12 ms·

Two years in, GDPR defined by mixed signals, unbalanced enforcement

136 points by joering2 6y ago

barking 6y ago
We care about your privacy notices have become the bane of my life.
- ianlevesque 6y ago
  Just pair them with cookie notices for extra effectiveness!
- briandear 6y ago
  Right up there with emails from software companies with “our response to Covid-19.” You are a software company. Unless the server has the virus, I really don’t care.
- Causality1 6y ago
  Indeed. Frankly I miss the days when my popups had breasts in them.
- Nextgrid 6y ago
  The majority of these aren't actually compliant. Tracking should be opt-in and consent should be freely given. If your notice is annoying enough that most people click accept (or if clicking decline is harder) then you are already in breach. A lot of websites also consider analytics cookies as essential and don't provide a way to decline those which isn't compliant either. These websites can be detected very easily by running a web scraper and looking for one of these non-compliant "consent management" solutions (looking at you TrustArc) and fining every single company that uses it.
  - SpicyLemonZest 6y ago
    I've seen a lot of people say this, but I'm just not convinced it's actually the law. It's not obvious to me that analytics cookies categorically can't be essential or that "freely given" implies strict UI neutrality between accepting and declining.
    - Tomte 6y ago
      Yesterday the highest German court (BGH) ruled that "default accept" in cookie dialog boxes is illegal. It was a pre-GDPR case, but the court said it interpreted the them-in-force law in a GDPR-friendly way.
    - Nextgrid 6y ago
      The majority of websites use third-party analytics that collect way more information than necessary and may use it for their own purposes (surprisingly a lot of these companies' main business is ad-tech). The problem here is that not only do you get analytics but the third-party (with whom the user has no relationship and their interests might be against the user's) is now able to track that user across other websites.
    - chris_engel 6y ago
      Well, essential means that a web service cannot technically work without it. For example, a session cookie.
      - Nextgrid 6y ago
        The law explicitly has exemptions around purely functional cookies so you are free to set session cookies without requiring consent/disclosure.
  - shadowgovt 6y ago
    > A lot of websites also consider analytics cookies as essential For a lot of websites, they are.
    - lmkg 6y ago
      Under PECR, a cookie being essential means necessary to provide the requested service, not necessary to stay in business. If the user wants to view a news article, and you can serve the article without using analytics cookies, then PECR doesn't allow the cookie. (The situation for paywalls is complicated.)
      - cameronbrown 6y ago
        Providing the service assumes staying in business, no?
        p_l 6y ago
        No, there's no protection for failed business models, as there should not be.
        shadowgovt 6y ago
        The business model of Google isn't a failed business model. What the GDPR does do, quite successfully, is build a moat around Google so wide and deep as to minimize competition with them, because they're one of the few firms that can both (a) afford the engineers with the technical expertise to comply with the law while accomplishing their goals and (b) afford the lawyers to address the issue when they fail at the former.
        Nextgrid 6y ago
        > afford the engineers with the technical expertise to comply with the law while accomplishing their goals Google is in breach of the GDPR as it stands, so no. > afford the lawyers to address the issue when they fail at the former Potentially, though again a clear-cut breach like theirs should result in a fine regardless of how much money they throw at the problem. As far as building a moat, I'm not sure. Whether it's Google or a one-man shop, neither can accurately track users without being in breach. There is no moat that I can see, you either break the law or you don't.
  - JMTQp8lwXL 6y ago
    On mobile, some of the opt-out toggle switches don't even function. You literally cannot disable the toggle in iOS Safari.
    - SilasX 6y ago
      Yeah but that says more about the clumsiness of iOS. Since upgrading to 13, a ton of stuff is broken, like tap to zoom, and significant ability to edit text fields. Web pages randomly freeze, forcing a kill and reopen, which I rarely saw before.
  - andrewla 6y ago
    > The majority of these aren't actually compliant. The title of the article is "Two years in, GDPR defined by mixed signals, unbalanced enforcement". So sure, maybe they're not complaint, but nobody is enforcing anyway. EDIT: removed unnecessary pejorative statement from last paragraph
  - JumpCrisscross 6y ago
    > The majority of these aren't actually compliant There is insufficient evidence attempting to comply with GDPR is worth the cost.
    - Nextgrid 6y ago
      Absolutely, given the current lack of enforcement. However, if you're going to be in breach, you might as well improve UX and not bother with the whole "consent management" thing, not to mention that the TrustArc garbage solution doesn't seem cheap.
      - Mirioron 6y ago
        But then it's much more apparent that you are in breach. If you pretend to care then the chance of being caught is much lower.
    - Dylan16807 6y ago
      Do you mean the direct cost of implementing the compliance, or the indirect cost of no longer getting extra ad revenue in an illegal way? In most cases I bet the former isn't all that much. The latter is a harder nut to crack, with everyone trying to toe the line and referencing what other companies are able to get away with. Lack of good faith is a big obstacle.
      - JumpCrisscross 6y ago
        > I bet the former isn't all that much One of the fundamental problems with GDPR is it contains a federated complain-investigate enforcement model. So your bet would have to apply to each of the EU’s twenty-eight members, now and in the future. In that context, throwing up notices and calling a day makes sense. One can argue one tried. But not go so far as to potentially create new liabilities by interpreting these enforcers’ current and future preferences too strongly.
    - disabled 6y ago
      > There is insufficient evidence attempting to comply with GDPR is worth the cost. The number of people working at the respective national privacy regulators is appalling. All of them have an extremely scarce amount of privacy auditors that are qualified to extensively investigate privacy breaches. Even Ireland, which has a huge tech hub with the social media companies especially, has a scarce amount of them. The Financial Times wrote an article about this awhile back, which tends to have good reporting on tech and privacy issues.
  - SyneRyder 6y ago
    Here's an example of a broken site: https://www.europarl.europa.eu/privacy-policy/en https://www.europarl.europa.eu/privacy-policy/en The only two cookie options are "Accept" or "More". But the More option is broken and just brings up the same cookie notice again and again on my browser. It drops cookies on the browser regardless of whether you choose to accept or not (search your cookies in the browser for europarl.europa.eu, you'll find the unique "atuserid" and "atidvisitor" analytics identifiers it has set to identify you). If that's the result on the EU Parliament's own website, on their privacy policy page, it's safe to say the EU doesn't actually care about privacy.
    - Mirioron 6y ago
      Maybe all these websites are simply taking the EU Parliament's site as an example on how you should do it? They made the regulation, surely you should follow their example.
    - XCSme 6y ago
      That's incredible and just shows how stupid this directive was. In my opinion it destroyed the user privacy and user experience: the average user now clicks "accept" as soon as he visits a site. This made it easy to fool non-technical users to subscribe to push notifications, give access to location and other privacy-invading features. I used the phone of my sister for a few minutes and her notification center was bombarded with random push notifications froms sites he visited and to which she unknowingly subscribed to.
      - Nextgrid 6y ago
