6 ms·

A £99 million fine is on its way for Marriott after their 2018 breach of 30 million EU citizen guest records, for lack of due diligence over data security. Tho

A £99 million fine is on its way for Marriott after their 2018 breach of 30 million EU citizen guest records, for lack of due diligence over data security. Those who said EU regulations had no teeth last year might need to readjust their expectations. This follows on from BA's large fine a few days ago.

dalbasal 7y ago
The data security side of gdpr is strong, imo. Even before these fines, the disclosure requirement is "teeth." It's already having major positive impact. The user consent parts of gdpr, are, imo, not good. Any wins though are better than nothing.
- vijayr02 7y ago
  Genuine question: what specific changes to the user content parts would you want to see? Thanks
  - gnode 7y ago
    I'm assuming they meant enforcement of Art. 7 of the GDPR: https://gdpr-info.eu/art-7-gdpr/ https://gdpr-info.eu/art-7-gdpr/
    - dalbasal 7y ago
      Enforcement is certainly not great, but I actually meant that I think it is badly conceived.
  - dalbasal 7y ago
    I don't have a strong/mature alternative of my own. But, I feel that assuming a pseudo-contractual relationship between websites and users is euphemism. I feel the same way about user agreements. The south park parody of apple's sums it up, for me. Not even judges read it. It can't form the basis of a consent model. I think bans on certain types of tracking would be preferable to "consent." If we are determined to have explicit contracts, we need to be realistic and take incentives into account. If the website controls the UI of the "opt in," language of the contract and such... they have a high level of control over outcomes... and these are highly manipulated to secure convenient outcomes. UI plays a far bigger role in determining the "consent" outcomes than user preferences. So, if we are determined to go down this route, "consent management" needs to be "open" to 3rd parties chosen by users and allow central management, user selected defaults and 3rd party recommendations/defaults. If user consent actually reflected informed user preferences, FB's tracking pixel would be disabled for >90% of users. What possible benefit is this to users? The overlap between people who are paranoid that FB is listening to their conversations via the phone mic and users who have "consented" to advertiser cookies on a bunch of sites tells me that this model for consent is fundamentally broken. On the flip side if you (or someone) doesn't mind.... I can tell from the downvotes (also on similar comments) that this is an unpopular opinion. Anyone care to defend gdpr "consent" as it exists currently. I don't mean the aspirational language of the law, I mean consent in the wild under gdpr today.
    - TazeTSchnitzel 7y ago
      I personally doubt that the common click-here-to-agree-to-everything implementations in the wild comply with the law, and I expect they are under scrutiny and the hammer will come down on them at some point.
- gnode 7y ago
  > The user consent parts of gdpr, are, imo, not good. Indeed, this seems to be really lacking as far as I've seen. Compliance with article 7 section 4 in particular (provision of service must not be conditional on consent for processing of personal data not necessary for provision of that service) is blatantly ignored by many actors, with a message of "accept our tracking or we won't let you see our content". Others pretend to be in compliance by having an opt-out which never completes, or other dark patterns.
  - cevn 7y ago
    Agree, this needs to be seriously enforced. Web browsing is a PITA now with all these popups that only have an "I Accept" box with no way to dismiss the notification otherwise. Usually I just close the tab.
    - Benjamin_Dobell 7y ago
      Luckily they're usually poorly implemented and you can just "Inspect Element" + delete. Although, in saying that, given the lack of official opt-out functionality, using the site will probably result in tracking.
      - klez 7y ago
        Wasn't the point (or at least one of them) of the GDPR that the consent was to be opt-in?
        gnode 7y ago
        Yes. So if they track you after you delete their consent overlay, you'd have grounds to complain about them to your data protection agency.
    - TeMPOraL 7y ago
      Since so many companies seem to be outsourcing these popups, possibly because they're enrolled in some ad-network cooperations, I wonder if it would be possible to build a browser extension that would automatically submit these forms with everything set to "no consent".
rjtavares 7y ago
Also in need to readjust their expectations: those that said everybody would be fined because it's impossible to comply with GDPR rules. So far, fines have been pretty reasonable and for clear offenses.
gnode 7y ago
I think the accusation that the GDPR has no teeth is not about the magnitude of fines. The GDPR promised great enhancements to privacy and freedom in the text of the legislation (opt-in data processing consent not conditional on service; right to data erasure; data portability). In practise, enforcement has been focused on punishing poor security, rather than lack of privacy or freedom.
- simias 7y ago
  That's fair, although even if they still only focus on breaches I think it might improve privacy indirectly: the database that's hardest to hack is the one that doesn't exist. If companies get in the mindset that storing client data is a big liability they might decide that archiving everything and anything forever might not be such a clever decision after all.
  - amputect 7y ago
    This is, as I understand it, the goal. I mentioned this in a different comment, but getting companies to think of unsecured consumer data as a liability is absolutely key to getting them to take privacy seriously. Companies need to consciously decide if the risk of accruing this data is worth the downside. Pre-gdpr there was functionally no downside at all.
  - Silhouette 7y ago
    If companies get in the mindset that storing client data is a big liability they might decide that archiving everything and anything forever might not be such a clever decision after all. I think this would be a stronger argument if other EU laws didn't actively require the collection and long-term retention of some of the most important personal information, including identity and financial details, for other purposes such as VAT audits. Such obligations often preclude otherwise reasonable data management strategies like encrypting all personal data with a per-account key that can be easily deleted and thus render everything connected with a given account permanently inaccessible in the event of an erasure request etc. Instead, data controllers are in principle supposed to keep track of every possible purpose for which personal data could be processed, even those originating in theoretical legal requirements that are rarely if ever used in practice, as they applied at the time each item of personal data was first collected and at all times since; to retain each individual data point for as long as any purpose for which it might be needed continues to apply; and then to delete that data promptly once its final purpose is no longer relevant. I suggest that few if any data controllers are actually doing this. Instead I suspect almost everyone who is trying in good faith to comply with the GDPR is using sufficiently generic purposes and blanket provisions to simplify their position to a manageable level of complexity. (How many privacy policies have you read since GDPR came out that actually stated a concrete time period for retaining each category of personal data being processed, and how may have you seen that rely on abstract wording about keeping the data for as long as any stated purpose applies or something similar?) No doubt many other organisations are simply not complying with the GDPR rules about retention and deletion at all, perhaps through ignorance, or perhaps as a deliberate choice that they hope to get away with.
tomatotomato37 7y ago
I never really understood the arguments over the GDPR having teeth or not; it's a EU mandate, whatever teeth it will have is dependent on what each member country decides it will have. That's just how confederations work

