13 ms·

GDPR Hasn’t Shown Its Teeth, Frustrating Advocates

88 points by donohoe 7y ago

scoot_718 7y ago
All the GDPR did was make it harder for the smaller players. It was a massive win for Facebook and Google.
- bzb3 7y ago
  That's how regulation works mostly. Even if the intentions are noble, this has happened so many times that politicians should know better.
  - llcoolv 7y ago
    Come on. Intentions are never noble. All politicians have their respective owners. Be it officially through lobby groups or unofficially by local oligarchs without middle men.
    - anoncake 7y ago
      Too many, yes, but far from all. At least our politicians are less aligned to lobby groups than the companies behind those groups, be they small or Google-sized.
    - aguyfromnb 7y ago
      >All politicians have their respective owners. Who owns you, or do you consider yourself immune?
      - llcoolv 7y ago
        Am I a career politician? But actually you might be right - just noticed Massie[0]. If he was to act like a typical politician he would let the food shortage strike and only then go solving it to gather extra points. Rand Paul also seems to have something like a conscience. Guess when such people would have any say on real matters though. Never. And with nation states still being the main actor, there is no such person in Brussels, unless we count the hell-raising clowns like Korwin-Mikke and Farage who raise hell for the sake of raising hell. 0. https://noqreport.com/2020/04/26/rep-thomas-massie-has-a-plan-to-prevent-the-coming-food-shortage/ https://noqreport.com/2020/04/26/rep-thomas-massie-has-a-pla...
  - colejohnson66 7y ago
    So because of past failures, people should never try to improve?
    - searchableguy 7y ago
      This is an absurd argument repeated so many times I don't know at which point you stop to keep falling for bs your politicians and legal systems come up with. We will improve next time. We will improve next time. We will improve next time. Why do you let someone exist after so many times the same? Change the institutions first rather than keep trying with failed engine. The structure. The elections. Power distribution. Changing chasey won't do when the engine and transmission is broken.
      - deleted 7y ago
        [deleted]
- llcoolv 7y ago
  Not only. It worked out really well for the new board members a.k.a. GDPR officers a.k.a Politkomisars.
- deleted 7y ago
  [deleted]
- goto11 7y ago
  It is extremely easy to comply with GDPR. Just don't record, retain or sell personally identifiable information.
  - cyral 7y ago
    Unless your business is entirely anonymous, it's way more involved than that
  - lazyjones 7y ago
    Every company with consumers as customers needs to record and retain such information, for legal and operative reasons.
    - goto11 7y ago
      Sure, but the GDPR requirements for storing essential information is no burden.
      - lazyjones 7y ago
        It is, you still need to document everything in detail, be ready to reply to requests, take care how and where you store data internally etc.
        M2Ys4U 7y ago
        Oh no! You have to respect your customer's fundamental human rights! What a burden!
        scoot_718 7y ago
        That might have been the initial intent of the GDPR, but it's not the outcome. The problem isn't the human rights, but the bureaucratic, legal and compliance nightmare it creates for small business. IP blocking is easier than mangling every business and technical process to follow it.
        7y ago
- aantix 7y ago
  It’s simple - just don’t deal with customers from Europe. The verbiage is so general and far reaching the other way that it’s impossible to know if you’re doing things right. Unless you want to higher a legal team, for small businesses, it’s just not worth it.
  - M2Ys4U 7y ago
    Mmmmm, FUD. The GDPR is very clearly written, as far as legislation goes. It's really not hard to understand, unless you're wilfully trying to misunderstand it.
    - scoot_718 7y ago
      It's not about being hard to understand. At all. It's about the work needed to comply vs. the risk vs. the possible benefits. 1. Work to read an interpret legislation means lawyers. If you think you understand a law because it "seems" to be simple to understand you are fucking wrong. Words in law tend to mean different things and refer to other laws, precedents, principles and treaties. 2. The benefits are often small for international businesses. EU customers? Do you care? Probably not. 3. The risks are MASSIVE for breaking the GDPR. So, in cost/benefit, it's a massive "I'm not touching that".
jddj 7y ago
Don't let perfect be the enemy of the good. GDPR did a lot to shift the window back and put the behaviour of the big adtech companies in the sunlight for a while. The enforcement side is definitely lacking, and black mirror might still have done more to shift opinion, but it's not all bad. Consumers all over the world now have the ability to request data takeouts and deletions, etc. And anecdotally I've noticed more and more sites honouring the opt in requirement for 3rd party tracking scripts. It's a solid improvement over the status quo of 2017.
- JeanMarcS 7y ago
  Sadly it mostly still is opt out options. Not later than this morning I wanted to access a forum post. So I go to the privacy page (as a popup proposed me) and then arrived to a page with the list of all the « partners » with access authorized by default. Around 50 of them. No button to refuse all and had to do it one by one. And I visit sites like that every day. I agree that there have been a lot of progress but we are still far from completion.
  - colejohnson66 7y ago
    I’m an American, so forgive my ignorance, but I thought GDPR required explicit opt-in?
CraigJPerry 7y ago
I don’t know, this article maybe makes sense through an american lens, i’m open to that idea. From my view, GDPR has had a few impacting benefits to me personally already. I’ve been notified of security breaches 3 times now that i’m confident either wouldn’t have been reported or would but 18 months later. I’ve been able to move my ISP as a result. Getting closer to that idea that customers will punish you if you mess up - in this case i was able to learn about their mistake thanks to GDPR.
- donatj 7y ago
  I agree. Additionally the added ability to get my data back via take-out features from most services has been a general boon for me, and a major upside to the law. A far more important feature of the GDPR in my eyes than vindictive punishments.
- captainbland 7y ago
  It doesn't take too much searching to discover where GDPR benefits the consumer. Facebook basically wrote a big announcement about it two months before GDPR came into effect: https://about.fb.com/news/2018/03/privacy-shortcuts/ https://about.fb.com/news/2018/03/privacy-shortcuts/ Of course they don't reference GDPR specifically, but it's all basically new tools that allowed them to handle GPDR requirements automatically rather than having to handle a deluge of access requests and otherwise manually which would have been much more expensive.
Sir_Substance 7y ago
Yes and no. I can't lie, I was really hoping for a significant company to be put up against a wall and shot, maybe a major retailer that won't let you check out online without giving a phone number or whatever. The notion of data being a toxic asset[1] still hasn't really sunk into the higher ranks of most large orgs. However, I've found GDPR deletion requests to be a pretty strong cudgel. For the last 10 years or so I've been sending deletion requests for accounts when I no longer need them. Prior to GDPR, about 50% of responses would be along the lines of "in the nicest possible way, we don't care about you enough to do that so please fuck off". Reading between the lines, I assumed that about 50% of websites were implemented poorly and didn't properly support deletion. Post GDPR, all but one request have been given a polite "we have done as you have requested, we hope to see you as a customer again". GDPR has both legitimized the process of requesting that your data has been deleted after you're finished using a service, and has legitimized the concerns of all those developers who were never able to get engineering time to properly support account deletion. So it's been a success, it could be succeeding more but I'm not unhappy. I would still like to see at least one company get ICBM'd in order to remind larger entities that they've got responsibilities to society too, not just their shareholders. [1] https://www.schneier.com/blog/archives/2016/03/data_is_a_toxic.html https://www.schneier.com/blog/archives/2016/03/data_is_a_tox...
- hknapp 7y ago
  Can you call it "your data" if it is not being stored on your hard drive?
  - skummetmaelk 7y ago
