58 ms·

GDPR After One Year

• Virtuoso 7y ago
  Can GDPR be used to actually destroy a company operating online in the EU? I'm guessing it could be, by simply overwhelming them with valid requests under GDPR, like "Give me all my data!"
  • Bjartr 7y ago
    I would hope that under such an intentional deluge, the court would accept that the reasonable turnaround time for requests would increase substantially.
  • chmod775 7y ago
    You can automate this - easily in most cases.
  • gerbilly 7y ago
    Well maybe the companies should make it easy to extracts and delete people's data? SV is full of people telling themselves how smart they are, and they can't come up with something as simple as this?
  • anonymousab 7y ago
    Since the goal is merely compliance with the spirit of the law, the courts likely wouldn't hammer down a company for having issues when trying to legitimately and fully comply with the law.
  • bqqyz 7y ago
    If you can't locate my data and send me a copy and/or delete it then you don't deserve to be in business. It's as if you had a parking business and couldn't locate my car.
  • DanBC 7y ago
    > by simply overwhelming them with valid requests under GDPR, Doesn't work in the UK because the request has to be genuine and not vexatious. https://2040infolawblog.com/2019/05/19/a-cure-for-blindness/ https://2040infolawblog.com/2019/05/19/a-cure-for-blindness/ > The relevant text in the final version (Article 12.5) is as follows: > Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either: > (a) charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or > (b) refuse to act on the request
    • Dylan16807 7y ago
      Also they have 30 days to respond, so at most you can force them to grab your data every 3-4 weeks even without that clause.
  • simion314 7y ago
    You should then implement an automatic process. But why a large number of your users would start asking for their data at once? Maybe you did something wrong and they want to move elsewhere and in this cage you would like to keep them hostage?
• anotheryou 7y ago
  And does it really protect much? As long as you sign an agreement with the 3rd party that they value GDPR you are all golden, no?
  • dcbadacd 7y ago
    Can be revoked at any time as well as request all the data they've aquired about you and it's deletion.
  • scrollaway 7y ago
    It's not just for protection but also for control, which gdpr excels at. I am able to retain full control over where my data goes, who is allowed to have it, I can make sure it's deleted when I don't want it there, and I can actually request to have it.
    • WA 7y ago
      I‘m not so sure about that. Sure, in theory this works, but if your data was shared with thousands of companies, how do you know it really was deleted? Furthermore, GDPR still has the thing that businesses are allowed to have a legitimate reason for keeping your data. So far, as an end user, the GDPR doesn’t feel like anything changed at all. Facebook and Google still gather shitloads of data with zero control on my side. Cookie warnings on every website and loaded with dark patterns (link leads to link, leads to link, leads to link, leads to server timeout). I simply accept these popups and trust uBlock Origin to actually block the whole AdTech shenanigans, instead of relying on their popup bullshit.
  • DanBC 7y ago
    > As long as you sign an agreement with the 3rd party that they value GDPR you are all golden, no? No. Consent isn't always required, and consent alone isn't sufficient for all purposes.
• duxup 7y ago
  I like the philosophy behind GDPR. I just think it misunderstands how people actually behave. Human behavior is always a challenge for any regulation. These are early days for digital age regulations, even the best efforts will be hit or miss at best I think.
• LaGrange 7y ago
  ..Amazon not doing due diligence ain't a GDPR problem. The only problem is that those two values are way too low: * €55,955,871 in fines * €50 million of which was a single fine on Google Those are a joke. Considering what's going on, those values should be orders of magnitude higher.
  • WA 7y ago
    Especially in the light of: "89,271 data breach notifications" Very odd.
  • cobookman 7y ago
    Sounds like Google is being unfairly targeted due to its success & cash reserves.
    • NeedMoreTea 7y ago
      Nothing to do with their size and number of users impacted then?
  • criley2 7y ago
    >Those are a joke. Considering what's going on, those values should be orders of magnitude higher. Frankly, I think higher fines and more aggressive fining would even further deepen the business moat that mega businesses are already developing over small and medium. The article already describes how the current regulatory regime boosted Google and big players 20-40% directly at the cost of small and medium (not in the top 100 or top 50) sites. Frankly, I think European countries should just take the China approach and ban American companies because there isn't going to be a regulatory structure that works here, and they're only going to hurt their domestic competition by playing this stupid game.
    • seanmcdirmid 7y ago
      China doesn’t ban American companies for that reason, they ban them because political dissidents could use them to communicate privately (gmail) or publicly (YouTube Facebook twitter....). Not all American companies are banned, either.
• skybrian 7y ago
  It seems like a biased list, but it's good that someone is collecting links about these incidents.
  • Operyl 7y ago
    It seems like there’s things from both sides of the camp on first glance, can you point out the bias you see? (Legitimate question, and I only quickly glanced.)
    • lobotryas 7y ago
      Now-a-days”biased” means “I brought evidence to support my opinion”. There is nothing biased in TFA; just a person who thinks GDPR is a bad idea.
      • skybrian 7y ago
        If you start out with an opinion and look for evidence to support it, yeah, that is biased. But it doesn't mean it's not a useful contribution to the conversation. Certainly it's better than not looking for evidence!
