35 ms·

UK to depart from GDPR

452 points by bencollier49 6y ago

Hamuko 6y ago
>new information commissioner to focus not just on privacy but on the use of data for ‘economic and social goals’. Congratulations Britons, your data's back on sale.
- 8fingerlouie 6y ago
  I wonder if we will now see a situation where British companies will be forced to move their cloud out of GB, to i.e. Ireland if they want to do business with the rest of Europe ? The thing is, even though the GB decides to ditch GDPR, they're still bound by it if they want to do business with the rest of Europe, just like the US is bound by it.
  - nicbou 6y ago
    It's already happening. I work with a few affiliate platforms, amd many of them sent an email requesting me to update my invoices. They moved to Germany or some other EU country.
  - deleted 6y ago
    [deleted]
  - dageshi 6y ago
    Sure, but the large number of businesses who are UK only won't have to deal with it. Instead of frontloading compliance for any new venture, they can build for the UK first then work on compliance if and when they go for EU business.
  - Freak_NL 6y ago
    With the difference that companies can now move Britons into the cohort of users whose data you can sell and do things with you probably didn't quite consent to in any meaningful way. And as Europeans we will probably get a couple more websites that will just tell us to sod off (in proper British English parlance now) because of our data protection laws. You know, the kind of message that already pops up when you search for some recipe and end up on an American website with good SEO or some topic featured on a local news outlet in the US.
  - mmrezaie 6y ago
    We are counting on this. Actually investments in Sweden for data centers has rissen more than 20-40 percent at the normal rate. I know that some purchases of cloud services are halted for now to be sure about this. Data movement is going to be increasingly an important matter. It should have been from the begining but here we are.
  - Jonnax 6y ago
    So with a quick search online, I found this site: https://incountry.com/blog/data-residency-laws-by-country-overview/ https://incountry.com/blog/data-residency-laws-by-country-ov... Organisations which receive and hold any of regulated data types to follow the GDPR requirements. According to GDPR, companies have to keep the data secure inside the EU and if the data is to be transferred outside of the UE, then it can only be transferred to countries or organisations that have signed up to equivalent privacy protection." So the EU has all the power here to say that the UK doesn't meet their standards and require businesses to transfer their data. However, I would guess that most international organisations would have already moved their EU customer data out of the UK. There were years of uncertainty with the Brexit negotiations, keeping data in the UK would have too much risk. Plus many other countries have data residency laws, so it's not like a foreign concept to international businesses.
  - alphadevx 6y ago
    100% this. Already happening (I moved all of mine from London to Frankfurt last year, fully expecting this to happen). DCs in the UK will suffer.
- hnlmorg 6y ago
  It's not surprising considering this is the same government who used such data to create targeted campaigns to win the referendum in the first place. edit: wow that's a lot of downvotes in a short space of time. Maybe I should back my point up with some evidence to prove I'm not talking out of my arse (though it was widely reported at the time so I'm surprised anyone would disagree with me): https://www.bbc.co.uk/news/uk-politics-44966969 https://www.bbc.co.uk/news/uk-politics-44966969
kwhitefoot 6y ago
Is anyone surprised?
rich_sasha 6y ago
I have mixed feelings about this. On the one hand, I think GDPR is a great step towards stopping companies hoarding your data and holding you hostage to it. On the other, main GDPR change is those awful 'hand over data / pretend you're not' dialogue boxes. When I'm feeling strong, I look for the 'reject / object / blah' box, but often I don't find it in me to resist anymore. So maybe it's not awful they're reshaping GDPR.
- beforeolives 6y ago
  This won't be a change aiming to improve your web browsing user experience. It will likely be a change to reduce your rights and legal protections.
- martin_a 6y ago
  The GDPR sets a pretty straight border for this. No active (this does NOT include "by using this site you accept...") approval = no permission to collect data and give it to third parties. That's the law. But we'll still need some hard work and hefty fines to make everyone obey it.
  - rich_sasha 6y ago
    Right - the law sounds good. But it's not the practice I see on the t'Internet.
    - martin_a 6y ago
      Then push it! I've done this before and there are active cases running with the regulatory offices in Germany. It's a slow process for sure but it'll get faster and words will spread, that people are using their rights.
      - Nextgrid 6y ago
        To be fair, the ICO is absolutely incompetent and does not seem to care about enforcing the GDPR. I've reported things much worse than non-compliant consent prompts and the best I got out of them was to send a letter to the organization after months of waiting, which the organization promptly ignored.
melomal 6y ago
I can honestly say that I think it made little to no difference, across the board. The requirements etc have not been fulfilled by most companies, why bother.
- james-bcn 6y ago
  If you work in enterprise it absolutely has made a big difference.
  - killtimeatwork 6y ago
    I work in an large euroepan enterprise and our GDPR compliance is... absymal. And we're not even investing that much into becoming more compliant. My impression is that the board is in a state of denial, as doing GDPR properly would probably cost us billions.
    - throwaway210222 6y ago
      Exactly, once Europe realises that the USA's 2018 Cloud Act makes its *impossible* for every USA registered cloud provider, every Office 365 account, every Google doc, every Gmail account, and every Dropbox account to be GDPR compliant, it will just quietly fade away. A nice idea, but no one will care that much.
      - Daho0n 6y ago
        All those are "fading away" in every area of enterprise I have seen that deal with private data. When GDPR is causing US states to follow suit and create GDPR-like laws I'd say it is the US's woefully bad privacy laws that are fading the most. Of course I don't believe for a second that it will matter inside the US but that is not the EU's problem.
        throwaway210222 6y ago
        With secret FISA courts, the is no way you will ever be able to know. You have no idea who they have approached, nor what they have asked [= insisted] for. And to be clear, because of the CLOUD Act, this reaches all EU citizens on US owned platforms.
dash2 6y ago
YIPPEE. Does this mean no more of those stupid little popups every time I see a site? HOORAY. Does it mean less absurd bureaucracy and non-jobs? GREAT. As for data privacy... does anyone seriously think that Facebook was stopped from collecting data due to GDPR?
- estaseuropano 6y ago
  Facebook and google takeout only exist because of gdpr. Right to delete (not just deactivate) your account only exists due to gdpr. Right to opt out at all only exists because of gdpr, and many companies do actually stick to it. That many don't follow the spirit of the regulation is not really the fault of the regulation. Thing is its not been tested much in the courts yet, but the cases have really started last year so hopefully more enforcement incoming.
  - throwaway3699 6y ago
    Google Takeout existed for many years before GDPR was even a thing: https://en.m.wikipedia.org/wiki/Google_Data_Liberation_Front https://en.m.wikipedia.org/wiki/Google_Data_Liberation_Front
  - perryizgr8 6y ago
    > google takeout only exist because of gdpr. I doubt that since takeout precedes gdpr by several years.
- monkey_monkey 6y ago
  I guess Facebook can use the additional profit they'll make on UK citizens to pay for fines they incur in the EU https://www.decisionmarketing.co.uk/news/facebook-sets-aside-e302m-for-potential-gdpr-fines https://www.decisionmarketing.co.uk/news/facebook-sets-aside...
- shrew 6y ago
  Ah this is the best bit! Because many companies cater for a global audience, us Brits will STILL have to endure the stupid little popups AND we'll have no protection or recourse from privacy invasion! Can't wait! /s
Jonnax 6y ago
"...culture secretary Oliver Dowden said he would use the appointment of a new information commissioner to focus not just on privacy but on the use of data for ‘economic and social goals’. ...Dowden said that under the regime ‘too many businesses and organisations are reluctant to use data – either because they don’t understand the rules or are afraid of inadvertently breaking them’." However this would only be in relation to UK data. If they want to do business with EU citizens, then businesses have to comply with GDPR. Seems pretty myopic.
dbetteridge 6y ago
I somewhat miss the days when the corruption was at least somewhat veiled. No-no of course we don't want to sell your data for profit, that would be ridiculous. Clearly it is just our corporate sponsors who will be doing it for us!
- lanevorockz 6y ago
  Yep, never heard of corruption in Italy before. The Mafia was created just a year ago right after Brexit
  - user-the-name 6y ago
    Why are you talking about Italy?
    - rusk 6y ago
      They are trying to use the prevalence of organised crime in one nation to justify corruption in another. It’s called “comparing yourself downwards”. Kind of like the drunken neglectful husband who pats himself on the back for not beating his wife like some guys he sees on TV.
- kzrdude 6y ago
  Money has become the main objective, and it's poisoning us. Money is a means to an end, not the end itself. The nation (any country) needs to have human goals - not economical goals for their own sake - but a better life for us, for us all.
  - aloisdg 6y ago
    That why we cry when countries are compared by GDP...
  - Cthulhu_ 6y ago
    And I want to say that's fine, but it's the methods involved. Recently, a LOT of decisions have been made that (to me, armchair internet guy) seem to be aimed at short-term gain. Like Brexit, the people benefiting most from it are already well settled, they're working on their short- to mid-term plan to earn a lot of money before retiring to their private island or estate or whatever. They live outside of the negative consequences of their decisions. Meanwhile, the rest of the population will have to suffer through the consequences for the foreseeable. Tl;dr, policy optimizing for short term individual gain instead of long term sustainable gain. And the long term gain would be so much more better as well. All of the countries currently under a short term gain capitalist regime could be so much better for their inhabitants. Wealth, socialist policies, comfort, safety, stability, etc is all in reach. But instead the people at the top - who already live a very comfortable and privileged life so they don't see and never will see the problem - choose short term personal gain for them and their 1% friends.