    If I write your birthday on a piece of paper is it "your" birthday?
    - deleted 7y ago
      [deleted]
    - drusepth 7y ago
      It's his birthday, but he definitely doesn't own your piece of paper now.
JeanMarcS 7y ago
In France, for example, the GDPR law haven’t still been transcribed in French law. Even more, the IT privacy agency (CNIL) gave time to adv. parties to comply, as in « you can continue to do as usual for now » Big shame.
- hrktb 7y ago
  By curiosity, what important parts of GDPR are you seeing not covered by CNIL's guidelines ?
- jcelerier 7y ago
  > In France, for example, the GDPR law haven’t still been transcribed in French law. are you sure about this ? - http://www.ab-consulting.fr/blog/gdpr/rgpd/rgpd-la-loi-francaise-du-20-juin-2018 http://www.ab-consulting.fr/blog/gdpr/rgpd/rgpd-la-loi-franc... - http://www.assemblee-nationale.fr/dyn/15/textes/l15t0113_texte-adopte-provisoire.pdf http://www.assemblee-nationale.fr/dyn/15/textes/l15t0113_tex...
- anoncake 7y ago
  Regulations, unlike directives, don't have to be transformed to national law to be applicable.
- M2Ys4U 7y ago
  > In France, for example, the GDPR law haven’t still been transcribed in French law. This is a common misconception. Directives need to be transcribed into national law but Regulations - like the GDPR - have direct effect and do not. Regulations become the law of the member states as soon as they are passed, by virtue of the treaties.
buboard 7y ago
GDPR was meant to spite google, it ended up killing all their competition. Who knows, maybe that was the plan?
- anoncake 7y ago
  The GDPR being meant to spite Google (rather than, you know, protecting privacy) is an unfounded conspiracy theory. Claiming the EU tried to support a US company by harming its (European) competition doesn't even deserve that level.
- foepys 7y ago
  GDPR is heavily based on the old German "Bundesdatenschutzgesetz" (Federal Data Protection Act). There is little new in it that wasn't the law in Germany already, only now it carries way higher penalties. The law was passed in 1977 in its first form on the federal level, was already in effect on state-level in 1971, and thus is older than Google by a few decades.
  - M2Ys4U 7y ago
    Yeah, the GDPR was an evolution of data protection, not a revolution. The previous European legislation on this was the Data Protection Directive from 1995, predating Google by three years.
  - buboard 7y ago
    So? EU or Ireland are not Germany
- number6 7y ago
  Main Problem with the Big Companies is that these are located in Ireland. The Commissioner there has no resources [0] to pursue these cases but he can't be bypassed when it comes to fees (at least convention of the other Commissioners if not by the GDPR itself). The other Commissioners are becoming more and more upset with this and planing to institute a board to overrule Ireland's Commissioner. But all of this is very slow... You can't imagen the frustration over this on part of the other Comissioners [0] https://technology.ie/data-protection-commissioner-double-workforce-new-dublin-office/ https://technology.ie/data-protection-commissioner-double-wo...
michaelbuckbee 7y ago
A lot of this gets into whether you think punishment is the desired outcome or behavioral changes. There has been a real and definite shift in the industry post GDPR away from "we might need this data someday" to "please delete it at the first opportunity".
- M2Ys4U 7y ago
  > A lot of this gets into whether you think punishment is the desired outcome or behavioral changes. It's both, surely. Behavioural change won't last unless there are punishments for non-compliance.
  - readams 7y ago
    Surely, you don't think punishment is an end in itself?
- gerland 7y ago
  Punishment is always the desired outcome in the journalist world. If something dramatic does not happen, then from the perspective of NY Times nothing has happened at all. There is no story, no people to smear that were the villains, no heroes to glorify that fought for GDPR. The reality is, that the mundane often impacts our lives much more than the exciting. Small incremental changes that we do not notice shape our reality. The same way that NY Times slowly became a parody of itself, the GDPR slowly changes the web. I still think that we need more time to put this into perspecive and we need more initiatives that build on top of GDPR really stands for.
  - whatsmyusername 7y ago
    Ok boomer
  - dexen 7y ago
    Underrated comment. Perhaps because it's laying out a mundane case, rather than making bombastic claims...
filleokus 7y ago
IMHO GDPR has been (as of yet at least) a net loss to society. It hasn't, and probably never will, change the status quo of the biggest data hoggers (Facebook, Google et.al). It have increased my annoyance on the web with even more crap interruptions about cookies etc. It has increased administration in so many places in our society where data is collected in totally non-harmful ways with no real functioning opt-out, like phone numbers in kids football associations or contact info for parents in schools etc. Remember that even data stored on papers are covered by GDPR. I think my gripe is that organisations becoming "GDPR compliant" mainly has created systems for collecting consent or focusing on which cloud platform to not use, rather than creating any real change by e.g not using systems with piss poor security to begin with. Almost like if we created regulation around banning bad roads, and all that happened was that people had to start signing papers saying they accepted the risk of bad roads. But I guess it will take some time to see real change, hopefully it will come someday.
- simion314 7y ago
  >Almost like if we created regulation around banning bad roads, and all that happened was that people had to start signing papers saying they accepted the risk of bad roads. Really?, did you not see the popups with the giant list of "partners" that have access to your data, you need to click on the show details button but now you can see the shit, where in your road example people would not see the wholes in the road. I am fine with even more transparency.
  - filleokus 7y ago
    I mean it's nice that it's transparent and even opt-out. But would be interesting to see the stats of how many people click the details-link on pages like https://www.elle.com https://www.elle.com or even http://techcrunch.com http://techcrunch.com. My hunch is that its way less than 0.01%. Imho it would been as effective, and much nicer, if they could just assume consent and have a setting accessible via the footer. The small small percentage of people caring about it enough to be bothered would find it as easily, and the rest could just go about their day as before.
rsynnott 7y ago
GDPR has caused significant behavioral change for many companies. There hasn't been much high-profile enforcement yet, granted, but I'm not sure that that's actually that unusual for an (in EU terms) shiny new regulation.
- filleokus 7y ago
  People keep saying this, and to some extent it's very true, I've witnessed it myself in companies. But I mean, the aim of GDPR was never to make resonable data collection that is done in a safe way by "the good guys" hard. The question is rather how many companies that pre-GDPR stored my data in ways I (as a technical person) would consider unsafe, or used it in ways I would consider "bad", that have changed their ways. My local bowling alley still stores my password in plaintext and use an outdated Wordpress-plugin for bookings, and Google stills knows as much about my behaviour online and IRL.
  - rsynnott 7y ago
    > and Google stills knows as much about my behaviour online and IRL. It probably doesn't, as fewer websites will be so blasé about pumping every piece of metadata they can think of into Adwords and Analytics APIs these days.
    - bryan_w 7y ago
      I mean Google doesn't need to know every bike website you've been to, just that you've been to A bike website for them to know that you're into bikes. So even if some sites are pulling out their GA, some won't and that's good enough for Google
      - mandelbrotwurst 7y ago
        They can't build as accurate of a model with a smaller subset of your activity as compared to a more complete one.
        7y ago
jp555 7y ago
What hasn't worked: Expensive bureaucracy that big incumbents can easily afford to navigate but new entrants would be easily crippled by? Shocked. /s
- cultus 7y ago
  It's damn near impossible for very small organizations to follow the GDPR in good faith, especially without a lawyer. The intent is good, but not the execution.
  - modo_mario 7y ago
    What bs. There's plenty arguments against it but people act like it's some arcane thick book with legalese written in runes. That's very far from the truth and a quick read-trough the law to identify where it applies to you won't leave many with much if any questions
