7 ms·

Article 13 is terrible not because it’s terrible for start-ups, it’s terrible because it’s terrible for people. I’m pretty close to the rough-end of GDPR in my

Article 13 is terrible not because it’s terrible for start-ups, it’s terrible because it’s terrible for people. I’m pretty close to the rough-end of GDPR in my current job, but it represents real benefits for millions of people. If you asked them what’s a reasonable way to treat their data, I believe the GDPR is close-ish to what a lot of Europeans would want. Or, at least a shift in the right direction. Article 13 on the other hand is what you get if you ask rights-holders groups what they want, and poses a direct threat to freedom of expression for millions of Europeans.

orangecat 8y ago
If you asked them what’s a reasonable way to treat their data, I believe the GDPR is close-ish to what a lot of Europeans would want. I'm pretty sure that if you asked people whether they would prefer to pay for Facebook and Google with cash or by sharing data for ad targeting, most would choose the latter. The GDPR specifically forbids that option. Article 13 on the other hand is what you get if you ask rights-holders groups what they want, and poses a direct threat to freedom of expression for millions of Europeans. And it demonstrates the impossibility of having a powerful bureaucracy that does only the things that you want.
- sametmax 8y ago
  The gdpr doesn't prevent such thing. It just requires consent, care and empowerment.
  - ApolloFortyNine 8y ago
    The GDPR does not allow you to block people who do not consent. Well, it's never gone to court yet, so I guess you can't say for sure. But that's how it's widely interpreted.
    - deleted 8y ago
      [deleted]
    - sametmax 8y ago
      Yes, you need consent. That's the point. That's good for us, the users. Services can still do all what they did before, but we need to agree.
    - diffeomorphism 8y ago
      Consent is meaningless if it is forced. Also, if the law allowed that, you would simply get a large banner saying "To access this website you agree to all our privacy invasion and to sell us your soul. We are not asking you, just informing you."
      - ApolloFortyNine 8y ago
        Except you do have the choice not to view the site. If hackernews said give consent or leave, you could just close the tab.
- mikekchar 8y ago
  > I'm pretty sure that if you asked people whether they would prefer to pay for Facebook and Google with cash or by sharing data for ad targeting, most would choose the latter. The GDPR specifically forbids that option. First, it's important to distinguish between the types of lawful bases with which you are processing data. For example, if you were to provide a service of targeting ads to people, you do not need consent to collect the data you need to target your ads: because you are simply fulfilling the contract. One of the problems with the current Facebooks and Googles of the world is that they assume you don't want targeted ads. I think this is an enormous mistake. Sign me up for targeted ads! I want them! I will freely give you information so that I can get targeted ads! In reality, the Faebooks of and Googles of the world are not offering targeted ads. They are offering indiscriminate ads and also selling your data. This is incredibly important to understand. Next, even if we decide to offer a service and ask for consent for collection of non-related information, there is nothing stopping us from paying for that collection (as far as I can tell). The law states that consent must be "freely given", however this "freely given" means that you can't threaten consequences for non-consent. There is no provision for thanking your customers. In other words, I'm pretty sure you can charge $5 a month for a service and then give $5 a month worth of credit as a thank you for being able to use your data. (Note: I tried to find some kind of verification of this, but was unable to find a discussion of it either way. I would be grateful for some evidence even if it contradicts my thesis ;-) ) However, there are massive caveats. First you must inform the customers what you are doing with their data and who your are sending it to. Second you must allow them to withdraw their consent. If they withdraw their consent then you must also do everything in your power to notify the downstream data processors to also stop using that data. And I think that's the real reason you don't see the Facebooks and Googles of the world trying this. They don't want to work with the data in a trackable way. They want to do whatever the heck they want with your data forever. They don't want to inform you that they've sent your data to an organisation that you might disapprove of. They don't want to allow you to cancel your consent without cancelling your service and also do whatever is necessary to stop the downstream processor from using your data if you object. There is usually a lot of vitriol here when we discuss GDPR however usually this is a result of distilling the argument down to an either/or situation. Either the company is an abusive monster or the law is trying to remove a legitimate business model. It overlooks the idea that there are serious problems with the way this business model works right now and the law attempts to improve that situation in ways that are both useful and frustrating. Edit: At the risk of bringing the wrath of the EU down upon my employer, I just realised that we offer a 25 GBP voucher for agreeing to sign up to our newsletter. So, there is at least 1 company who does this and I really don't think there is anything wrong with it.
- confounded 8y ago
  > ... pay for Facebook and Google... by sharing data for ad targeting... The GDPR specifically forbids that option. All I can say is that this is not my lived experience of Google and Facebook in the EU. This is also not those companies’ interpretation of that law (nor a common one). There are real arguments against the burden the GDPR puts on companies who hold/process significant PII (which I am sympathetic to), but this is not one of them. > ... powerful bureaucracy that does only the things that you want. The same could be said of any democracy. My point is that there is no democratic basis for Article 13. It’s only getting support because IP law is too boring and abstract for most people to get worked up about.
- _nalply 8y ago
  > I'm pretty sure that if you asked people whether they would prefer to pay for Facebook and Google with cash or by sharing data for ad targeting, most would choose the latter. The GDPR specifically forbids that option. Do you have a source for that?
  - bryanrasmussen 8y ago
    Well since you can't make sharing of personal data a prerequisite for using a service unless it can be shown that data is actually necessary for the operation of the service it could be argued that this follows.
    - VonGallifrey 8y ago