        I agree that the current lack of enforcement is bad for the intent of the law and its long-term impact. Currently the lack of enforcement allows non-compliant solutions (where accepting is easier than declining) to thrive so people get used to accepting everything. Down the line, even when enforcement catches up and compliant solutions start appearing, users will still be clicking accept because they've been trained to do so. This is unfortunately good for adtech/martech not just now but in the future, so all of those currently making your money on stalking users, don't cry, it's all gonna be okay.
- tjoff 6y ago
  Disrespectful web developers have become the bane of my life. Be thankful that GDPR exposes them, and look for alternatives.
  - microcolonel 6y ago
    Setting aside GDPR for a moment, the cookie thing just means that if I want to use these websites, I have to enable cookies so that I can dismiss the cookie dialog.
    - tjoff 6y ago
      Again, only because of incompetent and/or immoral developers.
      - microcolonel 6y ago
        How else can you even store a consent for cookies/localStorage? You can go around calling people immoral and incompetent, but what is the actual way to ask for permission to store data? If your contention is that it is immoral or incompetent to store any data except through some specific user interaction related to those data, sure that's an opinion. But if your job is literally "tell me which other pages users go to after this one", it's not really that crazy of an ask. The law seems to call upon you to make it conspicuous, but when you make it conspicuous it is annoying, the law then calls upon you to make it not annoying. The better solution, in my mind, is just making cookie control features more visible in browsers. They work great, and it's the right place for this form of consent. Malicious actors abuse the current circumstance, because it relies on there being a responsible party with collateral to complain against. This is one of those times where the engineered solution is better than the social one.
        ratww 6y ago
        > How else can you even store a consent for cookies/localStorage? You said "the cookie thing just means that if I want to use these websites, I have to enable cookies so that I can dismiss the cookie dialog". But if cookies are disabled, then there's no point in asking for consent. There should be no cookie banner in this case.
- XCSme 6y ago
  Found this Chrome Extension: I don't care about cookies - Remove cookie warnings from almost all websites! https://chrome.google.com/webstore/detail/i-dont-care-about-cookies/fihnjjcciajhdojfnbdddfaoknhalnja https://chrome.google.com/webstore/detail/i-dont-care-about-...
ashton314 6y ago
We value your privacy. Like, it's valuable. We sell it for money. We're going to nag you until you click this button so we can't get in trouble for profiting off the data you give us. Good legislation is important to let us penalize bad actors—does any one know of any accounts of some bad actors getting stopped by the GDPR? What do you guys think: are there laws that should be in place to incentivize privacy-preserving tools?
- Nextgrid 6y ago
  > We're going to nag you until you click this button so we can't get in trouble for profiting off the data you give us. That is explicitly against the regulation. Consent should be freely given otherwise it's invalid. The problem is that there is no enforcement around this (despite it being very easy to detect this behavior at scale by running a web scraper) so they keep doing it and profiting off it.
  - clarry 6y ago
    > Consent should be freely given otherwise it's invalid. I tried to figure out what this actually means but it's very hazy. A naggy news website isn't performing a contract. Are they provisioning a service (assuming you did not buy or order or subscribe to anything)? "When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract." https://gdpr-info.eu/art-7-gdpr/ https://gdpr-info.eu/art-7-gdpr/
    - Nextgrid 6y ago
      For starters, it simply means that if declining consent is harder/more annoying than accepting then it's already in breach, regardless of anything else. If your website takes 1 click to accept tracking but several clicks to deny it then you're already in breach (assuming the law was actually enforced, which it isn't at the moment).
moksly 6y ago
I work as a developer in the European public sector, we already took privacy and security rather serious because the laws governing it had always been and are still tougher than the GDPR. I actually like that the EU is doing something, and I guess this is the best you get from a bureaucracy, but what it’s changed is that we document everything. Whenever I build anything that moves privacy data, even if it’s just hooking up a new system to our ADFS which accesses employee names, I need to fill out 4 forms and write a risk assessment. It all goes somewhere I suppose, I’m not sure because once I file them I never hear anything about it unless my wording wasn’t good enough. As far as security goes, it hasn’t actually changed anything. I guess it does if you weren’t taking security very serious before, but the idea that we as developers will think about security first or design better systems if a bunch of lawyers force us to fill out forms and write essays on what can go wrong... I just can’t wrap my head about why anyone would actually believe that stuff. Like I said, it’s a great idea, on paper, but the bureaucracy that is enforcing it is just so clueless. Passing inspections is more about having the right answers and documentation than having actual security, so it’s no wonder that the outcome is full of mixed signals and weird enforcement. Still better than nothing, in my opinion, and it’ll probably get better with time.
- ThePhysicist 6y ago
  Not sure why this is getting downvoted, seems to be a perfectly reasonable point?
  - Barrin92 6y ago
    because there's a rabid anti-regulation and anti-EU bias on this site. Well thought out answers get frequently downvoted while free market platitudes get upvoted.
- lmkg 6y ago
  There is a privacy benefit to adding friction to spreading personal data around everywhere. At the margin, some services will decide not to bother processing non-essential personal data just to avoid the paperwork. And really, that's one of the excesses that GDPR was a reaction to: that the "default" was "track everything in case the data magically becomes valuable," and now the it's become "perhaps not."
stevenbruce569 6y ago
I'm happy to see this as the top post on Hacker News, though would wonder if anyone would be able to provide me with a summary of the article since $399 is a bit steep for me (as in, I can afford it, but it's obviously WAY too much for what's promised by the title). I'd also be interested in case anyone has any thoughts on what the short or long-term outcome of the situation would be. Come to think of it, I'd like it if someone could give me a rough outline of GDPR at all. I'm a software developer working in Britain, and I reckon the local consequences are "the lawyers make lots of money", but am always keen to hear other viewpoints.
- MattGaiser 6y ago
  You can open it on Incognito mode.
- Nextgrid 6y ago
  At the moment, lawyers and all the scummy industry around the GDPR (whether it's advice/consulting or "consent management") are indeed the only ones making the money. There is very little enforcement and flawed solutions from the aforementioned industry are allowed to proliferate despite not actually being compliant (the majority of "consent management" solutions are in breach, so they are making money while not even helping their client become compliant).
  - joering2 6y ago
    Another good page with stats [1] including this: $63 million in fines issued $57 million of that issued to Google [1] https://www.varonis.com/blog/gdpr-effect-review/ https://www.varonis.com/blog/gdpr-effect-review/
    - Nextgrid 6y ago
      > Google was hit with a fee of $57 million for not making it clear to users how they were harvesting data from the Google search engine, YouTube and Google Maps for personalized ads. This fine only amounts to .04% of Google’s yearly revenue. Not only does this not cover Google's main offense (tracking of users and non-users with Google Analytics even on non-Google properties) but the fine is so minimal that it's basically the cost of doing business. I wish people would stop bringing this one up.