    - derekp7 7y ago
      A quick read through doesn't necessarily make it easy to follow. For example, Sarbanes Oxley compliance is a huge business, that is fairly expensive for a company to implement correctly. And the compliance requirements of it stems from essentially one paragraph of law.
    - blibble 7y ago
      quick read through the law? it's 72 pages of extremely dense legal text, where meaning of every singe word is important https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=EN https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...
    - renewiltord 7y ago
      Honestly, GDPR is fine. I love the power of interoperability it's given me. That part is wonderful. But if what you're saying is so obvious, then GDPR experts should be very cheap. But they aren't. If you're so good at it that it's easy, why don't you just go make your million dollars as a consultant in the next couple of years?
SpicyLemonZest 7y ago
Frankly, I think advocates are just wrong about what GDPR means. A lot of people expected every tech company to face huge fines, because they got it in their heads that the regulation grants you a right to opt out of targeted ads, and as far as I can tell that's just not true. The obvious explanation for why "no major fines or penalties have been announced against Facebook, Amazon or Twitter" is that those companies don't have any major violations.
whatsmyusername 7y ago
Requiring everyone to post those stupid cookie popups is not going to win you any advocates.
calibas 7y ago
What I don't like about the GDPR is how it handled cookies. We could have much tighter control and explicit consent at the browser level, which makes sense because it's a browser feature. Instead of something useful like that, we have annoying popups on millions of websites.
- spongeb00b 7y ago
  As someone who has had to both communicate to clients what the rulings mean, and also implement these popups, I totally agree... (and I'm sorry for the the popups)
- TomJansen 7y ago
  This. We really need a cookie consent at the browser level, just like browser ask for location/webcam access etc.
- lazyjones 7y ago
  Consent at the browser level could be implemented in a consumer-friendly way by browser makers. It isn't and enforcing it with laws is stupid (and will lead to similar negative results as with GDPR). Ask your browser maker to fix this, but don't bother asking Google.
- M2Ys4U 7y ago
  That is not because of the GDPR. Cookies (or, more specifically, data stored on end-user's devices) falls under the ePrivacy Directive from 2002(!) The only real change that the GDPR has made to this framework is the definition of "consent".
- drusepth 7y ago
  I wish we could at least get a browser-level setting to accept/decline all the cookie popups, but AFAIK there's no normalization across them that would make interacting with them in a general sense easy/possible. Why didn't we just use the cookie settings we already had in browsers, again?
- Nextgrid 7y ago
  The cookie thing is a myth most likely perpetuated by the cancerous advertising/marketing industry in an attempt to make the regulation look more annoying than it is. Cookies for strictly necessary technical reasons (like a session cookie set when you log in) or those that contain non-identifying information like language or font size do not require disclosure or consent. Oh the other hand, any tracking technology that collects personal information (whether cookies, local storage, server logs or browser fingerprinting) for non strictly necessary purposes (like analytics, A/B testing or conversion tracking) needs explicit, opt-in consent, and as far as I know personal information includes IP addresses or anything that can be used to identify someone uniquely with reasonable accuracy (so browser fingerprints fall in this category too). When consent is requested, it should freely given, so if saying yes is easier than saying no (which often requires unticking hundreds of checkboxes one by one or waiting 30 seconds for a fake "we are applying your ad preferences") then that consent is considered invalid and you may as well just not ask for it in the first place because you're in breach of the regulation anyway, but at least you wouldn't be annoying your users.
crankylinuxuser 7y ago
You know.... I'm still waiting for Adtech companies to request realtime log shipping on the backend. You'd set up each server type (Apache, HAProxy, Nginx, IIS, etc) as a log ingester type. And from there, you ask the server admin to install a telegraf like tool that securely sends data to endpoint. Doing this would allow websites to remove all appearances of tracking code. It just wouldn't be there. Sure makes for some strong plausible deniability.
- ThePowerOfFuet 7y ago
  Please don't give them ideas.
  - crankylinuxuser 7y ago
    I'm sure the people working in Adtech (primarily google) have already thought of this long ago. It's only stopped by the fact that many websites are just frontends and have no backend access.
    - Macha 7y ago
      The real obstacle is that solution involves trusting the publisher. The biggest reason ads are so bloated these days is all the companies that advertisers, publishers and ad networks tack in to try catch anyone cheating anyone else (in terms of JS at least, obviously higher res video content also contributes, but at least nominally most ad companies try pick something appropriate for the connection as starting playback quickly is in their interest too)
- drusepth 7y ago
  Removing front-end JS would be extra nice for speeding up page loads, too.
- pcr0 7y ago
  It's too easy to perform click fraud when advertisers only rely on server logs and nobody would pay for advertising on such sites. Advertisers pay because companies like Google are willing to fingerprint your hardware, run machine learning models on your mouse movement, analyze your browsing history and make you jump through captchas to ensure you're actually human.
thefz 7y ago
Hasn't shown its teeth... in America. For anyone working with even remotely liable user data in the EU, GDPR has been a massive change.
- jdxcode 7y ago
  "shown its teeth" specifically means penalties or similar remedies when talking about laws. It doesn't mean that it hasn't had an effect.
lucideer 7y ago
Getting the strong impression many commenters here are reading the headline and not the article (and tbh it kind of buries the lede), so TL;DR: > At the center of the dispute is Ireland, which has outsize influence over the law’s enforcement because Apple, Facebook, Google, LinkedIn and Twitter are all based there. The country is responsible for leading more investigations, 127, than any other country in Europe, according to Brave. > [...] > Last year, Ireland’s data protection regulator sought a budget increase of €5.9 million. It got a third of that amount. > Helen Dixon, the chair of Ireland’s data protection agency, said she was frustrated by the budget restrictions but defended the work of her office. > She graded Ireland’s performance an “A for effort” but a “C-plus/B-minus in terms of output.” Basically, the current Irish government administration, responsible for funding the DPC, is not a fan of GDPR. For anyone interested in reading more about the Irish DPC's frustrations, Cianan Brennan[0][1] of the Irish Examiner is pretty dogged in his coverage of all things Helen Dixon & DPC (he's basically the main journalist covering GDPR in the main country tasked with enforcing GDPR), including her various[2][3][4] battles with the Irish government on their own GDPR-compliance. [0] https://twitter.com/ciananbrennan https://twitter.com/ciananbrennan [1] https://www.irishexaminer.com/breakingnews/authors/cianan-brennan/ https://www.irishexaminer.com/breakingnews/authors/cianan-br... [2] https://www.irishexaminer.com/breakingnews/ireland/over-6700-data-breaches-reported-to-data-protection-commissioner-976403.html https://www.irishexaminer.com/breakingnews/ireland/over-6700... [3] https://www.irishexaminer.com/breakingnews/views/analysis/cianan-brennan-dixon-determined-to-face-all-challenges-982811.html https://www.irishexaminer.com/breakingnews/views/analysis/ci... [4] https://www.irishexaminer.com/breakingnews/ireland/psc-data-protection-policy-updated-after-doherty-loses-seat-981078.html https://www.irishexaminer.com/breakingnews/ireland/psc-data-...
- Proven 7y ago
  > Last year, Ireland’s data protection regulator sought a budget increase of €5.9 million. It got a third of that amount. AFAIAC they can go screw themselves. Taxes should be cut and not increased.
- killerpopiller 7y ago