        • looeee 7y ago
          If you look for evidence to prove yourself right, then you will find it. Even if you're wrong.
    • CyanBird 7y ago
      At least from what I read, it is the slant of the entire piece than anything in particular. If we removed environmental protections we would also see a boom of growth in the industry, but we decided that those benefits don't outweigh the environmental cost, same here with GDPR, after Cambridge analytica using digital micro targeting to heavily manipulate populations and elections it is simply too high a cost to pay for what is otherwise a pretty shifty industry otherwise I'd heavily recommend everyone here to read the book surveillance capitalism it is an incredible explanation of what goes behind the curtain In short, GDPR has some relatively minor problems and externalities and blogger wants to scrap the entire GDPR because of them....
• WA 7y ago
  This is a very interesting list, especially the part about the GDPR increasing the attack surface and where the data gravity center is. The part about "compliance cost" should be taken with a grain of salt. If you were compliant before, because you respected the users‘ privacy, the effort was relatively low. The study about VC having dropped by 50% in the EU because of the GDPR sounds pretty weird to me. Unless of course there’s selection bias and we’re talking AdTech companies mostly. An interesting number would be: how many people closed down forums and moved their discussion boards to Facebook?
  • defertoreptar 7y ago
    > If you were compliant before, because you respected the users‘ privacy, the effort was relatively low. Why? Don't you still have to build systems to be able to comply with user requests in a timely matter?
    • WA 7y ago
      First, if you cared about user privacy, you would store as few data points as possible. Second, it’s very likely that you have APIs in place that can request all data for a user anyways. If you don’t know what data you have of your users, you don’t give a shit about their privacy, no? Third, user requests are usually: a) what data do you store about me? B) Export all data. C) delete all my data (for real).
      • fromMars 7y ago
        This is so simplistic. There are many storage solutions for many different use cases. Some of these are write once and immutable afterwards. There are relational structures for transaction history that may also link to customers. These all have to be re-designed in such away that information can be removed from the system and exported from the system, while keeping essential information (such as past sales records). This is not an easy problem to solve.
        • EdwardDiego 7y ago
• deleted 7y ago
  [deleted]
• xwdv 7y ago
  Unintended consequence: because children are under the custody of their parents until they become adults, a parent could easily go in and demand the entire history of data a company collected from their child be provided; a gross violation of their right to privacy which some argue doesn’t even exist anyway.
  • drawnwren 7y ago
    Do people believe that children have a right to privacy from their parents?
    • xwdv 7y ago
      Not sure, if you are raising a child and they are hiding information or data from you that could be detrimental to their development or may imply intent of hurting or maiming others do you have a right to know about it so you can take action? Could even be nasty in a case where separated parents have 50/50 custody and one parent uses GDPR to get data on what another parent might be doing with their child and build a case against them.
    • failbuffer 7y ago
      Not per se, no. But there are many overbearing/controlling parents out there. It's easy to imagine scenarios where parental access to GDPR data could be a bad thing (and yet other scenarios where it could be a good thing).
    • balfirevic 7y ago
      I sure believe that they should have it to some degree, depending on age.
    • DanBC 7y ago
      Yes, of course. Imagine a father who rapes his child and abuses his wife. The child is removed from the father by the mother who goes into hiding, but with temporary legal approval. We don't want the father (who likely retains some element of parental responsbility until the court case has finished) to be able to get the child's location by SARs. In Europe children are humans and humans have rights. Children are not the property of their parents.
• NewsAware 7y ago
  The article vaguely links Cambridge Analytics to GDPR. Is there really a connection or is the article merely trying to frame GDPR negatively by comparing?
  • captainbland 7y ago
    I don't think so. The APIs that Cambridge Analytica were taking advantage of were available long before GDPR became enforceable and are most likely illegal under GDPR because they allowed third parties access to your personal information without your consent - where it was a friend of yours who consented to revealing their information, Facebook would also reveal some information about you. The Wikipedia article actually details all this quite well in the fourth paragraph (obviously without reference to GDPR): https://en.wikipedia.org/wiki/Cambridge_Analytica https://en.wikipedia.org/wiki/Cambridge_Analytica
  • tschellenbach 7y ago
    Cambridge Analytics is a data portability exploit. It leveraged your friend's ability to send your Facebook data to third party apps. GDPR enforces more data portability, which in some sense allows for a larger attack surface for such exploits. The article mentions one example of hackers extracting all your personal data after a takeover of your account.
  • phiresky 7y ago
    Framing a law that forces companies to allow you to export your own personal data in a readable format to reduce vendor lock in as "this will definitely cause the next Cambridge Analytics!" on the basis of "but user authentication might be bad!" is absolutely laughable and the fact that this article got so popular here is pretty discouraging.
