a signup form, or is selling goods/services that only apply to Europe, then you'd have to comply.
- jonhendry18 8y ago
  And what counts as "operations in Europe"? Would a magazine's Paris correspondent count?
AmericanChopper 8y ago
>there is a disproportionate amount of people that think that EU laws apply to the entire world I think one of the problems is that too many of those people are MEPs.

williesleg 8y ago

That's part of the strategy. Then they'll just go after some of them and fine them lots of cash. Or at least hold them hostage in lieu of fining them.

eulers__number 8y ago

Any kind of regulation will harm small businesses and create monopolies of large companies who have teams of lawyers to del with this kind of situation

programmarchy 8y ago
Counterexample: Anti-trust regulation

megous 8y ago

I'm quite happay, my phone number and addresses slowly disappeared from the google/bing/duckduckgo/... searchable internet over the past month. Often times without my involvement. Searches for my real name now vs prior to GDPR enforcement are like day/night. Prior, it was all topped by aggressive (SEO wise) companies who clone public registries and republish them en-masse without adding any value whatsoever. They just use this as a trick to drive people searching for various people's names to their online magazines and whatever. They basically parasite on other people's names to prop up their revenue at those people's expense. Now the searches are actually starting to return relevant things near the top, like my past OSS contributions, etc. For me, this side of GDPR compliance is working fine, and almost all comapnies are pretty good at responding to requests. That is a law working pretty well from the side of the data subject.

baxtr 8y ago
> Now the searches are actually starting to return relevant things near the top How were the prior top search results not relevant before? Either google and others are lousy or relevance means something different to you than most other people when searching for your name.
- inetknght 8y ago
  What's relevant to someone can change over time, even at different parts of the day. I know of no search engine which has always shown what I'm trying to find.
- megous 8y ago
  Top 10 or so results just contained the same info repeated over and over on different websites. Half of the time outdated (old addresses, etc.). Yes, google is lousy sometimes. It was the result of name squatting, as I described earlier.

mgkimsal 8y ago

I was onsite at a client's retail location and got chatting to a customer. They learned I was in IT and said "I hope you're all set for GDPR!" and I said "it doesn't affect us". "Oh yes it does! There's a lot of people living in this area (in the US) who are European citizens - this affects you right here!" I tried to argue back politely that it didn't affect us, and she started getting a bit... agitated, and the voice started to raise a bit. I tried to de-escalate - other customers in the store would have started paying attention once the raised voice went on. But... man on man... my comeback question I was ready to put back - then stopped short - was "Do you think a 20 person brick and mortar in the middle of Spain is required to abide by US laws? They're not, even when serving customers who happen to be US citizens." I would have hoped it would have made it clear, but... stopped short of getting in to a shouting match with my client's customers. :)

cletus 8y ago
I hate to be the one to break it to you but just being in another country and being small doesn't automatically exempt you from other countries' laws. Some examples: - Australia has laws that about child sex tourism aimed at those that go to Asian countries with lax laws or enforcement. These crimes are committed in other countries [1] - Foreign financial institutions are subject to FATCA when serving US customers, an issue that has made it difficult for US expats to even open bank accounts in some jurisdictions [2] - Australia has some pretty strict insider trading laws such that two foreigners who trade in inside information about an ASX listed company while they're on foreign soil (may) have commited a crime in Australia - Sanctions on the likes of Iran and North Korea prevent US companies or persons from trading with entities from sanctioned states even if such transactions take place entirely on foreign soil. - US citizens living in other countries are required to file taxes with the IRS even though during the tax year the citizen may never have stepped foot on US soil and any income is earned and paid entirely in foreign jurisdictions. So I'm not saying GDPR applies or doesn't. I honestly don't know. I'm just saying not being in Europe and being small aren't the automatic defenses you seem to think they are. [1]: http://www.thejakartapost.com/news/2017/12/13/australia-introduces-tough-new-laws-on-child-sex-tourism.html http://www.thejakartapost.com/news/2017/12/13/australia-intr... [2]: https://en.wikipedia.org/wiki/Foreign_Account_Tax_Compliance_Act https://en.wikipedia.org/wiki/Foreign_Account_Tax_Compliance...

