13 ms·

‘too many businesses and organisations are reluctant to use data – either because they don’t understand the rules or are afraid of inadvertently breaking them’

by m12k 6y ago

‘too many businesses and organisations are reluctant to use data – either because they don’t understand the rules or are afraid of inadvertently breaking them’ TBH I'm glad companies stay away from my data if they don't know how to get consent, store data securely, or even what those things mean.

tobyhinloopen 6y ago
Yes this sounds like a great thing
lanevorockz 6y ago
This is an illusion, only thing that happened is that you only get access to websites if you give away your GDPR consent. I love the ignorance of people over here thinking that GDPR is nothing more than just that accept button that people click in order to get access to the websites.
- switch007 6y ago
  I have never observed a non-techie do anything other than blindly click the call to action (i.e. agree to everything). The entire scheme seems sneakily designed to actually encourage users to give more and explicit consent, avoiding the situation where consent was a grey area. It seems to have been spun to a great extent.
  - kalleboo 6y ago
    > The entire scheme seems sneakily designed to actually encourage users to give more and explicit consent The law itself says that the default option should be to opt-out. Any site that doesn't have precisely equally prominent "agree to all" and "deny all" buttons violate the GDPR. The problem seems to be in the complete lack of enforcement.
  - devonbleak 6y ago
    My biggest annoyance lately is having to go set my cookie preferences on every. single. site. If only there was some sort of browser standard that I could set in the preferences there and sites would just obey it....
    - knorker 6y ago
      You mean like how we've been able to set cookie behavior in the browser since cookies were invented? Konqueror even had "confirm cookies" as default for a while back then.
      - ysavir 6y ago
        I think they're referencing the Do Not Track header.
        knorker 6y ago
        Ok. So we already have do not track and cookie control. So what the hell is the EU doing?
    - thwarted 6y ago
      Remember P3P? https://en.m.wikipedia.org/wiki/P3P https://en.m.wikipedia.org/wiki/P3P
- dundarious 6y ago
  That is a huge and often unacknowledged factor. However, there are small (smaller than many think) victories even in having those click barriers -- a few percent more people can choose not to click. And unrelated to the GP's point and your response, but the ability to ask for all your data is a huge benefit.
  - deleted 6y ago
    [deleted]
- rlpb 6y ago
  > ...you only get access to websites if you give away your GDPR consent. If a model box only has "I consent" and "Learn more" buttons, then I don't consider clicking on "I consent" to mean freely given GDPR consent. Since it's the only reasonable way of viewing the website, and the GDPR doesn't permit a consent-wall, it's non-consent, and any use of my personal data following that event remains illegal. It's not a problem with the GDPR; it's a problem with the ICO failing to put a stop to this.
  - dheera 6y ago
    If there is a modal box I usually right click and get rid of the modal box with dev tools. That way I never gave any consent. Nowadays I have browser plugins that do that for me, but same idea. In any case I block cookies on all sites except for a few whitelisted ones so big "ha" to them if they think they can cookie me up. "Functional cookies" my ass. The sites work just fine without them.
    - anoncake 6y ago
      Do you really think those websites actually check if you "gave consent" before tracking you?
      - dheera 6y ago
        It feels good to not agree successfully in the lack of a "I don't agree" button. I block their cookies anyway. :) I need to find better ways to mess with their fingerprinting though, or maybe throw back some bogus cookies at them with badly-formatted data instead of blocking them.
        pasabagi 6y ago
        Is this something people do? Is it possible for a user to edit a cookie in a malicious way? Do servers typically trust cookies they have placed on a user's machine?
        6y ago
- Nursie 6y ago
  > only thing that happened is that you only get access to websites if you give away your GDPR consent Well that seems untrue, as someone that regularly either outright declines, or goes through and chooses "functional only". I do occasionally see websites that say "we no longer serve the european market". That's a shame but it's up to them.
  - Macha 6y ago
    Yeah, the only sites I really come across that do that are local/regional US news sites, which by their nature I'm not really _that_ interested in, I've just been linked from reddit/HN.
