3 ms·

I think calling GDPR over-regulation is extremely suspect. The GDPR does a good job in codifying basic privacy principles of what you can do with personal data.

by DCKing 8y ago

I think calling GDPR over-regulation is extremely suspect. The GDPR does a good job in codifying basic privacy principles of what you can do with personal data. Clear communication, consent, control over your own data and data protection principles. Things that should be self-evident but we have been failing with forever, and something that has become an extremely widespread widespread in an online society. The only reason to call it over regulation is if you're spoiled about not being regulated beforehand - but there was a clear need for such a law and codifying reasonable privacy principles. I don't understand why I hear so few Americans about wanting this in their own country. Article 13 is fundamentally different from the GDPR. The fundamental problem is that I think (and most people hopefully do) user privacy is an ethical good, and I don't believe (much of) copyright law is an ethical good. If you fundamentally believe copyright must be defended vigilantly Article 13 is not an unreasonable consequence at all - I just don't agree with that premise one bit. Websites that don't want to comply with GDPR, I say good riddance. If you really feel you cannot uphold the basic privacy principles posited, then screw you too. But for Article 13, the laws are only in the interest of big corporations. I don't care about those.

sambe 8y ago
There is a cost to businesses in complying with and implementing regulations, regardless of the size of the business and how good or bad their behaviour has been with respect to the intention of those regulations. You can't deny over-regulation by assuming only the badly-behaving people are burdened by it. Besides, there is also a cost to me: the never-ending pop-ups and acceptance dialogues, inability to access information in a straightforward manner for those that choose to block, etc. What is the percentage of users who actively control their privacy as a result of GDPR (and still happily use the website)? What is the percentage of badly -behaving businesses who will be prosecuted?
- Dylan16807 8y ago
  If a business can't afford basic privacy processes then it deserves to fail. The law doesn't ask for any popups, blocking is a dumb option that not many take, and for prosecutions we'll have to wait a bit longer before we see.
- DCKing 8y ago
  Every regulation is a trade-off. > There is a cost to businesses in complying with and implementing regulations, regardless of the size of the business and how good or bad their behaviour has been with respect to the intention of those regulations. You can't deny over-regulation by assuming only the badly-behaving people are burdened by it. Indeed - the lack of this cost of business was causing (1) reckless and (2) (deeply) unethical behaviour to become rampant [0]. I think it was fair to say it was not acceptable anymore, and I think the GDPR does a good job of formalizing rules of basic common sense about personal data protection. There's really nothing in the GDPR that I can point to that is overbearing, although of course many businesses do implement unnecessarily overbearing UX on top of it. Processing personal data should be a risk to business, and I think some basic rule of law was warranted for this risk to be clear to business. I'm not saying there is no cost to regulation. But the cost needs to be proportional to the good it achieves and I think the GDPR does that quite well. Article 13 - in my opinion - clearly will not. [0]: E.g. in unregulated countries: https://news.ycombinator.com/item?id=17081684 https://news.ycombinator.com/item?id=17081684
- TheCoelacanth 8y ago
  You can avoid the burden of GDPR entirely if you simply don't collect user data, and you can avoid most of it if you only collect data that you actually need.
kodablah 8y ago
> I think calling GDPR over-regulation is extremely suspect. I don't. I find it an egregious example of over-regulation. I think not recognizing the obviously large scope of such regulation is extremely suspect. > The GDPR does a good job in codifying basic privacy principles of what you can do with personal data By what measure do you define "good job"? > The only reason to call it over regulation is if you're spoiled about not being regulated beforehand I admit being this kind of spoiled. But it's ridiculous to say that's the only reason. There are measured ways to go about things and to so blatantly say that this is the only reason one might view it as over-regulation (despite real reasons such as size and scope and ineffectiveness of predecessors/enforcement) destroys our ability to have real conversations about the many alternative ways to solve some of the problems we have. Such a black-and-white absolutist view is harmful. > I don't understand why I hear so few Americans about wanting this in their own country. Can't speak for all, but for many, it's because they recognize the difference between what would be ideal and what would actually happen. Large anti-company (especially against companies that users prefer to use) laws have a chance to be frowned upon, despite ridiculous promises/optimism/naivete by the hopeful. > Websites that don't want to comply with GDPR, I say good riddance. If you really feel you cannot uphold the basic privacy principles posited, then screw you too. These are not how chilling effects work. You don't get to say "well, if they choose not to do business where a law is, they must not be able to uphold that law". There are compliance costs/risks. The amount of assumptions concerning this topic, whether assumptions that the law is good or assumptions that those disagreeing with it are of a certain ilk, need to stop. You only hurt your cause discussing things in this manner.
- DCKing 8y ago
  I'd like to point out that you're responding to me as if you assume I have no to little experience with this law and its consequences for organizations. That's not a reasonable assumption - my post is speaking from organizational experience. You're not talking to some outsider of all of this. If you have specific problems with GDPR or that it goes too far, I'd like to know what those specific aspects are. In my view, there's some basic rules on how to deal with personal data that the GDPR codifies, and it does that surprisingly (for the EU) reasonably. It starts from simple principles of citizen rights and ethical behaviour and writes a complete rulebook on how to apply them - that's my definition of a good job. It might be difficult for business to adapt to actually now considering processing personal data a risk. But that by itself does not make GDPR "overregulation" - that just makes it a difficult regulation change to process. I won't shed a tear about business having a difficult time going through that process - I'm incredibly happy that they are forced to consider processing personal data a risk, because it is. Also note I specifically said "Websites that don't want to comply with GDPR" - not "Companies that are not sure they can comply with GDPR yet". There's a reasonable difference, I agree. But, yes, if you find that your business intrinsically cannot comply with GDPR or you don't want to - it's time to take a good hard look in the mirror.

