13 ms·

This is particularly concerning given that GDPR specifically requires member states, in enforcing GDPR, allow exceptions for journalism and documents/data "in t

This is particularly concerning given that GDPR specifically requires member states, in enforcing GDPR, allow exceptions for journalism and documents/data "in the public interest." Considering the funds at the center of these Facebook posts went missing from EU coffers its clear the information falls squarely within both exemptions. At least it's a civil case. The fines for non-compliance with the request will surely add up quickly but I suspect this will make its way through the court system and reach a just conclusion.

JumpCrisscross 8y ago
> its clear the information falls squarely within both exemptions This is the problem with GDPR. Each member state decides what's clear and what's not. It may be appealable. But that's expensive, time- and attention-consuming and risky. We need strong privacy regulation. One downside to a fragmented complain-investigate-fine regulatory structure (as opposed to strict liability or complain-mediate-investigate structures) is that these things happen, and when they happen they do so decisively.
- pennaMan 8y ago
  All the regulation in the world won't do any good against a highly corrupt government like the one Romania is sadly facing at the moment.
  - JumpCrisscross 8y ago
    > All the regulation in the world won't do any good against a highly corrupt government It doesn't help to add arrows to their quiver. GDPR is a good law when a government can be trusted. It throws petrol on the fire in over-reaching states.
    - torstenvl 8y ago
      A state that has something like the GDPR is, by that very fact, overreaching.
      - overkalix 8y ago
        "It's OK though, government X will only use GDPR for good and they will go easy on small companies and individuals infringing it". Literally the argument you would eventually see at the end of threads about GDPR. I don't know how many times I've said this, but it amazes me that people can feel so identified and represented by nation-state politics that they are so willing to trust their government.
        vertex-four 8y ago
        I don't trust the companies that the GDPR is targeting either - who are more involved in my life on a day-to-day basis and can have as much or more effect on it, short of literally putting me in a cell. Information is power, and it's generally private companies wielding it. We exist in a society where companies and Government and the people all continually back each other up in oppressing people. Fact of the matter is, that the GDPR is a pile of shit (it's basically an argument that only the Government should be allowed to amass and weaponise information, where I'd argue that nobody should be allowed to), but so is the mass centralisation of information in the hands of large, powerful entities that it's intended to target. And one would be entirely unnecessary and unwarranted without the other.
        simias 8y ago
        I don't feel "identified and represented by nation-state politics", whatever that means. But I do trust my democratically elected government to some extent. At least, I trust it more that the companies GDPR is supposed to protect me from. And you're building a strawman with GDPR supporters, I don't think anybody said that nobody would ever try to abuse it. The GDPR has explicit provisions protecting journalists. It remains to be seen how this particular case pans out and if they truly manage to get the journalists to expose their source (or get heavily fined). If the Romanian authorities really manages to get this through and the rest of the Eurogroup doesn't react then yeah, that's quite worrying. Also note that it's not like without the GDPR those journalists would be able to work peacefully anyway: >Dragnea invoked the European data protection legislation last year when he threatened RISE Project with a lawsuit after journalists published stories on his connections to Tel Drum SA executives and other Romanian business people indicted for corruption and fraud. >The president of the PSD never sued but soon after these threats were made, the Romanian Anti-Fraud Authority (ANAF) raided RISE Project’s offices, saying they suspected the organization of fraud. The investigation carried out by ANAF never uncovered any such fraud. >RISE Project discovered that the initial complaint ANAF used to target RISE was a forgery filed by a non-existent person, with a non-existent physical address who falsely claimed that she worked as an accountant at the media house. Due process is not really the keyword here from what I understand from this article. Something tells me that if it wasn't about the GDPR it would be something else.
    - AJ007 8y ago
      What government can be trusted?
      - ben_w 8y ago
        One which is effectively regulated. Separate police, courts, lawmakers, executive, etc., where they are incentivised to prevent corruption.
        TomMarius 8y ago
        Could you name such government? I don't know about any single government in the world that isn't corrupt, only ones that are less corrupt than other ones, and that is not nearly enough.
    - Asooka 8y ago
      From my perspective, living in one of those highly corrupt governments, it's better to be in the EU and subject to the occasional malicious application of an otherwise well-meant law, that does benefit actual legitimate governments, than to be out of the EU and under Russian control with completely unchecked corruption. The hope is that over time, the mafia will grow into a form that steals money in the usual manner of western societies, skimming a bit off the top (e.g. tax fraud, etc.) and otherwise leaving a normally functioning society, rather than just taking everything and telling us to eat shit.
    - int_19h 8y ago
      The problem, of course, is that the country can have a trusted government today, and one that is very much not trusted tomorrow. Historical examples are many.
  - TomMckenny 8y ago
    It's the fashion to twist laws to cover unconscionable behavior it seems. I'm only surprised Orban or Morawiecki didn't think of it first. But it's no surprise when the press is called "the enemy of the people"
- deleted 8y ago
  [deleted]
- Angostura 8y ago
  > This is the problem with GDPR. Each member state decides what's clear and what's not. That's no so much a problem with GDPR as nation states.
  - reitanqild 8y ago
