31 ms·

> Time will tell how effective the GDPR is going to be [...] Nevertheless, we should acknowledge the fact that EU law has got many of the foundational principle

> Time will tell how effective the GDPR is going to be [...] Nevertheless, we should acknowledge the fact that EU law has got many of the foundational principles around data protection right. This post accidentally explains many Americans' issues with the GDPR. By focusing on intent and idealism to buttress justifications for the law's presence, proponents use righteousness as an excuse for heavy government interference. Almost everyone agrees with the ideals of data privacy. But recognizing reality, some advocate for not asking clearly ineffective institutions to police such things since often said technology laws and policing tend to hurt more than help. They also give a mandate for more government intrusion in technology (e.g. welcoming GDPR tacitly encourages the copyright directive) as policy makers can't help themselves. Rather, more measured approaches like education, consumer awareness, encouragement of alternatives, transparency requirements, and enforcement of existing statutes (fraud, personal info, etc) are leaped over. Tech that people willingly trade info for (and arguably would do so regardless of awareness) is not analogous to food ingredients or medicine. You can't legislate every harm out of existence, and this is the fundamental difference in the two sides. One side is concerned with government oversight in these matters and where it leads, the other is not. Usually we'd say to each their own, yet we communicate on a global medium, so ideally we'd lean towards fewer restrictions (especially if you consider the legislative implementers on the American side).