vmception 6y ago
I honestly get giggles from how unprepared they are culturally for what becoming America-like will do to them. Does anyone else? American-like but with no negotiating leverage and having burned all the bridges to the other economic unions.
- heywherelogingo 6y ago
  GDPR is three years old.
- andy_ppp 6y ago
  They get to asset strip the country before anyone realises right?
- lanevorockz 6y ago
  The EU as a political union exists a little over a decade, if anything the UK never adapted to it.
  - asutekku 6y ago
    But they benefited from the EU in a way which is no more possible.
  - HugoDaniel 6y ago
    Mistaking the EU, the political union as an evolved form of the Rome treaty, with Euro, the coin. All that with the tone of absolute certainty and authority. Hacker News has reached new lows :(
    - dataduck 6y ago
      Come on, that's not fair. The EEC was a very different beast to today's EU. The modern form of the EU could certainly be argued as starting with the Treaty of Lisbon.
      - orwin 6y ago
fundatus 6y ago
This feels like one of those things where Post-Brexit-Britain simply HAS to do something different. Just for the sake of it. Sovereignty and all that. The fact that many online businesses will probably still cater to EU citizens and will therefore still follow GDPR rules doesn't matter. Those companies will end up with two slightly different sets of rules and it will just be annoying.
- mytailorisrich 6y ago
  The problem becomes one of enforcement. If you're an online business established outside of the EU with no presence in the EU then as long as you abide by the data protection laws of your own country I don't see how an EU country's data protection authority could do anything to you. This is a general issue online where sites and potentially services can be reached and used globally whilst each country basically cannot do anything outside of its own borders. The part of the GDPR that says that the regs apply worldwide as long as the individual is in the EU is not really realistic in many actual situations.
andy_ppp 6y ago
I mean this of course means EU data won’t be able to be stored on British servers as I understand it. More barriers to trade, it’s like this government is trying to destroy the economy...
- that_guy_iain 6y ago
  As far as I understand it, it currently can't be hosted in the UK anyways. As the requirement is to store the data within the EU.
  - Blikkentrekker 6y ago
    I thought the data could be exported to any country whose laws offer the same level of protection.
    - theelous3 6y ago
      You can store it wherever you want, so long as you're in compliance.
      - jeroenhd 6y ago
        > You can store it wherever you want, as long as you're in compliance. From a GDPR standpoint, compliance means that the country where the data is stored has an agreement with the EU AND you must have enforceable and strong, negative consequences for the foreign party in your contract. The EU can only make such an agreement for a foreign country if the data protection laws are sufficient. I do not know whether or not the UK laws are considered sufficient, but without any such agreement, you cannot assume that you can just store EU personal data in the UK. With the death of Privacy Shield and its siblings, this first requirement isn't even the case for the US anymore as the US will not guarantee the safety of EU citizens' information from things like the patriot act. However, I haven't seen any country complain about storing data with Google, Amazon or Facebook yet so I don't think this rule will be enforced any time soon. Technically, though, storing PII in a foreign, non-EU country without the necessary requirements is still very much illegal with the full suite of fines available to the data processing agencies.
ArkanExplorer 6y ago
To 99% of internet users, GDPR has meant nothing except extra popups, blocked access to some websites, and an additional regulatory burden. In some cases bad actors exploited GDPR for fraudulent purposes - eg. requesting a full account deletion in the event of a ban. They can then recreate the same account with the same data.
- ClumsyPilot 6y ago
  That like claiming "For 99% of consumers food safety regulations means nothing but annoying 'use by date'!" Just because the effects are not obvious to a layman, doesnt they aren't there
  - ur-whale 6y ago
    Thank you for the protection we've never asked for. Now, can you come and change my diapers for me ?
    - iamacyborg 6y ago
      I never asked for rigorous safety legislation around fire safety, infrastructure safety, etc. I'm still glad they exist though.
      - ClumsyPilot 6y ago
        In New York, the Free Market gave us fire escapes built out of wood before regulations came around.
    - arkitaip 6y ago
      Just because you don't care about your privacy and the way companies handle your data doesn't mean others should suffer the same date. As for changing your diapers, there are services for that, too.
- nicoburns 6y ago
  I don't think that's true. I've watched a complete about face by companies when faced by the GDPR. Previously the attitude was to collect and store as much data as possible "just in case" it was later useful. With GDPR, management is suddenly aware of the legal liability of storing this data, and it's generally only stored if it's actually needed.
piokoch 6y ago
For me the biggest flaw of GDPR that it does not distinguish between something done as a business to make money and something done non-profit, as a hobby project, etc. GDPR killed forums, etc. everything moved to Facebook groups, where people agree to whatever Facebook wants. Who will create forum for a community if one has to deal with all the bureaucracy, "right to be forgotten", data accuracy checks, data export request, gathering consents, being responsible for bugs in some forum software if there will be data leak and risk huge fines if something is not done correctly. Another issue is vagueness of the regulation. What exactly is data processing/controlling? If kids leave they clothes in kindergarten or school, can clothes be signed with kid first and last name (so it is easier to find lost items)? Is school a processor or controller of kids' PII in that case? Probably not, but who knows what will happen if someones signed hat will be stolen?
- nicbou 6y ago
  I'm not sure why it should do that. Data is data. In the end though, you don't have to go crazy about it, because there is zero chance of enforcement over small pebbles.
- gampleman 6y ago
  A school most certainly already is a data controller as it has way more PII than just your kids name.
- ThePhysicist 6y ago
  The GDPR only regulates automated data processing and manual data processing where a "filing system" is used, so you kindergarten doesn't "process" children's data just because they write the children's names on their coats... In general I think you're exaggerating a lot of the problems, many forums are still alive and kicking and most forum software has been updated to accommodate the requirements of the GDPR (which aren't very difficult to implement in any case). The centralization of the web on very few commercial platform has many reasons, data protection is probably the least important and might even be a counter-force in my experience.
- bornelsewhere 6y ago
  If you do not have resources to take care of PI then perhaps do not gather and store it in the first place? Forums do not necessarily require personal information to exist.
CryptoPunk 6y ago
I hope the UK follows through with its 'Singapore-on-Thames' plan, which requiring losing regulatory harmonization with the EU: https://en.wikipedia.org/wiki/Singapore-on-Thames https://en.wikipedia.org/wiki/Singapore-on-Thames
- lanevorockz 6y ago
  Let’s be honest, it’s not up to the UK alone. The EU still has strong world influence and they will try to stop it at any cost.
  - viraptor 6y ago
    Why do you think so? What do you think EU has to gain from UK doing badly? And I mean in practice, economically - we're way past the time "told you so" is relevant.
    - auganov 6y ago
      If the EU cannot show there's a big exit cost it may not last too much longer. Economic growth is so lackluster all across the EU, including new entrants, that few people (who looked at the data) genuinely believe EU membership is a GDP booster. EU's next best bet is to play into the fear that exiting will bring about economic ruin. This works particularly well on newer members who may not be on good terms with core EU countries. Their fear wouldn't necessarily be missing out on benefits but getting slapped with sanctions.
      - viraptor 6y ago
        We already saw the big exit cost. Tariffs will apply where trade deals are missing. I'm not sure who you expect to use sanctions - EU won't slap anyone with sanctions just because they left EU. Have a look at https://sanctionsmap.eu/ https://sanctionsmap.eu/ for situations where sanctions have been applied.
        6y ago
dtf 6y ago
Well say goodbye to EU data adequacy. Although to be honest it probably wouldn’t have survived the first court case given the UK state’s addiction to snooping.
- remus 6y ago
  It'll be interesting to see what changes they actually propose. Id assume they would want to avoid threatening the EU adequacy decision so would go with some changes that would score them some points with businesses but without materially affecting contents of the current legislation.
- jjcon 6y ago
  > UK state’s addiction to snooping GDPR has nothing to say on state snooping and if you think Germany or plenty other members aren’t.... I’ve got some bad news for you
  - dtf 6y ago
    Undoubtedly so. What UK is doing wasn't a problem until it was no longer a member.
deleted 6y ago
[deleted]
ur-whale 6y ago
> UK to depart from GDPR Good for them. Looks like in the UK there will be a lot less time wasting clicking on useless "Accept all cookies or else" disclaimers pop-ups.
- Nextgrid 6y ago
  These useless pop-ups are only there because the GDPR wasn't enforced properly. The majority of tracking consent popups you see are not compliant with the regulation. A compliant pop-up should make the opt-out option as easy to use as the opt-in option.
- Nemo157 6y ago
  Just block them in your ad blocker, because they must be opt-in, by not interacting with them you are asserting your right to not be tracked.
renewiltord 6y ago
Hmm, this would be good for business if it had never been an issue. It looks like the plan is for this to just be a divergent set of regulations which is not particularly of any general utility. Maybe if they harmonize along CCPA or something it would be of value.
jpxw 6y ago
Good riddance. GDPR is an insane, Byzantine mess of legalese, which maps poorly onto reality.
- M2Ys4U 6y ago
  > Good riddance. GDPR is an insane, Byzantine mess of legalese, which maps poorly onto reality. Have you even read it? The GDPR is a quite straightforward piece of legislation.
  - jpxw 6y ago
    Yes, I have read it. A pdf copy of it runs to 156 pages. Not particularly straightforward. Can you sum what the legislation does up in a couple of paragraphs?
