9 ms·

The GDPR doesn't specify what you can't do with personal data, it specifies what you can do. Personal data is private by default; you can only use my data if it

The GDPR doesn't specify what you can't do with personal data, it specifies what you can do. Personal data is private by default; you can only use my data if it is explicitly lawful for you to do so. If you're not absolutely sure that what you're doing is in line with the GDPR, you shouldn't do it. That's by design, not by accident. The GDPR's fundamental principles are set out in article 5. You should collect the least amount of data possible, you should process it only for specific, explicit and legitimate purposes and you should delete it as soon as possible once you've finished. Can anyone legitimately argue that a facial recognition system is the least intrusive way of collecting attendance data? Would any reasonable person believe that constant video surveillance with facial recognition technology is no more intrusive than taking the register at the start of class? I think not. The actions of the school authorities were in flagrant breach of the GDPR and they fully deserve to be fined. There's no second-guessing in this case, no grey area, just an organisation that used advanced surveillance technology to monitor children without giving a moment of thought to the privacy implications. This fine is precisely in line with the intentions of the European Parliament when they signed the GDPR into law. https://gdpr-info.eu/art-5-gdpr/ https://gdpr-info.eu/art-5-gdpr/

tapland 7y ago
Afaik the ruling also stated that parents abd children dont have a resonable ability to consent towards a school.
- cameronbrown 7y ago
  That makes sense. Opt out for even just one individual would be effectively impossible, otherwise how would the system know who's opted out without remembering them in some way.
  - tpxl 7y ago
    A person who has not opted in has opted out. No tracking necessary.
    - cameronbrown 7y ago
      You really think they're going to design things opt in and not opt out?
      - tpxl 7y ago
        The question was how do you track whether people have opted in or not, by not having biometrics for people who have opted out. The solution is simple, if you do not recognise the person, they have not opted in. According to the article, the experiment was constructed as opt in and several students have opted in.
        cameronbrown 7y ago
        The thing is, aren't all the efficiency gains wasted if even just a couple students opt out? You've still got to take a register, even if shorter. It can't be worth it for a few extra minutes.
  - zaroth 7y ago
    This was a tech trial where 22 students and their parents (both separately) opted in to take part over 3 weeks. The teacher also opted-in.
- xxs 7y ago
  It's covered by recital 43 which deals with public institutions and power imbalance. There is no practical way for a student (or their parents) to say no, given the circumstances.
tomatocracy 7y ago
I don't think the argument was that it was not in line with GDPR. The argument is that GDPR is wrong itself in not allowing people to consent to anything which goes beyond "minimal" data collection for the purpose needed, because whether it is "minimal" is, in some sense, a value judgment as to how much convenience and innovation matter. It seems to me that the principle should be personal "ownership" of personal data - and "ownership" of data should imply the owners have the right to alienate that data as the owner sees fit, with the right safeguards to ensure this isn't coerced or a result of fraud. On the other hand, this type of scenario doesn't feel much like the consent given was really voluntary - (1) because noone wants to be the one person who stopped the school from doing something which everyone else was on board with and (2) because it involved adults consenting on behalf of children for something which the children may not be happy about in future when they are adults and it's too late.
- crooked-v 7y ago
  The reason that the GDPR is so expansive is that 'voluntary' consent means nothing when your only alternatives to not 'voluntarily' consenting are moving to a different city or going completely without a given service. See how, for instance, literally every major internet provider in the US have contract clauses that amount to 'we can do whatever we want with your personal information forever, neener neener'.
- sokoloff 7y ago
  As a parent, I constantly make choices on behalf of my children that they (or I) may not be happy about in the future and it’ll be too late.
mytailorisrich 7y ago
The issue with the GDPR as worded and this ruling is that they remove the possibility of informed individual decisions. In this case it seems that all involved were informed and OK with it but that did not matter. I would also think that knowing where pupils are at all times is quite a legitimate aim for a school.
- deleted 7y ago
  [deleted]
- ziddoap 7y ago
  Do you have any evidence that all parties provided informed consent? i.e. The consent form detailed out what could happen in the (somewhat likely) event the data is breached and how the data may be used? What other parties have access to the information and how that information is stored? How the information is transmitted? And they understood it all, with the attached implications? Considering the only words the person who oversees both high schools had to say on record was that the technology is "fairly safe", I am somewhat doubting that the parents had a fully formed view of what the potential downfalls of the program are if/when it is breached or misused, or even malfunctions. I think when we are dealing with advanced tech such as facial recognition it is analogous to the informed consent issues doctors face. How can someone possibly obtain informed consent from non-experts over something that requires years of schooling to understand?