  sorry, but the Irish DPA is bought. Even with a low budget she could have at least start investigations, instead nothing. The GDPR will be revised this year (I believe), the corrupted Irish DPA and the OneStopShop approach is the main issue. Other DPA‘s are furious btw.
Cenk 7y ago
Here’s a handy website to keep track of GDPR enforcement and fines: https://www.enforcementtracker.com https://www.enforcementtracker.com
PaulKeeble 7y ago
What I really learned from GDPR and its rollout and its subsequent lack of enforcement is that laws written with regulators being the only ones able to enforce it are just political light shows, they achieve little of value. It is easy for a government to effectively sidestep not implementing the law by defunding the organisation that would do the enforcement or putting a person in charge who doesn't pursue the big breakers. Since individuals can't bring GDPR lawsuits themselves for breaches and fines charged and governments have largely stopped effective enforcement it has become a pointless law. Any company complying now has missed just how little regulators care and are hampering their business for no good reason, it is still open season on customer data. It has the potential to charge in the future, a government change and some adjustments in the commissioner's office in a country could suddenly make the law come into effect but right now it's looking like companies have another half-decade of ignoring this law at least. It could have been useful, in practice it just made websites more annoying to use and those complying fully are exceptionally rare.
- M2Ys4U 7y ago
  >Since individuals can't bring GDPR lawsuits themselves They absolutely can: Article 79 Right to an effective judicial remedy against a controller or processor 1. Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Article 77, each data subject shall have the right to an effective judicial remedy where he or she considers that his or her rights under this Regulation have been infringed as a result of the processing of his or her personal data in non-compliance with this Regulation. 2. Proceedings against a controller or a processor shall be brought before the courts of the Member State where the controller or processor has an establishment. Alternatively, such proceedings may be brought before the courts of the Member State where the data subject has his or her habitual residence, unless the controller or processor is a public authority of a Member State acting in the exercise of its public powers.
belorn 7y ago
We are moving into a world where every thing we do will leave a data history behind. To take a single example of a single act of buying a milk at the store: The store want a record in order to manage inventory, sale history and sale predictions. They also want location path data in order to determine effectiveness of product placements. Your bank want a record in order to facilitating money exchange and manage money laundering laws. The recipient bank want a record too to do the same for the store owner, but also to keep track of the market which the store is under. The government want a record in order to know how much money has changed hand and for what product in order to determine taxes for the seller and buyer. The mall want a record for the location of the store you bought the milk and how you traversed the mall to reach it in order to evaluate property values and advertise placements. Other milk producers and milk alternatives want a record in order to make a better case arguing for their competing product. The secret police want a secret record in order to verify that you did not buy something that could be made into a threat. The regular police want a copy of the record and a video record in case a crime happened while buying the milk. The local government want a location record in order to manage traffic of people who travel around in order to buy milk. The health department want a record to help researcher determine the potential benefit of milk drinkers. GDPR is really just a small stop gap to manage a fraction of all the records we leave behind. It is unlikely to be the last one trying to create the laws needed to handle the fact that everyone a record of everything everyone does, but that we also likely going to end up where everyone has a record of everything everyone does because it saves money, makes strategies more efficient and reduces the need for manual labor. Unrestricted data records has a history full of recorded abuse, and a lot of current use today is explicitly designed to harm people by manipulation and predatory strategies. GDPR is a small step forward, but it is mostly just testing the water for the real legal work needed to make the behavior of all those data collectors safe enough that a person can do something as simple as buying milk at the store without exposing themselves to harm.
- lazyjones 7y ago
  You completely missed the point: GDPR is not a "small step" in the right direction, but counter-productive and detrimental for future efforts. Big companies will manage to comply with the legal requirements but ignore the spirit and intention of the GDPR, small companies will have more stumbling stones in competing with big corporations.
Proven 7y ago
Maybe because the advocates aren't particularly bright to begin with? GDPR has shown its teeth annoying the crap out of me with it's stupid privacy notices on the few EU-based sites I occasionally visit. I recall many companies simply stopped doing business in the overregulated hellhole. So there are less choices, customers are worse off and so on - isn't that plenty of teeth?
pnw_hazor 7y ago
IMO the only way GDPR would have worked the way its advocates hoped is if the enacting statutes created a private right of action. (I don't even know if private rights of action is a thing in the EU.) In the US some (though not enough) consumer protection or civil right laws expressly grant plaintiffs the right to bring their own lawsuit in court. There are edge conditions depending on the laws or jurisdictions involved. For example, some laws provide a private right of action only if the state agents decline to pursue the case. While other laws may require the plaintiff to give notice to some agencies first. Otherwise, laws that may look bold on paper become toothless based on inaction by the state agents that must enforce them. In contrast, if a law includes a private right of action and reasonable fee shifting provisions, private attorneys will pick up the slack and then some. For example, in the US, the medical privacy regime, HIPAA, is considerably weakened by its absence (as far as I know) of a private right of action. For example, if your medical privacy is violated by your HR department or your doctor, you cannot sue under US Federal HIPAA laws, you need to sue under some other law and prove real damages. Note, there may be other laws that cover the same facts, such as, state privacy laws, or the like. And, in some circumstance, proven HIPAA violations may be used as evidence of negligence, or the like, to meet the requirements of the other laws.
- e73u3hdjfu 7y ago
  I'm uncertain why the assumption is that GDPR was actually meant to appease advocates. It's pretty obvious that the law as it exists impacts foreign companies far more than EU companies. If the point of these laws was strictly for the benefit of European consumers then there'd be more dialogue around the value to consumers of having cheaper digital goods and services vs. the often abstract and vague benefits of GDPR's regulations. From this perspective, the ethical concerns seem mostly like a smokescreen to justify protectionist measures that will defend less efficient EU businesses in a manner similar to their current agricultural laws which exist mainly to protect the EU's wildly inefficient meat and dairy industries.
- M2Ys4U 7y ago
  >IMO the only way GDPR would have worked the way its advocates hoped is if the enacting statutes created a private right of action. Article 79 Right to an effective judicial remedy against a controller or processor 1. Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Article 77, each data subject shall have the right to an effective judicial remedy where he or she considers that his or her rights under this Regulation have been infringed as a result of the processing of his or her personal data in non-compliance with this Regulation. 2. Proceedings against a controller or a processor shall be brought before the courts of the Member State where the controller or processor has an establishment. Alternatively, such proceedings may be brought before the courts of the Member State where the data subject has his or her habitual residence, unless the controller or processor is a public authority of a Member State acting in the exercise of its public powers.
darepublic 7y ago
Frustrating advocates such as the nytimes

