7 ms·

I don't think I had understood the why behind Google's GDPR fine prior to this. It's also illustrative of the challenges of running a worldwide business with G

by twunde 8y ago

I don't think I had understood the why behind Google's GDPR fine prior to this. It's also illustrative of the challenges of running a worldwide business with GDPR. Google knew it had a target on its back, is organized and spent a lot of time becoming GDPR compliant and STILL screwed up in a significant way.

icebraining 8y ago
I disagree. It only displays the challenges when you're trying to comply with the letter of the law while doing everything you can to evade its purpose. Stuff like pre-selected consent boxes are not just mistakes or misunderstandings.
- saulrh 8y ago
  The only guaranteed way to avoid regulatory attention is to shut down everything and stop operations. There is fundamentally no decision you can make other than "comply with the law while continuing to operate as effectively as possible". Even more unfortunately, bureaucracies, including every modern corporation and government, are UnFriendly AIs. You must comply with the letter of the law because not a single agent involved, not the regulators writing the law nor the courts that will interpret the law nor your competitors that will bring complaints against you nor even the users of the products involved, knows or cares what the spirit is. They don't have the correct value systems, experiences, philosophical frameworks, or cognitive architectures to execute the "comprehend human values" step that would be required to interpret the "spirit" of the law. That incapability is why an even minimally functional justice system needs things like checks and balances and case law and jurisprudence and rules of evidence and all of those things. But we do need those things, because history has proven universally that the letter of the law is the only thing that matters. On the one hand, this means we literally can't trust any organization composed of more than approximately two people. You often can't even trust organizations with one person, simply because bureaucracy is a force-multiplier even for single humans; think about things like bug trackers and source-control systems and apply them to other workflows. On the other hand, this means that it's pretty much worthless to try to do anything about any individual corporation. Up to the point where you entirely obliterate their industry you're stuck. Which is, coincidentally, what an antitrust action really is - antitrust actions happen exactly when a single agent has taken over an entire industry, and making sure that that an identical bad actor doesn't reappear requires not just breaking it up but also obliterating its industry and introducing a new one with similar features but substantially different (non-agglutinative) dynamics. Standard disclaimers: Views don't represent employer, etc.
ocdtrekkie 8y ago
To be clear, this isn't even necessarily about "how Google violated GDPR". This is "why the case didn't go through a country favorable to Google". Aka, Google would've still likely been violating GDPR if they had a proper DPO in Ireland, but given how favorable Ireland is to the international companies it harbors the EU legal entities for, it's possible Google would've more successfully evaded punishment, had they been set up to ensure the case got handled in Ireland, rather than France.
- kasey_junk 8y ago
  Frankly, jurisdiction shopping was one of the big questions surrounding GDPR. You can be sure that legal teams are using this ruling to shore up their own documentation to make sure a random DPA can't bring case against them. Always better to be engaged with an enforcement agency in a country that collects revenue from you.
  - ocdtrekkie 8y ago
    The biggest problem with this is that the enforcement agency in the country that collects revenue from you has extremely more incentive to side with you, and not the consumer bringing a complaint against you. It can be a huge challenge to prevent a situation like the Eastern District of Texas and patent lawsuits, and that sort of situation can harm both sides.
    - fmajid 8y ago
      That's why there is a Court of Justice of the European Union.
  - Mirioron 8y ago
    The problem with being engaged with these enforcement agencies is that this is probably a significant amount of "bloat." Google would need to engage with all 28 EU governments on this issue. They didn't even allow a bunch of Eastern European countries to sell apps in their play store until a few years ago because they were that's insignificant.
ggggtez 8y ago
IMO, it seemed that the purpose of GDPR was to create a legal arrangement to tax/fine Google (and other big US tech companies). The fine was going to happen one way or another, the question was just how big it would be in the end. For some context on why: consider those "cookie" notices you see on every site now. The notices are often obtrusive, usually don't have a "no" button, don't make it clear how to withdraw your consent if you do click "yes"... So if every company is in violation, and no one knows how to do it correctly even with millions of reasons why... Then how exactly is it going to protect user privacy in the real world?
- jacquesm 8y ago
  If that is what you got from the available materials and the track record of the EU DPAs to date then you should probably do some more reading. EU companies have as much or more stake in being compliant than the few US tech giants active on EU soil. I see the impact of the GDPR on EU based companies every week and it is definitely moving the needle towards more secure operations and a much better attitude towards stewardship of data-subject related data.
  - Mirioron 8y ago
    But there are few major EU tech companies in the first place. These kinds of rules are going to hurt foreign companies because they're the major players in the market. I'm European and I barely use anything made by European tech companies in terms of final products. I'm sure there are some networking chips or similar in some of the devices I use, but the major software and hardware I use is made and designed outside of the EU. Now I would argue that the reason we don't have many major tech companies in the EU is because of a hostile environment for them here. I really can't think of many other reasons. The EU has more people than the US that are about as educated. There's at least a comparable amount of capital around, our internet connectivity is actually better, but we have very few major tech companies, even fewer ones that focus on internet stuff. Why is this important? Because if eventually we want to build automation to do other jobs then we need a lot if qualified tech workers.
    - 8y ago

by twunde 8y ago

icebraining 8y ago

I disagree. It only displays the challenges when you're trying to comply with the letter of the law while doing everything you can to evade its purpose. Stuff like pre-selected consent boxes are not just mistakes or misunderstandings.

