9 ms·

The GDPR as accidentally explained by people in the US

121 points by M2Ys4U 6y ago

M2Ys4U 6y ago
The full title is "The GDPR as accidentally explained by people in the US who criticize the GDPR for its pitfalls, while calling for what’s actually in the GDPR" but HN doesn't allow titles to be that long.
- Nextgrid 6y ago
  I'd argue a better title would be "The EU GDPR as understood by Americans". The current title seems to imply an authoritative, true explanation of the GDPR by Americans, while the article is all about how the GDPR is frequently misunderstood on the other side of the pond.
  - hugoroy 6y ago
    Hi - author of the post here. The points in the post are really about GDPR basics. I'm not actually trying to explain or interpret anything. Instead, I am mostly paraphrasing, if not merely quoting the GDPR directly (and linking to the authoritative source - check for yourself). The more blatant example is probably the first one, about "data use" v. "data collection". There's just no way that the statements about GDPR "missing the point of data collection" can be characterized as a misunderstanding of the text itself. The text has explicit references to data collection all over, including in the definition of the most important word, i.e. "processing". So I think that, as these examples show, it's not really about misunderstanding on the other side of the Atlantic. I think it's more about baseless misconceptions and myths being thrown out here and there. Ask yourself: Why? Edit: typos
    - Nextgrid 6y ago
      > I'm not actually trying to explain or interpret anything. Instead, I am mostly paraphrasing Yes, this is what I meant - apologies if this was worded poorly (edited it now). I was indeed referring to American's (wrong) understanding/interpretation of the GDPR you are referring to rather than your own article's interpretation of it. > I think it's more about baseless misconceptions and myths being thrown out here and there. Ask yourself: Why? Indeed it is, however misconceptions/myths can be referred to as misunderstandings. I'm sure there are business interests at play and why there's a lot of bad advice being thrown around in an attempt to demonize the GDPR and make it seem more annoying than it actually is, but if we were to only assume good faith then I think it's fair to call it a misunderstanding.
      - p_l 6y ago
        Locally (Poland) I had a feeling that a lot of the misconception was fueled by people trying to sell consulting on GDPR, when majority of the situation could be summed up as "remember the GIODO (polish PII protection agency) rules that you ignored so far? Now they have teeth". But if you sold it as something more complex than "PII is like nuclear waste, you want to avoid it", then you couldn't sell high-priced "GDPR transformation services" or get lots of ad views on your spiffy web page :/
        Nextgrid 6y ago
        Agreed. There is a lot of money to be made in GDPR-related consulting peddling non-compliant snake oil. GDPR compliance is actually quite simple, however it is often detrimental to the business, so it's near-impossible to do "honest" GDPR consulting because you'd be telling your client things they don't want to hear and they would rather go to someone else that tells them what they want to hear, even if they don't actually solve the underlying problem of compliance. That's the only reason I can think of why non-compliant consent management solutions (such as TrustArc) are thriving despite even a casual read of the regulations would immediately point out that they are not compliant and thus do not help to achieve the desired goal of GDPR compliance. Unfortunately there is no enforcement at present so there's nobody out there to set the record straight and scare companies into compliance (potentially getting them to sue the consultancies for their non-compliant solutions).
        p_l 6y ago
        At the same time, looking at all "parties" trying to track me on random website, my core question ends up being "why the everloving fuck why?". A lot of actionable data for many a business can be safely separated from PII. Simultaneously I have hard time understanding why a simple website might need 20-50 different tracking services, all 3rd party. In my experience, that's the typical kind of business that was targeted by dishonest "GDPR consulting". For majority of businesses that I talked with, GDPR compliance could be handled by implementing a set of rules that fit, normal font, on A4 page. There are few that truly required more, but those also had that data as crucial data, and that's where good honest consulting could do a lot of good.
    - tannhaeuser 6y ago
      So I have asked myself: why? But after 10 minutes I didn't come to a conclusion :) so could you share what you're after or give me a hint? Are you suggesting there's an anti-EU/anti-GDPR/anti-whatever campaign of sorts going on that makes people biased, or, more realistically, an intent to discredit GDPR by US advertisers who fight against similar legislation in the US? That may very well be the case, but I haven't noticed on HN specifically where the pro-GDPR camp seems to be (slightly) in the majority if I'm not mistaken. Or maybe you're criticizing snake oil businesses selling GDPR compliance solutions which aren't (as discussed elsewhere in the thread), betting on people being too lazy to read the GDPR when the GDPR law text is quite understandable as you rightly point out? Genuinely don't understand the general direction of your suggestion.