• jaabe 7y ago
  I think we went in the wrong direction in terms of public data. It really isn’t in my best interest as a citizen that our public sector can’t use my data to run more effective, spot health issues sooner or perform city planning based on citizen-mobility rather than educated guesses. I think it’s absolutely the right direction for private companies though. I know, I know, a lot of you are distrustful of government, but I’m Danish and we generally trust our public sector in to an extend that would truly surprise a lot of you. So with that out of the way, I think it’s a shame that we spend so much public funding burying public data in silos. I think we should absolutely keep citizen data safe, but I think we should also use it and perhaps work to make some of it less sensitive. Because some of it frankly doesn’t have to be sensitive. In my country we have a social security number. You get it 1-5 minutes after you’re born, and in the olden days, it was used to identify you when you wanted to do things like open a bank account. It’s still used for that to some extend, but in the meantime we’ve created this thing called NemID (soon to be mitID), which is a national 2-factor secure digital identity, that we use to enter online agreements because it turned out that your social security number wasn’t actually safe. We’ve also had leaks and hacks exposing nearly half of the current social security numbers over the past 25 years. Because a social security number is deemed sensitive by the GDPR, we’re spending hundred of millions on the bureaucracy around it. It’s by far the most reported thing to our national data protection agency, I think almost 80% of the public cases involve it. And it makes no sense. Why the hell didn’t we make it illegal to use it as an identifying number instead? It would have saved us so much money. And that’s just one issue with the GDPR. Another is machine learning and data. This is obviously a sensitive area. I don’t personally think we should troll through citizen cases to try and find possible alcoholics. Maybe someday, but society has to deem it morally acceptable first. I do think we should use citizen data to schedule shifts though. It makes no sense to me, to have 10 nurses and 15 teachers do full time scheduling in a city of 60,000-100,000 citizens when an algorithm can do it instead. But we can’t, because the GDPR prevents us from using data that way. I like the GDPR, but I think it needs a revision for the modern public sector, and I think we should really ask ourselves what we want with our data. Do we want to spend trillions on a bureaucracy guarding it, or do we want to demystify some of it and put it to good use, so we can spend the trillions on nurses, teachers and better infrastructure? /disclaimer I work in the public sector.
  • 7y ago
• BeniBoy 7y ago
  "GDPR has been the death knell for small and medium-sized businesses [...] Here is a partial list: [...] Unroll.me, inbox management app" Don't know for the other companies, but for this one, good riddance, they had a notoriously scummy business model[1]. [1]:https://www.nytimes.com/2017/04/24/technology/personal-data-firm-slice-unroll-me-backlash-uber.html https://www.nytimes.com/2017/04/24/technology/personal-data-...
  • tormeh 7y ago
    Also Klout was shit. The negatives of social media magnified to parodic heights. https://xkcd.com/1057/ https://xkcd.com/1057/
  • nindalf 7y ago
    Exactly. Unroll.me continues to operate outside the EU and continues to sell access to people's emails. "We don't charge you for this amazing service" they claim, at no point making it clear what their business model is. They prey on the ignorance of consumers, exactly what regulations (like GDPR) should be protecting consumers against. I suppose a similar article could be published about the pharmaceutical industry, crying about the cost and consequences of FDA regulation. Doesn't mean we should scrap FDA regulation and "let consumers decide" whether drugs are safe or not.
  • hannasanarion 7y ago
    Every single company on that list deserved to die.
    • LaGrange 7y ago
      "GDPR has made it so that only large multinationals can steal your personal data :["
    • daxterspeed 7y ago
      Each item on the list deserves a little blurb on why GDPR "forced" it's removal from the EU market. Examples: Unroll.me's entire business model was made illegal in the EU. Hitman: Absolution faced problems in taking ownership of its EU servers. The two games Loadout and Super Monday Night Combat both claimed not having the resources necessary to comply with GDPR. For perspective Loadout had a peak of 208 concurrent players in 2018[0] while SMNC had a peak of 40 players in 2018[1]. [0] https://steamcharts.com/app/208090 https://steamcharts.com/app/208090 [1] https://steamcharts.com/app/104700 https://steamcharts.com/app/104700
• mola 7y ago
  Yes, an economy based on deception that uses it's customers in unknown ways, most of the time in ways entirely unrelated to the product, is failing after appropriate regulation. All consequences seem entirely acceptable. Businesses must act with responsibility for society. the regulator is usually lax, until all hell break loose.
  • OskarS 7y ago
    Couldn't agree more. It's a biased presentation of the facts, and could easily be reframed. Take "compliance costs are astronomic", for instance, could just as easily be rephrased "Companies spend more money than ever to ensure the safety of customer data". I know that's certainly the case where I work: it's been a massive amount of work, but it's great for our customers. If it weren't for GDPR, I am certain that management wouldn't have allowed us to do it. Cleaning up a shitty system is expensive, and there are bumps in the road. It's still worth doing.
  • jchw 7y ago
    >“Since 2016, newspapers in Belgium and Italy have removed articles from their archives under [GDPR]. Google was also ordered last year to stop listing some search results, including information from 2014 about a Dutch doctor who The Guardian reported was suspended for poor care of a patient.” >All consequences seem entirely acceptable. ...I am not sure I agree with your worldview.
    • anoncake 7y ago
      It's impossible to judge whether those articles should have been removed without knowing their content and context. Removing the article about a doctor being suspended for poor care is perfectly reasonable if he was later cleared of wrongdoing.
      • jchw 7y ago
        I mean, the context is actually available. They link to the original news story. It's definitely not impossible for us to know.