MattGaiser 6y ago
Has anyone beyond big tech actually figured out what the rules are yet?
- Nextgrid 6y ago
  The rules are very clear once you look past the fear-mongering. Don't stalk people, and if you want to stalk them you need to ask them nicely and allow them to decline. Don't be careless with user data so you minimize the likelihood of a breach, and if you do get breached then report it to the regulator and cooperate with them. In fact, "big tech" has figured out how to get around the rules by exploiting the lack of enforcement. The majority of big tech is knowingly not GDPR-compliant.
  - umvi 6y ago
    > Don't stalk people, and if you want to stalk them you need to ask them nicely and allow them to decline Ok, that's nice in a fantasy world, but in the real world a lot of people/sites rely on ad revenue, and ad revenue for the most part, requires tracking built in. So now if you legally force me to allow users to decline "stalking" you are basically allowing users to decline my monetization model and use my website/product for free. And why should I allow that? Why can't I say: "accept that my site is ad-supported or don't use my site?"
    - rocmcd 6y ago
      You can? If the user doesn’t opt-in to advertising then you could simply not allow them to use the site... Note, I’m not in any way an expert on the legality of it, but this seems like a silly argument to make. If anything, being more up-front with the model may open alternative methods of monetization (subscription-based, etc).
      - ApolloFortyNine 6y ago
        You can not [1] (though this is definitely the clause that at least in the US, I'm confident would be beaten down in court). And this is why I have such a problem with the rule. Without some dramatic changes, any video streaming site almost surely wouldn't be able to handle the substantially lower ad revenue and still make a profit if everyone actually opted out. Sites like Facebook would probably turn a profit, but there's a large portion of the internet that would not survive when faced with 90% less revenue (untargeted ads payout drastically less). >“Freely given” consent essentially means you have not cornered the data subject into agreeing to you using their data. For one thing, that means you cannot require consent to data processing as a condition of using the service. They need to be able to say no. According to Recital 42, “Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.” [1] [1] https://gdpr.eu/gdpr-consent-requirements/ https://gdpr.eu/gdpr-consent-requirements/ EDIT: Come on can we not down vote just because you disagree here? It's just going to be come a circle jerk like most of Reddit if you guys keep this up... I linked a source even proving this OP wrong... from the official GDPR resource...
HissingMachine 6y ago
This has been a constant headache, not the rules or how to apply it, but our customers still act like there isn't such a thing like GDPR, and actively demand, DEMAND that we put in place functionality that is in clear violation of GDPR, and when you try to inform and explain to them who things work they get mad at me and threaten that they will get a more professional shop to do things for them shrugs
- luckylion 6y ago
  Given that enforcement would have to be stepped up considerably to even be called selective, compliance means your competition has a large advantage.
  - HissingMachine 6y ago
    I'm not going to lie, if one of them switches shop and they make what they asked us, I'm going to report, in Finland law isn't selective even if it isn't enforced.
legitster 6y ago
It is worth pointing out GDPR is really two sets of laws - one around data security and breaches, and another set of laws around privacy. It's the second set of laws that get the most criticism for their opaqueness, but I don't know if they are better or worse than the first. They probably should have held off completely on the second set - the upcoming ePrivacy regulations are promised to actually do something, rather than just provide a really frustrating and opaque set of consent guidelines. As it is now, the law doesn't require anyone to actually stop what they are doing. The only difference now is you have to retain a lawyer to do it.
duxup 6y ago
I think GDPR has its heart in the right place. I don't think it really helps and I suspect that is because users themselves really don't know what is actually happening behind the scenes and no amount of banners or otter things changes their level of knowledge. And I fear even if they know, users don't care and are happy to click past a banner / trade their privacy for free things. GDPR seems to play out as a strangely legally mechanical beast that people are largely disconnected from.
- AndrewUnmuted 6y ago
  > GDPR has its heart in the right place I'm not sure we can jump to that conclusion. If the outcome of the GDPR was bewilderingly out of left field, and totally unpredictable, perhaps we could pass this off as being a big-hearted failure. The thing that I struggle to get past, though, is just how many of us warned of these outcomes _before_ the regulations were implemented. I fear very few had their heart in the right place. After all, it's pretty evident now, that those of of who saw this as a corporate effort to erect unnatural barriers to entry were correct. The people who designed the GDPR aren't idiots - they knew what they were doing too.
- Nextgrid 6y ago
  > users don't care and are happy to click past a banner / trade their privacy for free things. The GDPR explicitly mandates that consent should be freely given (it should not be more difficult to decline than to accept) and that consent should be informed, so you can't bury the information in 30 pages of ToS or privacy policies. The problem is that there is currently zero enforcement around those things. I'd argue that this is very bad for the intent of the law because even when enforcement starts happening and declining consent becomes possible users would've already been trained to just click accept to everything.
  - chris_engel 6y ago
    It gets even better: consent needs to be possible to be taken away as easy as its granted. Where are all the banners that nag me to take away ma consent?
- 6y ago
volak 6y ago
I would pay a subscription to a news site if they spent all their time evaluating 2-5 year old events and determining which side was right. 2 years ago comments of "this will only benefit the lawyers" would be -50 points. Turns out... actually yeah.
- flemhans 6y ago
  I thought that’s what everyone thought back then. At least all my friends were like, the lawyers will have a good time and be the only ones benefiting from this
  - volak 6y ago
    That's why such a news app would be so interesting. I remember comments from back then slightly differently.
  - emilfihlman 6y ago
    HN was (is) super into GDPR and any dissonance was (is, but fortunately less nowadays) quickly downvoted.
    - emilfihlman 6y ago
      A person commented and asked me about suggestions, but deleted his comment before I could answer so here it is anyways: Super quickly (I'm sure you have heard of, or can quickly use a search engine to find the commonly listed issues): Damages: damages need to be scaled according to the company size, severity and amount. GDPR was created to punish Big Players, but the wording that would have fit them is equally (and should be, laws should be equal) applied to small companies resulting in an impedance mismatch. Frankly, the damages are too small for the Big Players, but insane to the small ones. GDPR also does not apply to the state, but holy shit it fucking should! Enforcement: it needs to be equally enforced and you need to be able to sue by yourself over it instead of just limiting it to a state organisation. Data: it should be data that is directly tied to you, ie leave the normal web logs etc out of it. PII is just a sham as it's defined today. A factor of usage also needs to play into it, ie normal web server ip logs that are separate and don't feed into a user specific connection into a database should not be a consideration. Access: access _needs_ to be able to be done online if the data is collected or transferred online. Ie no this "you need to physically mail us a certified mail with your id" shit. GPDR is a fucking failure in this aspect. Also no required strong authentication: access should be just directly through your account you can access normally without strong authentication. Usage: GDPR does not allow you to trade tracking for access (ie monetisation of content is almost impossible if you care about user privacy): this is insane. GDPR also supposedly does not allow for those complicated "accept all or modify your preferences" windows, but it should have no saying in that: if a site wants to make the experience painful, that's up to them. It is up to the user to select if they want to use that site or not.