  - mytailorisrich 7y ago
    This is going over the top. It was just about using facial recognition in a school, not about having brain implants in children... Schools already have pictures and detailed personal details of all pupils. This new technology can have real benefits. For example it could be used to locate a pupil that does not show up in class when they should, or to trigger an alert if a pupil leaves school when not expected to or when someone unknown is detected. To me the law should protect but not prevent useful applications that people agree to, and I think that this specific case shows that, as they stand, the GDPR can be over-restrictive.
jimmaswell 7y ago
Choosing between European internet laws and having a tech sector, I'd pick having a tech sector any day. It's all totally unnecessary strangling of innovation. The entire idea that you own data pertaining to you is absurd.
- intertextuality 7y ago
  This is not a dichotomy. We can have a tech sector that’s also compliant with laws like GDPR.
  - ggreer 7y ago
    No, you can't. Since GDPR was rolled out, venture capital investments in the EU have dropped by a third.[1] According to that paper, the companies most hurt are early stage startups. 1. The Short-Run Effects of GDPR on Technology Venture Investment: https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3278912 https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3278912
    - maldeh 7y ago
      That presumes all early stage startups (as made in the US) are created equal, and any regression in their success rates is bad. Given that 9/10 startups fail even without GDPR, it's not surprising that early stage cos form the Lion's share of failures, and it surely can't be good for any data that was slurped up during whatever these experiments at market fit were doing. And given that the ultimate goal of GDPR is to protect privacy, it doesn't make sense to exempt startups, especially when the early stage stakes are high and a failure to squeeze out every drop of value legally possible out of your data (while your competitors do) could mean the death of your venture. As such, comparing to American standards or even current European standards doesn't quite work when there's a clear shift of the moral bar for GDPR compliance.
      - ggreer 7y ago
        You misunderstand the point I'm making. After GDPR, investments in early stage startups dropped by almost 50% in the EU. If you cut investment in half, you're going to cause some startups to fail that otherwise would have succeeded. Startups are a "hits" enterprise. Most fail. Some are mildly successful. A few are responsible for almost all of the upside. Cutting investment by 50% means that instead of getting a Dropbox and a Spotify, you'll only get a Dropbox. That missing upside is bad for the economy. I'm saying that you can have GDPR or you can have a thriving startup ecosystem. The data shows that you can't have both. Personally, I think the GDPR is a colossal waste of time that only benefits incumbents. I've had to help implement GDPR compliance at a company and it did absolutely nothing to protect the privacy of customers. However it did cost several hundred thousand dollars.
downandout 7y ago
This fine is precisely in line with the intentions of the European Parliament when they signed the GDPR into law. That is certainly a statement that no one could argue with. I think the argument is whether those intentions are actually good, logical, or workable. For example, the fine structure is explicitly designed so that they could take all of the assets of a small business and wipe it off the face of the map, but only take 5% of annual revenue of a large business. Does that reflect an intention to consolidate market power in the hands of a very few companies? That would be a bad intention in IMO.
- xxs 7y ago
  >but only take 5% of annual revenue of a large business It's 4% global revenue and it's really a lot. Fines are issued based on the amount of data and amount of people affected. Small companies rarely need anything but contact information. Storing the data securely is no trivial task for any size of organization, though. Small companies would have significantly less data and customers to be worthy of a hefty fine. Again, if you can't keep the data secure, don't go into such a business.
  - downandout 7y ago
    I was referring to the maximum fine. It is 4% of global revenues, or 20M EUR, whichever is greater. So the maximum fine would wipe out any business that doesn’t happen to have 20M EUR lying around - that might be 1000% of what they have, but the damage to a large business is capped at 4% of their revenue regardless of how egregious the behavior. That kind of a fine structure has only one possible purpose: it was specifically designed to be able to decimate small businesses while being a minor speed bump for any large business. The ultimate effect is the consolidation of power into the hands of handful of large companies.
    - isostatic 7y ago
      Normal fines are “up to x million” The GDPR fine is specially done some large multinationals can’t ignore it.