• csense 7y ago
  My question is, if you're a US startup, and you simply ignore GDPR requests, what happens? Does Europe have some way to require its ISP's to firewall you off or blackhole your DNS? Can they force Amazon to shut off your AWS account? Do your executives risk being taken away in handcuffs to a European jail when they go to Europe on vacation? If there are no consequences, why don't US tech companies just completely ignore it? (Of course, big players like Google probably have EU-based datacenters and other assets that could be seized to pay their fines. I'm thinking of small, cloud-hosted startups whose employees, bank accounts and physical assets are all on US soil.)
  • ronsor 7y ago
    You could probably get tangled if you accept money from EU citizens. If you don't take money from them (or use cryptocurrency), the EU can't really do anything.
  • anoncake 7y ago
    > Does Europe have some way to require its ISP's to firewall you off or blackhole your DNS? Not in a systematic EU-wide way. Courts sometimes force individual ISPs to blackhole websites used for copyright infringement. I guess if your company ignores the GDPR, it's treated as an illegal organization. So you may still be able to provide your service in the EU, but people cannot legally pay you, including paying you for ads.
  • microcolonel 7y ago
    If you're only moving packets, you generally have nothing to fear until the EU develops into an empire, at which point there's a good chance that they will have a mandatory firewall mechanism (some members already do impose firewall rules on ISPs through the courts, AFAIK). If you have no business in the EU, generally the worst they'll do is censor your website.
  • wongarsu 7y ago
    > If there are no consequences, why don't US tech companies just completely ignore it? Once you grow big enough the EU will inevitably have leverage over you: Servers rented in the EU to lower latency, payment streams from EU customers, offices in the EU to get talent, subsidiaries created for tax reasons, executives on vacation, employees on conferences, money spent on advertising, etc. If you are a startup in SV the EU migh not have much direct pressure it can apply, but how would an investor react when given the choice of "we could spend some more money now, or we could do nothing and be significantly limited once we grow to a certain size, basically unable to do anything significant in one of the largest economies of the world".
• njharman 7y ago
  I never understood how anyone thinks being forgotten is a right. Wrong, false, liable, limited set of privacy related information should be correctable, removable. But facts about you and what you’ve done, no. I’m sorry you made embarrassing mistake. But it’s not worth losing so much public information and enabling bad actors to save yourself from your own actions.
  • fromMars 7y ago
    Agree, and it doesn't even exist in most domains. I can't expunge my school transcripts or information from credit bureaus. Do we really think a society where there is no public information about people better?
    • Nursie 7y ago
      Credit bureau information tends to expire off the record over time doesn't it?
    • izacus 7y ago
      Which country in Europe are you from that school transcripts are public?
      • fromMars 7y ago
        That's a fair point. It isn't public information. But, GDPR applies to any information, even if it isn't available publicly.
        • afiori 7y ago
          But it does not apply to governments
    • lewis1028282 7y ago
      You can, any bankruptcy information expires after 7? years, and school records aren't public.
  • 7y ago
• fromMars 7y ago
  I am sure I will get downvoted to oblivion, but I think GDPR is a colossal waste of time and money. I think mandatory do not track settings are great, but the right to be forgotten is to onerous to implement and not present in other domains. They do make it harder for smaller businesses to compete. I can't go to my school or a credit bureau or an insurance company and say that all my past history should be forgotten. Why should we enforce such a regulation online?
  • pleasecalllater 7y ago
    OK, can you also post here all your personal details, so I could sell them to anybody who wants to exploit them to earn money? OK, fine, you don't want to post it here. Could I get them from your bank, work, friends, family, post it here and sell to anybody?
    • fromMars 7y ago
      This is a strawman. You are talking personally identifiable information and data usage policies which is an entirely different thing than the requirement for all data to be deleted.
      • detaro 7y ago
        > You are talking personally identifiable information and data usage policies which is an entirely different thing than the requirement for all data to be deleted. Could you explain a bit more by what you mean? GDPR only concerns itself with personally identifiable information, and is at it's core about the rules for "data usage policies" around it (which of course will involve rules for when to delete data).
        • fromMars 7y ago
          Are you sure that GDPR only concerns itself with PII information. In other words, is it legal to collect information about users as long as it isn't tied to PII? I consider PII to be things like name, Social Security Numbers, a credit card #, an email, DOB, etc. You seem to be suggesting as long as the data isn't associated with the above or can't reasonably be tied to the above then GDPR doesn't apply. I am in favor of rules around the usage and collection of PII information. i.e. that information should not be shared with other parties without the user's consent and in general access should be restricted. My main beef with GDPR, is the difficulty to implement such a system, with on demand wipeout.
• ivan_gammel 7y ago
  This all is a reflection of the old talks about the costs of doing technical things right. One way of looking at them is that if something works for business, we should not pursue better software architecture or improve security or usability. Another way is to analyze and estimate the technical debt and eventually start paying it. This is exactly what happens with privacy now: business may cry about "removed incentives", "prohibiting costs", "eliminated opportunities" and other BS, but in the end it's just a compliance debt that they are not willing to pay. GDPR identified that debt and the mechanisms for claiming it, that's it. After the dust settles, there will be plenty of best practices and educated people which will make compliance easy, certain business models unpractical and the business will go as usual. Yes, compliance isn't a piece of cake, but there's nothing written in that law which a sane engineer or manager would not implement. Even the right to be forgotten makes sense: information about past crimes distributed via search is a kind of extrajudicial punishment which makes it much harder for people who already served their sentence to find a job and return to normal life. It's a job of a government to prevent them from committing another crime, it's not a job of a search engine or a news website.