      - rsynnott 6y ago
        > Are you suggesting there's an anti-EU/anti-GDPR/anti-whatever campaign of sorts going on that makes people biased, or, more realistically, an intent to discredit GDPR by US advertisers who fight against similar legislation in the US? I mean, in one sense, _obviously_. Most of the fearmongering around the GDPR comes from the ad industry (and to some extent from other impacted industries like the shadier parts of the debt collection industry, but they're much smaller and less noisy). I doubt there's an origanised conspiracy to discredit it as such, but most of the anti-GDPR talking points do ultimately come from the ad industry. And this isn't that surprising, arguably. For most companies, the GDPR essentially means, at most, "your business model is fine, but your process is flawed; fix it". For large parts of the ad industry, it means "your business model is flawed; change it". Note that a lot of the ad industry complaints are around consent; either that it has to be asked for in the first place or that it's too hard to give accidentally. Well, yes, that's the point.
      - deleted 6y ago
        [deleted]
    - pjc50 6y ago
      > as these examples show, it's not really about misunderstanding on the other side of the Atlantic. I think it's more about baseless misconceptions and myths being thrown out here and there. Ask yourself: Why? That's just how discourse works these days. The bigger and scarier the strawman, the more people click on it.
- vanderZwan 6y ago
  Funny/sadly enough this can be said for a lot of critique on EU regulation, regardless of country of origin (but let's be honest: the UK tabloids are the worst of the bunch).
- lmkg 6y ago
  > people... criticize X for its pitfalls, while calling for what’s actually in X My experience says this is true for a lot of things where I'm a subject-matter expert. I suspect it's also true about several of my own criticisms of things where I'm not an expert, but it's difficult to find out.
- dang 6y ago
  True, but it's best to use representative language from the article itself when editing a title. In this case we can simply use a prefix. (Submitted title was "The EU General Data Protection Regulation Explained by Americans")
rman666 6y ago
This is kind of silly. The title implies “... by dumb Americans.” Sure, GDPR applies to more than just EU citizens, but why would you expect Americans to know about it in the first place? It might be more interesting to here how EU citizens explain it, or how EU citizens explain driving on the opposite side of the road.
- nfg 6y ago
  > why would you expect Americans to know about it in the first place? I’d expect anyone making specific public criticisms of the GDPR to have a general understanding of it and the legal context it sits in.
- TotempaaltJ 6y ago
  > why would you expect Americans to know about it in the first place These are quotes from influential people directly commenting on the GDPR, criticizing it for things they mistakenly believe it does/doesn't do. This article isn't the first to claim that these specific Americans should know about the GDPR, they themselves are claiming they know about it.
- vinay427 6y ago
  > It might be more interesting to here how EU citizens explain it, or how EU citizens explain driving on the opposite side of the road. There are only three countries remaining in the EU that drive on the left side of the road: Ireland, Cyprus, and Malta. A very small minority of EU residents could "explain" driving on the left side of the road, whatever that means.
  - pjc50 6y ago
    .. and those are entirely down to the British influence.
    - robin_reala 6y ago
      Although to be fair Sweden drove on the left without British influence until other countries influenced them to change.
deleted 6y ago
[deleted]
kodablah 6y ago
> Time will tell how effective the GDPR is going to be [...] Nevertheless, we should acknowledge the fact that EU law has got many of the foundational principles around data protection right. This post accidentally explains many Americans' issues with the GDPR. By focusing on intent and idealism to buttress justifications for the law's presence, proponents use righteousness as an excuse for heavy government interference. Almost everyone agrees with the ideals of data privacy. But recognizing reality, some advocate for not asking clearly ineffective institutions to police such things since often said technology laws and policing tend to hurt more than help. They also give a mandate for more government intrusion in technology (e.g. welcoming GDPR tacitly encourages the copyright directive) as policy makers can't help themselves. Rather, more measured approaches like education, consumer awareness, encouragement of alternatives, transparency requirements, and enforcement of existing statutes (fraud, personal info, etc) are leaped over. Tech that people willingly trade info for (and arguably would do so regardless of awareness) is not analogous to food ingredients or medicine. You can't legislate every harm out of existence, and this is the fundamental difference in the two sides. One side is concerned with government oversight in these matters and where it leads, the other is not. Usually we'd say to each their own, yet we communicate on a global medium, so ideally we'd lean towards fewer restrictions (especially if you consider the legislative implementers on the American side).