dalbasal 7y ago

The data security side of gdpr is strong, imo. Even before these fines, the disclosure requirement is "teeth." It's already having major positive impact. The user consent parts of gdpr, are, imo, not good. Any wins though are better than nothing.

vijayr02 7y ago
Genuine question: what specific changes to the user content parts would you want to see? Thanks
- gnode 7y ago
  I'm assuming they meant enforcement of Art. 7 of the GDPR: https://gdpr-info.eu/art-7-gdpr/ https://gdpr-info.eu/art-7-gdpr/
  - dalbasal 7y ago
    Enforcement is certainly not great, but I actually meant that I think it is badly conceived.
- dalbasal 7y ago
  I don't have a strong/mature alternative of my own. But, I feel that assuming a pseudo-contractual relationship between websites and users is euphemism. I feel the same way about user agreements. The south park parody of apple's sums it up, for me. Not even judges read it. It can't form the basis of a consent model. I think bans on certain types of tracking would be preferable to "consent." If we are determined to have explicit contracts, we need to be realistic and take incentives into account. If the website controls the UI of the "opt in," language of the contract and such... they have a high level of control over outcomes... and these are highly manipulated to secure convenient outcomes. UI plays a far bigger role in determining the "consent" outcomes than user preferences. So, if we are determined to go down this route, "consent management" needs to be "open" to 3rd parties chosen by users and allow central management, user selected defaults and 3rd party recommendations/defaults. If user consent actually reflected informed user preferences, FB's tracking pixel would be disabled for >90% of users. What possible benefit is this to users? The overlap between people who are paranoid that FB is listening to their conversations via the phone mic and users who have "consented" to advertiser cookies on a bunch of sites tells me that this model for consent is fundamentally broken. On the flip side if you (or someone) doesn't mind.... I can tell from the downvotes (also on similar comments) that this is an unpopular opinion. Anyone care to defend gdpr "consent" as it exists currently. I don't mean the aspirational language of the law, I mean consent in the wild under gdpr today.
  - TazeTSchnitzel 7y ago
    I personally doubt that the common click-here-to-agree-to-everything implementations in the wild comply with the law, and I expect they are under scrutiny and the hammer will come down on them at some point.
gnode 7y ago
> The user consent parts of gdpr, are, imo, not good. Indeed, this seems to be really lacking as far as I've seen. Compliance with article 7 section 4 in particular (provision of service must not be conditional on consent for processing of personal data not necessary for provision of that service) is blatantly ignored by many actors, with a message of "accept our tracking or we won't let you see our content". Others pretend to be in compliance by having an opt-out which never completes, or other dark patterns.
- cevn 7y ago
  Agree, this needs to be seriously enforced. Web browsing is a PITA now with all these popups that only have an "I Accept" box with no way to dismiss the notification otherwise. Usually I just close the tab.
  - Benjamin_Dobell 7y ago
    Luckily they're usually poorly implemented and you can just "Inspect Element" + delete. Although, in saying that, given the lack of official opt-out functionality, using the site will probably result in tracking.
    - klez 7y ago
      Wasn't the point (or at least one of them) of the GDPR that the consent was to be opt-in?
      - gnode 7y ago
        Yes. So if they track you after you delete their consent overlay, you'd have grounds to complain about them to your data protection agency.
  - TeMPOraL 7y ago
    Since so many companies seem to be outsourcing these popups, possibly because they're enrolled in some ad-network cooperations, I wonder if it would be possible to build a browser extension that would automatically submit these forms with everything set to "no consent".