  • tschellenbach 7y ago
    I don't think it's the goal of privacy or the tech that caused the costs to be soo high. Probably more related to the ambiguity of the law.
    • dmitriid 7y ago
      This lw has been in effect in the form of various national laws for over a decade. GDPR is only slightly different from Swedish national Data Protection Law, for example. So yes, this entirely the tech’s fault and debt. We as an industry have ignored these laws for too long, and now crying because the debt is being collected. Boo hoo. Cry me a river.
    • ivan_gammel 7y ago
      I don't think the law is ambiguous. It's usually the situation when GDPR is already violated or going to be violated and data processor wants to find the least expensive solution to reduce the risks. In other words, it's not "How we should do it?", but rather "How difficult it will be to challenge our solution X in court? What our chances to win?" THIS is ambiguous, but it's the same with any regulation.
• nudpiedo 7y ago
  Meanwhile, people started to believe that Google reads their mind and society evolved the way they behave as The Internet transforms the consequences for acts such as chatting or posting things in public (or having certain opinions in public)... I think GDPR same as other laws protecting citizens from The Internet failed to protect the user, even if it was a good first try, to begin with. Hope some standardization will come in the future to prevent all cookies or some HTML tag standard or whatever.
  • dcbadacd 7y ago
    We have the Do-Not-Track header that should be interpreted as a denial to all cookie notices and GDPR requests but they didn't write that into the law.
    • anoncake 7y ago
      The ePrivacy regulation is supposed to introduce something like like that. Passing it would require the consent of Austria or, of course, a sensible political system for the EU.
    • nudpiedo 7y ago
      exactly, that's what I mean: it cannot be part of a law... but such standard must exist and be enforced by the browser, same as window.alert is a browser pop up and not a javascript one. The cookie rejection should do it in the same way. Laws like GDPR are encountering problems to be enforced without being too intrusive with the technology and the freedom to create products/standards.
• _fizz_buzz_ 7y ago
  I am pretty ok with most of those. However, article 17, the right to be forgotten sounds extremely problematic.
  • ivan_gammel 7y ago
    The right to be forgotten is the equivalent of the right to no punishment without the law. The deeds must be interpreted and judged by a court, not by a public, basing their opinion on newspaper publications. When someone is denied a job because there were some news about him in Google from many years ago, it's a form of extrajudicial punishment, which is illegal, and must be prevented.
    • seventhtiger 7y ago
      It's far too powerful. It makes sense when you think of publishers and articles about criminal cases. It becomes much harder in social media. If I type your name in a comment that I own, the platform becomes obligated to destroy my intellectual property to satisfy your right to be forgotten. If a book is written with a politician's name in the title, can the politician ban this book from the Internet?
      • afiori 7y ago
        > If a book is written with a politician's name in the title, The politician would need to argue that his/her own name is problematic. > If I type your name in a comment that I own, If you write a long comment about how I am a terrible person because of action I took 10 years ago and are no longer relevant, yes. As far as I understand the right does not apply to you human to be forgotten, but to specific information about you that are no longer relevant.
        • seventhtiger 7y ago
          You are giving a government body the power of total Internet censorship and trusting in their opaque process to determine whether each request is warranted or not. I can understand many arguments for censorship for the greater good. This is censorship as an individual right enabled by a closed review process. I believe it will have far reaching implications and it will be fertile grounds for corruption. A massively powerful governance tool is created and all its stated goals are of limited public good.
• addicted 7y ago
  The major benefit that GDPR has brought (at least in our company, and I suspect in other companies as well), is an increased emphasis on not storing user data that is not needed. The idea that user data is useful, but it’s also a liability. This likely will lead to certain private data that companies would otherwise have saved, because why not, not being saved anymore, which would reduce the damage caused by a breach, which will never show up in numbers and stats.