- corty 6y ago
  > Rather, more measured approaches like education, consumer awareness, encouragement of alternatives, transparency requirements, and enforcement of existing statutes (fraud, personal info, etc) are leaped over. More measured approaches were tried and didn't work. Previous national laws and EU regulations were less intrusive, which didn't help anyone, the industry still complained back then and consumers were under a far worse protection. The ship for the industry to propose soft non-measures like education and volontary limitations has long sailed. Tech botched it so hard that the EU, usually unable to find any firm stance on anything, got its act together and created GDPR. Which, at the time, even surprised privacy advocates...
  - kodablah 6y ago
corty 6y ago
Main problem with GDPR criticism and press reporting about GDPR is that virtually all of it is based on second-hand knowledge and hearsay. I would really suggest to get the official PDF and read it. It is readable (for a legal text) and immediately clears up lots of common misconceptions like e.g. the collection/use confusion. Pick your favourite language https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679 https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A...
- vertex-four 6y ago
  The UK's ICO also has a reasonable plain-English guide for anyone interested in collecting or processing data - https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/ https://ico.org.uk/for-organisations/guide-to-data-protectio...
- munchbunny 6y ago
  I had to study up on GDPR for a past job, and after reading the full thing several times over combined with reading various people's interpretations of it, I came away feeling like it was a generally sane piece of legislation that was overall reasonable about the trade-offs and requirements it imposed. Since then I've heard many people complaining about the effort required to deal with or work around GDPR constraints, including in one case a data scientist complaining about needing to get consent to use certain data sources for something that wasn't the product being sold to the user. Frankly, I was happy about it, because that's privacy working as expected.
  - SpicyLemonZest 6y ago
    I feel like there's a kinda silly trend towards the idea that regulation should never be burdensome, that something's wrong if compliance efforts are more onerous than annual training and automated enforcement. It comes from a good place - we do need to be cautious of regulatory capture through creating so many burdens that small companies can't afford to comply. But the loudest complaints always seem to be along the lines of "it's unfair that it's harder to do these things GDPR is trying to discourage".
deleted 6y ago
[deleted]
deleted 6y ago
[deleted]
thierryzoller 6y ago
I always chuckle when I see comments made. You can feel that they don't understand the concepts behind laws like the GDPR. Also they don't understand principles based regulation.
seamyb88 6y ago
I can't wait to read what these ignorant rednecks have to say on privacy. <Begins with Snowden and Stallman> What, no! Close tab! Close tab!
voxic11 6y ago
This article is written very strangely. For example > One last bit: Richard Stallman argues that “improving efficiency” of a system must not be a justification for collecting personal data. > Article 5(1) already provides that personal data must be “collected for specified, explicit and legitimate purposes.” Therefore, it seems that Richard Stallman’s interpretation of this principle means that “improving efficiency” may never be considered legitimate. Do you agree What is the author trying to say here? Its honestly confusing. Is he trying to say that Stallman's point about the law allowing broad collection of data is wrong? Or is he trying to say Stallman is being unreasonable in his demands of the law?
- simonh 6y ago
  Improving efficiency could mean anything, efficiency of what? It's the thing being made efficient that needs to be evaluated for appropriateness, so I'm with Stallman on this (an infrequent but not unknown occurrence).
  - AnthonyMouse 6y ago
    The problem with requirements to be explicit is that they just turn into dense legalese. You say "efficiency of what" thinking they're going to list a specific thing, but then they list every specific thing. Is it software or hardware? No, software and hardware. Is it efficiency in runtime performance or in user interface behavior? Both. Asking animal, vegetable or mineral doesn't actually make it more specific if they can still get to "all of the above" by just listing every option individually.