ghosterrific 8y ago

GDPR is totalitarian control in disguise. Allow me to make the case... Thr beautiful thing about the internet before was about not having to ask for permission to create, to connect and to run a business. We now have to ask the government inspectors for permission, we have the threat of being hauled off to court or prison for "not keeping good records" in the name of 'safeguarding people's privacy" And this from a government thst is doing wholesome, Orwellian style wire tapping of Everything. Notice how the government is EXCEMPT from having to fulfill GDPR requirements? Why does this law apply to private individuals and businesses, but completely exempts countries and the EU itself from complying? If you trade a bit of security for freedom, you will get neither. The government tske over of the internet is almost complete, in the name of 'safety' anf 'privacy'. Since when did the government give a fuck about our right to: - not be spied on incessantly - not be stolen from at gunpoint via oppressive taxation - not be harassed by corrupt politicians ask for more "donations" If they so care about protecting us from evil, then why do they not make these laws apply to the state as well? We know from history that the greatest abuses of personal information is at the hands of the state.... rounding up dissendents from the dossiers they have built up. There is nothing wrong with Facebook or any company selling your data, when they said they would, in the contract you signed in exchange for a free product. Who is the government to tell me that I cannot give my personal information to a comoany in exchange for a product? The government takes my info and I'm fine with that... they do far more nefarious things eith my info than any private company can: - steal money via corrupt tax code - confiscate my property - confiscate my children - threaten violence and prison time The private corporation does none of this. It is the state that is the biggest abuser of personal information and they are conveniently exempt. Mark my words. There will be more laws written cuz "muh privacy protections" Watch.

kisstheblade 8y ago

Isn't the intent of the law quite easy to understand? Do not track/store anything by default. And your site works perfectly and without questions. If you then have a legitimate need for some data, without which your site doesnät work (eg. gps location data for a map), then you ask for it. And if you need to use ads, then have some opt in button somewhere deep in the settings where the user can go and click "please track me aggressively" if he so chooses.

smileypete 8y ago

I'd like to see some sort of browser request header that can set or deny permissions on a global basis, dealt with by an options page in the web browser. Then sites only need to serve up the annoying dialogs if they need a permission you haven't set, otherwise clearing cookies periodically means being plagued by the dreaded things. >;-(

JaceLightning 8y ago
I feel like this is against the spirit of the law.

duxup 8y ago

I feel like I'll have a way better idea of what is up once we see actual enforcement.

jillesvangurp 8y ago

Gdpr is very straightforward to comply with. Yes there are fines but you pretty much only get them at the end of an escalation process with plenty of opportunity to fix things. If your business was breaking the pre gdpr laws by doing things that were dodgy already, then, yes, this is now more likely to happen. That's a good thing. As for legislation and jurisdiction, doing business internationally has always been complicated. Many big corporations have legal entities across the world and funneling revenue via the eu is a popular way to dodge taxes in the us. If you do business with such companies, that makes gdpr relevant for you even if you have no direct eu ties as these companies may be forced to reconsider their relationship with you otherwise. Think anything involving ad based revenue, e-commerce, and other sectors involving non trivial revenue from the EU. Anyway, read the law text. It's surprisingly easy to find and digest and it puts all the idiots interpreting each other's interpretations a bit in perspective. Good summaries are available.

techsin101 8y ago

I feel US companies should have protection against badly implemented laws from forgein governments. Regardless of treaties. I'd love to see someone quantify loss of innovation, added cost of operation, and total delays cost by GDPR to companies he re

Thiez 8y ago
What would this protection look like, in your ideal world? How would it work?

Paianni 8y ago

Everytime I see the GDPR acronym I immediately think 'German Democratic Peoples Republic' and I can't think straight about it.