8 ms·

I tend to put GDPR and this Copyright bill in different camps. The copyright bill is insane. GDPR is... also a bit insane, but the hard parts shine light on wha

I tend to put GDPR and this Copyright bill in different camps. The copyright bill is insane. GDPR is... also a bit insane, but the hard parts shine light on what we probably should have been doing which are now hard to do because we've spent so long ignoring the ethical elephant in the room. GDPR is very far from perfect, but I think it's still directionally good. The copyright bill is just bad.

Scaevolus 8y ago
At least GDPR is intended to help actual people, instead of increasing media-holders' stranglehold over their content.
- raverbashing 8y ago
  This In a way, GDPR goes in the way of common sense, despite the legalese and FUD Copyright filter is censorship.
- kodablah 8y ago
  Why does it matter what it is intended to do?
  - AsyncAwait 8y ago
    Because intent matters?
    - kodablah 8y ago
      But why? People are affected by the practical application. Even if you argue that intent matters once it reaches a court or regulator, that is long past the effect.
      - AsyncAwait 8y ago
        Because when a law is pushed by corporations, aimed at individuals, you're not likely to have much recourse, as an individual targeted by such a law. The hammer is going to drop on you and that's that. A law such as the GDPR, which is targeted at corporations primarily, is worded in such a way that no company is going to get massive fines if they seriously tried to comply, but for whatever reason failed to do so. They're going to get a dozen written warnings, guidance on complying etc. before they have to pay anything. Small businesses don't even need a data protection officer. Why this discrepancy between laws targeting individuals vs corporations? Because corporations control the flow of capital, control a large part of our politicians, can blackmail with outsourcing etc. None of this power is usually available to an individual.
        kodablah 8y ago
        Ah, you're saying it matters during design. Sure. I am talking about after passed, the intent matters very little. Too often on the GDPR and other legislation in effect, the intent is used to judge effectiveness which is invalid. When a law on the books is not working right, what it was trying to do is not an argument in favor of it working right.
        AsyncAwait 8y ago
        > I am talking about after passed, the intent matters very little. The intent matters precisely because of how the law is going to be enforced when passed.
        kodablah 8y ago
        But since its enforcement can be completely contrary to the intent, intent only matters to the enforcers if they want it to matter. The actual enforcement, whether intended or not, is what really matters.
        AsyncAwait 8y ago
        > But since its enforcement can be completely contrary to the intent, intent only matters to the enforcers if they want it to matter. Right, and my argument is that with legislation intended to serve the people, (GDPR), enforcement is likely to be much closer in line with the intent than say Article 13, which is the other way around, (serving corporations, not people). Enforcers are newer as aggressive when protecting individuals as they are when protecting corporate interests. Apart from corruption, this is simply because of the leverage corporations have that individuals lack, (control of the flow of capital).
Loic 8y ago
GDPR is very good in fact. If you read through it as a person, it is basically the way we should have operated from the start. Reading it while wearing the hat of my role in my company, I can see all the points where we are collecting data without a well defined process and clear understanding from the end users. It is hard to fix this, but it is for my own good as a person.
- tokyodude 8y ago
  Can you explain to me how the deletion policies work? If you ask for your data to be deleted does that include your address in my contacts? Does it include your messages to me? Does it include your posts that appeared on my feed? In the physical world all of those would be mine. Addresses: It would be my paper address book with your address written in it. Email: would paper letters you sent to me that I keep in my files. Your posts in my feed would be postcards I received from you keep in a scrapbook or shoebox. It's not clear to me how those are handled by the GDPR and at what point things sent digitally from you to me end being my property and no longer your property.
  - bryanrasmussen 8y ago
    The things sent digitally from me to you end being my property and end up being your property immediately as long as the sending is not part of some business arrangement, but if it is some business arrangement that business is regulated, and when it becomes your property if ever can be dependent on many different factors of your business.
  - willeh 8y ago
    > Can you explain to me how the deletion policies work? Disclaimer: The GDPR hasn't been the law of the land for a year, so there is little precedent. It is fairly simple, the GDPR requires that companies that control identifying information about you (or somehow delegate this), have acceptable reasons for doing so (user consent/other law/etc). When some entity controls your information the GDPR gives you certain rights. The key point here is that the company is controlling your information not you, whereas the scrapbook is under your control. The loss of control of the information creates in my mind a moral obligation to treat it a certain way. One of the rights that the GDPR confers on the data-subject is the having data deleted, this right is not absolute and if you have any other grounds (e.g. AML regulation) for keeping the data then you don't have to delete it. Additionally, deletion doesn't have to be immediately consistent, so you won't have to go into old backups and delete the data there. TL;DR: If someone asks you to remove something, just delete it from your SQL database, and that's it. There are two key costs for startups implementing the GDPR: 1. Privacy by Design - Make some efforts to design the information systems in your company in a way that promotes privacy. 2. Demonstrating compliance - This tasks scales with company size, you might start out with a boilerplate privacy policy, but as you grow want to be more diligent.
kodablah 8y ago
> I tend to put GDPR and this Copyright bill in different camps [...] GDPR is very far from perfect, but I think it's still directionally good Depends on the context. I tend to see how one begets the other. GDPR is good by intent, but is bad by implementation. The copyright bill is bad by both intent and presumably implementation. And since it turns out that only implementation matters, many would agree that we'd be better off without both and recognize that solutions to the problems the GDPR attempts to (heavy-handedly yet ambiguously) fix can have more measured steps towards remedies.
- koffiezet 8y ago
  > GDPR is good by intent, but is bad by implementation. What is so bad about the implementation? Genuinely asking, I went through making a few companies compliant - and companies that were treating their data and security responsibly, had only little or even no issues at all to get their things in order. One of the great things about the GDPR is that it clearly defines WHO is responsible if something goes wrong. The generic mindset seems to be that accidents and incidents happen, but as long as you did reasonable effort to prevent this from happening, there's little to fear.
  - kodablah 8y ago
    > What is so bad about the implementation? Several things, but I'll be brief. Basically the same problems its predecessor had: lack of enforcement, inconsistent enforcers across countries, subjective enforcement, attempts at global internet governance, and not providing substantial benefit compared to the costs. They took those implementation failures and instead of scaling back and doing a measured approach to understand what went wrong, they exacerbated it by adding more burdens on businesses and increasing scope chilling many businesses into spending money out of fear of compliance or regionalizing their online presences. All of that with hardly any practical effects makes it a clear net negative, and couple that with the fuck-with-the-global-internet mandate they were given and we've ushered in a scary internet big brother, cheering the whole way. All to prevent tracking and data sharing. Compare the harms, compare the results, compare the costs, and it becomes clear that while we all want the implementation to achieve its goals, in practice it is more bad than good. You should be wary of using your personal business anecdotes to justify impositions on the rest of businesses. The "I can't see any problem means there aren't any problems" is not an inclusive mindset.