    - simonh 6y ago
      That's easy. If the justification isn't clear, then the answer is No. It's their responsibility to provide a clear and valid justification.
- hugoroy 6y ago
  Sorry that it's not clear. Happy to take suggestions for clearer language. Maybe this part should just be removed as it is maybe a bit off topic. I am trying to lay out what principle Richard Stallman is advocating for exactly, when he says that it is never okay to collect data for the purpose of improving efficiency of a system. The principle that RMS is pushing for here, seems to be that only “legitimate” purposes should be allowed. And RMS seems to think that “improving efficiency” is not a legitimate purpose. So, I added this part in the post because in all fairness, if RMS thinks that we should consider that improving a system is an illegitimate purpose, then I think we finally found an actual critique of GDPR that is actually advocating for something not already in the GDPR. But honestly, I think this is just too radical. I think that, provided the right protections are in place, the goal of improving a system has nothing illegitimate per se. I actually prefer to interact with improved systems, and if some personal data may be necessary for that, let's allow it and put the right safeguards. Update: just "Improving a system." without more explanation is not very "explicit" - it should be put in context and more detailed, and information about the explicit purpose must be disclosed to users (see Art 5(1) and 13 of the GDPR).
yoden 6y ago
Weird article. After reading it I agree more with the points it's trying to refute. You can't use the existence of a 1995 law to prove the GDPR doesn't have problems. The whole reason the GDPR got written was because the 1995 law was ineffective. The GDPR adds new requirements on top of the 1995 law. Privacy advocates don't think these requirements help privacy much. Businesses claim that it makes it harder to do business (but they say that about any legislation). You can argue about who is right but neither side particularly likes the regulation. The biggest group of people who do like the regulation seem to be EU citizens who want a reason to feel superior to Americans. It's unfortunate nationalism. We're all on the same side against the large corporations.
- simion314 6y ago
  >The biggest group of people who do like the regulation seem to be EU citizens who want a reason to feel superior to Americans. It's unfortunate nationalism. We're all on the same side against the large corporations. But you have an even extreme law in US for health data, you protect your health data that is generated in the health care system but if you google some symptoms, buy online some health products, read/watch some health related pages you are fine to be analyzed and sold to advertising? There is the example with the supermarket that detected some girl is pregnant in "leaked" the data to her parents and that is fine for you = but if a doctor would have done the "leak" it would have been a serious issue. GDPR is not as extreme as HIPAA it just makes all personal data "problematic" and you can't do whatever you want with the data in secret. GDPR surfaced all the hidden shit to the surface, many wanted the shit to stay hidden, now people can see that not only websites sell my data to a third party, they are greedy you want to sell it to 100+ different third parties - it makes you stop and think if maybe you want to close this tab or use a private window.
  - AnthonyMouse 6y ago
    HIPAA is a facet of the general disease in the US healthcare system. The compliance cost is enormous but the industry doesn't object, it even benefits them, because it's all getting billed to insurance and the more everything costs the higher the base cost they get to multiply by their profit margin. Meanwhile the insurance is heavily subsidized by employers due to tax incentives, and the employees/citizens don't even realize how much it's costing them because there are so many layers of indirection.
covidien 6y ago
Has gdpr been enforced at all since inception? Is there a public listing of cases and punishments?
- robin_reala 6y ago
  Yes to both questions: https://www.enforcementtracker.com/ https://www.enforcementtracker.com/
- hugoroy 6y ago
  Yes. Check out https://gdprhub.eu/ https://gdprhub.eu/ The most important fine so far is against Google (50 million EUR - for France only, not for the whole of the EU territory). [CNIL info in English here](https://www.cnil.fr/en/council-state-confirms-sanction-imposed-google-llc https://www.cnil.fr/en/council-state-confirms-sanction-impos...) [Latest decision June 2020, here](https://www.conseil-etat.fr/ressources/decisions-contentieuses/dernieres-decisions-importantes/conseil-d-etat-19-juin-2020-sanction-infligee-a-google-par-la-cnil https://www.conseil-etat.fr/ressources/decisions-contentieus...) The UK data protection authority (ICO) has also announced huge fines against British Airways and Marriott - but these fines are not in effect yet - unsure how high they will be exactly if any.

