12 ms·
I think they should read their own rules and hit themselves with a fine of 10 million or 2% whichever is greater and distribute it among those who were effected
by marcrosoft 8y ago
I think they should read their own rules and hit themselves with a fine of 10 million or 2% whichever is greater and distribute it among those who were effected.
Edit: or at least consider that their rules are ridiculous.
- zavi 8y agoIs it possible to sue them for this?
- a1a 8y agoThink there is a need for a clarification. It says _member states_ of EU have trackers on their websites. Not EU itself.
- hopler 8y agoSo? EU laws are a suite of national laws.
- ionised 8y agoWhat the hell are you talking about?
- UncleEntity 8y agoDepends on if you think fonts.googleapis.com and fonts.gstatic.com cookies are "trackers on their websites" both of which are found on http://europa.eu/rapid/press-release_STAT-19-1728_en.htm http://europa.eu/rapid/press-release_STAT-19-1728_en.htm Though I did have to do a bit of clicking around until Privacy Badger found something so it looks like they at least are trying.
- solarkraft 8y agoIt's certainly handing data to google, which isn't great for integrity. But we're complaining at a high standard.
- killjoywashere 8y agoSeriously. What would be more interesting would finding some low standard things worth complaining about. Like potable tap water in <pick your city>.
- tener 8y ago2% of what...? GDP :) ?
- marcrosoft 8y agoHeck yeah :) Of course, this is ridiculous so what I'm really suggesting is that they look at their laws and reconsider how crazy they are.
- Voloskaya 8y agoYou thinking GDPR is crazy doesn't make it objectively crazy.
- marcrosoft 8y agoI do think GDPR regulation is absolutely bat shit crazy. Edit: even though I'm sure they have the best of intentions.
- cinquemb 8y agoFunny, I'm think the opposite. I think GDPR regulation makes sense as front for a cash grab from multinational corporations, seeing as even they cant be bothered to not use said multinational corporations non-GDPR compliant tools. I find this all hilarious.
- marcrosoft 8y agoYou're totally right. I think the EU wants to grab a piece of the silicon valley pie since there are very few large tech companies willing to put up with the high European regulation and setup thier home base there. They get their "share" through fines and regulation.
- colejohnson66 8y agoOr... or... it’s about privacy
- lucb1e 8y agosigh Right, that's why the Dutch authority sent out letters a few weeks ago to some of the biggest offenders in the Netherlands, telling them their practices were not allowed. I don't know if law works differently in the USA, but just based on how panicked American sites seemed to be on May 25th 2018 versus European sites, it sure seems like it. Yes, the law has teeth, but no, they're not out to kill small businesses or even bother big ones if there is no appearance of malintent. Facebook is an example they seem to just fine, but a big Dutch media company (RTL) having a cookie wall that quite clearly explains what you are consenting to by clicking "continue" but doesn't strictly fall within the correct opt-in mechanism? They send a warning for that, not a fine. Yes, it's rather embarrassing that even the government itself doesn't follow the law. But then screaming the 2019 equivalent of "get your pitchforks!" shows how misunderstood the GDPR is. It's supposed to help, not collect extra money.
- Mirioron 8y agoThat's because when American companies break the law in the US they get punished. When they break the law in the EU they get punished. When European companies break the law in the US, they get punished, but when they break the law in the EU they get a slap on the wrist. Just look at Volkswagen and diesel gate. >It's supposed to help, not collect extra money. It's supposed to give more leverage over foreign companies to EU countries, because we have somehow managed to create an environment that's very hostile to building tech companies.
- mschuetz 8y agoThat's the maximum possible. You'll have to act in bad faith and ignore warnings to ever get handed the maximum fine.
- downandout 8y agoPlease point to the specific part of the GDPR where this is codified. (Just FYI, it is not there. Indeed they can impose the maximum fines for a first offense, and are fully incentivized to do so).
- cyphar 8y agoCourts have discretion when deciding on penalties. This is the case for the vast majority of laws you can think of. You might argue that not having a "first-offender" concept is unfair, but that stops courts from being able to punish really egregious first offenses. It might also incentivise companies to try to work around the repeat-offender rules so they can continue to violate GDPR without any serious penalty. > Indeed they can impose the maximum fines for a first offense, and are fully incentivized to do so And yet they didn't when they first fined Google[1], where the fine was 50 million euros -- which was only 1% of the maximum fine they could've imposed. It's almost as if the maximum penalty is the upper ceiling and not the default. [1]: https://www.itnews.com.au/news/google-cops-50m-gdpr-fine-518298 https://www.itnews.com.au/news/google-cops-50m-gdpr-fine-518...