corty 6y ago
> Rather, more measured approaches like education, consumer awareness, encouragement of alternatives, transparency requirements, and enforcement of existing statutes (fraud, personal info, etc) are leaped over. More measured approaches were tried and didn't work. Previous national laws and EU regulations were less intrusive, which didn't help anyone, the industry still complained back then and consumers were under a far worse protection. The ship for the industry to propose soft non-measures like education and volontary limitations has long sailed. Tech botched it so hard that the EU, usually unable to find any firm stance on anything, got its act together and created GDPR. Which, at the time, even surprised privacy advocates...
- kodablah 6y ago
  I'm not convinced public awareness campaigns and various support for alternatives were reasonably tried. Also, the firmness of one's stance isn't in its words.
vertex-four 6y ago
The way the EU usually works is that they say "we are concerned about X, Y and Z's effect on our citizens" to industry, and industry responds "we'll self-regulate to ensure X, Y and Z do not have the effect you're concerned about". If self-regulation doesn't work out, a directive is passed. Industry, in this case, didn't even try to self-regulate, so a series of directives with gradually more teeth were passed over the last 20-odd years.
- kodablah 6y ago
  > If self-regulation doesn't work out, a directive is passed. We can do better! Public education campaigns and support for alternatives for starters. The "they didn't fix the issues, so new laws will fix their issues" is myopic at the least, and potentially harmful if it doesn't fix the issues either.
  - vertex-four 6y ago
    A significant part of the GDPR - and in fact the bit most software people complain about - is forcing the companies in question to educate the public on what their data is being used for.
    - kodablah 6y ago
      That's not a reasonable approach to public awareness IMO. "Forcing" these private companies to do this and that is only going to result in it being done in the least meaningful way possible. It doesn't matter whether it's the DPD, the EU cookie law, or the GDPR. So much deja vu...
      - vertex-four 6y ago
        That's ok - if the company can't convince the user that it'd be good for them to opt in to all 200 "partners" they'd like to share data with, the user can click the big shiny "fuck off" button that's required to be there. It's not there, or not obvious? That's a GDPR violation.
  - 6y ago
cameronbrown 6y ago
+1. I was against GDPR explicitly because it was obvious something like the Copyright Directive would be next and now the EU is literally ending online freedom of speech.
sleepyhead 6y ago
Your argument would be more pervasive if it had any examples. > You can't legislate every harm out of existence Says country with highest murder rate among developed nations. (Ok, so not a fair comparison but the political argument is the same). If there is anything US tech companies have shown us it is that the industry or consumers cannot handle data protection and privacy by themselves. There needs to be a good set of legislation to ensure it. Sure GDPR is a bit invasive and detailed in some areas - but the general idea and the way it works is good. To limit data collection, sharing and processing with rules is good. Unfortunately there are a few shortcomings to the law such as requirement to be explicit and notify about suppliers for data processors, documentation and deletion policies. > Rather, more measured approaches like education, consumer awareness, encouragement of alternatives, transparency requirements, and enforcement of existing statutes (fraud, personal info, etc) are leaped over. I can assure you that nothing has done more to educate consumers about data privacy than GDPR. Partly by media focus, but mainly by showing consumers what data they give away to companies by making this explicit. Regarding fraud it also has a positive impact as GDPR specifically requires encryption and other security measures. Companies might have not bothered to fix this before, but with GDPR fines of up to 4% of revenue they surely have.
- kodablah 6y ago
  > Ok, so not a fair comparison but the political argument is the same It's not. We have to avoid these analogies, because for every legislative success one can point to, there is a failure one can point to. For every positive national statistic one can point to, there is a negative statistic one can point to. > the industry or consumers cannot handle data protection and privacy by themselves While true, that doesn't always imply extreme measures. > but the general idea and the way it works is good Most people agree with the ideals. I argue the way it works is not good, neither as codified nor as implemented. For example, transparency requirements can have value. But such a large unenforced (or worse, selectively enforced) collection of requirements is only adding complexity to the system while providing only negligible benefit. > I can assure you that nothing has done more to educate consumers about data privacy than GDPR Exactly. If the only tool you use is a hammer, it's going to also be the most effective regardless if it's the best tool.
rsynnott 6y ago
> Rather, more measured approaches like education, consumer awareness, encouragement of alternatives, transparency requirements, and enforcement of existing statutes (fraud, personal info, etc) are leaped over. The GDPR didn't come out of nowhere. There is a whole slew of prior legislation, of course (the Data Protection Directive is from the 90s, for instance), which was generally ignored by big players because it was fairly toothless (fines typically at most in the hundreds of thousands, etc). The industry had a _lot_ of warning, over three decades, that it would be regulated if it didn't improve things. It really has only itself to blame.
- kodablah 6y ago
  To tailor the argument for the audience, please stop bringing me tweaks on this same flawed implementation that is only adding complexity and bugs to the system while not even fixing the majority of original problems. I don't care what the Jira issue comment said this would do or what the PR issue said it would do, I am telling you how it is performing in production, how the last version of the same approach performed in production, and am asking for re-thinking the approach.
  - p_l 6y ago
    What you're saying is that somehow we should have continued doing things that didn't work at all, whereas GDPR actually got companies to care at least a little (seeing from both inside and outside). Yet you insist that instead of doing anything, we should think of the big pie in the sky and continue doing the same not-working alternatives.

corty 6y ago

> Rather, more measured approaches like education, consumer awareness, encouragement of alternatives, transparency requirements, and enforcement of existing statutes (fraud, personal info, etc) are leaped over. More measured approaches were tried and didn't work. Previous national laws and EU regulations were less intrusive, which didn't help anyone, the industry still complained back then and consumers were under a far worse protection. The ship for the industry to propose soft non-measures like education and volontary limitations has long sailed. Tech botched it so hard that the EU, usually unable to find any firm stance on anything, got its act together and created GDPR. Which, at the time, even surprised privacy advocates...

kodablah 6y ago
I'm not convinced public awareness campaigns and various support for alternatives were reasonably tried. Also, the firmness of one's stance isn't in its words.

vertex-four 6y ago

The way the EU usually works is that they say "we are concerned about X, Y and Z's effect on our citizens" to industry, and industry responds "we'll self-regulate to ensure X, Y and Z do not have the effect you're concerned about". If self-regulation doesn't work out, a directive is passed. Industry, in this case, didn't even try to self-regulate, so a series of directives with gradually more teeth were passed over the last 20-odd years.