121 points by M2Ys4U 6y ago

The full title is "The GDPR as accidentally explained by people in the US who criticize the GDPR for its pitfalls, while calling for what’s actually in the GDPR" but HN doesn't allow titles to be that long.

Nextgrid 6y ago
I'd argue a better title would be "The EU GDPR as understood by Americans". The current title seems to imply an authoritative, true explanation of the GDPR by Americans, while the article is all about how the GDPR is frequently misunderstood on the other side of the pond.
- hugoroy 6y ago
  Hi - author of the post here. The points in the post are really about GDPR basics. I'm not actually trying to explain or interpret anything. Instead, I am mostly paraphrasing, if not merely quoting the GDPR directly (and linking to the authoritative source - check for yourself). The more blatant example is probably the first one, about "data use" v. "data collection". There's just no way that the statements about GDPR "missing the point of data collection" can be characterized as a misunderstanding of the text itself. The text has explicit references to data collection all over, including in the definition of the most important word, i.e. "processing". So I think that, as these examples show, it's not really about misunderstanding on the other side of the Atlantic. I think it's more about baseless misconceptions and myths being thrown out here and there. Ask yourself: Why? Edit: typos
  - Nextgrid 6y ago
    > I'm not actually trying to explain or interpret anything. Instead, I am mostly paraphrasing Yes, this is what I meant - apologies if this was worded poorly (edited it now). I was indeed referring to American's (wrong) understanding/interpretation of the GDPR you are referring to rather than your own article's interpretation of it. > I think it's more about baseless misconceptions and myths being thrown out here and there. Ask yourself: Why? Indeed it is, however misconceptions/myths can be referred to as misunderstandings. I'm sure there are business interests at play and why there's a lot of bad advice being thrown around in an attempt to demonize the GDPR and make it seem more annoying than it actually is, but if we were to only assume good faith then I think it's fair to call it a misunderstanding.
    - p_l 6y ago
      Locally (Poland) I had a feeling that a lot of the misconception was fueled by people trying to sell consulting on GDPR, when majority of the situation could be summed up as "remember the GIODO (polish PII protection agency) rules that you ignored so far? Now they have teeth". But if you sold it as something more complex than "PII is like nuclear waste, you want to avoid it", then you couldn't sell high-priced "GDPR transformation services" or get lots of ad views on your spiffy web page :/
      - Nextgrid 6y ago
        Agreed. There is a lot of money to be made in GDPR-related consulting peddling non-compliant snake oil. GDPR compliance is actually quite simple, however it is often detrimental to the business, so it's near-impossible to do "honest" GDPR consulting because you'd be telling your client things they don't want to hear and they would rather go to someone else that tells them what they want to hear, even if they don't actually solve the underlying problem of compliance. That's the only reason I can think of why non-compliant consent management solutions (such as TrustArc) are thriving despite even a casual read of the regulations would immediately point out that they are not compliant and thus do not help to achieve the desired goal of GDPR compliance. Unfortunately there is no enforcement at present so there's nobody out there to set the record straight and scare companies into compliance (potentially getting them to sue the consultancies for their non-compliant solutions).
        p_l 6y ago
        At the same time, looking at all "parties" trying to track me on random website, my core question ends up being "why the everloving fuck why?". A lot of actionable data for many a business can be safely separated from PII. Simultaneously I have hard time understanding why a simple website might need 20-50 different tracking services, all 3rd party. In my experience, that's the typical kind of business that was targeted by dishonest "GDPR consulting". For majority of businesses that I talked with, GDPR compliance could be handled by implementing a set of rules that fit, normal font, on A4 page. There are few that truly required more, but those also had that data as crucial data, and that's where good honest consulting could do a lot of good.
  - tannhaeuser 6y ago
    So I have asked myself: why? But after 10 minutes I didn't come to a conclusion :) so could you share what you're after or give me a hint? Are you suggesting there's an anti-EU/anti-GDPR/anti-whatever campaign of sorts going on that makes people biased, or, more realistically, an intent to discredit GDPR by US advertisers who fight against similar legislation in the US? That may very well be the case, but I haven't noticed on HN specifically where the pro-GDPR camp seems to be (slightly) in the majority if I'm not mistaken. Or maybe you're criticizing snake oil businesses selling GDPR compliance solutions which aren't (as discussed elsewhere in the thread), betting on people being too lazy to read the GDPR when the GDPR law text is quite understandable as you rightly point out? Genuinely don't understand the general direction of your suggestion.
    - rsynnott 6y ago
      > Are you suggesting there's an anti-EU/anti-GDPR/anti-whatever campaign of sorts going on that makes people biased, or, more realistically, an intent to discredit GDPR by US advertisers who fight against similar legislation in the US? I mean, in one sense, _obviously_. Most of the fearmongering around the GDPR comes from the ad industry (and to some extent from other impacted industries like the shadier parts of the debt collection industry, but they're much smaller and less noisy). I doubt there's an origanised conspiracy to discredit it as such, but most of the anti-GDPR talking points do ultimately come from the ad industry. And this isn't that surprising, arguably. For most companies, the GDPR essentially means, at most, "your business model is fine, but your process is flawed; fix it". For large parts of the ad industry, it means "your business model is flawed; change it". Note that a lot of the ad industry complaints are around consent; either that it has to be asked for in the first place or that it's too hard to give accidentally. Well, yes, that's the point.
    - deleted 6y ago
      [deleted]
  - pjc50 6y ago
    > as these examples show, it's not really about misunderstanding on the other side of the Atlantic. I think it's more about baseless misconceptions and myths being thrown out here and there. Ask yourself: Why? That's just how discourse works these days. The bigger and scarier the strawman, the more people click on it.
vanderZwan 6y ago
Funny/sadly enough this can be said for a lot of critique on EU regulation, regardless of country of origin (but let's be honest: the UK tabloids are the worst of the bunch).
lmkg 6y ago
> people... criticize X for its pitfalls, while calling for what’s actually in X My experience says this is true for a lot of things where I'm a subject-matter expert. I suspect it's also true about several of my own criticisms of things where I'm not an expert, but it's difficult to find out.
dang 6y ago
True, but it's best to use representative language from the article itself when editing a title. In this case we can simply use a prefix. (Submitted title was "The EU General Data Protection Regulation Explained by Americans")