danmur 6y ago
Any time 'adequate' is the bar it's not great
matthewmacleod 6y ago
One of the most obvious political impacts of Brexit is that the government will feel obliged to demonstrate some kind of benefit. Since real benefits are difficult—verging on impossible—to find, it seems likely the government is going to head in the direction of fabricating benefits. So - slash some regulation, present it as “freeing up business”, and ignoring the wider impact.
tomelders 6y ago
GDPR should have been implemented as a standard that browser vendors should implement. e.g. ``` window.getPersonalDataPreferences() ``` It should only prompt the user to submit their preferences if no preferences were detected, or a specific permission is required to allow certain features. People may argue that everyone will just turn everything off everywhere and forget about it, and I would argue "so what?". The burden of GDPR has been dumped on the wrong people and has become so tedious to administer it's basically useless and a massive waste of time and energy.
- Nextgrid 6y ago
  We had that in the form a "Do Not Track" header and not only did nobody obey it, but malicious actors actually used it as an extra fingerprinting vector to track you even more.
- M2Ys4U 6y ago
  The GDPR is not a cookie law. It's not even an internet law. The GDPR applies when any processing of any data is done regardless of context.
oytis 6y ago
Well, we'll see. The pandemic has shown that tracking can be a huge economic advantage - and it's likely not the last pandemic we encounter. OTOH targeting adtech can redirect resources to some more potentially useful areas.
- DangerousPie 6y ago
  I don't think GDPR applies to governments anyway, does it?
  - oytis 6y ago
    But you don't necessarily want tracking infrastructure being built by governments completely, that would be pretty inefficient. As far as I understand the China case at least (I'm not an expert here though, and have never been to China), it's largely started with a commercial app (WeChat). Not to say that the necessary technology (big data, ML etc.) is to a great extent driven by commercial applications - and businesses should have economic incentives to develop them further.
  - krageon 6y ago
    It does not and it never has.
    - Daho0n 6y ago
      It does. For example there're GDPR compliance info and access to delete etc. your info in all Danish governmental databases that aren't for national security or covered by GDPRs legitimate interest. You could argue if it works 100% but saying it doesn't cover and impact government isn't true.
    - libertine 6y ago
      Of course it does, and they are liable for it.
  - ewidar 6y ago
    It depends on what you mean: GDPR does not prevent EU government from handling their citizens personal data for bureaucracy. However a good example of GDPR applying to the government is the COVID tracking app built by (for?) the French government, which still has to provide ways to opt out from tracking + clean your personal data. I think that's what the GP was talking about.
sseneca 6y ago
Huh. I guess this'll be what pushes me to finally figure out a proper backup system for my server, so I can trust it with all my photos etc, and remove them from "The Cloud"
m12k 6y ago
‘too many businesses and organisations are reluctant to use data – either because they don’t understand the rules or are afraid of inadvertently breaking them’ TBH I'm glad companies stay away from my data if they don't know how to get consent, store data securely, or even what those things mean.
- tobyhinloopen 6y ago
  Yes this sounds like a great thing
- lanevorockz 6y ago
  This is an illusion, only thing that happened is that you only get access to websites if you give away your GDPR consent. I love the ignorance of people over here thinking that GDPR is nothing more than just that accept button that people click in order to get access to the websites.
  - switch007 6y ago
    I have never observed a non-techie do anything other than blindly click the call to action (i.e. agree to everything). The entire scheme seems sneakily designed to actually encourage users to give more and explicit consent, avoiding the situation where consent was a grey area. It seems to have been spun to a great extent.
    - kalleboo 6y ago
      > The entire scheme seems sneakily designed to actually encourage users to give more and explicit consent The law itself says that the default option should be to opt-out. Any site that doesn't have precisely equally prominent "agree to all" and "deny all" buttons violate the GDPR. The problem seems to be in the complete lack of enforcement.
    - devonbleak 6y ago
      My biggest annoyance lately is having to go set my cookie preferences on every. single. site. If only there was some sort of browser standard that I could set in the preferences there and sites would just obey it....
fumblebee 6y ago
> "too many businesses and organisations are reluctant to use data – either because they don’t understand the rules or are afraid of inadvertently breaking them" This is a deeply depressing take if the conclusion is to scrap GDPR. Is this true for 'data' in the general sense, or actually only true in the murky cases where there's an opportunity to use and abuse our personal data. In my book, that implies that GDPR is working exactly as we hoped it would.
- Daho0n 6y ago
  I'm willing to bet that this: >The UK has the freedom to strike its own partnerships, he said, and he would announce priority countries for data adequacy agreements shortly will be an announcement that the US has adequate data protection.
- remus 6y ago
  This is obviously reading the tea leaves a bit, but I didn't get the impression they are looking to scrap GDPR. It seems to me that they just want to relax things a bit so that businesses don't feel so threatened by it. Overall I think GDPR is a very positive thing, but from the government's perspective if they could keep the adequacy agreement in place with the EU while still relaxing some of the current GDPR legislation then that would be a big win for them, especially from a political point of view as it would be some much-needed validation of their brexit strategy: "Look! We have all the benefit of being in the EU [via the adequacy decision] but we get to make our own rules! Go us." I could imagine them doing something along the lines of greatly reducing the maximum fine, for example. Big fines are typically not being issued, so they likely wouldn't see it as a big loss.
deleted 6y ago
[deleted]
MaxBarraclough 6y ago
Seems there's a reason reputable news outlets aren't reporting this: > The government has sent a first signal of its intention for UK data protection laws to part company with the EU’s General Data Protection Regulation. In a Financial Times article last week, culture secretary Oliver Dowden said he would use the appointment of a new information commissioner to focus not just on privacy but on the use of data for ‘economic and social goals’. So we don't know the UK is going to depart from the GDPR, but despite that, this website is reporting that it will.
- Daho0n 6y ago
  But we do: >The UK has the freedom to strike its own partnerships, he said, and he would announce priority countries for data adequacy agreements shortly Either he recant that comment or announce a country (the US I bet) that doesn't have an adequacy agreement with the EU. You can't have it both ways. If he does announce a list that isn't the same as the EU's they'll have scrapped GDPR.
earnubs 6y ago
Link says Government sent a "first signal of its intention", title says "UK to depart". Comments skip straight to how dumb we all are. :shrug:
- thinkingemote 6y ago
  It's like this for most stories and subjects to be honest. It's just that technology news has more people knowing what's actually going on.
sdfhbdf 6y ago
‚Meanwhile one of the architects of the GDPR, German MEP Axel Voss, last week called for the regulation to be updated to take into account developments such as blockchain technology...’ What does that have to do with personal data? Sounds like keyword stuffing
- tremon 6y ago
  Blockchain data is immutable after it's been signed. If PII ends up in blockchain data, which is not unthinkable for e.g. financial transactions, there is no way to comply with data deletion requests, which the GDPR mandates.
- M2Ys4U 6y ago
  Axel Voss wasn't even one of the GDPR's architects. He was trying to kill it before it was born.
  - smartbit 6y ago
    Documentary Democracy: Im Rausch der Daten (2015) [0] gives insight in the some of the main characters during the GDPR negotations. It films behind closed doors where the real negotiations took place. Highly recommended for anyone interested in EU politics and in particular for those with interest in privacy. Quotes from Alex Voss in today’s Financial Times [1] [0] https://www.imdb.com/title/tt5053042/ https://www.imdb.com/title/tt5053042/ [1] https://archive.is/P1gqZ https://archive.is/P1gqZ
KaiserPro 6y ago
With respect, this is not what the article means. The UK has an equivalence agreement with the EU, which unlike a trade agreement can be rescinded quickly (something like 4 weeks). This means that we have to have equivalent provisions to continue to handle data about EU citizens. so the UK might be "departing" from GDPR in name, it won't be in substance just by this act. This of course assumes the the UK is acting rationally.
corobo 6y ago
Now we got rid of the EU protections the Tory govt is going to stripmine the country for cash. Imagine the desire for wealth and power at the expense of others being defined as a mental illness that needed treating instead of giving these cunts more power.
- aembleton 6y ago
  What did the EU stop the Tory government from stripmining?
  - corobo 6y ago
    Data, did I comment on the wrong thread?
    - aembleton 6y ago
      No, I don't think you did. Why didn't the EU prevent the UK from selling/sharing 1.6 million patient records in 2016? https://www.newscientist.com/article/2086454-revealed-google-ai-has-access-to-huge-haul-of-nhs-patient-data/#.VyOORsEjCiU.twitter https://www.newscientist.com/article/2086454-revealed-google...
      - corobo 6y ago
        Got me good there. What a fun conversation this was. Consider me zinged. I knew you were setting me up for something.
deleted 6y ago
[deleted]
varispeed 6y ago
Not sure why people treat GDPR as dogmatic ultimate privacy law. This is a bit laughable. The giants violate it as they please and people are now taught to click boxes without reading its contents and agreeing to who knows what. I think the result is quite the opposite of what was intended as it also added few more vectors of attack that didn't exist before. Only advantage I can see is that some services now offer data download. I hope UK will come up with something much better.
macinjosh 6y ago
At least the UK is one European country with its head screwed on straight.
kmlx 6y ago