    Nation states has problems. But I can't think of a better alternative: - one world government? All the problems of nation states and then some. Plus nowhere to seek refuge. It's not like a government more powerful than all todays governments would magically become less corrupted. - no government? Has it's own problems as well. What we have today is a mess but IMO it's the price we have to pay to avoid the worst dictatorship imaginable on this earth or going back to the dark ages.
  - TangoTrotFox 8y ago
    The alternative is centralization of government which changes nothing except ensures that once corrupted its scale would affect what, at scale, could even be the entire world. It also gives bad actors a single target to focus all their energy (and influence) on. In my opinion the solution is to go in the opposite direction. I think the 'closer' to the people, both figuratively and literally, a government is, the more they tend to be held accountable. Romania's revolution against Ceausescu was a very clear, and quite literal, illustration of this. As an aside, "nation state" is not a fancy way of saying country. It has a specific meaning denoting a mostly ethnically homogeneous nation. E.g. Belgium is most certainly not a nation state.
    - azernik 8y ago
      Not necessarily ethnically homogeneous; just one that explicitly endorses the ethnic nationalism of the dominant group. For example, Slovakia, Israel, and Lithuania all have substantial ethnic minorities (respectively Hungarian, Arab, and Russian) with varying degrees of protection for minority groups, yet are very much nation-states.
  - BurningFrog 8y ago
    > That's no so much a problem with GDPR as nation states. Out of GDPR and nation states, only one can be abolished.
- M2Ys4U 8y ago
  >This is the problem with GDPR. Each member state decides what's clear and what's not. That was a big problem with the Data Protection Directive (which the GDPR replaced). But now the European Data Protection Board[0] (basically, the supervisory authorities from the member states and EEA member states, plus the European Data Protection Supervisor) can make sure that each supervisory authority is - approximately - following the same standards. Each case gets filed in a common system by the lead authority investigating it and cases gets discussed between the Board members. [0] https://edpb.europa.eu/ https://edpb.europa.eu/
Thiez 8y ago
I wonder which part of the GDPR they are using to demand sources. I have read the thing a couple of months ago and as I recall the thing is mostly about not sharing personal information without consent, does anyone else recall parts that grant governments new rights to demand the disclosure of personal information?
- treewhistle 8y ago
  You can read an English translation of the demand letter here: https://www.occrp.org/en/16-other/other-articles/8876-english-translation-of-the-letter-from-the-romanian-data-protection-authority-to-rise-project https://www.occrp.org/en/16-other/other-articles/8876-englis...
  - e12e 8y ago
    Thanks for that. Some of those points are actually reasonable, and a journalist should be comfortably within rights to respond that sources need to be kept secret, and comment why/how/why not subjects were alerted to the publication (perhaps given a chance to comment). Hopefully this'll go to court and set a precedent that more in line with the spirit of the gdpr.
    - krastanov 8y ago
      I am not quite certain how much a precedent matters here. Of the western world we have the US, UK, and Canada that employ common law where precedent really matters. In most of the EU the system of civil law is used, where the judiciary is expected to be much more literal and to not perform much interpretation or reference to previous interpretations.
      - jacobush 8y ago
        Aaaand then we have the Scandinavian systems which are somehow both.
      - jkaplowitz 8y ago
        Civil law has a concept similar to the common law world's respect for prior judicial rulings, but weaker. It's called jurisprudence constante (a French phrase). The impact of a single ruling on future rulings is not huge, but a series of rulings all in accord will be treated as strongly persuasive. It's still secondary to the statute and not 100% binding, but nevertheless it is a real part of the system. Also, both the US and Canada have a civil law jurisdiction: Louisiana and Quebec, respectively. Both do make some use of common law as well, but private law (governing relations between non-state parties) is even now predominantly civil law in both places. If the original actors in this case were non-state parties, I expect that civil law would be applicable to a hypothetical Quebec version of this dispute. In Louisiana, same thing if the relevant law was at the state level rather than federal. (In Quebec, even federal laws are interpreted using civil law principles when covering private law topics.)
tzs 8y ago
> This is particularly concerning given that GDPR specifically requires member states, in enforcing GDPR, allow exceptions for journalism and documents/data "in the public interest." That may not apply, because of the clever (evil too, but also clever) way they are doing this. If they were asking as data subjects where the data came from (which data subjects have a right to under Article 15 1(g)), then journalism and public interest exceptions should apply. But that's not what they are doing. They aren't coming in as data subjects asking about the data held on them. They are coming in as an Article 51 supervisory authority in charge monitoring GDPR in their country. They are claiming to be doing the tasks Article 57 assigns to the supervisory authority, and exercising the powers Article 58 gives them for that. Presumably, someone who the journalists wrote about alleged that the journalists were not complying with GDPR in how they obtained and used the data. And so now the supervisory authority is investigating that. Article 58 gives them power "to obtain, from the controller and the processor, access to all personal data and to all information necessary for the performance of its tasks". They can probably argue that in order to decide if a journalism or public interest exception applies, they have to know where the data came from and how it was obtained. Assuming things are as corrupt as people have claimed, I'd expect they will go in, and if they obtain the information on the sources, they will rule that a journalism or public interest exception applies, and dismiss whatever sham GDPR complaint they had someone file to set this off.
- hyperpape 8y ago
  Your post makes it sound as if, no matter how corrupt this is, their demand is within the letter of the law. If so, that is a pretty nasty unintended consequence.
  - ccnafr 8y ago
    That's exactly what he's saying.
  - celticninja 8y ago
    Usual thing with these laws, within the letter of the law but not within the spirit of it.