      The question was if there is a source on the claim that most people would prefer intrusive ads to paying for a service.
      - bryanrasmussen 8y ago
        Sorry, I had assumed the question was for a source on "The GDPR specifically forbids that option.", I didn't give the source, but an argument why it follows from the rules of the GDPR.
    - Tarean 8y ago
      A service could offer an ad-free version for a fee.
      - kruczek 8y ago
        If you provide a free service which is only accessible after you give permission to data processing, then that permission is not freely given and thus invalid (as long as such processing is not strictly necessary to provide the service) - see Article 7 and Recital 43.
    - beobab 8y ago
      That's not quite accurate. The law allows you to legitimately ask for permission to share the data for advertising purposes, but you have to be transparent with the details, and the advertiser has to have the same safeguards on the data as your company (they aren't allowed to re-sell it without the original company's knowledge, for example).
- raverbashing 8y ago
  > I'm pretty sure that if you asked people whether they would prefer to pay for Facebook and Google with cash or by sharing data for ad targeting, most would choose the latter. The GDPR specifically forbids that option. Yes, in the same way (as an exaggerated example) it forbids people selling their organs for profit or jobs with no salary etc But the parent is right, this is not only about companies, this has a direct impact on users and freedom of expression
- tyfon 8y ago
  I had absolutely no issue getting my family members to pay for an account at diasp.eu when google+ shut down. They were rather happy to do so since one of its selling points is that they do not track users for advertising. Do not underestimate the general publics tracking/advertising fatigue.
  - dageshi 8y ago
    Forgive me but doesn't that mean they were actually using google+ in the first place? Which seems.... unlikely? Or at least incredible outliers. You won't get the majority of people on Facebook to pay for the service after you've been giving it to them for "free" for 10 years, you'd maybe convert 10% if that, at which point what use is facebook with most of the users gone?
    - tyfon 8y ago
      We were all using google+ to share images. Some of them are on facebook (my mother and sister in particular), but the rest of my extended family is not there. But we were all on G+, I told them if they wanted to see baby pictures you have to sign up. I couldn't care less about anyone outside my family, if they want to contact me they can email or call me by phone.
    - sacado2 8y ago
      It's difficult to ask for users to pay for a service that was always free, indeed, furthermore facebook is not growing its user base anymore. But a competitor can emerge by providing an alternative service, for a fee, marketing it as "the service that doesn't spy on you". Now, sure, that will be a niche service, and social networks can't be niche services. The protonmail of facebook or twitter will probably never emerge.
  - sacado2 8y ago
    For semi-private file sharing (ie family-wide, not worldwide), paying services are great. If you want as big of a circle of "friends" as possible, you are in a "winner-takes-all" situation, and being free helps to be the winner.
- deleted 8y ago
  [deleted]
- beobab 8y ago
  My understanding of the GDPR (did a course on it for work) is that it allows data sharing for advertising to named companies, but holds you and the advertiser responsible for ensuring that no-one else gets your data without permission and for letting you know if any such data breach occurs. But I agree with you on the principle that bureaucracy very seldom does only the things I want.
- mikkom 8y ago
  Well consumers can still give information to google if they want to, gdpr does not disallow it. What is now forbidden is to gather identifiable data about people without consent and ability to remove it.
- StreamBright 8y ago
  > I'm pretty sure that if you asked people whether they would prefer to pay for Facebook and Google with cash or by sharing data for ad targeting They would chose not to have Google and Facebook. The basic principals of capitalism that products are something people want or need. Surveillance capitalism gets around this by exploiting the fact that an average citizen does know nothing about data collection and its scale and the implications for their privacy. GDPR is trying to fix this and also the fuck all attitude to security that most companies have.
LoSboccacc 8y ago
> Article 13 is terrible not because it’s terrible for start-ups, it’s terrible because it’s terrible for people. the two aren't mutually exclusive and Europe is right now in a deep growth slump also caused by middle class not moving into entrepreneurship due all the red tape and inefficiencies around having to deal with the particularities of every European state, with the EU aggregating without unifying a mess of regional particularities (i.e. vatmoss) we desperately need the EU to cater both to the individual and the small business interests working out the kinks of the common market.
- krageon 8y ago
  VAT and a vast majority of the laws surrounding commerce at least are simple and have been abstracted away by various platforms ages ago. I invite you to read up on the subject and revise your stance (your premise may or may not be true, I will not claim to know either way) based on something that is actually true.
  - sisu2019 8y ago
    VAT is absolutely not abstracted away and intra-EU VAT is anything but simple. Why speak when you have no idea what you are talking about?
  - xxs 8y ago
    VAT is very far from simple across the EU and there have been recent changes for online shopping (depending on the amount/turnover per year if might be necessary to charge VAT based on the buyer residence instead of company registration) Another instance in most EU countries tips (in restaurants/bars) should be subject of VAT, not in the UK for instance. Different exceptions for deductibles like water for employees (but not coffee and so on)
  - sbacic 8y ago
    I think it all depends on how far you want to stretch the definition of "simple". I run a sole proprietorship and don't have to worry about national VAT until I cross a certain threshold. However, if I do business with customers in another EU state, I immediately need to account for VAT and report it. Add to that mistranslated directives (!), misinformed and uncooperative tax officials and you quickly realize that both "ease of doing business" and the single market are all a bunch of baloney. If I ever launch a B2C service, you can bet your ass I won't be aiming it at the EU market. I'll leave that for when I can afford an expert to handle all the bureaucratic nonsense that doing business in the EU involves.