the lightest of articles based on a single quote. we'll wait for the actual documents, but in the meantime: 1. does this mean no more cookie stuff, and no more "click here to accept" modals? if yes, then it's a huge win. years of useless clicking, and countless Mwh will be saved in the long run. 2. will this mean no more protections whatsoever? this is not so great imo, and sincerely impossible in today's world of Big Tech legislation (especially in the highly litigious Europe). 3. what about the right to forget? will they touch that part as well?
khalilravanna 6y ago
> too many businesses and organisations are reluctant to use data – either because they don’t understand the rules or are afraid of inadvertently breaking them I’m sure they’ll feel much better when there’s yet another set of rules and laws they’ll have to follow. Oof.
marcorx 6y ago
GDPR has not much to do with cookies, and more to do with how your data is captured and used. Most of the "annoying" cookie banners and popups are related to the e-privacy regulation [1]. I am not sure this will have a significant impact, as UK will have to comply with GDPR if they want to to reach European customers. [1] https://www.activemind.legal/gb/guides/eprivacy-regulation/ https://www.activemind.legal/gb/guides/eprivacy-regulation/
jonplackett 6y ago
The idea of GDPR was good, the execution was poor. All those pop ups in your way and you end up just hitting 'ok' anyway because it takes so long to figure them out. And big companies seem to completely ignore it anyway. Take twitter - all they have is a banner along the bottom that says: "By using Twitter’s services you agree to our Cookies Use. We and our partners operate globally and use cookies, including for analytics, personalisation, and ads." and a close button. How is that consent?
- dkersten 6y ago
  The pop ups are not usually complaint though. So its not that the execution was poor, but rather that the enforcement is poor. Also, your Twitter quote shows another issue: conflating GDPR with the Cookie directive. They are two very different laws. GDPR is concerned with personally identifiable data and data protection, the cookie laws are concerned with tracking users online. GDPR applies to all data (not just websites), the cookie laws deal with what websites can do. They are not at all the same thing. The popups you see tend to be for the cookie law, because GDPR doesn't require anything like that. Both do require consent (opt-in) though, but both also have exemptions for data and cookies required to provide the service.
  - jonplackett 6y ago
    Ok thanks for the clarification. Twitter are specifically saying that they’re going to use cookies for a bunch of things there that are not necessary - like ads. So how is that allowed?
    - dkersten 6y ago
      Its not, unfortunately enforcement is... seriously lacking.
elorant 6y ago
Let the spam kings rejoice.
fmajid 6y ago
It's worth mentioning the UK-Japan free-trade agreement already exempted data flows to Japan from GDPR (and from there they can be laundered to the USA): https://edri.org/our-work/uk-japan-trade-agreement-violates-data-protection-rights/ https://edri.org/our-work/uk-japan-trade-agreement-violates-... As Boris Johnson said, "The UK won't immediately send children up the chimneys or fill beaches across the country with raw sewage". Emphasis on "immediately".
jdlyga 6y ago
What does the UK want to do, make some commonwealth free trade zone? That would make sense. But it seems like everyone wants to go in their own directions, including parts of the UK.
mavhc 6y ago
Practical outcomes of GDPR: You can't search old emails. Your website lists 100 companies you send data to. Someone will randomly waste your time asking for all information you have about them. You have to click Accept cookies on every website you visit 100s of times a day, wasting your life. Things it didn't fix: Data leaks.
turkey99 6y ago
ICO pretty much said they were only going to enforce it like previous data protection laws anyway.
benbristow 6y ago
Can we get a rid of the cookie notifications next? They're so annoying and usually end up conflicting with Adblockers and breaking pages because they're not fully blocked.
- glsdfgkjsklfj 6y ago
  elitist nonsense. They ought to be annoying. so sites that do not track you for advertising can just add your cookie when you actively sign in, without the annoying popup on first visit, and receive more traffic because they are less-annoying.
  - benbristow 6y ago
    Get real, most sites aren't going to do that when they can get away with putting a modal/banner up. It's the end-user that gets the brunt. Most of the modals are full of dark patterns that basically force you to accept the cookies etc. unless you go through multiple different screens and checkboxes.
    - glsdfgkjsklfj 6y ago
      > It's the end-user that gets the brunt. as they should. At least it is in their face now and can entice curiosity.
      - benbristow 6y ago
        Let's be honest, the average user (even myself) will just click 'okay'. It doesn't help anyone and just causes annoyances for most users. If there was proper legislation to block the tracking full-stop then maybe it'd make a difference but in the end it's just a half-measure that causes frustration for both parties. The users that have to dismiss the prompts and websites that have to implement them.
        glsdfgkjsklfj 6y ago
        you are missing my point. if you visit site A, you click OK, get all the cookies, get screwed, and annoyed. you visit site B, you don't see the popup, you don't get annoyed (and screwed with invisible tracking, but you just said you don't care about that) In the long run, we should hope site B will get less attrition and keep more users, by being less annoying (as a consequence of not tracking you)
danpalmer 6y ago
I'm broadly in favour of any consumer protective legislation like the GDPR, but I feel that the GDPR has been misinterpreted by many, in both directions. Those who ultimately respect user privacy and want to do the right thing are often paralysed by process and making sure that they absolutely can't be sued, rather than being able to show respect for data and best practices but still getting things done. Those who ultimately don't respect user privacy use it as an excuse. They plaster their services with GDPR notices, and then ignore the spirit of the law and sweep up all the data they want, regardless of whether they need it or should have it, but of course this is invisible to users so nothing happens about it. I wonder if this disconnect comes from the enforcement? I'd like to see a few high-profile cases that set out some precedents for what is and what isn't a breach of GDPR.
- choeger 6y ago
  Don't forget the people that use it as an excuse to not do what they simply don't want to do. "Sorry, we cannot contact you via email, GDPR, you understand? You have to come to us and have an awkward sales talk in order to get your trivial information."
- Nextgrid 6y ago
  Yes, there is definitely a lack of enforcement. The annoying consent flows people complain about and blame on the GDPR are actually forbidden by it and news of any enforcement actions would quickly scare most websites into implementing an actually compliant one.
freddybobs 6y ago
GDPR is generally a good thing IMHO. It seems this can only lead to 1) Rolling back to pre GDPR, where user data is largely a free for all 2) The UK having it's own 'unique' rules Neither which seems very good for users and/or businesses. Perhaps the point here is to make some kind dubious 'look what we can do because of brexit' argument. When the reality is that 'freedom' has a reality which is more negative than any positives it might have.
deleted 6y ago
[deleted]
flimflamm 6y ago
Should we just switch to France as a main language in the EU countries? Oui.
drusepth 6y ago
While GDPR's intentions were good, the implementation is hilariously vague/wide and has had a chilling effect on small and large businesses worldwide since going into effect (not to mention the additional costs immediately levied on every business to develop, verify, and maintain GDPR infrastructure). I'm sure this is a minority opinion on HN but I'm glad to see some countries pulling back, especially in light of recent calls to expand GDPR even further (!).
aerosmile 6y ago
Just an observation that we seem to have two camps here: one camp correctly noting that GDPR was a net positive for the users, and the other camp correctly noting that GDPR was a net negative for startups and SMBs. I am surprised that nobody is realizing that what's bad for startups and SMBs is also ultimately bad for the users, just on a longer timescale (with an equally long reversal period). I remember the US Congress grilling Zuckerberg back in 2018, and him responding that he's certainly willing to make amendments, but if you tie his hands too much, someone from China will swoop in and bypass all regulations. Everyone scoffed at that, and less than 3 years later, TikTok is unstoppable despite Facebook's best efforts. While users' privacy has benefited from Facebook's downfall, their privacy has never been at more risk with the rise of TikTok (I do realize that TikTok's servers are in the US and Singapore, but let's not fool ourselves - the ByteDance leadership would be quickly replaced if they refused a data request from their government). I would consider this a net negative for the users, and particularly for the US as a country. Just another example proving that the paradox of tolerance [0] is a real thing. If you get too tolerant too quickly, you end up with a less tolerant outcome. [0] https://en.wikipedia.org/wiki/Paradox_of_tolerance https://en.wikipedia.org/wiki/Paradox_of_tolerance
- Nextgrid 6y ago
  Is there any evidence that TikTok's popularity is due to their non-compliance with regulations, and not just being a novelty and them having lots of money to bankroll such a service without annoying the users with ads like FB does?
  - aerosmile 6y ago
    On the first-order basis, it might be difficult to pinpoint why Facebook "wasn't allowed" to build this product before anyone else. On the second-order basis, there is an interesting comparison between how well Facebook hindered Snapchat's growth with their rollout of Stories, vs how well it hindered Tiktok's growth with their rollout of Reels (not very). There are obviously a million factors to consider, but I would argue that us taking Facebook through the dirt 1) weakened its hold over its users and 2) triggered a talent exodus, both of which contributed to Facebook's Reels not being as impactful as Stories (viewed strictly through the lens of defending against the new competitor).
lucasnortj 6y ago
Yes! We’ve finally taken back control of our data!
Mentlo 6y ago
Did anyone actually read the article? Most of the comments here are treating the article as if the UK will depart from GDPR (as the title says) - but the article says nothing of the kind. It will be a slight change, probably reformatted to allow for less red tape and more clarity for small businesses and early-life enterprise. And the UK still needs to keep regulatory alignment to the EU to be able to have low-tarrif access to the markets. If I was a betting man, I wouldn't bet on this being a significant change, given the world is moving more towards privacy (yes, including US).