av501 6y ago
Nothing says GDPR is something that can't be improved upon. Better enforcement, refinement of laws, everything is possible. It has to begin somewhere and that beginning is rarely perfect. Every failure is also an opportunity to learn what to do better. As some other people have commented, the intent is right, the execution has to be improved. Edit: Fixed grammar and some words
- Mirioron 6y ago
  The issue is the collateral damage. The EU doesn't have a thriving web/tech sector to begin with when compared to the US or China. These kinds of things likely make it worse.
  - Nextgrid 6y ago
    I see this argument every so often but I'm wondering, what did we actually lose? Nasty social media that makes their money on outrage and exposing people to scam ads? That's about the only thing I can think of, and I don't think it's a big loss. The legal environment of the EU might actually pave the way for better social media, if the market wasn't already monopolized by the current incumbents. As a counter-argument, Europe and especially the UK has a thriving fintech scene that produces solutions light-years ahead of what's currently in the US, despite the stronger consumer protection laws that we have.
    - burntoutfire 6y ago
      We didn't lose that much because I suspect big business in Europe is largely ignoring the more difficult parts of the GDPR. I work for a large bank that is totally non-compliant with GDPR and does not really even have a strategy for getting there. My impression is that we (the bank) looked at the draconian requirements of the bill, realized that, with the total mess that the IT of the bank is in, implementing GDPR would cost billions, and just sort of gave up. It looks like we wait for the regulators to fine us and hope that it won't be a nine figure fine.
      - 6y ago
justignoregdpr 6y ago
Guys, we have a lot of European customers and we completely ignored GDPR rules. After it was introduced, only 2 potential customers asked us about it and we just moved their emails to trash. Not worth the hassle! There is nothing they can do anyway to force it if you are not living within the EU (unless there is a special agreement between your country and EU). I even know some startups who are located within the EU, but still don't care about GDPR :D
Romanulus 6y ago
Who could have predicted that an overarching government program to control and regulate content on the internet is failing?
emilfihlman 6y ago
GDPR was known to be, is known to be, and will known to be a shit law that's not tied to reality. It did have some good (allowing you to know what they have on you in general, and asking them to delete some of that), but the rest is just bad, bad, bad. I wish people would be rational when supporting privacy increasing things. GDPR could have been much better and it saddens me that it was ruined, and defended by, zealots.
- justignoregdpr 6y ago
  In a way, I'm glad this law exists. My competitors spend so much time to be compliant. I just ignore the law and spend my time on improving my SAAS instead. They all will go bankrupt and my startup gets more and more users every day.
- deleted 6y ago
  [deleted]
- emilfihlman 6y ago
  A person commented and asked me about suggestions, but deleted his comment before I could answer so here it is anyways: Super quickly (I'm sure you have heard of, or can quickly use a search engine to find the commonly listed issues): Damages: damages need to be scaled according to the company size, severity and amount. GDPR was created to punish Big Players, but the wording that would have fit them is equally (and should be, laws should be equal) applied to small companies resulting in an impedance mismatch. Frankly, the damages are too small for the Big Players, but insane to the small ones. GDPR also does not apply to the state, but holy shit it fucking should! Enforcement: it needs to be equally enforced and you need to be able to sue by yourself over it instead of just limiting it to a state organisation. Data: it should be data that is directly tied to you, ie leave the normal web logs etc out of it. PII is just a sham as it's defined today. A factor of usage also needs to play into it, ie normal web server ip logs that are separate and don't feed into a user specific connection into a database should not be a consideration. Access: access _needs_ to be able to be done online if the data is collected or transferred online. Ie no this "you need to physically mail us a certified mail with your id" shit. GPDR is a fucking failure in this aspect. Also no required strong authentication: access should be just directly through your account you can access normally without strong authentication. Usage: GDPR does not allow you to trade tracking for access (ie monetisation of content is almost impossible if you care about user privacy): this is insane. GDPR also supposedly does not allow for those complicated "accept all or modify your preferences" windows, but it should have no saying in that: if a site wants to make the experience painful, that's up to them. It is up to the user to select if they want to use that site or not.
Antecedent 6y ago
And the European fetish for choking on paper continues. No wonder they have moribund economies.
paulie_a 6y ago
Personally I am just annoyed by the cookie warning on every site. Gdpr does not apply to vast portions of the internet.
- MattGaiser 6y ago
  >Gdpr does not apply to vast portions of the internet Europe wants it to apply to anything a European might touch.
  - thejynxed 6y ago
    Of course they do, and just like my ancestors did in 1776 I am free to tell them to mind their own business on their own side of the pond.
- justignoregdpr 6y ago
  If you use an AdBlocker, you can add the list called "EasyList Cookie" and it will remove some of the annoying cookie notifications, but even with that list a lot of cookie notifications will be showed.
hypersoar 6y ago
The fears about GDPR when it passed, if I remember correctly, were mainly around arbitrary draconian enforcement. This article seems to only be talking about under enforcement. The causes of this under enforcement seem fixable. Ireland, putatively afraid of the big tech companies choosing to put their Europe HQs elsewhere, has been dragging their feet on privacy investigations. But the investigations are happening. Then there are some countries not putting enough money into it. The rest seems to be the various countries not being in alignment. For a sweeping, two-year-old regulation that has spent about an eighth of its life in the time of a major global crisis, this doesn't strike me as all that shocking. Does anyone have any actual examples of draconian fines being handed out for good-faith misunderstandings of the regulation? Big Tech has professed confusion over how they're supposed to comply, but it seems to me like like they would simply prefer not to.
schrototo 6y ago
The worst effect the GDPR had was on offline bureaucracy. "Data protection" has become the go-to excuse for blocking every single goddamn thing.
- hindsightbias 6y ago
  Beyond the impact of crushing knowledge transfer, it’s going to kill a lot of people. In companies with world-wide products/solutions/support, older employees tend to have a broad base of knowledge and learning from being exposed to all customer experiences and issues. Now, everything is in a protected silo and new employees will only learn through a soda-straw looking glass. Older employees are learning to say “not my problem” when getting cleared to look at something overseas because there are 3 layers of data protection officers and it cant be proven there’s not 1 bit of PPD in that 10GB dump. Some day soon, an industrial or other large-scale accident will kill people and someone in the back office will say “That team didn’t know about X? Doh!”