orangecat 8y ago

If you asked them what’s a reasonable way to treat their data, I believe the GDPR is close-ish to what a lot of Europeans would want. I'm pretty sure that if you asked people whether they would prefer to pay for Facebook and Google with cash or by sharing data for ad targeting, most would choose the latter. The GDPR specifically forbids that option. Article 13 on the other hand is what you get if you ask rights-holders groups what they want, and poses a direct threat to freedom of expression for millions of Europeans. And it demonstrates the impossibility of having a powerful bureaucracy that does only the things that you want.

sametmax 8y ago
The gdpr doesn't prevent such thing. It just requires consent, care and empowerment.
- ApolloFortyNine 8y ago
  The GDPR does not allow you to block people who do not consent. Well, it's never gone to court yet, so I guess you can't say for sure. But that's how it's widely interpreted.
  - deleted 8y ago
    [deleted]
  - sametmax 8y ago
    Yes, you need consent. That's the point. That's good for us, the users. Services can still do all what they did before, but we need to agree.
  - diffeomorphism 8y ago
    Consent is meaningless if it is forced. Also, if the law allowed that, you would simply get a large banner saying "To access this website you agree to all our privacy invasion and to sell us your soul. We are not asking you, just informing you."
    - ApolloFortyNine 8y ago
      Except you do have the choice not to view the site. If hackernews said give consent or leave, you could just close the tab.
mikekchar 8y ago
> I'm pretty sure that if you asked people whether they would prefer to pay for Facebook and Google with cash or by sharing data for ad targeting, most would choose the latter. The GDPR specifically forbids that option. First, it's important to distinguish between the types of lawful bases with which you are processing data. For example, if you were to provide a service of targeting ads to people, you do not need consent to collect the data you need to target your ads: because you are simply fulfilling the contract. One of the problems with the current Facebooks and Googles of the world is that they assume you don't want targeted ads. I think this is an enormous mistake. Sign me up for targeted ads! I want them! I will freely give you information so that I can get targeted ads! In reality, the Faebooks of and Googles of the world are not offering targeted ads. They are offering indiscriminate ads and also selling your data. This is incredibly important to understand. Next, even if we decide to offer a service and ask for consent for collection of non-related information, there is nothing stopping us from paying for that collection (as far as I can tell). The law states that consent must be "freely given", however this "freely given" means that you can't threaten consequences for non-consent. There is no provision for thanking your customers. In other words, I'm pretty sure you can charge $5 a month for a service and then give $5 a month worth of credit as a thank you for being able to use your data. (Note: I tried to find some kind of verification of this, but was unable to find a discussion of it either way. I would be grateful for some evidence even if it contradicts my thesis ;-) ) However, there are massive caveats. First you must inform the customers what you are doing with their data and who your are sending it to. Second you must allow them to withdraw their consent. If they withdraw their consent then you must also do everything in your power to notify the downstream data processors to also stop using that data. And I think that's the real reason you don't see the Facebooks and Googles of the world trying this. They don't want to work with the data in a trackable way. They want to do whatever the heck they want with your data forever. They don't want to inform you that they've sent your data to an organisation that you might disapprove of. They don't want to allow you to cancel your consent without cancelling your service and also do whatever is necessary to stop the downstream processor from using your data if you object. There is usually a lot of vitriol here when we discuss GDPR however usually this is a result of distilling the argument down to an either/or situation. Either the company is an abusive monster or the law is trying to remove a legitimate business model. It overlooks the idea that there are serious problems with the way this business model works right now and the law attempts to improve that situation in ways that are both useful and frustrating. Edit: At the risk of bringing the wrath of the EU down upon my employer, I just realised that we offer a 25 GBP voucher for agreeing to sign up to our newsletter. So, there is at least 1 company who does this and I really don't think there is anything wrong with it.
confounded 8y ago
> ... pay for Facebook and Google... by sharing data for ad targeting... The GDPR specifically forbids that option. All I can say is that this is not my lived experience of Google and Facebook in the EU. This is also not those companies’ interpretation of that law (nor a common one). There are real arguments against the burden the GDPR puts on companies who hold/process significant PII (which I am sympathetic to), but this is not one of them. > ... powerful bureaucracy that does only the things that you want. The same could be said of any democracy. My point is that there is no democratic basis for Article 13. It’s only getting support because IP law is too boring and abstract for most people to get worked up about.