452 points by bencollier49 6y ago

>new information commissioner to focus not just on privacy but on the use of data for ‘economic and social goals’. Congratulations Britons, your data's back on sale.

8fingerlouie 6y ago
I wonder if we will now see a situation where British companies will be forced to move their cloud out of GB, to i.e. Ireland if they want to do business with the rest of Europe ? The thing is, even though the GB decides to ditch GDPR, they're still bound by it if they want to do business with the rest of Europe, just like the US is bound by it.
- nicbou 6y ago
  It's already happening. I work with a few affiliate platforms, amd many of them sent an email requesting me to update my invoices. They moved to Germany or some other EU country.
- deleted 6y ago
  [deleted]
- dageshi 6y ago
  Sure, but the large number of businesses who are UK only won't have to deal with it. Instead of frontloading compliance for any new venture, they can build for the UK first then work on compliance if and when they go for EU business.
- Freak_NL 6y ago
  With the difference that companies can now move Britons into the cohort of users whose data you can sell and do things with you probably didn't quite consent to in any meaningful way. And as Europeans we will probably get a couple more websites that will just tell us to sod off (in proper British English parlance now) because of our data protection laws. You know, the kind of message that already pops up when you search for some recipe and end up on an American website with good SEO or some topic featured on a local news outlet in the US.
- mmrezaie 6y ago
  We are counting on this. Actually investments in Sweden for data centers has rissen more than 20-40 percent at the normal rate. I know that some purchases of cloud services are halted for now to be sure about this. Data movement is going to be increasingly an important matter. It should have been from the begining but here we are.
- Jonnax 6y ago
  So with a quick search online, I found this site: https://incountry.com/blog/data-residency-laws-by-country-overview/ https://incountry.com/blog/data-residency-laws-by-country-ov... Organisations which receive and hold any of regulated data types to follow the GDPR requirements. According to GDPR, companies have to keep the data secure inside the EU and if the data is to be transferred outside of the UE, then it can only be transferred to countries or organisations that have signed up to equivalent privacy protection." So the EU has all the power here to say that the UK doesn't meet their standards and require businesses to transfer their data. However, I would guess that most international organisations would have already moved their EU customer data out of the UK. There were years of uncertainty with the Brexit negotiations, keeping data in the UK would have too much risk. Plus many other countries have data residency laws, so it's not like a foreign concept to international businesses.
- alphadevx 6y ago
  100% this. Already happening (I moved all of mine from London to Frankfurt last year, fully expecting this to happen). DCs in the UK will suffer.
hnlmorg 6y ago
It's not surprising considering this is the same government who used such data to create targeted campaigns to win the referendum in the first place. edit: wow that's a lot of downvotes in a short space of time. Maybe I should back my point up with some evidence to prove I'm not talking out of my arse (though it was widely reported at the time so I'm surprised anyone would disagree with me): https://www.bbc.co.uk/news/uk-politics-44966969 https://www.bbc.co.uk/news/uk-politics-44966969

kwhitefoot 6y ago

Is anyone surprised?

rich_sasha 6y ago

I have mixed feelings about this. On the one hand, I think GDPR is a great step towards stopping companies hoarding your data and holding you hostage to it. On the other, main GDPR change is those awful 'hand over data / pretend you're not' dialogue boxes. When I'm feeling strong, I look for the 'reject / object / blah' box, but often I don't find it in me to resist anymore. So maybe it's not awful they're reshaping GDPR.

beforeolives 6y ago
This won't be a change aiming to improve your web browsing user experience. It will likely be a change to reduce your rights and legal protections.
martin_a 6y ago
The GDPR sets a pretty straight border for this. No active (this does NOT include "by using this site you accept...") approval = no permission to collect data and give it to third parties. That's the law. But we'll still need some hard work and hefty fines to make everyone obey it.
- rich_sasha 6y ago
  Right - the law sounds good. But it's not the practice I see on the t'Internet.
  - martin_a 6y ago
    Then push it! I've done this before and there are active cases running with the regulatory offices in Germany. It's a slow process for sure but it'll get faster and words will spread, that people are using their rights.
    - Nextgrid 6y ago
      To be fair, the ICO is absolutely incompetent and does not seem to care about enforcing the GDPR. I've reported things much worse than non-compliant consent prompts and the best I got out of them was to send a letter to the organization after months of waiting, which the organization promptly ignored.

melomal 6y ago

I can honestly say that I think it made little to no difference, across the board. The requirements etc have not been fulfilled by most companies, why bother.

james-bcn 6y ago
If you work in enterprise it absolutely has made a big difference.
- killtimeatwork 6y ago
  I work in an large euroepan enterprise and our GDPR compliance is... absymal. And we're not even investing that much into becoming more compliant. My impression is that the board is in a state of denial, as doing GDPR properly would probably cost us billions.
  - throwaway210222 6y ago
    Exactly, once Europe realises that the USA's 2018 Cloud Act makes its *impossible* for every USA registered cloud provider, every Office 365 account, every Google doc, every Gmail account, and every Dropbox account to be GDPR compliant, it will just quietly fade away. A nice idea, but no one will care that much.
    - Daho0n 6y ago
      All those are "fading away" in every area of enterprise I have seen that deal with private data. When GDPR is causing US states to follow suit and create GDPR-like laws I'd say it is the US's woefully bad privacy laws that are fading the most. Of course I don't believe for a second that it will matter inside the US but that is not the EU's problem.
      - throwaway210222 6y ago
        With secret FISA courts, the is no way you will ever be able to know. You have no idea who they have approached, nor what they have asked [= insisted] for. And to be clear, because of the CLOUD Act, this reaches all EU citizens on US owned platforms.

dash2 6y ago

YIPPEE. Does this mean no more of those stupid little popups every time I see a site? HOORAY. Does it mean less absurd bureaucracy and non-jobs? GREAT. As for data privacy... does anyone seriously think that Facebook was stopped from collecting data due to GDPR?

estaseuropano 6y ago
Facebook and google takeout only exist because of gdpr. Right to delete (not just deactivate) your account only exists due to gdpr. Right to opt out at all only exists because of gdpr, and many companies do actually stick to it. That many don't follow the spirit of the regulation is not really the fault of the regulation. Thing is its not been tested much in the courts yet, but the cases have really started last year so hopefully more enforcement incoming.
- throwaway3699 6y ago
  Google Takeout existed for many years before GDPR was even a thing: https://en.m.wikipedia.org/wiki/Google_Data_Liberation_Front https://en.m.wikipedia.org/wiki/Google_Data_Liberation_Front
- perryizgr8 6y ago
  > google takeout only exist because of gdpr. I doubt that since takeout precedes gdpr by several years.
monkey_monkey 6y ago
I guess Facebook can use the additional profit they'll make on UK citizens to pay for fines they incur in the EU https://www.decisionmarketing.co.uk/news/facebook-sets-aside-e302m-for-potential-gdpr-fines https://www.decisionmarketing.co.uk/news/facebook-sets-aside...
shrew 6y ago
Ah this is the best bit! Because many companies cater for a global audience, us Brits will STILL have to endure the stupid little popups AND we'll have no protection or recourse from privacy invasion! Can't wait! /s

Jonnax 6y ago

"...culture secretary Oliver Dowden said he would use the appointment of a new information commissioner to focus not just on privacy but on the use of data for ‘economic and social goals’. ...Dowden said that under the regime ‘too many businesses and organisations are reluctant to use data – either because they don’t understand the rules or are afraid of inadvertently breaking them’." However this would only be in relation to UK data. If they want to do business with EU citizens, then businesses have to comply with GDPR. Seems pretty myopic.

dbetteridge 6y ago

I somewhat miss the days when the corruption was at least somewhat veiled. No-no of course we don't want to sell your data for profit, that would be ridiculous. Clearly it is just our corporate sponsors who will be doing it for us!

lanevorockz 6y ago
Yep, never heard of corruption in Italy before. The Mafia was created just a year ago right after Brexit
- user-the-name 6y ago
  Why are you talking about Italy?
  - rusk 6y ago
    They are trying to use the prevalence of organised crime in one nation to justify corruption in another. It’s called “comparing yourself downwards”. Kind of like the drunken neglectful husband who pats himself on the back for not beating his wife like some guys he sees on TV.
kzrdude 6y ago
Money has become the main objective, and it's poisoning us. Money is a means to an end, not the end itself. The nation (any country) needs to have human goals - not economical goals for their own sake - but a better life for us, for us all.
- aloisdg 6y ago
  That why we cry when countries are compared by GDP...
- Cthulhu_ 6y ago
  And I want to say that's fine, but it's the methods involved. Recently, a LOT of decisions have been made that (to me, armchair internet guy) seem to be aimed at short-term gain. Like Brexit, the people benefiting most from it are already well settled, they're working on their short- to mid-term plan to earn a lot of money before retiring to their private island or estate or whatever. They live outside of the negative consequences of their decisions. Meanwhile, the rest of the population will have to suffer through the consequences for the foreseeable. Tl;dr, policy optimizing for short term individual gain instead of long term sustainable gain. And the long term gain would be so much more better as well. All of the countries currently under a short term gain capitalist regime could be so much better for their inhabitants. Wealth, socialist policies, comfort, safety, stability, etc is all in reach. But instead the people at the top - who already live a very comfortable and privileged life so they don't see and never will see the problem - choose short term personal gain for them and their 1% friends.