JumpCrisscross 8y ago

> its clear the information falls squarely within both exemptions This is the problem with GDPR. Each member state decides what's clear and what's not. It may be appealable. But that's expensive, time- and attention-consuming and risky. We need strong privacy regulation. One downside to a fragmented complain-investigate-fine regulatory structure (as opposed to strict liability or complain-mediate-investigate structures) is that these things happen, and when they happen they do so decisively.

pennaMan 8y ago
All the regulation in the world won't do any good against a highly corrupt government like the one Romania is sadly facing at the moment.
- JumpCrisscross 8y ago
  > All the regulation in the world won't do any good against a highly corrupt government It doesn't help to add arrows to their quiver. GDPR is a good law when a government can be trusted. It throws petrol on the fire in over-reaching states.
  - torstenvl 8y ago
    A state that has something like the GDPR is, by that very fact, overreaching.
    - overkalix 8y ago
      "It's OK though, government X will only use GDPR for good and they will go easy on small companies and individuals infringing it". Literally the argument you would eventually see at the end of threads about GDPR. I don't know how many times I've said this, but it amazes me that people can feel so identified and represented by nation-state politics that they are so willing to trust their government.
      - vertex-four 8y ago
        I don't trust the companies that the GDPR is targeting either - who are more involved in my life on a day-to-day basis and can have as much or more effect on it, short of literally putting me in a cell. Information is power, and it's generally private companies wielding it. We exist in a society where companies and Government and the people all continually back each other up in oppressing people. Fact of the matter is, that the GDPR is a pile of shit (it's basically an argument that only the Government should be allowed to amass and weaponise information, where I'd argue that nobody should be allowed to), but so is the mass centralisation of information in the hands of large, powerful entities that it's intended to target. And one would be entirely unnecessary and unwarranted without the other.
      - simias 8y ago
        I don't feel "identified and represented by nation-state politics", whatever that means. But I do trust my democratically elected government to some extent. At least, I trust it more that the companies GDPR is supposed to protect me from. And you're building a strawman with GDPR supporters, I don't think anybody said that nobody would ever try to abuse it. The GDPR has explicit provisions protecting journalists. It remains to be seen how this particular case pans out and if they truly manage to get the journalists to expose their source (or get heavily fined). If the Romanian authorities really manages to get this through and the rest of the Eurogroup doesn't react then yeah, that's quite worrying. Also note that it's not like without the GDPR those journalists would be able to work peacefully anyway: >Dragnea invoked the European data protection legislation last year when he threatened RISE Project with a lawsuit after journalists published stories on his connections to Tel Drum SA executives and other Romanian business people indicted for corruption and fraud. >The president of the PSD never sued but soon after these threats were made, the Romanian Anti-Fraud Authority (ANAF) raided RISE Project’s offices, saying they suspected the organization of fraud. The investigation carried out by ANAF never uncovered any such fraud. >RISE Project discovered that the initial complaint ANAF used to target RISE was a forgery filed by a non-existent person, with a non-existent physical address who falsely claimed that she worked as an accountant at the media house. Due process is not really the keyword here from what I understand from this article. Something tells me that if it wasn't about the GDPR it would be something else.