• anoncake 7y ago
  > If your account gets hacked, the hacker can use the right of access to get all of your data. If your account gets hacked, the hacker has access to your account. Duh. > The right to be forgotten is in conflict with the public’s right to know a bad actor’s history (and many of them are using the right to memory hole their misdeeds). People can change. Newspapers can exaggerate one's misdeeds. > And the right to opt-out of data collection creates a free-rider problem where users who opt-in subsidize the privacy of those who opt-out. Opting out of data collection isn't a thing under the GDPR. Breaking business models that involve people selling their privacy is an intended consequence of the GDPR. > “Amazon sent 1,700 Alexa voice recordings to the wrong user following data request” (The Verge) Doesn't sound like a company that can be trusted to ensure people's privacy without regulation. > “The problem with data portability is that it goes both ways: if you can take your data out of Facebook to other applications, you can do the same thing in the other direction. The question, then, is which entity is likely to have the greater center of gravity with regards to data: Facebook, with its social network, or practically anything else?” (Ben Thompson) Freedom includes the freedom to make bad decisions. > “Presumably data portability would be imposed on Facebook’s competitors and potential competitors as well. That would mean all future competing firms would have to slot their products into a Facebook-compatible template. Let’s say that 17 years from now someone has a virtual reality social network innovation: does it have to be “exportable” into Facebook and other competitors? No more than Facebook has to create a search engine so you can export your search history into Google. > “About 220,000 name tags will be removed in Vienna by the end of [2018], the city’s housing authority said. Officials fear that they could otherwise be fined up to $23 million, or about $1,150 per name.” (The Washington Post) The data protection authorities later told them that this is bullshit. > As of March 20, 2019, 1,129 US news sites are still unavailable in the EU due to GDPR. (Joseph O’Connor) "Losing" businesses that don't respect privacy is intended. It's kinda flattering that so many US news sites specifically cater to EU residents, making them subject to the GDPR. But frankly: We don't care much about your local news. > During a Senate hearing, Keith Enright, Google’s chief privacy officer, estimated that the company spent “hundreds of years of human time” to comply with the new privacy rules. (Quartz) > However, French authorities ultimately decided Google’s compliance efforts were insufficient: “France fines Google nearly $57 million for first major violation of new European privacy regime” (The Washington Post) The French authorities rightfully didn't care how much time Google spent on not complying with the GDPR. > Tradeoff between privacy regulations and market competition Oh no, we might lose the ad market. > GDPR has been the death knell for small and medium-sized businesses Companies that cannot safeguard their users' privacy shouldn't exist, not to mention those whose business model is based on infringing on their users' privacy. --------------------------------------------- The "arguments" ad companies use against the GDPR are just absurd. EU 2016: We don't want businesses based on violating our citizens' privacy to operate anymore. You have two years two comply. Ad companies 2018: Evil government! If you force us to stop violating our customers' privacy, we will stop violating our customers' privacy! You will regret this! And why didn't you warn us? --------------------------------------------- GDPR: You must ask your customers to opt into data collection, letting them opt out is not sufficient. Ad companies: The evil EU fined us for not complying with the GDPR! That's unfair! How could we know that "letting them opt out is not sufficient" means that letting them opt out is not sufficient? The GDPR is so vague! And we spent so much money on not complying!
• franciscop 7y ago
  Color me surprised, scammy business are losing millions and exiting the EU. I'm totally happy about the outcome. Though there is still a lot of abuse and dark patterns going on, I believe most of them should make it as easy to "opt all in" as "opt all out" for the cookies for instance.
  • maximus1983 7y ago
    The problem is any regulation is that it increases the startup costs for smaller businesses. So as more regulation comes in it will just end up cementing the large players in place as they can absorb the costs of any regulation, while smaller businesses will have higher startup costs (which lets face it were next to nothing). So while you maybe rejoicing now that shitty companies have gone for now, regulation will just make it harder for these massive companies to be toppled as it makes it harder for smaller companies to comply. The EU are trying to have article 13 pushed through and any site that has user generated content will have to have some sort of upload filter to check for copyrighted content. That is going to cost money to implement and since Youtube hasn't really be able to achieve it, the only people that will be supplying the software will be the likes of Google, Microsoft etc ... So again it will just make it harder to the small business and help the large businesses. Also a lot of these regulations make are making the web a shittier place. Every time I go onto a site now, I have the stupid cookie and GDPR notice plaster in front of what I want to look at. I already protect myself and don't care about their attempt to track me. It is just an irritation that nobody pays attention to and it achieves the opposite of what it was intended to achieve.
    • oblio 7y ago
      Legislation is not meant for you (at least for now). It's meant for those who cannot/do not know how to protect themselves.
      • friedman23 7y ago
        >It's meant for those who cannot/do not know how to protect themselves. Like EU media giants?
• pixelmonkey 7y ago
  I have an interesting question about GDPR and all legal compliance efforts. When GDPR was first announced, I studied it in-depth because I'm the CTO of a company involved in first-party content analytics, and I wanted to ensure we complied. In addition to making changes internally and technically to ensure compliance, I also prepared a long Google Slide presentation that basically summarized my technical understanding of GDPR, after receiving the advice of several privacy attorneys. The information in this slidedeck was presented to my whole company, as a way to further ensure compliance -- to make sure my employees understood the policy at least as well as I did, since I had spent countless hours discussing the implications of the law -- as well as reading the raw text, which is excellently published/annotated by Algolia here: https://gdpr.algolia.com/gdpr-article-1 https://gdpr.algolia.com/gdpr-article-1 My inclination was to publish this deck I had painstakingly prepared publicly, because certainly it would be valuable to others. I publish a lot of stuff publicly on our blog, for example: https://blog.parse.ly/post/author/andrew-montalenti/ https://blog.parse.ly/post/author/andrew-montalenti/ -- with the only goal being to share information with the community. But then, one of my attorneys advised me against this. Basically, the concern was that if I publish something publicly about my understanding of GDPR, and it contains an error of understanding (after all, IANAL), then I could be held accountable for that. That felt really crappy to me -- after all, I'm just doing the best I can, and it seems like there's a lot of misinformation about GDPR out there on the web. Does anyone know anything much about this? To what degree can a company executive get him or herself in trouble for publishing a document that summarizes his or her own understanding of the effect of regulation, if the executive's company is potentially affected by said regulation?