_nalply 8y ago
> I'm pretty sure that if you asked people whether they would prefer to pay for Facebook and Google with cash or by sharing data for ad targeting, most would choose the latter. The GDPR specifically forbids that option. Do you have a source for that?
- bryanrasmussen 8y ago
  Well since you can't make sharing of personal data a prerequisite for using a service unless it can be shown that data is actually necessary for the operation of the service it could be argued that this follows.
  - VonGallifrey 8y ago
    The question was if there is a source on the claim that most people would prefer intrusive ads to paying for a service.
    - bryanrasmussen 8y ago
      Sorry, I had assumed the question was for a source on "The GDPR specifically forbids that option.", I didn't give the source, but an argument why it follows from the rules of the GDPR.
  - Tarean 8y ago
    A service could offer an ad-free version for a fee.
    - kruczek 8y ago
      If you provide a free service which is only accessible after you give permission to data processing, then that permission is not freely given and thus invalid (as long as such processing is not strictly necessary to provide the service) - see Article 7 and Recital 43.
  - beobab 8y ago
    That's not quite accurate. The law allows you to legitimately ask for permission to share the data for advertising purposes, but you have to be transparent with the details, and the advertiser has to have the same safeguards on the data as your company (they aren't allowed to re-sell it without the original company's knowledge, for example).
raverbashing 8y ago
> I'm pretty sure that if you asked people whether they would prefer to pay for Facebook and Google with cash or by sharing data for ad targeting, most would choose the latter. The GDPR specifically forbids that option. Yes, in the same way (as an exaggerated example) it forbids people selling their organs for profit or jobs with no salary etc But the parent is right, this is not only about companies, this has a direct impact on users and freedom of expression
tyfon 8y ago
I had absolutely no issue getting my family members to pay for an account at diasp.eu when google+ shut down. They were rather happy to do so since one of its selling points is that they do not track users for advertising. Do not underestimate the general publics tracking/advertising fatigue.
- dageshi 8y ago
  Forgive me but doesn't that mean they were actually using google+ in the first place? Which seems.... unlikely? Or at least incredible outliers. You won't get the majority of people on Facebook to pay for the service after you've been giving it to them for "free" for 10 years, you'd maybe convert 10% if that, at which point what use is facebook with most of the users gone?
  - tyfon 8y ago
    We were all using google+ to share images. Some of them are on facebook (my mother and sister in particular), but the rest of my extended family is not there. But we were all on G+, I told them if they wanted to see baby pictures you have to sign up. I couldn't care less about anyone outside my family, if they want to contact me they can email or call me by phone.
  - sacado2 8y ago
    It's difficult to ask for users to pay for a service that was always free, indeed, furthermore facebook is not growing its user base anymore. But a competitor can emerge by providing an alternative service, for a fee, marketing it as "the service that doesn't spy on you". Now, sure, that will be a niche service, and social networks can't be niche services. The protonmail of facebook or twitter will probably never emerge.
- sacado2 8y ago
  For semi-private file sharing (ie family-wide, not worldwide), paying services are great. If you want as big of a circle of "friends" as possible, you are in a "winner-takes-all" situation, and being free helps to be the winner.
deleted 8y ago
[deleted]
beobab 8y ago
My understanding of the GDPR (did a course on it for work) is that it allows data sharing for advertising to named companies, but holds you and the advertiser responsible for ensuring that no-one else gets your data without permission and for letting you know if any such data breach occurs. But I agree with you on the principle that bureaucracy very seldom does only the things I want.
mikkom 8y ago
Well consumers can still give information to google if they want to, gdpr does not disallow it. What is now forbidden is to gather identifiable data about people without consent and ability to remove it.
StreamBright 8y ago
> I'm pretty sure that if you asked people whether they would prefer to pay for Facebook and Google with cash or by sharing data for ad targeting They would chose not to have Google and Facebook. The basic principals of capitalism that products are something people want or need. Surveillance capitalism gets around this by exploiting the fact that an average citizen does know nothing about data collection and its scale and the implications for their privacy. GDPR is trying to fix this and also the fuck all attitude to security that most companies have.