tapland 7y ago

Afaik the ruling also stated that parents abd children dont have a resonable ability to consent towards a school.

cameronbrown 7y ago
That makes sense. Opt out for even just one individual would be effectively impossible, otherwise how would the system know who's opted out without remembering them in some way.
- tpxl 7y ago
  A person who has not opted in has opted out. No tracking necessary.
  - cameronbrown 7y ago
    You really think they're going to design things opt in and not opt out?
    - tpxl 7y ago
      The question was how do you track whether people have opted in or not, by not having biometrics for people who have opted out. The solution is simple, if you do not recognise the person, they have not opted in. According to the article, the experiment was constructed as opt in and several students have opted in.
      - cameronbrown 7y ago
        The thing is, aren't all the efficiency gains wasted if even just a couple students opt out? You've still got to take a register, even if shorter. It can't be worth it for a few extra minutes.
- zaroth 7y ago
  This was a tech trial where 22 students and their parents (both separately) opted in to take part over 3 weeks. The teacher also opted-in.
xxs 7y ago
It's covered by recital 43 which deals with public institutions and power imbalance. There is no practical way for a student (or their parents) to say no, given the circumstances.

tomatocracy 7y ago

I don't think the argument was that it was not in line with GDPR. The argument is that GDPR is wrong itself in not allowing people to consent to anything which goes beyond "minimal" data collection for the purpose needed, because whether it is "minimal" is, in some sense, a value judgment as to how much convenience and innovation matter. It seems to me that the principle should be personal "ownership" of personal data - and "ownership" of data should imply the owners have the right to alienate that data as the owner sees fit, with the right safeguards to ensure this isn't coerced or a result of fraud. On the other hand, this type of scenario doesn't feel much like the consent given was really voluntary - (1) because noone wants to be the one person who stopped the school from doing something which everyone else was on board with and (2) because it involved adults consenting on behalf of children for something which the children may not be happy about in future when they are adults and it's too late.

crooked-v 7y ago
The reason that the GDPR is so expansive is that 'voluntary' consent means nothing when your only alternatives to not 'voluntarily' consenting are moving to a different city or going completely without a given service. See how, for instance, literally every major internet provider in the US have contract clauses that amount to 'we can do whatever we want with your personal information forever, neener neener'.
sokoloff 7y ago
As a parent, I constantly make choices on behalf of my children that they (or I) may not be happy about in the future and it’ll be too late.

mytailorisrich 7y ago

The issue with the GDPR as worded and this ruling is that they remove the possibility of informed individual decisions. In this case it seems that all involved were informed and OK with it but that did not matter. I would also think that knowing where pupils are at all times is quite a legitimate aim for a school.

deleted 7y ago
[deleted]
ziddoap 7y ago
Do you have any evidence that all parties provided informed consent? i.e. The consent form detailed out what could happen in the (somewhat likely) event the data is breached and how the data may be used? What other parties have access to the information and how that information is stored? How the information is transmitted? And they understood it all, with the attached implications? Considering the only words the person who oversees both high schools had to say on record was that the technology is "fairly safe", I am somewhat doubting that the parents had a fully formed view of what the potential downfalls of the program are if/when it is breached or misused, or even malfunctions. I think when we are dealing with advanced tech such as facial recognition it is analogous to the informed consent issues doctors face. How can someone possibly obtain informed consent from non-experts over something that requires years of schooling to understand?
- mytailorisrich 7y ago
  This is going over the top. It was just about using facial recognition in a school, not about having brain implants in children... Schools already have pictures and detailed personal details of all pupils. This new technology can have real benefits. For example it could be used to locate a pupil that does not show up in class when they should, or to trigger an alert if a pupil leaves school when not expected to or when someone unknown is detected. To me the law should protect but not prevent useful applications that people agree to, and I think that this specific case shows that, as they stand, the GDPR can be over-restrictive.