136 points by joering2 6y ago

barking 6y ago

We care about your privacy notices have become the bane of my life.

ianlevesque 6y ago
Just pair them with cookie notices for extra effectiveness!
briandear 6y ago
Right up there with emails from software companies with “our response to Covid-19.” You are a software company. Unless the server has the virus, I really don’t care.
Causality1 6y ago
Indeed. Frankly I miss the days when my popups had breasts in them.
Nextgrid 6y ago
The majority of these aren't actually compliant. Tracking should be opt-in and consent should be freely given. If your notice is annoying enough that most people click accept (or if clicking decline is harder) then you are already in breach. A lot of websites also consider analytics cookies as essential and don't provide a way to decline those which isn't compliant either. These websites can be detected very easily by running a web scraper and looking for one of these non-compliant "consent management" solutions (looking at you TrustArc) and fining every single company that uses it.
- SpicyLemonZest 6y ago
  I've seen a lot of people say this, but I'm just not convinced it's actually the law. It's not obvious to me that analytics cookies categorically can't be essential or that "freely given" implies strict UI neutrality between accepting and declining.
  - Tomte 6y ago
    Yesterday the highest German court (BGH) ruled that "default accept" in cookie dialog boxes is illegal. It was a pre-GDPR case, but the court said it interpreted the them-in-force law in a GDPR-friendly way.
  - Nextgrid 6y ago
    The majority of websites use third-party analytics that collect way more information than necessary and may use it for their own purposes (surprisingly a lot of these companies' main business is ad-tech). The problem here is that not only do you get analytics but the third-party (with whom the user has no relationship and their interests might be against the user's) is now able to track that user across other websites.
  - chris_engel 6y ago
    Well, essential means that a web service cannot technically work without it. For example, a session cookie.
    - Nextgrid 6y ago
      The law explicitly has exemptions around purely functional cookies so you are free to set session cookies without requiring consent/disclosure.
- shadowgovt 6y ago
  > A lot of websites also consider analytics cookies as essential For a lot of websites, they are.
  - lmkg 6y ago
    Under PECR, a cookie being essential means necessary to provide the requested service, not necessary to stay in business. If the user wants to view a news article, and you can serve the article without using analytics cookies, then PECR doesn't allow the cookie. (The situation for paywalls is complicated.)
    - cameronbrown 6y ago
      Providing the service assumes staying in business, no?
      - p_l 6y ago
        No, there's no protection for failed business models, as there should not be.
        shadowgovt 6y ago
        The business model of Google isn't a failed business model. What the GDPR does do, quite successfully, is build a moat around Google so wide and deep as to minimize competition with them, because they're one of the few firms that can both (a) afford the engineers with the technical expertise to comply with the law while accomplishing their goals and (b) afford the lawyers to address the issue when they fail at the former.
        Nextgrid 6y ago
        > afford the engineers with the technical expertise to comply with the law while accomplishing their goals Google is in breach of the GDPR as it stands, so no. > afford the lawyers to address the issue when they fail at the former Potentially, though again a clear-cut breach like theirs should result in a fine regardless of how much money they throw at the problem. As far as building a moat, I'm not sure. Whether it's Google or a one-man shop, neither can accurately track users without being in breach. There is no moat that I can see, you either break the law or you don't.
- JMTQp8lwXL 6y ago
  On mobile, some of the opt-out toggle switches don't even function. You literally cannot disable the toggle in iOS Safari.
  - SilasX 6y ago
    Yeah but that says more about the clumsiness of iOS. Since upgrading to 13, a ton of stuff is broken, like tap to zoom, and significant ability to edit text fields. Web pages randomly freeze, forcing a kill and reopen, which I rarely saw before.
- andrewla 6y ago
  > The majority of these aren't actually compliant. The title of the article is "Two years in, GDPR defined by mixed signals, unbalanced enforcement". So sure, maybe they're not complaint, but nobody is enforcing anyway. EDIT: removed unnecessary pejorative statement from last paragraph
- JumpCrisscross 6y ago
  > The majority of these aren't actually compliant There is insufficient evidence attempting to comply with GDPR is worth the cost.
  - Nextgrid 6y ago
    Absolutely, given the current lack of enforcement. However, if you're going to be in breach, you might as well improve UX and not bother with the whole "consent management" thing, not to mention that the TrustArc garbage solution doesn't seem cheap.
    - Mirioron 6y ago
      But then it's much more apparent that you are in breach. If you pretend to care then the chance of being caught is much lower.
  - Dylan16807 6y ago
    Do you mean the direct cost of implementing the compliance, or the indirect cost of no longer getting extra ad revenue in an illegal way? In most cases I bet the former isn't all that much. The latter is a harder nut to crack, with everyone trying to toe the line and referencing what other companies are able to get away with. Lack of good faith is a big obstacle.
    - JumpCrisscross 6y ago
      > I bet the former isn't all that much One of the fundamental problems with GDPR is it contains a federated complain-investigate enforcement model. So your bet would have to apply to each of the EU’s twenty-eight members, now and in the future. In that context, throwing up notices and calling a day makes sense. One can argue one tried. But not go so far as to potentially create new liabilities by interpreting these enforcers’ current and future preferences too strongly.
  - disabled 6y ago
    > There is insufficient evidence attempting to comply with GDPR is worth the cost. The number of people working at the respective national privacy regulators is appalling. All of them have an extremely scarce amount of privacy auditors that are qualified to extensively investigate privacy breaches. Even Ireland, which has a huge tech hub with the social media companies especially, has a scarce amount of them. The Financial Times wrote an article about this awhile back, which tends to have good reporting on tech and privacy issues.
- SyneRyder 6y ago
  Here's an example of a broken site: https://www.europarl.europa.eu/privacy-policy/en https://www.europarl.europa.eu/privacy-policy/en The only two cookie options are "Accept" or "More". But the More option is broken and just brings up the same cookie notice again and again on my browser. It drops cookies on the browser regardless of whether you choose to accept or not (search your cookies in the browser for europarl.europa.eu, you'll find the unique "atuserid" and "atidvisitor" analytics identifiers it has set to identify you). If that's the result on the EU Parliament's own website, on their privacy policy page, it's safe to say the EU doesn't actually care about privacy.
  - Mirioron 6y ago
    Maybe all these websites are simply taking the EU Parliament's site as an example on how you should do it? They made the regulation, surely you should follow their example.
  - XCSme 6y ago
    That's incredible and just shows how stupid this directive was. In my opinion it destroyed the user privacy and user experience: the average user now clicks "accept" as soon as he visits a site. This made it easy to fool non-technical users to subscribe to push notifications, give access to location and other privacy-invading features. I used the phone of my sister for a few minutes and her notification center was bombarded with random push notifications froms sites he visited and to which she unknowingly subscribed to.
    - Nextgrid 6y ago
      I agree that the current lack of enforcement is bad for the intent of the law and its long-term impact. Currently the lack of enforcement allows non-compliant solutions (where accepting is easier than declining) to thrive so people get used to accepting everything. Down the line, even when enforcement catches up and compliant solutions start appearing, users will still be clicking accept because they've been trained to do so. This is unfortunately good for adtech/martech not just now but in the future, so all of those currently making your money on stalking users, don't cry, it's all gonna be okay.
tjoff 6y ago
Disrespectful web developers have become the bane of my life. Be thankful that GDPR exposes them, and look for alternatives.
- microcolonel 6y ago
  Setting aside GDPR for a moment, the cookie thing just means that if I want to use these websites, I have to enable cookies so that I can dismiss the cookie dialog.
  - tjoff 6y ago
    Again, only because of incompetent and/or immoral developers.
    - microcolonel 6y ago
      How else can you even store a consent for cookies/localStorage? You can go around calling people immoral and incompetent, but what is the actual way to ask for permission to store data? If your contention is that it is immoral or incompetent to store any data except through some specific user interaction related to those data, sure that's an opinion. But if your job is literally "tell me which other pages users go to after this one", it's not really that crazy of an ask. The law seems to call upon you to make it conspicuous, but when you make it conspicuous it is annoying, the law then calls upon you to make it not annoying. The better solution, in my mind, is just making cookie control features more visible in browsers. They work great, and it's the right place for this form of consent. Malicious actors abuse the current circumstance, because it relies on there being a responsible party with collateral to complain against. This is one of those times where the engineered solution is better than the social one.
      - ratww 6y ago
        > How else can you even store a consent for cookies/localStorage? You said "the cookie thing just means that if I want to use these websites, I have to enable cookies so that I can dismiss the cookie dialog". But if cookies are disabled, then there's no point in asking for consent. There should be no cookie banner in this case.
XCSme 6y ago
Found this Chrome Extension: I don't care about cookies - Remove cookie warnings from almost all websites! https://chrome.google.com/webstore/detail/i-dont-care-about-cookies/fihnjjcciajhdojfnbdddfaoknhalnja https://chrome.google.com/webstore/detail/i-dont-care-about-...