  • nihonde 7y ago
    “...there’s a lot of misinformation about GDPR out there on the web” It sounds like your lawyer is telling you not to add to that misinformation. Also, you already said this deck is based on advice from counsel, so you’re maybe dragging them into an endorsement, and there are strict ethical rules about what lawyers can opine about to non-clients. Anyway, GDPR is not that hard to understand. Just read the source materials. It’s one of the least-difficult legal texts you can take on. Also, why bother? Like the EU directive before it, there won’t be any meaningful enforcement of these rules. A few examples will be made, but you’ll need to be woefully unlucky to be one of those. I wish I weren’t so cynical but I’ve been following this area since 1997. It’s just an excuse for lawyers and consultants to rack up fees through careful manipulation of FUD. The intentions of the lawmakers are good, I’m sure, but laws without truly vigilant enforcement are eventually flaunted. (IAAL but not your lawyer.)
• dmitriid 7y ago
  > And the right to opt-out of data collection creates a free-rider problem where users who opt-in subsidize the privacy of those who opt-out. The actual fuck? Pardon the language, but I cannot express this strongly enough. What does ”subsidize” mean? Users who agree to sell their data subsidize those who agree not to sell their data? And not having to rely on data sales puts financial burden on companies and drives them out of business? Good riddance
• friedman23 7y ago
  >Startups: One study estimated that venture capital invested in EU startups fell by as much as 50 percent due to GDPR implementation. (NBER) https://www.nber.org/papers/w25248 https://www.nber.org/papers/w25248 That is massive. This will just further brain drain even more.
• umvi 7y ago
  Does GDPR mean blockchain based records are illegal? If a user's data is in the blockchain, there is no way to delete it...
  • lewis1028282 7y ago
    Yes but it is personal information about a living person? I doubt it, it's pseudo-anonymous so I believe it is legal under GDPR.
    • Avamander 7y ago
      Certificate Transparency logs contain personal information about a few people right now. Is that legal?
      • anticensor 7y ago
        Yes, but can only be used to contact to certificate authors about certificate-related matters.
        • Avamander 7y ago
          You're wrong, just search for ESTEID in the logs.
          • anticensor 7y ago
            EstEID is a purpose-built identifier. They are subject to a different law.
            • Avamander 7y ago
              How is a purpose-built identifier uploaded without explicit consent somehow not subject to GDPR?
      • lewis1028282 7y ago
• idlewords 7y ago
  Listing Klout as a casualty of the GDPR is like listing polio as a casualty of vaccination. Ditto for the vast swamp of ad intermediaries. It shows the legislation working as intended.
• jandrewrogers 7y ago
  This overlooks one of the biggest under-reported problems GDPR has created: a large percentage of all industrial sensor data is "personal data" under GDPR. These are systems and companies that nobody associates with collecting or using personal data, because their business isn't about people, but the regulations have defined the scope broadly enough that there is universal agreement among their legal experts that are liable for not treating this data as "personal" under GDPR. This raises some difficult challenges that the average Internet business doesn't have to deal with: - Compliance with GDPR requirements for personal data in many industrial settings is operationally impossible. These aren't Internet ad tech databases. - Some industrial systems aren't the kinds of things you can trivially upgrade to make them compliant in any case. We are talking embedded systems with operational lifespans measured in decades. In many cases there are other strict regulatory compliance requirements around the design and modification of these systems. - The workloads and data models for some high-scale sensor data models make it technically impossible, given the current state of computer science and hardware, to comply with some obligations under GDPR when handling "personal" data. And for a much larger set of systems, it would be economically implausible even though theoretically possible. - Sensor data infrastructure software often lacks the basic functionality required to support compliance, as the functionality that the regulators assumed exists for other purposes has no purpose in this context and therefore has never been implemented. There is a disconnect between what is required of the software users and what the upstream vendors can or are willing to provide. These aren't software companies. - For some specific industry sectors, compliance costs disproportionately fall on EU-based companies by virtue of the fact that their primary operations are in a European country, even though they sell into a global market. That's an economic own goal. This has become a Sword of Damocles over some industrial companies because their legal teams have studied their exposure to GDPR, identified substantial compliance obligations, and realized that compliance is effectively impossible. It is pretty clear to me that the regulators were so focused on Internet advertising companies and similar that they were completely oblivious to the unintended consequences for unrelated industrial sectors. I've been studying this problem for a few industrial sectors for a couple years now. You have companies scrambling to find technology that often doesn't exist and in some cases requires hardcore computer science R&D before it could exist. And this is a business opportunity for someone to add a tax to what these companies produce. But the worst part is that this extremely expensive compliance exercise does almost nothing for personal privacy because most of this data was being collected for boring industrial applications.
• Quanttek 7y ago
  > individual “data rights” have led to unintended consequences; “privacy protection” seems to have undermined market competition; That opening paragraph already speaks to the over-elevation of the market over any other concerns. So it perfectly fits onto "news.ycombinator.com". Human rights, including privacy and data rights, are more important than the profits of some companies Most examples in the text are, for instance, related to companies failing to properly implement the GDPR (Amazon sending data to the wrong person, Spotify not asking for 2FA/email confirmation for the bulk download, companies deleting articles even when there would sufficient public interest, Ad vendors failing to ensure compliance and therefore seeing drops in demand, ...), that is, market failures - something this site would probably not call out but rather attribute it to the legislation.