rman666 6y ago

This is kind of silly. The title implies “... by dumb Americans.” Sure, GDPR applies to more than just EU citizens, but why would you expect Americans to know about it in the first place? It might be more interesting to here how EU citizens explain it, or how EU citizens explain driving on the opposite side of the road.

nfg 6y ago
> why would you expect Americans to know about it in the first place? I’d expect anyone making specific public criticisms of the GDPR to have a general understanding of it and the legal context it sits in.
TotempaaltJ 6y ago
> why would you expect Americans to know about it in the first place These are quotes from influential people directly commenting on the GDPR, criticizing it for things they mistakenly believe it does/doesn't do. This article isn't the first to claim that these specific Americans should know about the GDPR, they themselves are claiming they know about it.
vinay427 6y ago
> It might be more interesting to here how EU citizens explain it, or how EU citizens explain driving on the opposite side of the road. There are only three countries remaining in the EU that drive on the left side of the road: Ireland, Cyprus, and Malta. A very small minority of EU residents could "explain" driving on the left side of the road, whatever that means.
- pjc50 6y ago
  .. and those are entirely down to the British influence.
  - robin_reala 6y ago
    Although to be fair Sweden drove on the left without British influence until other countries influenced them to change.

deleted 6y ago

[deleted]

kodablah 6y ago

> Time will tell how effective the GDPR is going to be [...] Nevertheless, we should acknowledge the fact that EU law has got many of the foundational principles around data protection right. This post accidentally explains many Americans' issues with the GDPR. By focusing on intent and idealism to buttress justifications for the law's presence, proponents use righteousness as an excuse for heavy government interference. Almost everyone agrees with the ideals of data privacy. But recognizing reality, some advocate for not asking clearly ineffective institutions to police such things since often said technology laws and policing tend to hurt more than help. They also give a mandate for more government intrusion in technology (e.g. welcoming GDPR tacitly encourages the copyright directive) as policy makers can't help themselves. Rather, more measured approaches like education, consumer awareness, encouragement of alternatives, transparency requirements, and enforcement of existing statutes (fraud, personal info, etc) are leaped over. Tech that people willingly trade info for (and arguably would do so regardless of awareness) is not analogous to food ingredients or medicine. You can't legislate every harm out of existence, and this is the fundamental difference in the two sides. One side is concerned with government oversight in these matters and where it leads, the other is not. Usually we'd say to each their own, yet we communicate on a global medium, so ideally we'd lean towards fewer restrictions (especially if you consider the legislative implementers on the American side).