LoSboccacc 8y ago

> Article 13 is terrible not because it’s terrible for start-ups, it’s terrible because it’s terrible for people. the two aren't mutually exclusive and Europe is right now in a deep growth slump also caused by middle class not moving into entrepreneurship due all the red tape and inefficiencies around having to deal with the particularities of every European state, with the EU aggregating without unifying a mess of regional particularities (i.e. vatmoss) we desperately need the EU to cater both to the individual and the small business interests working out the kinks of the common market.

krageon 8y ago
VAT and a vast majority of the laws surrounding commerce at least are simple and have been abstracted away by various platforms ages ago. I invite you to read up on the subject and revise your stance (your premise may or may not be true, I will not claim to know either way) based on something that is actually true.
- sisu2019 8y ago
  VAT is absolutely not abstracted away and intra-EU VAT is anything but simple. Why speak when you have no idea what you are talking about?
- xxs 8y ago
  VAT is very far from simple across the EU and there have been recent changes for online shopping (depending on the amount/turnover per year if might be necessary to charge VAT based on the buyer residence instead of company registration) Another instance in most EU countries tips (in restaurants/bars) should be subject of VAT, not in the UK for instance. Different exceptions for deductibles like water for employees (but not coffee and so on)
- sbacic 8y ago
  I think it all depends on how far you want to stretch the definition of "simple". I run a sole proprietorship and don't have to worry about national VAT until I cross a certain threshold. However, if I do business with customers in another EU state, I immediately need to account for VAT and report it. Add to that mistranslated directives (!), misinformed and uncooperative tax officials and you quickly realize that both "ease of doing business" and the single market are all a bunch of baloney. If I ever launch a B2C service, you can bet your ass I won't be aiming it at the EU market. I'll leave that for when I can afford an expert to handle all the bureaucratic nonsense that doing business in the EU involves.