88 points by donohoe 7y ago

scoot_718 7y ago

All the GDPR did was make it harder for the smaller players. It was a massive win for Facebook and Google.

bzb3 7y ago
That's how regulation works mostly. Even if the intentions are noble, this has happened so many times that politicians should know better.
- llcoolv 7y ago
  Come on. Intentions are never noble. All politicians have their respective owners. Be it officially through lobby groups or unofficially by local oligarchs without middle men.
  - anoncake 7y ago
    Too many, yes, but far from all. At least our politicians are less aligned to lobby groups than the companies behind those groups, be they small or Google-sized.
  - aguyfromnb 7y ago
    >All politicians have their respective owners. Who owns you, or do you consider yourself immune?
    - llcoolv 7y ago
      Am I a career politician? But actually you might be right - just noticed Massie[0]. If he was to act like a typical politician he would let the food shortage strike and only then go solving it to gather extra points. Rand Paul also seems to have something like a conscience. Guess when such people would have any say on real matters though. Never. And with nation states still being the main actor, there is no such person in Brussels, unless we count the hell-raising clowns like Korwin-Mikke and Farage who raise hell for the sake of raising hell. 0. https://noqreport.com/2020/04/26/rep-thomas-massie-has-a-plan-to-prevent-the-coming-food-shortage/ https://noqreport.com/2020/04/26/rep-thomas-massie-has-a-pla...
- colejohnson66 7y ago
  So because of past failures, people should never try to improve?
  - searchableguy 7y ago
    This is an absurd argument repeated so many times I don't know at which point you stop to keep falling for bs your politicians and legal systems come up with. We will improve next time. We will improve next time. We will improve next time. Why do you let someone exist after so many times the same? Change the institutions first rather than keep trying with failed engine. The structure. The elections. Power distribution. Changing chasey won't do when the engine and transmission is broken.
    - deleted 7y ago
      [deleted]
llcoolv 7y ago
Not only. It worked out really well for the new board members a.k.a. GDPR officers a.k.a Politkomisars.
deleted 7y ago
[deleted]
goto11 7y ago
It is extremely easy to comply with GDPR. Just don't record, retain or sell personally identifiable information.
- cyral 7y ago
  Unless your business is entirely anonymous, it's way more involved than that
- lazyjones 7y ago
  Every company with consumers as customers needs to record and retain such information, for legal and operative reasons.
  - goto11 7y ago
    Sure, but the GDPR requirements for storing essential information is no burden.
    - lazyjones 7y ago
      It is, you still need to document everything in detail, be ready to reply to requests, take care how and where you store data internally etc.
      - M2Ys4U 7y ago
        Oh no! You have to respect your customer's fundamental human rights! What a burden!
        scoot_718 7y ago
        That might have been the initial intent of the GDPR, but it's not the outcome. The problem isn't the human rights, but the bureaucratic, legal and compliance nightmare it creates for small business. IP blocking is easier than mangling every business and technical process to follow it.
        7y ago
aantix 7y ago
It’s simple - just don’t deal with customers from Europe. The verbiage is so general and far reaching the other way that it’s impossible to know if you’re doing things right. Unless you want to higher a legal team, for small businesses, it’s just not worth it.
- M2Ys4U 7y ago
  Mmmmm, FUD. The GDPR is very clearly written, as far as legislation goes. It's really not hard to understand, unless you're wilfully trying to misunderstand it.
  - scoot_718 7y ago
    It's not about being hard to understand. At all. It's about the work needed to comply vs. the risk vs. the possible benefits. 1. Work to read an interpret legislation means lawyers. If you think you understand a law because it "seems" to be simple to understand you are fucking wrong. Words in law tend to mean different things and refer to other laws, precedents, principles and treaties. 2. The benefits are often small for international businesses. EU customers? Do you care? Probably not. 3. The risks are MASSIVE for breaking the GDPR. So, in cost/benefit, it's a massive "I'm not touching that".

jddj 7y ago

Don't let perfect be the enemy of the good. GDPR did a lot to shift the window back and put the behaviour of the big adtech companies in the sunlight for a while. The enforcement side is definitely lacking, and black mirror might still have done more to shift opinion, but it's not all bad. Consumers all over the world now have the ability to request data takeouts and deletions, etc. And anecdotally I've noticed more and more sites honouring the opt in requirement for 3rd party tracking scripts. It's a solid improvement over the status quo of 2017.

JeanMarcS 7y ago
Sadly it mostly still is opt out options. Not later than this morning I wanted to access a forum post. So I go to the privacy page (as a popup proposed me) and then arrived to a page with the list of all the « partners » with access authorized by default. Around 50 of them. No button to refuse all and had to do it one by one. And I visit sites like that every day. I agree that there have been a lot of progress but we are still far from completion.
- colejohnson66 7y ago
  I’m an American, so forgive my ignorance, but I thought GDPR required explicit opt-in?

CraigJPerry 7y ago

I don’t know, this article maybe makes sense through an american lens, i’m open to that idea. From my view, GDPR has had a few impacting benefits to me personally already. I’ve been notified of security breaches 3 times now that i’m confident either wouldn’t have been reported or would but 18 months later. I’ve been able to move my ISP as a result. Getting closer to that idea that customers will punish you if you mess up - in this case i was able to learn about their mistake thanks to GDPR.

donatj 7y ago
I agree. Additionally the added ability to get my data back via take-out features from most services has been a general boon for me, and a major upside to the law. A far more important feature of the GDPR in my eyes than vindictive punishments.
captainbland 7y ago
It doesn't take too much searching to discover where GDPR benefits the consumer. Facebook basically wrote a big announcement about it two months before GDPR came into effect: https://about.fb.com/news/2018/03/privacy-shortcuts/ https://about.fb.com/news/2018/03/privacy-shortcuts/ Of course they don't reference GDPR specifically, but it's all basically new tools that allowed them to handle GPDR requirements automatically rather than having to handle a deluge of access requests and otherwise manually which would have been much more expensive.

Sir_Substance 7y ago

Yes and no. I can't lie, I was really hoping for a significant company to be put up against a wall and shot, maybe a major retailer that won't let you check out online without giving a phone number or whatever. The notion of data being a toxic asset[1] still hasn't really sunk into the higher ranks of most large orgs. However, I've found GDPR deletion requests to be a pretty strong cudgel. For the last 10 years or so I've been sending deletion requests for accounts when I no longer need them. Prior to GDPR, about 50% of responses would be along the lines of "in the nicest possible way, we don't care about you enough to do that so please fuck off". Reading between the lines, I assumed that about 50% of websites were implemented poorly and didn't properly support deletion. Post GDPR, all but one request have been given a polite "we have done as you have requested, we hope to see you as a customer again". GDPR has both legitimized the process of requesting that your data has been deleted after you're finished using a service, and has legitimized the concerns of all those developers who were never able to get engineering time to properly support account deletion. So it's been a success, it could be succeeding more but I'm not unhappy. I would still like to see at least one company get ICBM'd in order to remind larger entities that they've got responsibilities to society too, not just their shareholders. [1] https://www.schneier.com/blog/archives/2016/03/data_is_a_toxic.html https://www.schneier.com/blog/archives/2016/03/data_is_a_tox...

hknapp 7y ago
Can you call it "your data" if it is not being stored on your hard drive?
- skummetmaelk 7y ago
  If I write your birthday on a piece of paper is it "your" birthday?
  - deleted 7y ago
    [deleted]
  - drusepth 7y ago
    It's his birthday, but he definitely doesn't own your piece of paper now.