corty 6y ago
> Rather, more measured approaches like education, consumer awareness, encouragement of alternatives, transparency requirements, and enforcement of existing statutes (fraud, personal info, etc) are leaped over. More measured approaches were tried and didn't work. Previous national laws and EU regulations were less intrusive, which didn't help anyone, the industry still complained back then and consumers were under a far worse protection. The ship for the industry to propose soft non-measures like education and volontary limitations has long sailed. Tech botched it so hard that the EU, usually unable to find any firm stance on anything, got its act together and created GDPR. Which, at the time, even surprised privacy advocates...
- kodablah 6y ago

corty 6y ago

Main problem with GDPR criticism and press reporting about GDPR is that virtually all of it is based on second-hand knowledge and hearsay. I would really suggest to get the official PDF and read it. It is readable (for a legal text) and immediately clears up lots of common misconceptions like e.g. the collection/use confusion. Pick your favourite language https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679 https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A...

vertex-four 6y ago
The UK's ICO also has a reasonable plain-English guide for anyone interested in collecting or processing data - https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/ https://ico.org.uk/for-organisations/guide-to-data-protectio...
munchbunny 6y ago
I had to study up on GDPR for a past job, and after reading the full thing several times over combined with reading various people's interpretations of it, I came away feeling like it was a generally sane piece of legislation that was overall reasonable about the trade-offs and requirements it imposed. Since then I've heard many people complaining about the effort required to deal with or work around GDPR constraints, including in one case a data scientist complaining about needing to get consent to use certain data sources for something that wasn't the product being sold to the user. Frankly, I was happy about it, because that's privacy working as expected.
- SpicyLemonZest 6y ago
  I feel like there's a kinda silly trend towards the idea that regulation should never be burdensome, that something's wrong if compliance efforts are more onerous than annual training and automated enforcement. It comes from a good place - we do need to be cautious of regulatory capture through creating so many burdens that small companies can't afford to comply. But the loudest complaints always seem to be along the lines of "it's unfair that it's harder to do these things GDPR is trying to discourage".

deleted 6y ago

[deleted]

deleted 6y ago

[deleted]

thierryzoller 6y ago

I always chuckle when I see comments made. You can feel that they don't understand the concepts behind laws like the GDPR. Also they don't understand principles based regulation.

seamyb88 6y ago

I can't wait to read what these ignorant rednecks have to say on privacy. <Begins with Snowden and Stallman> What, no! Close tab! Close tab!

voxic11 6y ago

This article is written very strangely. For example > One last bit: Richard Stallman argues that “improving efficiency” of a system must not be a justification for collecting personal data. > Article 5(1) already provides that personal data must be “collected for specified, explicit and legitimate purposes.” Therefore, it seems that Richard Stallman’s interpretation of this principle means that “improving efficiency” may never be considered legitimate. Do you agree What is the author trying to say here? Its honestly confusing. Is he trying to say that Stallman's point about the law allowing broad collection of data is wrong? Or is he trying to say Stallman is being unreasonable in his demands of the law?