Scaevolus 8y ago

At least GDPR is intended to help actual people, instead of increasing media-holders' stranglehold over their content.

raverbashing 8y ago
This In a way, GDPR goes in the way of common sense, despite the legalese and FUD Copyright filter is censorship.
kodablah 8y ago
Why does it matter what it is intended to do?
- AsyncAwait 8y ago
  Because intent matters?
  - kodablah 8y ago
    But why? People are affected by the practical application. Even if you argue that intent matters once it reaches a court or regulator, that is long past the effect.
    - AsyncAwait 8y ago
      Because when a law is pushed by corporations, aimed at individuals, you're not likely to have much recourse, as an individual targeted by such a law. The hammer is going to drop on you and that's that. A law such as the GDPR, which is targeted at corporations primarily, is worded in such a way that no company is going to get massive fines if they seriously tried to comply, but for whatever reason failed to do so. They're going to get a dozen written warnings, guidance on complying etc. before they have to pay anything. Small businesses don't even need a data protection officer. Why this discrepancy between laws targeting individuals vs corporations? Because corporations control the flow of capital, control a large part of our politicians, can blackmail with outsourcing etc. None of this power is usually available to an individual.
      - kodablah 8y ago
        Ah, you're saying it matters during design. Sure. I am talking about after passed, the intent matters very little. Too often on the GDPR and other legislation in effect, the intent is used to judge effectiveness which is invalid. When a law on the books is not working right, what it was trying to do is not an argument in favor of it working right.
        AsyncAwait 8y ago
        > I am talking about after passed, the intent matters very little. The intent matters precisely because of how the law is going to be enforced when passed.
        kodablah 8y ago
        But since its enforcement can be completely contrary to the intent, intent only matters to the enforcers if they want it to matter. The actual enforcement, whether intended or not, is what really matters.
        AsyncAwait 8y ago
        > But since its enforcement can be completely contrary to the intent, intent only matters to the enforcers if they want it to matter. Right, and my argument is that with legislation intended to serve the people, (GDPR), enforcement is likely to be much closer in line with the intent than say Article 13, which is the other way around, (serving corporations, not people). Enforcers are newer as aggressive when protecting individuals as they are when protecting corporate interests. Apart from corruption, this is simply because of the leverage corporations have that individuals lack, (control of the flow of capital).