jimmaswell 7y ago

Choosing between European internet laws and having a tech sector, I'd pick having a tech sector any day. It's all totally unnecessary strangling of innovation. The entire idea that you own data pertaining to you is absurd.

intertextuality 7y ago
This is not a dichotomy. We can have a tech sector that’s also compliant with laws like GDPR.
- ggreer 7y ago
  No, you can't. Since GDPR was rolled out, venture capital investments in the EU have dropped by a third.[1] According to that paper, the companies most hurt are early stage startups. 1. The Short-Run Effects of GDPR on Technology Venture Investment: https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3278912 https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3278912
  - maldeh 7y ago
    That presumes all early stage startups (as made in the US) are created equal, and any regression in their success rates is bad. Given that 9/10 startups fail even without GDPR, it's not surprising that early stage cos form the Lion's share of failures, and it surely can't be good for any data that was slurped up during whatever these experiments at market fit were doing. And given that the ultimate goal of GDPR is to protect privacy, it doesn't make sense to exempt startups, especially when the early stage stakes are high and a failure to squeeze out every drop of value legally possible out of your data (while your competitors do) could mean the death of your venture. As such, comparing to American standards or even current European standards doesn't quite work when there's a clear shift of the moral bar for GDPR compliance.
    - ggreer 7y ago
      You misunderstand the point I'm making. After GDPR, investments in early stage startups dropped by almost 50% in the EU. If you cut investment in half, you're going to cause some startups to fail that otherwise would have succeeded. Startups are a "hits" enterprise. Most fail. Some are mildly successful. A few are responsible for almost all of the upside. Cutting investment by 50% means that instead of getting a Dropbox and a Spotify, you'll only get a Dropbox. That missing upside is bad for the economy. I'm saying that you can have GDPR or you can have a thriving startup ecosystem. The data shows that you can't have both. Personally, I think the GDPR is a colossal waste of time that only benefits incumbents. I've had to help implement GDPR compliance at a company and it did absolutely nothing to protect the privacy of customers. However it did cost several hundred thousand dollars.

downandout 7y ago

This fine is precisely in line with the intentions of the European Parliament when they signed the GDPR into law. That is certainly a statement that no one could argue with. I think the argument is whether those intentions are actually good, logical, or workable. For example, the fine structure is explicitly designed so that they could take all of the assets of a small business and wipe it off the face of the map, but only take 5% of annual revenue of a large business. Does that reflect an intention to consolidate market power in the hands of a very few companies? That would be a bad intention in IMO.

xxs 7y ago
>but only take 5% of annual revenue of a large business It's 4% global revenue and it's really a lot. Fines are issued based on the amount of data and amount of people affected. Small companies rarely need anything but contact information. Storing the data securely is no trivial task for any size of organization, though. Small companies would have significantly less data and customers to be worthy of a hefty fine. Again, if you can't keep the data secure, don't go into such a business.
- downandout 7y ago
  I was referring to the maximum fine. It is 4% of global revenues, or 20M EUR, whichever is greater. So the maximum fine would wipe out any business that doesn’t happen to have 20M EUR lying around - that might be 1000% of what they have, but the damage to a large business is capped at 4% of their revenue regardless of how egregious the behavior. That kind of a fine structure has only one possible purpose: it was specifically designed to be able to decimate small businesses while being a minor speed bump for any large business. The ultimate effect is the consolidation of power into the hands of handful of large companies.
  - isostatic 7y ago
    Normal fines are “up to x million” The GDPR fine is specially done some large multinationals can’t ignore it.