- smu 8y agoOn phone, so can’t type much. Please have a look at article 83: list of conditions to consider when determining the corrective measures (fines or other measures). Also: there’s a guidance document for authorities here: https://ec.europa.eu/newsroom/just/document.cfm?doc_id=47889 https://ec.europa.eu/newsroom/just/document.cfm?doc_id=47889 EU law does not work with exact codified procedures, which I understand is more common in US. So indeed, you will find guidance but not exact procedure (though it seems to be clear enough to me) EDIT: article 83 instead of 82
- vsl 8y ago
- Sir_Substance 8y agoI'd wager they have read their own rules. The GDPR is riddled with language to the effect of "lol but not EU governments OBVIOUSLY GUYS COME ON". I think GDPR is a great law, but if there's one critique of it'd I'd level without hesitation, god damn is it hypocritical.
- mtarnovan 8y agoExamples? I read parts of the GDPR, especially those covering exceptions and everything I read seemed reasonable.
- Sir_Substance 8y agoSure, examples: === Article 6.1.e "in the exercise of official authority vested in the controller;" - Wide open door. Article 9.2.d - exception to prohibition on racial profiling for political parties on their own membership. Article 9.2.g "processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued" - The "anything we declare acceptable" biometrics exception. Article 9.2.h - The "no opting out of online medical records" clause. Article 17.3.b "or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller" - The "if we say it's in the public interest not to delete it then we don't have to delete it" clause. Article 23.1 - The laundry list of cases where any EU government can throw out all rights the GDPR establishes. Includes the following: "other important objectives of general public interest of the Union or of a Member State" as if that's not a goalpost a mile wide. Article 49.1.d - Allows transfers of data to countries with inadequate data protections to take place if they are declared to be "in the public interest". === Pretty much everything in the GDPR document is untested at this point, and whether government or corporation, quite a lot of cases are going to have to be argued before the courts. However, this document leaves open many arguments for governments that are not open for others. There is no definition for what might be "in the public interest" in GDPR, nor are there guidelines for interpreting when someone is "exercising official authority". One could argue that police departments are doing that 24/7 and thus large chunks of GDPR don't apply to them at all because processing is always lawful as a result. By leaving themselves so many fruitful avenues of arguments to present to courts that have not been granted to others, the collective EU governments have created a law that holds others to a higher standard than themselves. Hence, hypocritical.
- tokai 8y agoThe European court fines countries all the time. Poland and France have been fined for not following air quality legislation. Denmark has been fined for 'processing' farming subsidies incorrectly. I wouldn't surprise see fines for those that don't pick up the slack. EU bureaucracy is like a glacier. It's slow, but when it gets moving it can grind down mountains.
- marcrosoft 8y agoThat's a terrifying concept to think that they are grinding down value because they are slow to react.
- sodosopa 8y ago> The European court fines countries all the time. But the important question is, do the countries pay their fines?
- lancewiggs 8y agoYes.
- CydeWeys 8y agoThat's not really an option for EU member countries.
- gumby 8y agoWhen they are small. But for example in the runup to the single currency both Germany and France were in violation of the deficit rules and both simply refused to comply.
- kiriakasis 8y agoThat is not a fine
- ramblerouser 8y agoA distinction without a difference.
- bryanrasmussen 8y agoor consider that the law also makes allowances for governmental organizations. on edit: I see someone has already addressed the issue several comments lower and in depth https://news.ycombinator.com/item?id=19426066 https://news.ycombinator.com/item?id=19426066
- hopler 8y agoOf course, laws are for the serfs and vassals, not the kings.
- bad_alloc 8y agoIf the EU is sued by itself and needs to pay a fine, does that fine count as income and does that need to be factored into the fine? This might be the first case of an infinite payment.
- greatersuccess 8y agoThe European Union is not its member states. Let me put it another way: the European Union is not like the federal government in the US; it's mainly an economic union. Or another way: European countries are independent, not states in a federation, and the European Union is a separate entity.
- creddit 8y agoIt wouldn't be infinite, actually: https://en.wikipedia.org/wiki/Geometric_series#Sum https://en.wikipedia.org/wiki/Geometric_series#Sum
- simonbw 8y agoEven if that were the case, the payment wouldn't be infinite. 1% + 1% of 1% + 1% of 1% of 1% ... doesn't converge to infinity, it converges to 1.0101010101...%.