Loic 8y ago

GDPR is very good in fact. If you read through it as a person, it is basically the way we should have operated from the start. Reading it while wearing the hat of my role in my company, I can see all the points where we are collecting data without a well defined process and clear understanding from the end users. It is hard to fix this, but it is for my own good as a person.

tokyodude 8y ago
Can you explain to me how the deletion policies work? If you ask for your data to be deleted does that include your address in my contacts? Does it include your messages to me? Does it include your posts that appeared on my feed? In the physical world all of those would be mine. Addresses: It would be my paper address book with your address written in it. Email: would paper letters you sent to me that I keep in my files. Your posts in my feed would be postcards I received from you keep in a scrapbook or shoebox. It's not clear to me how those are handled by the GDPR and at what point things sent digitally from you to me end being my property and no longer your property.
- bryanrasmussen 8y ago
  The things sent digitally from me to you end being my property and end up being your property immediately as long as the sending is not part of some business arrangement, but if it is some business arrangement that business is regulated, and when it becomes your property if ever can be dependent on many different factors of your business.
- willeh 8y ago
  > Can you explain to me how the deletion policies work? Disclaimer: The GDPR hasn't been the law of the land for a year, so there is little precedent. It is fairly simple, the GDPR requires that companies that control identifying information about you (or somehow delegate this), have acceptable reasons for doing so (user consent/other law/etc). When some entity controls your information the GDPR gives you certain rights. The key point here is that the company is controlling your information not you, whereas the scrapbook is under your control. The loss of control of the information creates in my mind a moral obligation to treat it a certain way. One of the rights that the GDPR confers on the data-subject is the having data deleted, this right is not absolute and if you have any other grounds (e.g. AML regulation) for keeping the data then you don't have to delete it. Additionally, deletion doesn't have to be immediately consistent, so you won't have to go into old backups and delete the data there. TL;DR: If someone asks you to remove something, just delete it from your SQL database, and that's it. There are two key costs for startups implementing the GDPR: 1. Privacy by Design - Make some efforts to design the information systems in your company in a way that promotes privacy. 2. Demonstrating compliance - This tasks scales with company size, you might start out with a boilerplate privacy policy, but as you grow want to be more diligent.

kodablah 8y ago

> I tend to put GDPR and this Copyright bill in different camps [...] GDPR is very far from perfect, but I think it's still directionally good Depends on the context. I tend to see how one begets the other. GDPR is good by intent, but is bad by implementation. The copyright bill is bad by both intent and presumably implementation. And since it turns out that only implementation matters, many would agree that we'd be better off without both and recognize that solutions to the problems the GDPR attempts to (heavy-handedly yet ambiguously) fix can have more measured steps towards remedies.

koffiezet 8y ago
> GDPR is good by intent, but is bad by implementation. What is so bad about the implementation? Genuinely asking, I went through making a few companies compliant - and companies that were treating their data and security responsibly, had only little or even no issues at all to get their things in order. One of the great things about the GDPR is that it clearly defines WHO is responsible if something goes wrong. The generic mindset seems to be that accidents and incidents happen, but as long as you did reasonable effort to prevent this from happening, there's little to fear.
- kodablah 8y ago
  > What is so bad about the implementation? Several things, but I'll be brief. Basically the same problems its predecessor had: lack of enforcement, inconsistent enforcers across countries, subjective enforcement, attempts at global internet governance, and not providing substantial benefit compared to the costs. They took those implementation failures and instead of scaling back and doing a measured approach to understand what went wrong, they exacerbated it by adding more burdens on businesses and increasing scope chilling many businesses into spending money out of fear of compliance or regionalizing their online presences. All of that with hardly any practical effects makes it a clear net negative, and couple that with the fuck-with-the-global-internet mandate they were given and we've ushered in a scary internet big brother, cheering the whole way. All to prevent tracking and data sharing. Compare the harms, compare the results, compare the costs, and it becomes clear that while we all want the implementation to achieve its goals, in practice it is more bad than good. You should be wary of using your personal business anecdotes to justify impositions on the rest of businesses. The "I can't see any problem means there aren't any problems" is not an inclusive mindset.