  • Camas 7y ago
    > that is, market failures - something this site would probably not call out but rather attribute it to the legislation. Socially shaming companies does very little compared to legislation, so that's completely understandable.
    • Quanttek 7y ago
      In general this might be agreeable. But in these cases these are not direct unintended consequences of the legislation but rather consequences of companies failing to do their due diligence when implementing GDPR. It would be like companies putting people in bomb disposal suits after sth like OSHA is implemented and complaining about the cost and lost productivity. Or to take the EU: Recently the CJEU ruled that all work time has to be tracked (not only overtime), and a German company (in Germany this wasn't mandated before) would force employees to install invasive phone apps that track location etc. and use to determine work time. Employees rightfully complaining should direct their anger at the company, not at a law that would work perfectly well with a standard punch card system
      • nordsieck 7y ago
        > But in these cases these are not direct unintended consequences of the legislation but rather consequences of companies failing to do their due diligence when implementing GDPR. The complexity of additional law is part of its unintended consequences.
• billconan 7y ago
  When GDPR first came out, I found the terms pretty vague. I don't know how I can implement it. For example, a user's email is Personally Identifiable Information. When the user wants to delete her account, I shall remove her email. This is ease. But what if in my comment system, another user mentioned her email in a comment. Do I need to remove this comment too? What if this comment has replies too, should I remove all the replies? What if a competitor make use of these undocumented gray areas to attack my business?
  • anoncake 7y ago
    > What if a competitor make use of these undocumented gray areas to attack my business? Then your regulator might ask you to remove the comment in question.
  • Drdrdrq 7y ago
    Yes, you need to remove the said comment (or PII in it) upon their request (ianal,...). I don't see how a competitor could abuse that.
    • billconan 7y ago
      Because you now need to implement a full text search or even natural language processing to identify personal identities in your comment, and that’s quite challenging. An evil competitor could register several accounts, purposely leave those comments with personal identities of those accounts on the system and then request to remove one of the accounts. Your algorithm needs to parse those comments, identify which Comments mentioned the to be removed identity, and remove them without breaking the integrity of your database. Failing to do that, you get sued...
• rietta 7y ago
  Pottery Barn, owned by Williams-Sonoma, is a weird mention. They sell household goods from mall stores and their online catalog. There exposure to GDPR should be pretty minimal. Ship the product and don't sell your customer list and basic security work that they should be doing already.
• downandout 7y ago
  This seems like a pretty even-handed analysis of the consequences of GDPR. I correctly predicted most of them, and have been highly criticized for it. It’s truly stunning to me that a community like HN that consists of many current and future startup executives can be so adoring of regulation that has “been the death knell for small and medium-sized businesses“ and for which “compliance costs are astronomical” according to the article. I sense that it is mostly the vocal minority making these comments that ignore the seriously negative consequences of GDPR and paint any company or person that is critical of it as a privacy abuser. I suspect that it is the same small group of abusive users that downvote any comment critical of GDPR into oblivion. Still, it is a very bad look for a community that claims to be so invested in startup culture. It really is OK to recognize that something with good intent (privacy legislation) can be poorly written and consequently fraught with problems (like GDPR). Any idiot could have predicted that the fine structure they imposed meant potential death for small businesses and a mere speed bump for large ones. GDPR should be torn up and rewritten. The fine structure should be a percentage of revenue, period - not 4% of revenue or €20 million, whichever is higher. That is ludicrous and was designed specifically to drive small businesses out of the market.
  • downandout 7y ago
    I suspect that it is the same small group of abusive users that downvote any comment critical of GDPR into oblivion. Case in point, this post. Downvoted with no replies - just a handful of people hiding behind their mice with no counterarguments.
• iamaelephant 7y ago
  Libertarianism is toxic.
• simplecomplex 7y ago
  Glad I live in and do business from the US where we don’t have to deal with this wasteful and oppressive law.
• admax88q 7y ago
  > Amazon sent 1,700 Alexa voice recordings to the wrong user following data request You know the best way to prevent sending 1,700 voice recordings? Not making 1,700 voice recordings in the first place. Amazon will eventually mess up and send leak data to the wrong person. Blaming this on the GDPR is stupid. If Amazon actually respected user privacy they wouldn't make those recordings in the first place.
• liveoneggs 7y ago
  every GDPR request I've seen has been public figures (actors, etc) asking to be forgotten from commercial acts (movies) they were in and no longer like. It's ridiculous.
• scarlac 7y ago
  Several specifically pre-GDPR issues are mentioned but still attributed to GDPR. GDPR is a win for the consumer. Not perfect, but overall a great step forward. But I do think The Right To Be Forgotten is a terrible idea. However, it was NOT introduced with GDPR, and there are several cases prior to GDPR. Perhaps there are good points to be made. But the article fails to stay sober with the misleading and sensational claims.
• davidhyde 7y ago
  Highlighting the cost of privacy is the very point of GDPR. This is the only way companies will stop collecting personal data by default and think very carefully about the consequences of what they keep.
• lucb1e 7y ago
  Well that's a rather biased account with cherry picked and anecdotical evidence.