ashton314 6y ago

We value your privacy. Like, it's valuable. We sell it for money. We're going to nag you until you click this button so we can't get in trouble for profiting off the data you give us. Good legislation is important to let us penalize bad actors—does any one know of any accounts of some bad actors getting stopped by the GDPR? What do you guys think: are there laws that should be in place to incentivize privacy-preserving tools?

Nextgrid 6y ago
> We're going to nag you until you click this button so we can't get in trouble for profiting off the data you give us. That is explicitly against the regulation. Consent should be freely given otherwise it's invalid. The problem is that there is no enforcement around this (despite it being very easy to detect this behavior at scale by running a web scraper) so they keep doing it and profiting off it.
- clarry 6y ago
  > Consent should be freely given otherwise it's invalid. I tried to figure out what this actually means but it's very hazy. A naggy news website isn't performing a contract. Are they provisioning a service (assuming you did not buy or order or subscribe to anything)? "When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract." https://gdpr-info.eu/art-7-gdpr/ https://gdpr-info.eu/art-7-gdpr/
  - Nextgrid 6y ago
    For starters, it simply means that if declining consent is harder/more annoying than accepting then it's already in breach, regardless of anything else. If your website takes 1 click to accept tracking but several clicks to deny it then you're already in breach (assuming the law was actually enforced, which it isn't at the moment).

moksly 6y ago

I work as a developer in the European public sector, we already took privacy and security rather serious because the laws governing it had always been and are still tougher than the GDPR. I actually like that the EU is doing something, and I guess this is the best you get from a bureaucracy, but what it’s changed is that we document everything. Whenever I build anything that moves privacy data, even if it’s just hooking up a new system to our ADFS which accesses employee names, I need to fill out 4 forms and write a risk assessment. It all goes somewhere I suppose, I’m not sure because once I file them I never hear anything about it unless my wording wasn’t good enough. As far as security goes, it hasn’t actually changed anything. I guess it does if you weren’t taking security very serious before, but the idea that we as developers will think about security first or design better systems if a bunch of lawyers force us to fill out forms and write essays on what can go wrong... I just can’t wrap my head about why anyone would actually believe that stuff. Like I said, it’s a great idea, on paper, but the bureaucracy that is enforcing it is just so clueless. Passing inspections is more about having the right answers and documentation than having actual security, so it’s no wonder that the outcome is full of mixed signals and weird enforcement. Still better than nothing, in my opinion, and it’ll probably get better with time.

ThePhysicist 6y ago
Not sure why this is getting downvoted, seems to be a perfectly reasonable point?
- Barrin92 6y ago
  because there's a rabid anti-regulation and anti-EU bias on this site. Well thought out answers get frequently downvoted while free market platitudes get upvoted.
lmkg 6y ago
There is a privacy benefit to adding friction to spreading personal data around everywhere. At the margin, some services will decide not to bother processing non-essential personal data just to avoid the paperwork. And really, that's one of the excesses that GDPR was a reaction to: that the "default" was "track everything in case the data magically becomes valuable," and now the it's become "perhaps not."

stevenbruce569 6y ago

I'm happy to see this as the top post on Hacker News, though would wonder if anyone would be able to provide me with a summary of the article since $399 is a bit steep for me (as in, I can afford it, but it's obviously WAY too much for what's promised by the title). I'd also be interested in case anyone has any thoughts on what the short or long-term outcome of the situation would be. Come to think of it, I'd like it if someone could give me a rough outline of GDPR at all. I'm a software developer working in Britain, and I reckon the local consequences are "the lawyers make lots of money", but am always keen to hear other viewpoints.

MattGaiser 6y ago
You can open it on Incognito mode.
Nextgrid 6y ago
At the moment, lawyers and all the scummy industry around the GDPR (whether it's advice/consulting or "consent management") are indeed the only ones making the money. There is very little enforcement and flawed solutions from the aforementioned industry are allowed to proliferate despite not actually being compliant (the majority of "consent management" solutions are in breach, so they are making money while not even helping their client become compliant).
- joering2 6y ago
  Another good page with stats [1] including this: $63 million in fines issued $57 million of that issued to Google [1] https://www.varonis.com/blog/gdpr-effect-review/ https://www.varonis.com/blog/gdpr-effect-review/
  - Nextgrid 6y ago
    > Google was hit with a fee of $57 million for not making it clear to users how they were harvesting data from the Google search engine, YouTube and Google Maps for personalized ads. This fine only amounts to .04% of Google’s yearly revenue. Not only does this not cover Google's main offense (tracking of users and non-users with Google Analytics even on non-Google properties) but the fine is so minimal that it's basically the cost of doing business. I wish people would stop bringing this one up.