simonh 6y ago
Improving efficiency could mean anything, efficiency of what? It's the thing being made efficient that needs to be evaluated for appropriateness, so I'm with Stallman on this (an infrequent but not unknown occurrence).
- AnthonyMouse 6y ago
  The problem with requirements to be explicit is that they just turn into dense legalese. You say "efficiency of what" thinking they're going to list a specific thing, but then they list every specific thing. Is it software or hardware? No, software and hardware. Is it efficiency in runtime performance or in user interface behavior? Both. Asking animal, vegetable or mineral doesn't actually make it more specific if they can still get to "all of the above" by just listing every option individually.
  - simonh 6y ago
    That's easy. If the justification isn't clear, then the answer is No. It's their responsibility to provide a clear and valid justification.
hugoroy 6y ago
Sorry that it's not clear. Happy to take suggestions for clearer language. Maybe this part should just be removed as it is maybe a bit off topic. I am trying to lay out what principle Richard Stallman is advocating for exactly, when he says that it is never okay to collect data for the purpose of improving efficiency of a system. The principle that RMS is pushing for here, seems to be that only “legitimate” purposes should be allowed. And RMS seems to think that “improving efficiency” is not a legitimate purpose. So, I added this part in the post because in all fairness, if RMS thinks that we should consider that improving a system is an illegitimate purpose, then I think we finally found an actual critique of GDPR that is actually advocating for something not already in the GDPR. But honestly, I think this is just too radical. I think that, provided the right protections are in place, the goal of improving a system has nothing illegitimate per se. I actually prefer to interact with improved systems, and if some personal data may be necessary for that, let's allow it and put the right safeguards. Update: just "Improving a system." without more explanation is not very "explicit" - it should be put in context and more detailed, and information about the explicit purpose must be disclosed to users (see Art 5(1) and 13 of the GDPR).

yoden 6y ago

Weird article. After reading it I agree more with the points it's trying to refute. You can't use the existence of a 1995 law to prove the GDPR doesn't have problems. The whole reason the GDPR got written was because the 1995 law was ineffective. The GDPR adds new requirements on top of the 1995 law. Privacy advocates don't think these requirements help privacy much. Businesses claim that it makes it harder to do business (but they say that about any legislation). You can argue about who is right but neither side particularly likes the regulation. The biggest group of people who do like the regulation seem to be EU citizens who want a reason to feel superior to Americans. It's unfortunate nationalism. We're all on the same side against the large corporations.

simion314 6y ago
>The biggest group of people who do like the regulation seem to be EU citizens who want a reason to feel superior to Americans. It's unfortunate nationalism. We're all on the same side against the large corporations. But you have an even extreme law in US for health data, you protect your health data that is generated in the health care system but if you google some symptoms, buy online some health products, read/watch some health related pages you are fine to be analyzed and sold to advertising? There is the example with the supermarket that detected some girl is pregnant in "leaked" the data to her parents and that is fine for you = but if a doctor would have done the "leak" it would have been a serious issue. GDPR is not as extreme as HIPAA it just makes all personal data "problematic" and you can't do whatever you want with the data in secret. GDPR surfaced all the hidden shit to the surface, many wanted the shit to stay hidden, now people can see that not only websites sell my data to a third party, they are greedy you want to sell it to 100+ different third parties - it makes you stop and think if maybe you want to close this tab or use a private window.
- AnthonyMouse 6y ago
  HIPAA is a facet of the general disease in the US healthcare system. The compliance cost is enormous but the industry doesn't object, it even benefits them, because it's all getting billed to insurance and the more everything costs the higher the base cost they get to multiply by their profit margin. Meanwhile the insurance is heavily subsidized by employers due to tax incentives, and the employees/citizens don't even realize how much it's costing them because there are so many layers of indirection.

covidien 6y ago

Has gdpr been enforced at all since inception? Is there a public listing of cases and punishments?

robin_reala 6y ago
Yes to both questions: https://www.enforcementtracker.com/ https://www.enforcementtracker.com/
hugoroy 6y ago
Yes. Check out https://gdprhub.eu/ https://gdprhub.eu/ The most important fine so far is against Google (50 million EUR - for France only, not for the whole of the EU territory). [CNIL info in English here](https://www.cnil.fr/en/council-state-confirms-sanction-imposed-google-llc https://www.cnil.fr/en/council-state-confirms-sanction-impos...) [Latest decision June 2020, here](https://www.conseil-etat.fr/ressources/decisions-contentieuses/dernieres-decisions-importantes/conseil-d-etat-19-juin-2020-sanction-infligee-a-google-par-la-cnil https://www.conseil-etat.fr/ressources/decisions-contentieus...) The UK data protection authority (ICO) has also announced huge fines against British Airways and Marriott - but these fines are not in effect yet - unsure how high they will be exactly if any.