rjtavares 7y ago

Also in need to readjust their expectations: those that said everybody would be fined because it's impossible to comply with GDPR rules. So far, fines have been pretty reasonable and for clear offenses.

gnode 7y ago

I think the accusation that the GDPR has no teeth is not about the magnitude of fines. The GDPR promised great enhancements to privacy and freedom in the text of the legislation (opt-in data processing consent not conditional on service; right to data erasure; data portability). In practise, enforcement has been focused on punishing poor security, rather than lack of privacy or freedom.

simias 7y ago
That's fair, although even if they still only focus on breaches I think it might improve privacy indirectly: the database that's hardest to hack is the one that doesn't exist. If companies get in the mindset that storing client data is a big liability they might decide that archiving everything and anything forever might not be such a clever decision after all.
- amputect 7y ago
  This is, as I understand it, the goal. I mentioned this in a different comment, but getting companies to think of unsecured consumer data as a liability is absolutely key to getting them to take privacy seriously. Companies need to consciously decide if the risk of accruing this data is worth the downside. Pre-gdpr there was functionally no downside at all.
- Silhouette 7y ago
  If companies get in the mindset that storing client data is a big liability they might decide that archiving everything and anything forever might not be such a clever decision after all. I think this would be a stronger argument if other EU laws didn't actively require the collection and long-term retention of some of the most important personal information, including identity and financial details, for other purposes such as VAT audits. Such obligations often preclude otherwise reasonable data management strategies like encrypting all personal data with a per-account key that can be easily deleted and thus render everything connected with a given account permanently inaccessible in the event of an erasure request etc. Instead, data controllers are in principle supposed to keep track of every possible purpose for which personal data could be processed, even those originating in theoretical legal requirements that are rarely if ever used in practice, as they applied at the time each item of personal data was first collected and at all times since; to retain each individual data point for as long as any purpose for which it might be needed continues to apply; and then to delete that data promptly once its final purpose is no longer relevant. I suggest that few if any data controllers are actually doing this. Instead I suspect almost everyone who is trying in good faith to comply with the GDPR is using sufficiently generic purposes and blanket provisions to simplify their position to a manageable level of complexity. (How many privacy policies have you read since GDPR came out that actually stated a concrete time period for retaining each category of personal data being processed, and how may have you seen that rely on abstract wording about keeping the data for as long as any stated purpose applies or something similar?) No doubt many other organisations are simply not complying with the GDPR rules about retention and deletion at all, perhaps through ignorance, or perhaps as a deliberate choice that they hope to get away with.

tomatotomato37 7y ago

I never really understood the arguments over the GDPR having teeth or not; it's a EU mandate, whatever teeth it will have is dependent on what each member country decides it will have. That's just how confederations work