MattGaiser 6y ago

Has anyone beyond big tech actually figured out what the rules are yet?

Nextgrid 6y ago
The rules are very clear once you look past the fear-mongering. Don't stalk people, and if you want to stalk them you need to ask them nicely and allow them to decline. Don't be careless with user data so you minimize the likelihood of a breach, and if you do get breached then report it to the regulator and cooperate with them. In fact, "big tech" has figured out how to get around the rules by exploiting the lack of enforcement. The majority of big tech is knowingly not GDPR-compliant.
- umvi 6y ago
  > Don't stalk people, and if you want to stalk them you need to ask them nicely and allow them to decline Ok, that's nice in a fantasy world, but in the real world a lot of people/sites rely on ad revenue, and ad revenue for the most part, requires tracking built in. So now if you legally force me to allow users to decline "stalking" you are basically allowing users to decline my monetization model and use my website/product for free. And why should I allow that? Why can't I say: "accept that my site is ad-supported or don't use my site?"
  - rocmcd 6y ago
    You can? If the user doesn’t opt-in to advertising then you could simply not allow them to use the site... Note, I’m not in any way an expert on the legality of it, but this seems like a silly argument to make. If anything, being more up-front with the model may open alternative methods of monetization (subscription-based, etc).
    - ApolloFortyNine 6y ago
      You can not [1] (though this is definitely the clause that at least in the US, I'm confident would be beaten down in court). And this is why I have such a problem with the rule. Without some dramatic changes, any video streaming site almost surely wouldn't be able to handle the substantially lower ad revenue and still make a profit if everyone actually opted out. Sites like Facebook would probably turn a profit, but there's a large portion of the internet that would not survive when faced with 90% less revenue (untargeted ads payout drastically less). >“Freely given” consent essentially means you have not cornered the data subject into agreeing to you using their data. For one thing, that means you cannot require consent to data processing as a condition of using the service. They need to be able to say no. According to Recital 42, “Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.” [1] [1] https://gdpr.eu/gdpr-consent-requirements/ https://gdpr.eu/gdpr-consent-requirements/ EDIT: Come on can we not down vote just because you disagree here? It's just going to be come a circle jerk like most of Reddit if you guys keep this up... I linked a source even proving this OP wrong... from the official GDPR resource...

HissingMachine 6y ago

This has been a constant headache, not the rules or how to apply it, but our customers still act like there isn't such a thing like GDPR, and actively demand, DEMAND that we put in place functionality that is in clear violation of GDPR, and when you try to inform and explain to them who things work they get mad at me and threaten that they will get a more professional shop to do things for them shrugs

luckylion 6y ago
Given that enforcement would have to be stepped up considerably to even be called selective, compliance means your competition has a large advantage.
- HissingMachine 6y ago
  I'm not going to lie, if one of them switches shop and they make what they asked us, I'm going to report, in Finland law isn't selective even if it isn't enforced.

legitster 6y ago

It is worth pointing out GDPR is really two sets of laws - one around data security and breaches, and another set of laws around privacy. It's the second set of laws that get the most criticism for their opaqueness, but I don't know if they are better or worse than the first. They probably should have held off completely on the second set - the upcoming ePrivacy regulations are promised to actually do something, rather than just provide a really frustrating and opaque set of consent guidelines. As it is now, the law doesn't require anyone to actually stop what they are doing. The only difference now is you have to retain a lawyer to do it.

duxup 6y ago

I think GDPR has its heart in the right place. I don't think it really helps and I suspect that is because users themselves really don't know what is actually happening behind the scenes and no amount of banners or otter things changes their level of knowledge. And I fear even if they know, users don't care and are happy to click past a banner / trade their privacy for free things. GDPR seems to play out as a strangely legally mechanical beast that people are largely disconnected from.

AndrewUnmuted 6y ago
> GDPR has its heart in the right place I'm not sure we can jump to that conclusion. If the outcome of the GDPR was bewilderingly out of left field, and totally unpredictable, perhaps we could pass this off as being a big-hearted failure. The thing that I struggle to get past, though, is just how many of us warned of these outcomes _before_ the regulations were implemented. I fear very few had their heart in the right place. After all, it's pretty evident now, that those of of who saw this as a corporate effort to erect unnatural barriers to entry were correct. The people who designed the GDPR aren't idiots - they knew what they were doing too.
Nextgrid 6y ago
> users don't care and are happy to click past a banner / trade their privacy for free things. The GDPR explicitly mandates that consent should be freely given (it should not be more difficult to decline than to accept) and that consent should be informed, so you can't bury the information in 30 pages of ToS or privacy policies. The problem is that there is currently zero enforcement around those things. I'd argue that this is very bad for the intent of the law because even when enforcement starts happening and declining consent becomes possible users would've already been trained to just click accept to everything.
- chris_engel 6y ago
  It gets even better: consent needs to be possible to be taken away as easy as its granted. Where are all the banners that nag me to take away ma consent?
6y ago

volak 6y ago

I would pay a subscription to a news site if they spent all their time evaluating 2-5 year old events and determining which side was right. 2 years ago comments of "this will only benefit the lawyers" would be -50 points. Turns out... actually yeah.

flemhans 6y ago
I thought that’s what everyone thought back then. At least all my friends were like, the lawyers will have a good time and be the only ones benefiting from this
- volak 6y ago
  That's why such a news app would be so interesting. I remember comments from back then slightly differently.
- emilfihlman 6y ago
  HN was (is) super into GDPR and any dissonance was (is, but fortunately less nowadays) quickly downvoted.
  - emilfihlman 6y ago
    A person commented and asked me about suggestions, but deleted his comment before I could answer so here it is anyways: Super quickly (I'm sure you have heard of, or can quickly use a search engine to find the commonly listed issues): Damages: damages need to be scaled according to the company size, severity and amount. GDPR was created to punish Big Players, but the wording that would have fit them is equally (and should be, laws should be equal) applied to small companies resulting in an impedance mismatch. Frankly, the damages are too small for the Big Players, but insane to the small ones. GDPR also does not apply to the state, but holy shit it fucking should! Enforcement: it needs to be equally enforced and you need to be able to sue by yourself over it instead of just limiting it to a state organisation. Data: it should be data that is directly tied to you, ie leave the normal web logs etc out of it. PII is just a sham as it's defined today. A factor of usage also needs to play into it, ie normal web server ip logs that are separate and don't feed into a user specific connection into a database should not be a consideration. Access: access _needs_ to be able to be done online if the data is collected or transferred online. Ie no this "you need to physically mail us a certified mail with your id" shit. GPDR is a fucking failure in this aspect. Also no required strong authentication: access should be just directly through your account you can access normally without strong authentication. Usage: GDPR does not allow you to trade tracking for access (ie monetisation of content is almost impossible if you care about user privacy): this is insane. GDPR also supposedly does not allow for those complicated "accept all or modify your preferences" windows, but it should have no saying in that: if a site wants to make the experience painful, that's up to them. It is up to the user to select if they want to use that site or not.