kodablah 6y ago
> If self-regulation doesn't work out, a directive is passed. We can do better! Public education campaigns and support for alternatives for starters. The "they didn't fix the issues, so new laws will fix their issues" is myopic at the least, and potentially harmful if it doesn't fix the issues either.
- vertex-four 6y ago
  A significant part of the GDPR - and in fact the bit most software people complain about - is forcing the companies in question to educate the public on what their data is being used for.
  - kodablah 6y ago
    That's not a reasonable approach to public awareness IMO. "Forcing" these private companies to do this and that is only going to result in it being done in the least meaningful way possible. It doesn't matter whether it's the DPD, the EU cookie law, or the GDPR. So much deja vu...
    - vertex-four 6y ago
      That's ok - if the company can't convince the user that it'd be good for them to opt in to all 200 "partners" they'd like to share data with, the user can click the big shiny "fuck off" button that's required to be there. It's not there, or not obvious? That's a GDPR violation.
- 6y ago

cameronbrown 6y ago

+1. I was against GDPR explicitly because it was obvious something like the Copyright Directive would be next and now the EU is literally ending online freedom of speech.

sleepyhead 6y ago

Your argument would be more pervasive if it had any examples. > You can't legislate every harm out of existence Says country with highest murder rate among developed nations. (Ok, so not a fair comparison but the political argument is the same). If there is anything US tech companies have shown us it is that the industry or consumers cannot handle data protection and privacy by themselves. There needs to be a good set of legislation to ensure it. Sure GDPR is a bit invasive and detailed in some areas - but the general idea and the way it works is good. To limit data collection, sharing and processing with rules is good. Unfortunately there are a few shortcomings to the law such as requirement to be explicit and notify about suppliers for data processors, documentation and deletion policies. > Rather, more measured approaches like education, consumer awareness, encouragement of alternatives, transparency requirements, and enforcement of existing statutes (fraud, personal info, etc) are leaped over. I can assure you that nothing has done more to educate consumers about data privacy than GDPR. Partly by media focus, but mainly by showing consumers what data they give away to companies by making this explicit. Regarding fraud it also has a positive impact as GDPR specifically requires encryption and other security measures. Companies might have not bothered to fix this before, but with GDPR fines of up to 4% of revenue they surely have.

kodablah 6y ago
> Ok, so not a fair comparison but the political argument is the same It's not. We have to avoid these analogies, because for every legislative success one can point to, there is a failure one can point to. For every positive national statistic one can point to, there is a negative statistic one can point to. > the industry or consumers cannot handle data protection and privacy by themselves While true, that doesn't always imply extreme measures. > but the general idea and the way it works is good Most people agree with the ideals. I argue the way it works is not good, neither as codified nor as implemented. For example, transparency requirements can have value. But such a large unenforced (or worse, selectively enforced) collection of requirements is only adding complexity to the system while providing only negligible benefit. > I can assure you that nothing has done more to educate consumers about data privacy than GDPR Exactly. If the only tool you use is a hammer, it's going to also be the most effective regardless if it's the best tool.

rsynnott 6y ago

> Rather, more measured approaches like education, consumer awareness, encouragement of alternatives, transparency requirements, and enforcement of existing statutes (fraud, personal info, etc) are leaped over. The GDPR didn't come out of nowhere. There is a whole slew of prior legislation, of course (the Data Protection Directive is from the 90s, for instance), which was generally ignored by big players because it was fairly toothless (fines typically at most in the hundreds of thousands, etc). The industry had a _lot_ of warning, over three decades, that it would be regulated if it didn't improve things. It really has only itself to blame.

kodablah 6y ago
To tailor the argument for the audience, please stop bringing me tweaks on this same flawed implementation that is only adding complexity and bugs to the system while not even fixing the majority of original problems. I don't care what the Jira issue comment said this would do or what the PR issue said it would do, I am telling you how it is performing in production, how the last version of the same approach performed in production, and am asking for re-thinking the approach.
- p_l 6y ago
  What you're saying is that somehow we should have continued doing things that didn't work at all, whereas GDPR actually got companies to care at least a little (seeing from both inside and outside). Yet you insist that instead of doing anything, we should think of the big pie in the sky and continue doing the same not-working alternatives.