vmception 6y ago

I honestly get giggles from how unprepared they are culturally for what becoming America-like will do to them. Does anyone else? American-like but with no negotiating leverage and having burned all the bridges to the other economic unions.

heywherelogingo 6y ago
GDPR is three years old.
andy_ppp 6y ago
They get to asset strip the country before anyone realises right?
lanevorockz 6y ago
The EU as a political union exists a little over a decade, if anything the UK never adapted to it.
- asutekku 6y ago
  But they benefited from the EU in a way which is no more possible.
- HugoDaniel 6y ago
  Mistaking the EU, the political union as an evolved form of the Rome treaty, with Euro, the coin. All that with the tone of absolute certainty and authority. Hacker News has reached new lows :(
  - dataduck 6y ago
    Come on, that's not fair. The EEC was a very different beast to today's EU. The modern form of the EU could certainly be argued as starting with the Treaty of Lisbon.
    - orwin 6y ago

fundatus 6y ago

This feels like one of those things where Post-Brexit-Britain simply HAS to do something different. Just for the sake of it. Sovereignty and all that. The fact that many online businesses will probably still cater to EU citizens and will therefore still follow GDPR rules doesn't matter. Those companies will end up with two slightly different sets of rules and it will just be annoying.

mytailorisrich 6y ago
The problem becomes one of enforcement. If you're an online business established outside of the EU with no presence in the EU then as long as you abide by the data protection laws of your own country I don't see how an EU country's data protection authority could do anything to you. This is a general issue online where sites and potentially services can be reached and used globally whilst each country basically cannot do anything outside of its own borders. The part of the GDPR that says that the regs apply worldwide as long as the individual is in the EU is not really realistic in many actual situations.

andy_ppp 6y ago

I mean this of course means EU data won’t be able to be stored on British servers as I understand it. More barriers to trade, it’s like this government is trying to destroy the economy...

that_guy_iain 6y ago
As far as I understand it, it currently can't be hosted in the UK anyways. As the requirement is to store the data within the EU.
- Blikkentrekker 6y ago
  I thought the data could be exported to any country whose laws offer the same level of protection.
  - theelous3 6y ago
    You can store it wherever you want, so long as you're in compliance.
    - jeroenhd 6y ago
      > You can store it wherever you want, as long as you're in compliance. From a GDPR standpoint, compliance means that the country where the data is stored has an agreement with the EU AND you must have enforceable and strong, negative consequences for the foreign party in your contract. The EU can only make such an agreement for a foreign country if the data protection laws are sufficient. I do not know whether or not the UK laws are considered sufficient, but without any such agreement, you cannot assume that you can just store EU personal data in the UK. With the death of Privacy Shield and its siblings, this first requirement isn't even the case for the US anymore as the US will not guarantee the safety of EU citizens' information from things like the patriot act. However, I haven't seen any country complain about storing data with Google, Amazon or Facebook yet so I don't think this rule will be enforced any time soon. Technically, though, storing PII in a foreign, non-EU country without the necessary requirements is still very much illegal with the full suite of fines available to the data processing agencies.

ArkanExplorer 6y ago

To 99% of internet users, GDPR has meant nothing except extra popups, blocked access to some websites, and an additional regulatory burden. In some cases bad actors exploited GDPR for fraudulent purposes - eg. requesting a full account deletion in the event of a ban. They can then recreate the same account with the same data.

ClumsyPilot 6y ago
That like claiming "For 99% of consumers food safety regulations means nothing but annoying 'use by date'!" Just because the effects are not obvious to a layman, doesnt they aren't there
- ur-whale 6y ago
  Thank you for the protection we've never asked for. Now, can you come and change my diapers for me ?
  - iamacyborg 6y ago
    I never asked for rigorous safety legislation around fire safety, infrastructure safety, etc. I'm still glad they exist though.
    - ClumsyPilot 6y ago
      In New York, the Free Market gave us fire escapes built out of wood before regulations came around.
  - arkitaip 6y ago
    Just because you don't care about your privacy and the way companies handle your data doesn't mean others should suffer the same date. As for changing your diapers, there are services for that, too.
nicoburns 6y ago
I don't think that's true. I've watched a complete about face by companies when faced by the GDPR. Previously the attitude was to collect and store as much data as possible "just in case" it was later useful. With GDPR, management is suddenly aware of the legal liability of storing this data, and it's generally only stored if it's actually needed.

piokoch 6y ago

For me the biggest flaw of GDPR that it does not distinguish between something done as a business to make money and something done non-profit, as a hobby project, etc. GDPR killed forums, etc. everything moved to Facebook groups, where people agree to whatever Facebook wants. Who will create forum for a community if one has to deal with all the bureaucracy, "right to be forgotten", data accuracy checks, data export request, gathering consents, being responsible for bugs in some forum software if there will be data leak and risk huge fines if something is not done correctly. Another issue is vagueness of the regulation. What exactly is data processing/controlling? If kids leave they clothes in kindergarten or school, can clothes be signed with kid first and last name (so it is easier to find lost items)? Is school a processor or controller of kids' PII in that case? Probably not, but who knows what will happen if someones signed hat will be stolen?

nicbou 6y ago
I'm not sure why it should do that. Data is data. In the end though, you don't have to go crazy about it, because there is zero chance of enforcement over small pebbles.
gampleman 6y ago
A school most certainly already is a data controller as it has way more PII than just your kids name.
ThePhysicist 6y ago
The GDPR only regulates automated data processing and manual data processing where a "filing system" is used, so you kindergarten doesn't "process" children's data just because they write the children's names on their coats... In general I think you're exaggerating a lot of the problems, many forums are still alive and kicking and most forum software has been updated to accommodate the requirements of the GDPR (which aren't very difficult to implement in any case). The centralization of the web on very few commercial platform has many reasons, data protection is probably the least important and might even be a counter-force in my experience.
bornelsewhere 6y ago
If you do not have resources to take care of PI then perhaps do not gather and store it in the first place? Forums do not necessarily require personal information to exist.

CryptoPunk 6y ago

I hope the UK follows through with its 'Singapore-on-Thames' plan, which requiring losing regulatory harmonization with the EU: https://en.wikipedia.org/wiki/Singapore-on-Thames https://en.wikipedia.org/wiki/Singapore-on-Thames

lanevorockz 6y ago
Let’s be honest, it’s not up to the UK alone. The EU still has strong world influence and they will try to stop it at any cost.
- viraptor 6y ago
  Why do you think so? What do you think EU has to gain from UK doing badly? And I mean in practice, economically - we're way past the time "told you so" is relevant.
  - auganov 6y ago
    If the EU cannot show there's a big exit cost it may not last too much longer. Economic growth is so lackluster all across the EU, including new entrants, that few people (who looked at the data) genuinely believe EU membership is a GDP booster. EU's next best bet is to play into the fear that exiting will bring about economic ruin. This works particularly well on newer members who may not be on good terms with core EU countries. Their fear wouldn't necessarily be missing out on benefits but getting slapped with sanctions.
    - viraptor 6y ago
      We already saw the big exit cost. Tariffs will apply where trade deals are missing. I'm not sure who you expect to use sanctions - EU won't slap anyone with sanctions just because they left EU. Have a look at https://sanctionsmap.eu/ https://sanctionsmap.eu/ for situations where sanctions have been applied.
      - 6y ago

dtf 6y ago

Well say goodbye to EU data adequacy. Although to be honest it probably wouldn’t have survived the first court case given the UK state’s addiction to snooping.

remus 6y ago
It'll be interesting to see what changes they actually propose. Id assume they would want to avoid threatening the EU adequacy decision so would go with some changes that would score them some points with businesses but without materially affecting contents of the current legislation.
jjcon 6y ago
> UK state’s addiction to snooping GDPR has nothing to say on state snooping and if you think Germany or plenty other members aren’t.... I’ve got some bad news for you
- dtf 6y ago
  Undoubtedly so. What UK is doing wasn't a problem until it was no longer a member.

deleted 6y ago

[deleted]

ur-whale 6y ago

> UK to depart from GDPR Good for them. Looks like in the UK there will be a lot less time wasting clicking on useless "Accept all cookies or else" disclaimers pop-ups.

Nextgrid 6y ago
These useless pop-ups are only there because the GDPR wasn't enforced properly. The majority of tracking consent popups you see are not compliant with the regulation. A compliant pop-up should make the opt-out option as easy to use as the opt-in option.
Nemo157 6y ago
Just block them in your ad blocker, because they must be opt-in, by not interacting with them you are asserting your right to not be tracked.

renewiltord 6y ago

Hmm, this would be good for business if it had never been an issue. It looks like the plan is for this to just be a divergent set of regulations which is not particularly of any general utility. Maybe if they harmonize along CCPA or something it would be of value.

jpxw 6y ago

Good riddance. GDPR is an insane, Byzantine mess of legalese, which maps poorly onto reality.