av501 6y ago

Nothing says GDPR is something that can't be improved upon. Better enforcement, refinement of laws, everything is possible. It has to begin somewhere and that beginning is rarely perfect. Every failure is also an opportunity to learn what to do better. As some other people have commented, the intent is right, the execution has to be improved. Edit: Fixed grammar and some words

Mirioron 6y ago
The issue is the collateral damage. The EU doesn't have a thriving web/tech sector to begin with when compared to the US or China. These kinds of things likely make it worse.
- Nextgrid 6y ago
  I see this argument every so often but I'm wondering, what did we actually lose? Nasty social media that makes their money on outrage and exposing people to scam ads? That's about the only thing I can think of, and I don't think it's a big loss. The legal environment of the EU might actually pave the way for better social media, if the market wasn't already monopolized by the current incumbents. As a counter-argument, Europe and especially the UK has a thriving fintech scene that produces solutions light-years ahead of what's currently in the US, despite the stronger consumer protection laws that we have.
  - burntoutfire 6y ago
    We didn't lose that much because I suspect big business in Europe is largely ignoring the more difficult parts of the GDPR. I work for a large bank that is totally non-compliant with GDPR and does not really even have a strategy for getting there. My impression is that we (the bank) looked at the draconian requirements of the bill, realized that, with the total mess that the IT of the bank is in, implementing GDPR would cost billions, and just sort of gave up. It looks like we wait for the regulators to fine us and hope that it won't be a nine figure fine.
    - 6y ago

justignoregdpr 6y ago

Guys, we have a lot of European customers and we completely ignored GDPR rules. After it was introduced, only 2 potential customers asked us about it and we just moved their emails to trash. Not worth the hassle! There is nothing they can do anyway to force it if you are not living within the EU (unless there is a special agreement between your country and EU). I even know some startups who are located within the EU, but still don't care about GDPR :D

Romanulus 6y ago

Who could have predicted that an overarching government program to control and regulate content on the internet is failing?

emilfihlman 6y ago

GDPR was known to be, is known to be, and will known to be a shit law that's not tied to reality. It did have some good (allowing you to know what they have on you in general, and asking them to delete some of that), but the rest is just bad, bad, bad. I wish people would be rational when supporting privacy increasing things. GDPR could have been much better and it saddens me that it was ruined, and defended by, zealots.

justignoregdpr 6y ago
In a way, I'm glad this law exists. My competitors spend so much time to be compliant. I just ignore the law and spend my time on improving my SAAS instead. They all will go bankrupt and my startup gets more and more users every day.
deleted 6y ago
[deleted]
emilfihlman 6y ago
A person commented and asked me about suggestions, but deleted his comment before I could answer so here it is anyways: Super quickly (I'm sure you have heard of, or can quickly use a search engine to find the commonly listed issues): Damages: damages need to be scaled according to the company size, severity and amount. GDPR was created to punish Big Players, but the wording that would have fit them is equally (and should be, laws should be equal) applied to small companies resulting in an impedance mismatch. Frankly, the damages are too small for the Big Players, but insane to the small ones. GDPR also does not apply to the state, but holy shit it fucking should! Enforcement: it needs to be equally enforced and you need to be able to sue by yourself over it instead of just limiting it to a state organisation. Data: it should be data that is directly tied to you, ie leave the normal web logs etc out of it. PII is just a sham as it's defined today. A factor of usage also needs to play into it, ie normal web server ip logs that are separate and don't feed into a user specific connection into a database should not be a consideration. Access: access _needs_ to be able to be done online if the data is collected or transferred online. Ie no this "you need to physically mail us a certified mail with your id" shit. GPDR is a fucking failure in this aspect. Also no required strong authentication: access should be just directly through your account you can access normally without strong authentication. Usage: GDPR does not allow you to trade tracking for access (ie monetisation of content is almost impossible if you care about user privacy): this is insane. GDPR also supposedly does not allow for those complicated "accept all or modify your preferences" windows, but it should have no saying in that: if a site wants to make the experience painful, that's up to them. It is up to the user to select if they want to use that site or not.

Antecedent 6y ago

And the European fetish for choking on paper continues. No wonder they have moribund economies.

paulie_a 6y ago

Personally I am just annoyed by the cookie warning on every site. Gdpr does not apply to vast portions of the internet.

MattGaiser 6y ago
>Gdpr does not apply to vast portions of the internet Europe wants it to apply to anything a European might touch.
- thejynxed 6y ago
  Of course they do, and just like my ancestors did in 1776 I am free to tell them to mind their own business on their own side of the pond.
justignoregdpr 6y ago
If you use an AdBlocker, you can add the list called "EasyList Cookie" and it will remove some of the annoying cookie notifications, but even with that list a lot of cookie notifications will be showed.

hypersoar 6y ago

The fears about GDPR when it passed, if I remember correctly, were mainly around arbitrary draconian enforcement. This article seems to only be talking about under enforcement. The causes of this under enforcement seem fixable. Ireland, putatively afraid of the big tech companies choosing to put their Europe HQs elsewhere, has been dragging their feet on privacy investigations. But the investigations are happening. Then there are some countries not putting enough money into it. The rest seems to be the various countries not being in alignment. For a sweeping, two-year-old regulation that has spent about an eighth of its life in the time of a major global crisis, this doesn't strike me as all that shocking. Does anyone have any actual examples of draconian fines being handed out for good-faith misunderstandings of the regulation? Big Tech has professed confusion over how they're supposed to comply, but it seems to me like like they would simply prefer not to.

schrototo 6y ago

The worst effect the GDPR had was on offline bureaucracy. "Data protection" has become the go-to excuse for blocking every single goddamn thing.

hindsightbias 6y ago
Beyond the impact of crushing knowledge transfer, it’s going to kill a lot of people. In companies with world-wide products/solutions/support, older employees tend to have a broad base of knowledge and learning from being exposed to all customer experiences and issues. Now, everything is in a protected silo and new employees will only learn through a soda-straw looking glass. Older employees are learning to say “not my problem” when getting cleared to look at something overseas because there are 3 layers of data protection officers and it cant be proven there’s not 1 bit of PPD in that 10GB dump. Some day soon, an industrial or other large-scale accident will kill people and someone in the back office will say “That team didn’t know about X? Doh!”