JeanMarcS 7y ago

In France, for example, the GDPR law haven’t still been transcribed in French law. Even more, the IT privacy agency (CNIL) gave time to adv. parties to comply, as in « you can continue to do as usual for now » Big shame.

hrktb 7y ago
By curiosity, what important parts of GDPR are you seeing not covered by CNIL's guidelines ?
jcelerier 7y ago
> In France, for example, the GDPR law haven’t still been transcribed in French law. are you sure about this ? - http://www.ab-consulting.fr/blog/gdpr/rgpd/rgpd-la-loi-francaise-du-20-juin-2018 http://www.ab-consulting.fr/blog/gdpr/rgpd/rgpd-la-loi-franc... - http://www.assemblee-nationale.fr/dyn/15/textes/l15t0113_texte-adopte-provisoire.pdf http://www.assemblee-nationale.fr/dyn/15/textes/l15t0113_tex...
anoncake 7y ago
Regulations, unlike directives, don't have to be transformed to national law to be applicable.
M2Ys4U 7y ago
> In France, for example, the GDPR law haven’t still been transcribed in French law. This is a common misconception. Directives need to be transcribed into national law but Regulations - like the GDPR - have direct effect and do not. Regulations become the law of the member states as soon as they are passed, by virtue of the treaties.

buboard 7y ago

GDPR was meant to spite google, it ended up killing all their competition. Who knows, maybe that was the plan?

anoncake 7y ago
The GDPR being meant to spite Google (rather than, you know, protecting privacy) is an unfounded conspiracy theory. Claiming the EU tried to support a US company by harming its (European) competition doesn't even deserve that level.
foepys 7y ago
GDPR is heavily based on the old German "Bundesdatenschutzgesetz" (Federal Data Protection Act). There is little new in it that wasn't the law in Germany already, only now it carries way higher penalties. The law was passed in 1977 in its first form on the federal level, was already in effect on state-level in 1971, and thus is older than Google by a few decades.
- M2Ys4U 7y ago
  Yeah, the GDPR was an evolution of data protection, not a revolution. The previous European legislation on this was the Data Protection Directive from 1995, predating Google by three years.
- buboard 7y ago
  So? EU or Ireland are not Germany
number6 7y ago
Main Problem with the Big Companies is that these are located in Ireland. The Commissioner there has no resources [0] to pursue these cases but he can't be bypassed when it comes to fees (at least convention of the other Commissioners if not by the GDPR itself). The other Commissioners are becoming more and more upset with this and planing to institute a board to overrule Ireland's Commissioner. But all of this is very slow... You can't imagen the frustration over this on part of the other Comissioners [0] https://technology.ie/data-protection-commissioner-double-workforce-new-dublin-office/ https://technology.ie/data-protection-commissioner-double-wo...

michaelbuckbee 7y ago

A lot of this gets into whether you think punishment is the desired outcome or behavioral changes. There has been a real and definite shift in the industry post GDPR away from "we might need this data someday" to "please delete it at the first opportunity".

M2Ys4U 7y ago
> A lot of this gets into whether you think punishment is the desired outcome or behavioral changes. It's both, surely. Behavioural change won't last unless there are punishments for non-compliance.
- readams 7y ago
  Surely, you don't think punishment is an end in itself?
gerland 7y ago
Punishment is always the desired outcome in the journalist world. If something dramatic does not happen, then from the perspective of NY Times nothing has happened at all. There is no story, no people to smear that were the villains, no heroes to glorify that fought for GDPR. The reality is, that the mundane often impacts our lives much more than the exciting. Small incremental changes that we do not notice shape our reality. The same way that NY Times slowly became a parody of itself, the GDPR slowly changes the web. I still think that we need more time to put this into perspecive and we need more initiatives that build on top of GDPR really stands for.
- whatsmyusername 7y ago
  Ok boomer
- dexen 7y ago
  Underrated comment. Perhaps because it's laying out a mundane case, rather than making bombastic claims...

filleokus 7y ago

IMHO GDPR has been (as of yet at least) a net loss to society. It hasn't, and probably never will, change the status quo of the biggest data hoggers (Facebook, Google et.al). It have increased my annoyance on the web with even more crap interruptions about cookies etc. It has increased administration in so many places in our society where data is collected in totally non-harmful ways with no real functioning opt-out, like phone numbers in kids football associations or contact info for parents in schools etc. Remember that even data stored on papers are covered by GDPR. I think my gripe is that organisations becoming "GDPR compliant" mainly has created systems for collecting consent or focusing on which cloud platform to not use, rather than creating any real change by e.g not using systems with piss poor security to begin with. Almost like if we created regulation around banning bad roads, and all that happened was that people had to start signing papers saying they accepted the risk of bad roads. But I guess it will take some time to see real change, hopefully it will come someday.

simion314 7y ago
>Almost like if we created regulation around banning bad roads, and all that happened was that people had to start signing papers saying they accepted the risk of bad roads. Really?, did you not see the popups with the giant list of "partners" that have access to your data, you need to click on the show details button but now you can see the shit, where in your road example people would not see the wholes in the road. I am fine with even more transparency.
- filleokus 7y ago
  I mean it's nice that it's transparent and even opt-out. But would be interesting to see the stats of how many people click the details-link on pages like https://www.elle.com https://www.elle.com or even http://techcrunch.com http://techcrunch.com. My hunch is that its way less than 0.01%. Imho it would been as effective, and much nicer, if they could just assume consent and have a setting accessible via the footer. The small small percentage of people caring about it enough to be bothered would find it as easily, and the rest could just go about their day as before.

rsynnott 7y ago

GDPR has caused significant behavioral change for many companies. There hasn't been much high-profile enforcement yet, granted, but I'm not sure that that's actually that unusual for an (in EU terms) shiny new regulation.