M2Ys4U 6y ago
> Good riddance. GDPR is an insane, Byzantine mess of legalese, which maps poorly onto reality. Have you even read it? The GDPR is a quite straightforward piece of legislation.
- jpxw 6y ago
  Yes, I have read it. A pdf copy of it runs to 156 pages. Not particularly straightforward. Can you sum what the legislation does up in a couple of paragraphs?

danmur 6y ago

Any time 'adequate' is the bar it's not great

matthewmacleod 6y ago

One of the most obvious political impacts of Brexit is that the government will feel obliged to demonstrate some kind of benefit. Since real benefits are difficult—verging on impossible—to find, it seems likely the government is going to head in the direction of fabricating benefits. So - slash some regulation, present it as “freeing up business”, and ignoring the wider impact.

tomelders 6y ago

GDPR should have been implemented as a standard that browser vendors should implement. e.g. ``` window.getPersonalDataPreferences() ``` It should only prompt the user to submit their preferences if no preferences were detected, or a specific permission is required to allow certain features. People may argue that everyone will just turn everything off everywhere and forget about it, and I would argue "so what?". The burden of GDPR has been dumped on the wrong people and has become so tedious to administer it's basically useless and a massive waste of time and energy.

Nextgrid 6y ago
We had that in the form a "Do Not Track" header and not only did nobody obey it, but malicious actors actually used it as an extra fingerprinting vector to track you even more.
M2Ys4U 6y ago
The GDPR is not a cookie law. It's not even an internet law. The GDPR applies when any processing of any data is done regardless of context.

oytis 6y ago

Well, we'll see. The pandemic has shown that tracking can be a huge economic advantage - and it's likely not the last pandemic we encounter. OTOH targeting adtech can redirect resources to some more potentially useful areas.

DangerousPie 6y ago
I don't think GDPR applies to governments anyway, does it?
- oytis 6y ago
  But you don't necessarily want tracking infrastructure being built by governments completely, that would be pretty inefficient. As far as I understand the China case at least (I'm not an expert here though, and have never been to China), it's largely started with a commercial app (WeChat). Not to say that the necessary technology (big data, ML etc.) is to a great extent driven by commercial applications - and businesses should have economic incentives to develop them further.
- krageon 6y ago
  It does not and it never has.
  - Daho0n 6y ago
    It does. For example there're GDPR compliance info and access to delete etc. your info in all Danish governmental databases that aren't for national security or covered by GDPRs legitimate interest. You could argue if it works 100% but saying it doesn't cover and impact government isn't true.
  - libertine 6y ago
    Of course it does, and they are liable for it.
- ewidar 6y ago
  It depends on what you mean: GDPR does not prevent EU government from handling their citizens personal data for bureaucracy. However a good example of GDPR applying to the government is the COVID tracking app built by (for?) the French government, which still has to provide ways to opt out from tracking + clean your personal data. I think that's what the GP was talking about.

sseneca 6y ago

Huh. I guess this'll be what pushes me to finally figure out a proper backup system for my server, so I can trust it with all my photos etc, and remove them from "The Cloud"

m12k 6y ago

‘too many businesses and organisations are reluctant to use data – either because they don’t understand the rules or are afraid of inadvertently breaking them’ TBH I'm glad companies stay away from my data if they don't know how to get consent, store data securely, or even what those things mean.

tobyhinloopen 6y ago
Yes this sounds like a great thing
lanevorockz 6y ago
This is an illusion, only thing that happened is that you only get access to websites if you give away your GDPR consent. I love the ignorance of people over here thinking that GDPR is nothing more than just that accept button that people click in order to get access to the websites.
- switch007 6y ago
  I have never observed a non-techie do anything other than blindly click the call to action (i.e. agree to everything). The entire scheme seems sneakily designed to actually encourage users to give more and explicit consent, avoiding the situation where consent was a grey area. It seems to have been spun to a great extent.
  - kalleboo 6y ago
    > The entire scheme seems sneakily designed to actually encourage users to give more and explicit consent The law itself says that the default option should be to opt-out. Any site that doesn't have precisely equally prominent "agree to all" and "deny all" buttons violate the GDPR. The problem seems to be in the complete lack of enforcement.
  - devonbleak 6y ago
    My biggest annoyance lately is having to go set my cookie preferences on every. single. site. If only there was some sort of browser standard that I could set in the preferences there and sites would just obey it....

fumblebee 6y ago

> "too many businesses and organisations are reluctant to use data – either because they don’t understand the rules or are afraid of inadvertently breaking them" This is a deeply depressing take if the conclusion is to scrap GDPR. Is this true for 'data' in the general sense, or actually only true in the murky cases where there's an opportunity to use and abuse our personal data. In my book, that implies that GDPR is working exactly as we hoped it would.

Daho0n 6y ago
I'm willing to bet that this: >The UK has the freedom to strike its own partnerships, he said, and he would announce priority countries for data adequacy agreements shortly will be an announcement that the US has adequate data protection.
remus 6y ago
This is obviously reading the tea leaves a bit, but I didn't get the impression they are looking to scrap GDPR. It seems to me that they just want to relax things a bit so that businesses don't feel so threatened by it. Overall I think GDPR is a very positive thing, but from the government's perspective if they could keep the adequacy agreement in place with the EU while still relaxing some of the current GDPR legislation then that would be a big win for them, especially from a political point of view as it would be some much-needed validation of their brexit strategy: "Look! We have all the benefit of being in the EU [via the adequacy decision] but we get to make our own rules! Go us." I could imagine them doing something along the lines of greatly reducing the maximum fine, for example. Big fines are typically not being issued, so they likely wouldn't see it as a big loss.

deleted 6y ago

[deleted]

MaxBarraclough 6y ago

Seems there's a reason reputable news outlets aren't reporting this: > The government has sent a first signal of its intention for UK data protection laws to part company with the EU’s General Data Protection Regulation. In a Financial Times article last week, culture secretary Oliver Dowden said he would use the appointment of a new information commissioner to focus not just on privacy but on the use of data for ‘economic and social goals’. So we don't know the UK is going to depart from the GDPR, but despite that, this website is reporting that it will.

Daho0n 6y ago
But we do: >The UK has the freedom to strike its own partnerships, he said, and he would announce priority countries for data adequacy agreements shortly Either he recant that comment or announce a country (the US I bet) that doesn't have an adequacy agreement with the EU. You can't have it both ways. If he does announce a list that isn't the same as the EU's they'll have scrapped GDPR.

earnubs 6y ago

Link says Government sent a "first signal of its intention", title says "UK to depart". Comments skip straight to how dumb we all are. :shrug:

thinkingemote 6y ago
It's like this for most stories and subjects to be honest. It's just that technology news has more people knowing what's actually going on.

sdfhbdf 6y ago

‚Meanwhile one of the architects of the GDPR, German MEP Axel Voss, last week called for the regulation to be updated to take into account developments such as blockchain technology...’ What does that have to do with personal data? Sounds like keyword stuffing

tremon 6y ago
Blockchain data is immutable after it's been signed. If PII ends up in blockchain data, which is not unthinkable for e.g. financial transactions, there is no way to comply with data deletion requests, which the GDPR mandates.
M2Ys4U 6y ago
Axel Voss wasn't even one of the GDPR's architects. He was trying to kill it before it was born.
- smartbit 6y ago
  Documentary Democracy: Im Rausch der Daten (2015) [0] gives insight in the some of the main characters during the GDPR negotations. It films behind closed doors where the real negotiations took place. Highly recommended for anyone interested in EU politics and in particular for those with interest in privacy. Quotes from Alex Voss in today’s Financial Times [1] [0] https://www.imdb.com/title/tt5053042/ https://www.imdb.com/title/tt5053042/ [1] https://archive.is/P1gqZ https://archive.is/P1gqZ

KaiserPro 6y ago

With respect, this is not what the article means. The UK has an equivalence agreement with the EU, which unlike a trade agreement can be rescinded quickly (something like 4 weeks). This means that we have to have equivalent provisions to continue to handle data about EU citizens. so the UK might be "departing" from GDPR in name, it won't be in substance just by this act. This of course assumes the the UK is acting rationally.

corobo 6y ago

Now we got rid of the EU protections the Tory govt is going to stripmine the country for cash. Imagine the desire for wealth and power at the expense of others being defined as a mental illness that needed treating instead of giving these cunts more power.

aembleton 6y ago
What did the EU stop the Tory government from stripmining?
- corobo 6y ago
  Data, did I comment on the wrong thread?
  - aembleton 6y ago
    No, I don't think you did. Why didn't the EU prevent the UK from selling/sharing 1.6 million patient records in 2016? https://www.newscientist.com/article/2086454-revealed-google-ai-has-access-to-huge-haul-of-nhs-patient-data/#.VyOORsEjCiU.twitter https://www.newscientist.com/article/2086454-revealed-google...
    - corobo 6y ago
      Got me good there. What a fun conversation this was. Consider me zinged. I knew you were setting me up for something.

deleted 6y ago

[deleted]

varispeed 6y ago

Not sure why people treat GDPR as dogmatic ultimate privacy law. This is a bit laughable. The giants violate it as they please and people are now taught to click boxes without reading its contents and agreeing to who knows what. I think the result is quite the opposite of what was intended as it also added few more vectors of attack that didn't exist before. Only advantage I can see is that some services now offer data download. I hope UK will come up with something much better.

macinjosh 6y ago

At least the UK is one European country with its head screwed on straight.

