5 ms·

The way the EU usually works is that they say "we are concerned about X, Y and Z's effect on our citizens" to industry, and industry responds "we'll self-regula

The way the EU usually works is that they say "we are concerned about X, Y and Z's effect on our citizens" to industry, and industry responds "we'll self-regulate to ensure X, Y and Z do not have the effect you're concerned about". If self-regulation doesn't work out, a directive is passed. Industry, in this case, didn't even try to self-regulate, so a series of directives with gradually more teeth were passed over the last 20-odd years.

kodablah 6y ago
> If self-regulation doesn't work out, a directive is passed. We can do better! Public education campaigns and support for alternatives for starters. The "they didn't fix the issues, so new laws will fix their issues" is myopic at the least, and potentially harmful if it doesn't fix the issues either.
- vertex-four 6y ago
  A significant part of the GDPR - and in fact the bit most software people complain about - is forcing the companies in question to educate the public on what their data is being used for.
  - kodablah 6y ago
    That's not a reasonable approach to public awareness IMO. "Forcing" these private companies to do this and that is only going to result in it being done in the least meaningful way possible. It doesn't matter whether it's the DPD, the EU cookie law, or the GDPR. So much deja vu...
    - vertex-four 6y ago
      That's ok - if the company can't convince the user that it'd be good for them to opt in to all 200 "partners" they'd like to share data with, the user can click the big shiny "fuck off" button that's required to be there. It's not there, or not obvious? That's a GDPR violation.
- grasshopperpurp 6y ago
  What's myopic is expecting people to "do better" when they make more money (or even think they'll make more money) by doing worse.
  - kodablah 6y ago
    Nobody expects that. It has become unfortunate that if you are not in favor for the GDPR as implemented, you must be against its principles and in favor of privacy-violating companies.
- vkou 6y ago
  Public education campaigns don't work when the people they are educating have no power in a problematic relationship. You can educate me about green energy all you want, but if all the power providers I can switch to are burning coal, you're just wasting your time and money. Passing laws is the opposite of myopic behaviour. To put it bluntly - theft is outlawed, not something we discourage solely through, uh, education campaigns.
- p_l 6y ago
  There was 20 years of that. 20 YEARS Actually more than that, but I'm just using one of the shorter timelines involved. So if the rather hands-off approach didn't work, campaigns didn't work, capitalism didn't work because it was always on the side of violating privacy? Well there comes the hammer.
AnthonyMouse 6y ago
> The way the EU usually works is that they say "we are concerned about X, Y and Z's effect on our citizens" to industry, and industry responds "we'll self-regulate to ensure X, Y and Z do not have the effect you're concerned about". The problem in this context is identifying adtech as the industry rather than the adversary. It's like identifying a problem with spam and then asking the spammers to self-regulate. It's misapprehending the nature of the problem. So then you say the spammers wouldn't self-regulate by not spamming so we're going to regulate email. Everybody hire a lawyer if you want to use email. And then the spammers still give you the finger because the internet spans the globe and they just set up in countries that won't enforce your rules, and the rules increase costs on everybody else. What we need here are technical solutions. Browsers that resist tracking and fingerprinting. Technology to resist correlation attacks. The dissolution of unitary identity systems. More software that runs on your machine and not the adversary's machine. Make tracking too hard and there is no more tracking industry. The thing most needed there is funding. There is profit in tracking and not so much profit in anti-tracking, so if you want anti-tracking then provide money for it. And for goodness sake stop passing laws against anti-tracking measures.
- vertex-four 6y ago
  I'll point out that the EU Government has poured an incredible amount of money into the problem of "privacy and enhancing trust" and related topics - if you're in the EU, even as an individual developer you can likely get some of that money through NLNet. Unfortunately it's a hard problem and the other side has a lot of money too.

kodablah 6y ago

> If self-regulation doesn't work out, a directive is passed. We can do better! Public education campaigns and support for alternatives for starters. The "they didn't fix the issues, so new laws will fix their issues" is myopic at the least, and potentially harmful if it doesn't fix the issues either.

vertex-four 6y ago
A significant part of the GDPR - and in fact the bit most software people complain about - is forcing the companies in question to educate the public on what their data is being used for.
- kodablah 6y ago
  That's not a reasonable approach to public awareness IMO. "Forcing" these private companies to do this and that is only going to result in it being done in the least meaningful way possible. It doesn't matter whether it's the DPD, the EU cookie law, or the GDPR. So much deja vu...
  - vertex-four 6y ago
    That's ok - if the company can't convince the user that it'd be good for them to opt in to all 200 "partners" they'd like to share data with, the user can click the big shiny "fuck off" button that's required to be there. It's not there, or not obvious? That's a GDPR violation.
grasshopperpurp 6y ago
What's myopic is expecting people to "do better" when they make more money (or even think they'll make more money) by doing worse.
- kodablah 6y ago
  Nobody expects that. It has become unfortunate that if you are not in favor for the GDPR as implemented, you must be against its principles and in favor of privacy-violating companies.
vkou 6y ago
Public education campaigns don't work when the people they are educating have no power in a problematic relationship. You can educate me about green energy all you want, but if all the power providers I can switch to are burning coal, you're just wasting your time and money. Passing laws is the opposite of myopic behaviour. To put it bluntly - theft is outlawed, not something we discourage solely through, uh, education campaigns.
p_l 6y ago
There was 20 years of that. 20 YEARS Actually more than that, but I'm just using one of the shorter timelines involved. So if the rather hands-off approach didn't work, campaigns didn't work, capitalism didn't work because it was always on the side of violating privacy? Well there comes the hammer.

AnthonyMouse 6y ago

> The way the EU usually works is that they say "we are concerned about X, Y and Z's effect on our citizens" to industry, and industry responds "we'll self-regulate to ensure X, Y and Z do not have the effect you're concerned about". The problem in this context is identifying adtech as the industry rather than the adversary. It's like identifying a problem with spam and then asking the spammers to self-regulate. It's misapprehending the nature of the problem. So then you say the spammers wouldn't self-regulate by not spamming so we're going to regulate email. Everybody hire a lawyer if you want to use email. And then the spammers still give you the finger because the internet spans the globe and they just set up in countries that won't enforce your rules, and the rules increase costs on everybody else. What we need here are technical solutions. Browsers that resist tracking and fingerprinting. Technology to resist correlation attacks. The dissolution of unitary identity systems. More software that runs on your machine and not the adversary's machine. Make tracking too hard and there is no more tracking industry. The thing most needed there is funding. There is profit in tracking and not so much profit in anti-tracking, so if you want anti-tracking then provide money for it. And for goodness sake stop passing laws against anti-tracking measures.

vertex-four 6y ago
I'll point out that the EU Government has poured an incredible amount of money into the problem of "privacy and enhancing trust" and related topics - if you're in the EU, even as an individual developer you can likely get some of that money through NLNet. Unfortunately it's a hard problem and the other side has a lot of money too.