filleokus 7y ago
People keep saying this, and to some extent it's very true, I've witnessed it myself in companies. But I mean, the aim of GDPR was never to make resonable data collection that is done in a safe way by "the good guys" hard. The question is rather how many companies that pre-GDPR stored my data in ways I (as a technical person) would consider unsafe, or used it in ways I would consider "bad", that have changed their ways. My local bowling alley still stores my password in plaintext and use an outdated Wordpress-plugin for bookings, and Google stills knows as much about my behaviour online and IRL.
- rsynnott 7y ago
  > and Google stills knows as much about my behaviour online and IRL. It probably doesn't, as fewer websites will be so blasé about pumping every piece of metadata they can think of into Adwords and Analytics APIs these days.
  - bryan_w 7y ago
    I mean Google doesn't need to know every bike website you've been to, just that you've been to A bike website for them to know that you're into bikes. So even if some sites are pulling out their GA, some won't and that's good enough for Google
    - mandelbrotwurst 7y ago
      They can't build as accurate of a model with a smaller subset of your activity as compared to a more complete one.
      - 7y ago

jp555 7y ago

What hasn't worked: Expensive bureaucracy that big incumbents can easily afford to navigate but new entrants would be easily crippled by? Shocked. /s

cultus 7y ago
It's damn near impossible for very small organizations to follow the GDPR in good faith, especially without a lawyer. The intent is good, but not the execution.
- modo_mario 7y ago
  What bs. There's plenty arguments against it but people act like it's some arcane thick book with legalese written in runes. That's very far from the truth and a quick read-trough the law to identify where it applies to you won't leave many with much if any questions
  - derekp7 7y ago
    A quick read through doesn't necessarily make it easy to follow. For example, Sarbanes Oxley compliance is a huge business, that is fairly expensive for a company to implement correctly. And the compliance requirements of it stems from essentially one paragraph of law.
  - blibble 7y ago
    quick read through the law? it's 72 pages of extremely dense legal text, where meaning of every singe word is important https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=EN https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...
  - renewiltord 7y ago
    Honestly, GDPR is fine. I love the power of interoperability it's given me. That part is wonderful. But if what you're saying is so obvious, then GDPR experts should be very cheap. But they aren't. If you're so good at it that it's easy, why don't you just go make your million dollars as a consultant in the next couple of years?

SpicyLemonZest 7y ago

Frankly, I think advocates are just wrong about what GDPR means. A lot of people expected every tech company to face huge fines, because they got it in their heads that the regulation grants you a right to opt out of targeted ads, and as far as I can tell that's just not true. The obvious explanation for why "no major fines or penalties have been announced against Facebook, Amazon or Twitter" is that those companies don't have any major violations.

whatsmyusername 7y ago

Requiring everyone to post those stupid cookie popups is not going to win you any advocates.

calibas 7y ago

What I don't like about the GDPR is how it handled cookies. We could have much tighter control and explicit consent at the browser level, which makes sense because it's a browser feature. Instead of something useful like that, we have annoying popups on millions of websites.

spongeb00b 7y ago
As someone who has had to both communicate to clients what the rulings mean, and also implement these popups, I totally agree... (and I'm sorry for the the popups)
TomJansen 7y ago
This. We really need a cookie consent at the browser level, just like browser ask for location/webcam access etc.
lazyjones 7y ago
Consent at the browser level could be implemented in a consumer-friendly way by browser makers. It isn't and enforcing it with laws is stupid (and will lead to similar negative results as with GDPR). Ask your browser maker to fix this, but don't bother asking Google.
M2Ys4U 7y ago
That is not because of the GDPR. Cookies (or, more specifically, data stored on end-user's devices) falls under the ePrivacy Directive from 2002(!) The only real change that the GDPR has made to this framework is the definition of "consent".
drusepth 7y ago
I wish we could at least get a browser-level setting to accept/decline all the cookie popups, but AFAIK there's no normalization across them that would make interacting with them in a general sense easy/possible. Why didn't we just use the cookie settings we already had in browsers, again?
Nextgrid 7y ago
The cookie thing is a myth most likely perpetuated by the cancerous advertising/marketing industry in an attempt to make the regulation look more annoying than it is. Cookies for strictly necessary technical reasons (like a session cookie set when you log in) or those that contain non-identifying information like language or font size do not require disclosure or consent. Oh the other hand, any tracking technology that collects personal information (whether cookies, local storage, server logs or browser fingerprinting) for non strictly necessary purposes (like analytics, A/B testing or conversion tracking) needs explicit, opt-in consent, and as far as I know personal information includes IP addresses or anything that can be used to identify someone uniquely with reasonable accuracy (so browser fingerprints fall in this category too). When consent is requested, it should freely given, so if saying yes is easier than saying no (which often requires unticking hundreds of checkboxes one by one or waiting 30 seconds for a fake "we are applying your ad preferences") then that consent is considered invalid and you may as well just not ask for it in the first place because you're in breach of the regulation anyway, but at least you wouldn't be annoying your users.

crankylinuxuser 7y ago

You know.... I'm still waiting for Adtech companies to request realtime log shipping on the backend. You'd set up each server type (Apache, HAProxy, Nginx, IIS, etc) as a log ingester type. And from there, you ask the server admin to install a telegraf like tool that securely sends data to endpoint. Doing this would allow websites to remove all appearances of tracking code. It just wouldn't be there. Sure makes for some strong plausible deniability.

ThePowerOfFuet 7y ago
Please don't give them ideas.
- crankylinuxuser 7y ago
  I'm sure the people working in Adtech (primarily google) have already thought of this long ago. It's only stopped by the fact that many websites are just frontends and have no backend access.
  - Macha 7y ago
    The real obstacle is that solution involves trusting the publisher. The biggest reason ads are so bloated these days is all the companies that advertisers, publishers and ad networks tack in to try catch anyone cheating anyone else (in terms of JS at least, obviously higher res video content also contributes, but at least nominally most ad companies try pick something appropriate for the connection as starting playback quickly is in their interest too)
drusepth 7y ago
Removing front-end JS would be extra nice for speeding up page loads, too.
pcr0 7y ago
It's too easy to perform click fraud when advertisers only rely on server logs and nobody would pay for advertising on such sites. Advertisers pay because companies like Google are willing to fingerprint your hardware, run machine learning models on your mouse movement, analyze your browsing history and make you jump through captchas to ensure you're actually human.

thefz 7y ago

Hasn't shown its teeth... in America. For anyone working with even remotely liable user data in the EU, GDPR has been a massive change.

jdxcode 7y ago
"shown its teeth" specifically means penalties or similar remedies when talking about laws. It doesn't mean that it hasn't had an effect.

lucideer 7y ago

Getting the strong impression many commenters here are reading the headline and not the article (and tbh it kind of buries the lede), so TL;DR: > At the center of the dispute is Ireland, which has outsize influence over the law’s enforcement because Apple, Facebook, Google, LinkedIn and Twitter are all based there. The country is responsible for leading more investigations, 127, than any other country in Europe, according to Brave. > [...] > Last year, Ireland’s data protection regulator sought a budget increase of €5.9 million. It got a third of that amount. > Helen Dixon, the chair of Ireland’s data protection agency, said she was frustrated by the budget restrictions but defended the work of her office. > She graded Ireland’s performance an “A for effort” but a “C-plus/B-minus in terms of output.” Basically, the current Irish government administration, responsible for funding the DPC, is not a fan of GDPR. For anyone interested in reading more about the Irish DPC's frustrations, Cianan Brennan[0][1] of the Irish Examiner is pretty dogged in his coverage of all things Helen Dixon & DPC (he's basically the main journalist covering GDPR in the main country tasked with enforcing GDPR), including her various[2][3][4] battles with the Irish government on their own GDPR-compliance. [0] https://twitter.com/ciananbrennan https://twitter.com/ciananbrennan [1] https://www.irishexaminer.com/breakingnews/authors/cianan-brennan/ https://www.irishexaminer.com/breakingnews/authors/cianan-br... [2] https://www.irishexaminer.com/breakingnews/ireland/over-6700-data-breaches-reported-to-data-protection-commissioner-976403.html https://www.irishexaminer.com/breakingnews/ireland/over-6700... [3] https://www.irishexaminer.com/breakingnews/views/analysis/cianan-brennan-dixon-determined-to-face-all-challenges-982811.html https://www.irishexaminer.com/breakingnews/views/analysis/ci... [4] https://www.irishexaminer.com/breakingnews/ireland/psc-data-protection-policy-updated-after-doherty-loses-seat-981078.html https://www.irishexaminer.com/breakingnews/ireland/psc-data-...