  - AJ007 8y ago
    What government can be trusted?
    - ben_w 8y ago
      One which is effectively regulated. Separate police, courts, lawmakers, executive, etc., where they are incentivised to prevent corruption.
      - TomMarius 8y ago
        Could you name such government? I don't know about any single government in the world that isn't corrupt, only ones that are less corrupt than other ones, and that is not nearly enough.
  - Asooka 8y ago
    From my perspective, living in one of those highly corrupt governments, it's better to be in the EU and subject to the occasional malicious application of an otherwise well-meant law, that does benefit actual legitimate governments, than to be out of the EU and under Russian control with completely unchecked corruption. The hope is that over time, the mafia will grow into a form that steals money in the usual manner of western societies, skimming a bit off the top (e.g. tax fraud, etc.) and otherwise leaving a normally functioning society, rather than just taking everything and telling us to eat shit.
  - int_19h 8y ago
    The problem, of course, is that the country can have a trusted government today, and one that is very much not trusted tomorrow. Historical examples are many.
- TomMckenny 8y ago
  It's the fashion to twist laws to cover unconscionable behavior it seems. I'm only surprised Orban or Morawiecki didn't think of it first. But it's no surprise when the press is called "the enemy of the people"
deleted 8y ago
[deleted]
Angostura 8y ago
> This is the problem with GDPR. Each member state decides what's clear and what's not. That's no so much a problem with GDPR as nation states.
- reitanqild 8y ago
  Nation states has problems. But I can't think of a better alternative: - one world government? All the problems of nation states and then some. Plus nowhere to seek refuge. It's not like a government more powerful than all todays governments would magically become less corrupted. - no government? Has it's own problems as well. What we have today is a mess but IMO it's the price we have to pay to avoid the worst dictatorship imaginable on this earth or going back to the dark ages.
- TangoTrotFox 8y ago
  The alternative is centralization of government which changes nothing except ensures that once corrupted its scale would affect what, at scale, could even be the entire world. It also gives bad actors a single target to focus all their energy (and influence) on. In my opinion the solution is to go in the opposite direction. I think the 'closer' to the people, both figuratively and literally, a government is, the more they tend to be held accountable. Romania's revolution against Ceausescu was a very clear, and quite literal, illustration of this. As an aside, "nation state" is not a fancy way of saying country. It has a specific meaning denoting a mostly ethnically homogeneous nation. E.g. Belgium is most certainly not a nation state.
  - azernik 8y ago
    Not necessarily ethnically homogeneous; just one that explicitly endorses the ethnic nationalism of the dominant group. For example, Slovakia, Israel, and Lithuania all have substantial ethnic minorities (respectively Hungarian, Arab, and Russian) with varying degrees of protection for minority groups, yet are very much nation-states.
- BurningFrog 8y ago
  > That's no so much a problem with GDPR as nation states. Out of GDPR and nation states, only one can be abolished.
M2Ys4U 8y ago
>This is the problem with GDPR. Each member state decides what's clear and what's not. That was a big problem with the Data Protection Directive (which the GDPR replaced). But now the European Data Protection Board[0] (basically, the supervisory authorities from the member states and EEA member states, plus the European Data Protection Supervisor) can make sure that each supervisory authority is - approximately - following the same standards. Each case gets filed in a common system by the lead authority investigating it and cases gets discussed between the Board members. [0] https://edpb.europa.eu/ https://edpb.europa.eu/