kmlx 6y ago

the lightest of articles based on a single quote. we'll wait for the actual documents, but in the meantime: 1. does this mean no more cookie stuff, and no more "click here to accept" modals? if yes, then it's a huge win. years of useless clicking, and countless Mwh will be saved in the long run. 2. will this mean no more protections whatsoever? this is not so great imo, and sincerely impossible in today's world of Big Tech legislation (especially in the highly litigious Europe). 3. what about the right to forget? will they touch that part as well?

khalilravanna 6y ago

> too many businesses and organisations are reluctant to use data – either because they don’t understand the rules or are afraid of inadvertently breaking them I’m sure they’ll feel much better when there’s yet another set of rules and laws they’ll have to follow. Oof.

marcorx 6y ago

GDPR has not much to do with cookies, and more to do with how your data is captured and used. Most of the "annoying" cookie banners and popups are related to the e-privacy regulation [1]. I am not sure this will have a significant impact, as UK will have to comply with GDPR if they want to to reach European customers. [1] https://www.activemind.legal/gb/guides/eprivacy-regulation/ https://www.activemind.legal/gb/guides/eprivacy-regulation/

jonplackett 6y ago

The idea of GDPR was good, the execution was poor. All those pop ups in your way and you end up just hitting 'ok' anyway because it takes so long to figure them out. And big companies seem to completely ignore it anyway. Take twitter - all they have is a banner along the bottom that says: "By using Twitter’s services you agree to our Cookies Use. We and our partners operate globally and use cookies, including for analytics, personalisation, and ads." and a close button. How is that consent?

dkersten 6y ago
The pop ups are not usually complaint though. So its not that the execution was poor, but rather that the enforcement is poor. Also, your Twitter quote shows another issue: conflating GDPR with the Cookie directive. They are two very different laws. GDPR is concerned with personally identifiable data and data protection, the cookie laws are concerned with tracking users online. GDPR applies to all data (not just websites), the cookie laws deal with what websites can do. They are not at all the same thing. The popups you see tend to be for the cookie law, because GDPR doesn't require anything like that. Both do require consent (opt-in) though, but both also have exemptions for data and cookies required to provide the service.
- jonplackett 6y ago
  Ok thanks for the clarification. Twitter are specifically saying that they’re going to use cookies for a bunch of things there that are not necessary - like ads. So how is that allowed?
  - dkersten 6y ago
    Its not, unfortunately enforcement is... seriously lacking.

elorant 6y ago

Let the spam kings rejoice.

fmajid 6y ago

It's worth mentioning the UK-Japan free-trade agreement already exempted data flows to Japan from GDPR (and from there they can be laundered to the USA): https://edri.org/our-work/uk-japan-trade-agreement-violates-data-protection-rights/ https://edri.org/our-work/uk-japan-trade-agreement-violates-... As Boris Johnson said, "The UK won't immediately send children up the chimneys or fill beaches across the country with raw sewage". Emphasis on "immediately".

jdlyga 6y ago

What does the UK want to do, make some commonwealth free trade zone? That would make sense. But it seems like everyone wants to go in their own directions, including parts of the UK.

mavhc 6y ago

Practical outcomes of GDPR: You can't search old emails. Your website lists 100 companies you send data to. Someone will randomly waste your time asking for all information you have about them. You have to click Accept cookies on every website you visit 100s of times a day, wasting your life. Things it didn't fix: Data leaks.

turkey99 6y ago

ICO pretty much said they were only going to enforce it like previous data protection laws anyway.

benbristow 6y ago

Can we get a rid of the cookie notifications next? They're so annoying and usually end up conflicting with Adblockers and breaking pages because they're not fully blocked.

glsdfgkjsklfj 6y ago
elitist nonsense. They ought to be annoying. so sites that do not track you for advertising can just add your cookie when you actively sign in, without the annoying popup on first visit, and receive more traffic because they are less-annoying.
- benbristow 6y ago
  Get real, most sites aren't going to do that when they can get away with putting a modal/banner up. It's the end-user that gets the brunt. Most of the modals are full of dark patterns that basically force you to accept the cookies etc. unless you go through multiple different screens and checkboxes.
  - glsdfgkjsklfj 6y ago
    > It's the end-user that gets the brunt. as they should. At least it is in their face now and can entice curiosity.
    - benbristow 6y ago
      Let's be honest, the average user (even myself) will just click 'okay'. It doesn't help anyone and just causes annoyances for most users. If there was proper legislation to block the tracking full-stop then maybe it'd make a difference but in the end it's just a half-measure that causes frustration for both parties. The users that have to dismiss the prompts and websites that have to implement them.
      - glsdfgkjsklfj 6y ago
        you are missing my point. if you visit site A, you click OK, get all the cookies, get screwed, and annoyed. you visit site B, you don't see the popup, you don't get annoyed (and screwed with invisible tracking, but you just said you don't care about that) In the long run, we should hope site B will get less attrition and keep more users, by being less annoying (as a consequence of not tracking you)

danpalmer 6y ago

I'm broadly in favour of any consumer protective legislation like the GDPR, but I feel that the GDPR has been misinterpreted by many, in both directions. Those who ultimately respect user privacy and want to do the right thing are often paralysed by process and making sure that they absolutely can't be sued, rather than being able to show respect for data and best practices but still getting things done. Those who ultimately don't respect user privacy use it as an excuse. They plaster their services with GDPR notices, and then ignore the spirit of the law and sweep up all the data they want, regardless of whether they need it or should have it, but of course this is invisible to users so nothing happens about it. I wonder if this disconnect comes from the enforcement? I'd like to see a few high-profile cases that set out some precedents for what is and what isn't a breach of GDPR.

choeger 6y ago
Don't forget the people that use it as an excuse to not do what they simply don't want to do. "Sorry, we cannot contact you via email, GDPR, you understand? You have to come to us and have an awkward sales talk in order to get your trivial information."
Nextgrid 6y ago
Yes, there is definitely a lack of enforcement. The annoying consent flows people complain about and blame on the GDPR are actually forbidden by it and news of any enforcement actions would quickly scare most websites into implementing an actually compliant one.

freddybobs 6y ago

GDPR is generally a good thing IMHO. It seems this can only lead to 1) Rolling back to pre GDPR, where user data is largely a free for all 2) The UK having it's own 'unique' rules Neither which seems very good for users and/or businesses. Perhaps the point here is to make some kind dubious 'look what we can do because of brexit' argument. When the reality is that 'freedom' has a reality which is more negative than any positives it might have.

deleted 6y ago

[deleted]

flimflamm 6y ago

Should we just switch to France as a main language in the EU countries? Oui.

drusepth 6y ago

While GDPR's intentions were good, the implementation is hilariously vague/wide and has had a chilling effect on small and large businesses worldwide since going into effect (not to mention the additional costs immediately levied on every business to develop, verify, and maintain GDPR infrastructure). I'm sure this is a minority opinion on HN but I'm glad to see some countries pulling back, especially in light of recent calls to expand GDPR even further (!).

aerosmile 6y ago

Just an observation that we seem to have two camps here: one camp correctly noting that GDPR was a net positive for the users, and the other camp correctly noting that GDPR was a net negative for startups and SMBs. I am surprised that nobody is realizing that what's bad for startups and SMBs is also ultimately bad for the users, just on a longer timescale (with an equally long reversal period). I remember the US Congress grilling Zuckerberg back in 2018, and him responding that he's certainly willing to make amendments, but if you tie his hands too much, someone from China will swoop in and bypass all regulations. Everyone scoffed at that, and less than 3 years later, TikTok is unstoppable despite Facebook's best efforts. While users' privacy has benefited from Facebook's downfall, their privacy has never been at more risk with the rise of TikTok (I do realize that TikTok's servers are in the US and Singapore, but let's not fool ourselves - the ByteDance leadership would be quickly replaced if they refused a data request from their government). I would consider this a net negative for the users, and particularly for the US as a country. Just another example proving that the paradox of tolerance [0] is a real thing. If you get too tolerant too quickly, you end up with a less tolerant outcome. [0] https://en.wikipedia.org/wiki/Paradox_of_tolerance https://en.wikipedia.org/wiki/Paradox_of_tolerance

Nextgrid 6y ago
Is there any evidence that TikTok's popularity is due to their non-compliance with regulations, and not just being a novelty and them having lots of money to bankroll such a service without annoying the users with ads like FB does?
- aerosmile 6y ago
  On the first-order basis, it might be difficult to pinpoint why Facebook "wasn't allowed" to build this product before anyone else. On the second-order basis, there is an interesting comparison between how well Facebook hindered Snapchat's growth with their rollout of Stories, vs how well it hindered Tiktok's growth with their rollout of Reels (not very). There are obviously a million factors to consider, but I would argue that us taking Facebook through the dirt 1) weakened its hold over its users and 2) triggered a talent exodus, both of which contributed to Facebook's Reels not being as impactful as Stories (viewed strictly through the lens of defending against the new competitor).

lucasnortj 6y ago

Yes! We’ve finally taken back control of our data!

Mentlo 6y ago

Did anyone actually read the article? Most of the comments here are treating the article as if the UK will depart from GDPR (as the title says) - but the article says nothing of the kind. It will be a slight change, probably reformatted to allow for less red tape and more clarity for small businesses and early-life enterprise. And the UK still needs to keep regulatory alignment to the EU to be able to have low-tarrif access to the markets. If I was a betting man, I wouldn't bet on this being a significant change, given the world is moving more towards privacy (yes, including US).