Proven 7y ago
> Last year, Ireland’s data protection regulator sought a budget increase of €5.9 million. It got a third of that amount. AFAIAC they can go screw themselves. Taxes should be cut and not increased.
killerpopiller 7y ago
sorry, but the Irish DPA is bought. Even with a low budget she could have at least start investigations, instead nothing. The GDPR will be revised this year (I believe), the corrupted Irish DPA and the OneStopShop approach is the main issue. Other DPA‘s are furious btw.

Cenk 7y ago

Here’s a handy website to keep track of GDPR enforcement and fines: https://www.enforcementtracker.com https://www.enforcementtracker.com

PaulKeeble 7y ago

What I really learned from GDPR and its rollout and its subsequent lack of enforcement is that laws written with regulators being the only ones able to enforce it are just political light shows, they achieve little of value. It is easy for a government to effectively sidestep not implementing the law by defunding the organisation that would do the enforcement or putting a person in charge who doesn't pursue the big breakers. Since individuals can't bring GDPR lawsuits themselves for breaches and fines charged and governments have largely stopped effective enforcement it has become a pointless law. Any company complying now has missed just how little regulators care and are hampering their business for no good reason, it is still open season on customer data. It has the potential to charge in the future, a government change and some adjustments in the commissioner's office in a country could suddenly make the law come into effect but right now it's looking like companies have another half-decade of ignoring this law at least. It could have been useful, in practice it just made websites more annoying to use and those complying fully are exceptionally rare.

M2Ys4U 7y ago
>Since individuals can't bring GDPR lawsuits themselves They absolutely can: Article 79 Right to an effective judicial remedy against a controller or processor 1. Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Article 77, each data subject shall have the right to an effective judicial remedy where he or she considers that his or her rights under this Regulation have been infringed as a result of the processing of his or her personal data in non-compliance with this Regulation. 2. Proceedings against a controller or a processor shall be brought before the courts of the Member State where the controller or processor has an establishment. Alternatively, such proceedings may be brought before the courts of the Member State where the data subject has his or her habitual residence, unless the controller or processor is a public authority of a Member State acting in the exercise of its public powers.

belorn 7y ago

We are moving into a world where every thing we do will leave a data history behind. To take a single example of a single act of buying a milk at the store: The store want a record in order to manage inventory, sale history and sale predictions. They also want location path data in order to determine effectiveness of product placements. Your bank want a record in order to facilitating money exchange and manage money laundering laws. The recipient bank want a record too to do the same for the store owner, but also to keep track of the market which the store is under. The government want a record in order to know how much money has changed hand and for what product in order to determine taxes for the seller and buyer. The mall want a record for the location of the store you bought the milk and how you traversed the mall to reach it in order to evaluate property values and advertise placements. Other milk producers and milk alternatives want a record in order to make a better case arguing for their competing product. The secret police want a secret record in order to verify that you did not buy something that could be made into a threat. The regular police want a copy of the record and a video record in case a crime happened while buying the milk. The local government want a location record in order to manage traffic of people who travel around in order to buy milk. The health department want a record to help researcher determine the potential benefit of milk drinkers. GDPR is really just a small stop gap to manage a fraction of all the records we leave behind. It is unlikely to be the last one trying to create the laws needed to handle the fact that everyone a record of everything everyone does, but that we also likely going to end up where everyone has a record of everything everyone does because it saves money, makes strategies more efficient and reduces the need for manual labor. Unrestricted data records has a history full of recorded abuse, and a lot of current use today is explicitly designed to harm people by manipulation and predatory strategies. GDPR is a small step forward, but it is mostly just testing the water for the real legal work needed to make the behavior of all those data collectors safe enough that a person can do something as simple as buying milk at the store without exposing themselves to harm.

lazyjones 7y ago
You completely missed the point: GDPR is not a "small step" in the right direction, but counter-productive and detrimental for future efforts. Big companies will manage to comply with the legal requirements but ignore the spirit and intention of the GDPR, small companies will have more stumbling stones in competing with big corporations.

Proven 7y ago

Maybe because the advocates aren't particularly bright to begin with? GDPR has shown its teeth annoying the crap out of me with it's stupid privacy notices on the few EU-based sites I occasionally visit. I recall many companies simply stopped doing business in the overregulated hellhole. So there are less choices, customers are worse off and so on - isn't that plenty of teeth?

pnw_hazor 7y ago

IMO the only way GDPR would have worked the way its advocates hoped is if the enacting statutes created a private right of action. (I don't even know if private rights of action is a thing in the EU.) In the US some (though not enough) consumer protection or civil right laws expressly grant plaintiffs the right to bring their own lawsuit in court. There are edge conditions depending on the laws or jurisdictions involved. For example, some laws provide a private right of action only if the state agents decline to pursue the case. While other laws may require the plaintiff to give notice to some agencies first. Otherwise, laws that may look bold on paper become toothless based on inaction by the state agents that must enforce them. In contrast, if a law includes a private right of action and reasonable fee shifting provisions, private attorneys will pick up the slack and then some. For example, in the US, the medical privacy regime, HIPAA, is considerably weakened by its absence (as far as I know) of a private right of action. For example, if your medical privacy is violated by your HR department or your doctor, you cannot sue under US Federal HIPAA laws, you need to sue under some other law and prove real damages. Note, there may be other laws that cover the same facts, such as, state privacy laws, or the like. And, in some circumstance, proven HIPAA violations may be used as evidence of negligence, or the like, to meet the requirements of the other laws.

e73u3hdjfu 7y ago
I'm uncertain why the assumption is that GDPR was actually meant to appease advocates. It's pretty obvious that the law as it exists impacts foreign companies far more than EU companies. If the point of these laws was strictly for the benefit of European consumers then there'd be more dialogue around the value to consumers of having cheaper digital goods and services vs. the often abstract and vague benefits of GDPR's regulations. From this perspective, the ethical concerns seem mostly like a smokescreen to justify protectionist measures that will defend less efficient EU businesses in a manner similar to their current agricultural laws which exist mainly to protect the EU's wildly inefficient meat and dairy industries.
M2Ys4U 7y ago
>IMO the only way GDPR would have worked the way its advocates hoped is if the enacting statutes created a private right of action. Article 79 Right to an effective judicial remedy against a controller or processor 1. Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Article 77, each data subject shall have the right to an effective judicial remedy where he or she considers that his or her rights under this Regulation have been infringed as a result of the processing of his or her personal data in non-compliance with this Regulation. 2. Proceedings against a controller or a processor shall be brought before the courts of the Member State where the controller or processor has an establishment. Alternatively, such proceedings may be brought before the courts of the Member State where the data subject has his or her habitual residence, unless the controller or processor is a public authority of a Member State acting in the exercise of its public powers.

darepublic 7y ago

Frustrating advocates such as the nytimes