Thiez 8y ago

I wonder which part of the GDPR they are using to demand sources. I have read the thing a couple of months ago and as I recall the thing is mostly about not sharing personal information without consent, does anyone else recall parts that grant governments new rights to demand the disclosure of personal information?

treewhistle 8y ago
You can read an English translation of the demand letter here: https://www.occrp.org/en/16-other/other-articles/8876-english-translation-of-the-letter-from-the-romanian-data-protection-authority-to-rise-project https://www.occrp.org/en/16-other/other-articles/8876-englis...
- e12e 8y ago
  Thanks for that. Some of those points are actually reasonable, and a journalist should be comfortably within rights to respond that sources need to be kept secret, and comment why/how/why not subjects were alerted to the publication (perhaps given a chance to comment). Hopefully this'll go to court and set a precedent that more in line with the spirit of the gdpr.
  - krastanov 8y ago
    I am not quite certain how much a precedent matters here. Of the western world we have the US, UK, and Canada that employ common law where precedent really matters. In most of the EU the system of civil law is used, where the judiciary is expected to be much more literal and to not perform much interpretation or reference to previous interpretations.
    - jacobush 8y ago
      Aaaand then we have the Scandinavian systems which are somehow both.
    - jkaplowitz 8y ago
      Civil law has a concept similar to the common law world's respect for prior judicial rulings, but weaker. It's called jurisprudence constante (a French phrase). The impact of a single ruling on future rulings is not huge, but a series of rulings all in accord will be treated as strongly persuasive. It's still secondary to the statute and not 100% binding, but nevertheless it is a real part of the system. Also, both the US and Canada have a civil law jurisdiction: Louisiana and Quebec, respectively. Both do make some use of common law as well, but private law (governing relations between non-state parties) is even now predominantly civil law in both places. If the original actors in this case were non-state parties, I expect that civil law would be applicable to a hypothetical Quebec version of this dispute. In Louisiana, same thing if the relevant law was at the state level rather than federal. (In Quebec, even federal laws are interpreted using civil law principles when covering private law topics.)

tzs 8y ago

> This is particularly concerning given that GDPR specifically requires member states, in enforcing GDPR, allow exceptions for journalism and documents/data "in the public interest." That may not apply, because of the clever (evil too, but also clever) way they are doing this. If they were asking as data subjects where the data came from (which data subjects have a right to under Article 15 1(g)), then journalism and public interest exceptions should apply. But that's not what they are doing. They aren't coming in as data subjects asking about the data held on them. They are coming in as an Article 51 supervisory authority in charge monitoring GDPR in their country. They are claiming to be doing the tasks Article 57 assigns to the supervisory authority, and exercising the powers Article 58 gives them for that. Presumably, someone who the journalists wrote about alleged that the journalists were not complying with GDPR in how they obtained and used the data. And so now the supervisory authority is investigating that. Article 58 gives them power "to obtain, from the controller and the processor, access to all personal data and to all information necessary for the performance of its tasks". They can probably argue that in order to decide if a journalism or public interest exception applies, they have to know where the data came from and how it was obtained. Assuming things are as corrupt as people have claimed, I'd expect they will go in, and if they obtain the information on the sources, they will rule that a journalism or public interest exception applies, and dismiss whatever sham GDPR complaint they had someone file to set this off.

hyperpape 8y ago
Your post makes it sound as if, no matter how corrupt this is, their demand is within the letter of the law. If so, that is a pretty nasty unintended consequence.
- ccnafr 8y ago
  That's exactly what he's saying.
- celticninja 8y ago
  Usual thing with these laws, within the letter of the law but not within the spirit of it.