saulrh 8y ago
The only guaranteed way to avoid regulatory attention is to shut down everything and stop operations. There is fundamentally no decision you can make other than "comply with the law while continuing to operate as effectively as possible". Even more unfortunately, bureaucracies, including every modern corporation and government, are UnFriendly AIs. You must comply with the letter of the law because not a single agent involved, not the regulators writing the law nor the courts that will interpret the law nor your competitors that will bring complaints against you nor even the users of the products involved, knows or cares what the spirit is. They don't have the correct value systems, experiences, philosophical frameworks, or cognitive architectures to execute the "comprehend human values" step that would be required to interpret the "spirit" of the law. That incapability is why an even minimally functional justice system needs things like checks and balances and case law and jurisprudence and rules of evidence and all of those things. But we do need those things, because history has proven universally that the letter of the law is the only thing that matters. On the one hand, this means we literally can't trust any organization composed of more than approximately two people. You often can't even trust organizations with one person, simply because bureaucracy is a force-multiplier even for single humans; think about things like bug trackers and source-control systems and apply them to other workflows. On the other hand, this means that it's pretty much worthless to try to do anything about any individual corporation. Up to the point where you entirely obliterate their industry you're stuck. Which is, coincidentally, what an antitrust action really is - antitrust actions happen exactly when a single agent has taken over an entire industry, and making sure that that an identical bad actor doesn't reappear requires not just breaking it up but also obliterating its industry and introducing a new one with similar features but substantially different (non-agglutinative) dynamics. Standard disclaimers: Views don't represent employer, etc.

ocdtrekkie 8y ago

To be clear, this isn't even necessarily about "how Google violated GDPR". This is "why the case didn't go through a country favorable to Google". Aka, Google would've still likely been violating GDPR if they had a proper DPO in Ireland, but given how favorable Ireland is to the international companies it harbors the EU legal entities for, it's possible Google would've more successfully evaded punishment, had they been set up to ensure the case got handled in Ireland, rather than France.

kasey_junk 8y ago
Frankly, jurisdiction shopping was one of the big questions surrounding GDPR. You can be sure that legal teams are using this ruling to shore up their own documentation to make sure a random DPA can't bring case against them. Always better to be engaged with an enforcement agency in a country that collects revenue from you.
- ocdtrekkie 8y ago
  The biggest problem with this is that the enforcement agency in the country that collects revenue from you has extremely more incentive to side with you, and not the consumer bringing a complaint against you. It can be a huge challenge to prevent a situation like the Eastern District of Texas and patent lawsuits, and that sort of situation can harm both sides.
  - fmajid 8y ago
    That's why there is a Court of Justice of the European Union.
- Mirioron 8y ago
  The problem with being engaged with these enforcement agencies is that this is probably a significant amount of "bloat." Google would need to engage with all 28 EU governments on this issue. They didn't even allow a bunch of Eastern European countries to sell apps in their play store until a few years ago because they were that's insignificant.

ggggtez 8y ago

IMO, it seemed that the purpose of GDPR was to create a legal arrangement to tax/fine Google (and other big US tech companies). The fine was going to happen one way or another, the question was just how big it would be in the end. For some context on why: consider those "cookie" notices you see on every site now. The notices are often obtrusive, usually don't have a "no" button, don't make it clear how to withdraw your consent if you do click "yes"... So if every company is in violation, and no one knows how to do it correctly even with millions of reasons why... Then how exactly is it going to protect user privacy in the real world?

jacquesm 8y ago
If that is what you got from the available materials and the track record of the EU DPAs to date then you should probably do some more reading. EU companies have as much or more stake in being compliant than the few US tech giants active on EU soil. I see the impact of the GDPR on EU based companies every week and it is definitely moving the needle towards more secure operations and a much better attitude towards stewardship of data-subject related data.
- Mirioron 8y ago
  But there are few major EU tech companies in the first place. These kinds of rules are going to hurt foreign companies because they're the major players in the market. I'm European and I barely use anything made by European tech companies in terms of final products. I'm sure there are some networking chips or similar in some of the devices I use, but the major software and hardware I use is made and designed outside of the EU. Now I would argue that the reason we don't have many major tech companies in the EU is because of a hostile environment for them here. I really can't think of many other reasons. The EU has more people than the US that are about as educated. There's at least a comparable amount of capital around, our internet connectivity is actually better, but we have very few major tech companies, even fewer ones that focus on internet stuff. Why is this important? Because if eventually we want to build automation to do other jobs then we need a lot if qualified tech workers.
  - 8y ago