- 908087 8y agoThe rules aren't ridiculous. Website developers are just lazy/dumb and generally include shit like GA by default without even thinking of the privacy implications.
- winter_blue 8y agoWhat's the problem with GA? I'm kind of left feeling a little puzzled by the hostility towards Google Analytics in the HN comments on the topic. I assumed HNers would be big fans of something like Google Analytics.
- 908087 8y agoThe problem is that it gives an advertising/surveillance corporation detailed data on the web browsing habits of a massive number of unsuspecting users.
- zik 8y agoIt makes web sites heavier, slows site loading and discloses your tracking information to google which it then uses for commercial purposes.
- londons_explore 8y agoI believe Google has made a binding statement that GA tracking data about a site will never be used for Google's commercial benefit outside the GA product.
- jlarocco 8y agoWho were they addressing when they made this binding statement? How was it binding? Can you prove it? Google's a software company, so without looking at their source code how do you know if they're lying or not? Let's not forget this same company also promised to "don't be evil", and then changed their mind. What's backing up this "binding statement" and how do we know they won't change their mind again?
- goto11 8y agoIt is not "themselves". This article is about government websites in member states. That is not the same thing as the EU itself. Although in this case they will not be fining anybody, since governments are exempt from GPPR. (The article doesn't say it is illegal either, just that it is disgraceful.)
- bkor 8y ago> Although in this case they will not be fining anybody, since governments are exempt from GPPR. That depends on how the GDPR is implemented within the country. E.g. above is factual for Belgium, but _not_ factual for The Netherlands. "Autoriteit Persoonsgegevens" has been notifying everyone to comply, government website or not. It's a steep learning curve though, there's also an multi-year effort to have government websites make use of TLS/certificates. Edit: A reference: https://www.rijksoverheid.nl/onderwerpen/privacy-en-persoonsgegevens/voldoen-aan-de-avg https://www.rijksoverheid.nl/onderwerpen/privacy-en-persoons...: "Sinds 25 mei 2018 moeten overheden, bedrijfsleven en verenigingen voldoen aan de Algemene Verordening Gegevensbescherming (AVG)." meaning: "Since 25 May 2018, governments, businesses and associations must comply with the General Data Protection Regulation (AVG)." Overheid.nl is the official government site.
- Mirioron 8y agoThe EU commission's websites were in violation of GDPR as well [1], but their websites are and were also exempt from the law. [1] https://www.techdirt.com/articles/20180605/22253339978/eu-commission-violates-gdpr-claims-that-exempt-law-legal-reasons.shtml https://www.techdirt.com/articles/20180605/22253339978/eu-co...
- AsyncAwait 8y agoI agree that they should follow their own rules. But I also think the EU should not be open to the greedy, unchecked capitalism of U.S. corporations.
- mav3rick 8y agoFill their coffers by fining tech corporations.
- ionised 8y agoYou mean the tech companies that repeatedly refuse to follow the laws and regulations of the companies in which they operate, like shitty house guests? Filling the coffers is just a nice bonus on top of dispensing some much-needed slap-downs.
- mav3rick 8y agoLet's see what happens when the US companies all pull the plug on Europe for one day. Best of luck getting any thing done. All you'll have is Spotify.
- AsyncAwait 8y agoYou don't seem to understand how businesses work. It's not the U.S. tech companies providing us some kind of 'favor'. The EU is a large market and a significant driver of their profits. They're guests here and WANT to be here, so should follow local laws as a result. If they don't like it, they're absolutely free to leave. They're just not willing to take the hit.
- ionised 8y agoI'm already doing it mate. No Microsoft (for two years now), no Google (for 6 years now), no Facebook (for two years), no Amazon (for a year) services here. The reason I don't use their services is that I don't want to support shitty companies that have no respect for the people of the countries in which they operate, and I believe these companies are primarily responsible for turning the web into the ad-infested walled-garden shitscape it currently is. There are alternatives for everything, and some are far better than what the big tech players offer. The difference is I'm willing to pay for a quality service. Most aren't. Besides, those companies would never leave the single largest trading bloc on Earth. Their shareholders would crucify them for it. In that sense, the EU is doing these companies the favour, because they make so much money doing business in the EU that they'll never leave. They'll adapt and fall in line, like everyone else. Trust me, nothing of what Facebook, Google, Amazon or Microsfot offer is irreplaceable.
- conanbatt 8y agoStates dont pay fines. You can make them pay 100 million, 100 trillion, and whose pocket will be ransacked to pay for it?