by DCKing 8y ago

sambe 8y ago

There is a cost to businesses in complying with and implementing regulations, regardless of the size of the business and how good or bad their behaviour has been with respect to the intention of those regulations. You can't deny over-regulation by assuming only the badly-behaving people are burdened by it. Besides, there is also a cost to me: the never-ending pop-ups and acceptance dialogues, inability to access information in a straightforward manner for those that choose to block, etc. What is the percentage of users who actively control their privacy as a result of GDPR (and still happily use the website)? What is the percentage of badly -behaving businesses who will be prosecuted?

Dylan16807 8y ago
If a business can't afford basic privacy processes then it deserves to fail. The law doesn't ask for any popups, blocking is a dumb option that not many take, and for prosecutions we'll have to wait a bit longer before we see.
DCKing 8y ago
Every regulation is a trade-off. > There is a cost to businesses in complying with and implementing regulations, regardless of the size of the business and how good or bad their behaviour has been with respect to the intention of those regulations. You can't deny over-regulation by assuming only the badly-behaving people are burdened by it. Indeed - the lack of this cost of business was causing (1) reckless and (2) (deeply) unethical behaviour to become rampant [0]. I think it was fair to say it was not acceptable anymore, and I think the GDPR does a good job of formalizing rules of basic common sense about personal data protection. There's really nothing in the GDPR that I can point to that is overbearing, although of course many businesses do implement unnecessarily overbearing UX on top of it. Processing personal data should be a risk to business, and I think some basic rule of law was warranted for this risk to be clear to business. I'm not saying there is no cost to regulation. But the cost needs to be proportional to the good it achieves and I think the GDPR does that quite well. Article 13 - in my opinion - clearly will not. [0]: E.g. in unregulated countries: https://news.ycombinator.com/item?id=17081684 https://news.ycombinator.com/item?id=17081684
TheCoelacanth 8y ago
You can avoid the burden of GDPR entirely if you simply don't collect user data, and you can avoid most of it if you only collect data that you actually need.

kodablah 8y ago

> I think calling GDPR over-regulation is extremely suspect. I don't. I find it an egregious example of over-regulation. I think not recognizing the obviously large scope of such regulation is extremely suspect. > The GDPR does a good job in codifying basic privacy principles of what you can do with personal data By what measure do you define "good job"? > The only reason to call it over regulation is if you're spoiled about not being regulated beforehand I admit being this kind of spoiled. But it's ridiculous to say that's the only reason. There are measured ways to go about things and to so blatantly say that this is the only reason one might view it as over-regulation (despite real reasons such as size and scope and ineffectiveness of predecessors/enforcement) destroys our ability to have real conversations about the many alternative ways to solve some of the problems we have. Such a black-and-white absolutist view is harmful. > I don't understand why I hear so few Americans about wanting this in their own country. Can't speak for all, but for many, it's because they recognize the difference between what would be ideal and what would actually happen. Large anti-company (especially against companies that users prefer to use) laws have a chance to be frowned upon, despite ridiculous promises/optimism/naivete by the hopeful. > Websites that don't want to comply with GDPR, I say good riddance. If you really feel you cannot uphold the basic privacy principles posited, then screw you too. These are not how chilling effects work. You don't get to say "well, if they choose not to do business where a law is, they must not be able to uphold that law". There are compliance costs/risks. The amount of assumptions concerning this topic, whether assumptions that the law is good or assumptions that those disagreeing with it are of a certain ilk, need to stop. You only hurt your cause discussing things in this manner.

DCKing 8y ago
I'd like to point out that you're responding to me as if you assume I have no to little experience with this law and its consequences for organizations. That's not a reasonable assumption - my post is speaking from organizational experience. You're not talking to some outsider of all of this. If you have specific problems with GDPR or that it goes too far, I'd like to know what those specific aspects are. In my view, there's some basic rules on how to deal with personal data that the GDPR codifies, and it does that surprisingly (for the EU) reasonably. It starts from simple principles of citizen rights and ethical behaviour and writes a complete rulebook on how to apply them - that's my definition of a good job. It might be difficult for business to adapt to actually now considering processing personal data a risk. But that by itself does not make GDPR "overregulation" - that just makes it a difficult regulation change to process. I won't shed a tear about business having a difficult time going through that process - I'm incredibly happy that they are forced to consider processing personal data a risk, because it is. Also note I specifically said "Websites that don't want to comply with GDPR" - not "Companies that are not sure they can comply with GDPR yet". There's a reasonable difference, I agree. But, yes, if you find that your business intrinsically cannot comply with GDPR or you don't want to - it's time to take a good hard look in the mirror.