- bajsejohannes 6y ago
  You are conflating GDPR and the annoying cookie dialogs. GDPR regulates, among other things, how information is stored and deleted on servers. I have worked at multiple companies in both Europe and the US who take this very seriously and has definitely altered their practices based on this. For example, pre-GDPR, we would "mark as deleted" but not delete. Now we delete.
- harperlee 6y ago
  The website accept button is not in the GDPR. [EDIT: it's a different law] GDPR covers way more requirements regarding data management. You need complete control over the lifecycle of sensitive data, exhaustive documentation of data transformations, you have concrete obligations regarding disclosure of incidents, data removal, limitations of for what data is used, user consent management, and the obligation to have people personally liable (which is big, just look at AML regulations to see the effect when not only the fuzzy concept of "the company" is liable).
  - macinjosh 6y ago
    It does not matter since it is a consequence of the GDPR anyway. Regulators can't just push aside negative consequences of their regulations by simply saying "that's not what we meant nor the outcome we wanted". This is why regulations fail. Regulators think they are providing incentives for good things and disincentives for bad things. In reality, they are just perverting incentives. To fix those problems more rules are added, and the cycle goes on. Pretty soon you have a foot high stack of regulations that small business owners can't afford to consider or follow so they just don't exist at some point.
    - harperlee 6y ago
      Sorry for not being clear: my point was not "the law does not explicitly ask for the button, that's just a misapplication" but more something like "the button thing is another completely different law, GDPR has way more topics and thus when you say 'I love the ignorance of people over here thinking that GDPR is nothing more than just that accept button' I disagree wholeheartedly".
  - nmeofthestate 6y ago
    Yeah, that's what I was thinking - people are mixing up GDPR with the "cookies law" that mandated the [Accept All]/[Maze of Settings] choice on all websites that want to use cookies. The cookies mess was pre-GDPR.
- Lapoino 6y ago
  At least in SAP (german softwarecompany 100.000 employees) we have to follow gdrp very stricktly and we do. I don't know if that was the case before gdrp but we have to centraly clarify if and when we store user data, what we do with it and we have to show that we can delete user data if requested. Not sure how far small companies go through this thow.
  - ric2b 6y ago
    SAP makes mega-customizable software installed at thousands of large companies, it's probably on the extreme end of the difficulty spectrum when it comes to complying with GDPR.
- kalleboo 6y ago
  > thinking that GDPR is nothing more than just that accept button that people click in order to get access to the websites I know of small companies that before GDPR didn't really consider the implications of private data at all. They'd just let their SQL databases grow forever (mark as delete and have "script to actually delete the data" as a TODO that never happened), had random backups lying around on dev machines. GDPR forced them to actual define policy, start deleting old data that was no longer relevant, strip private data from developer test sets. It was a bit more work, and adds a small bit of friction, but these are still important things! Forcing cooks in restaurants to wash their hands after using the bathroom also adds friction to the process but is similarly important.
  - Silhouette 6y ago
    GDPR forced them to actual define policy, start deleting old data that was no longer relevant, strip private data from developer test sets. That is the theory. The reality is that many small businesses don't even know the GDPR exists. Others are not complying because they think they will get away with it, and they are probably right. The rules are so ambiguous in some important ways that even those who do intend to comply might not actually be compliant and won't find out until a regulator intervenes. And all of that together means that a small business that does try hard and become compliant is at a significant competitive disadvantage. To be clear, I am a firm believer in strong privacy protections, and my own businesses seek to be in the latter category. But the GDPR is flawed in important ways, and future regulation deviating from it is not necessarily a bad thing. Obviously it depends on whether the deviation is of the selling-out or the fixing-problems variety. Though admittedly, with the current UK government, I fear the former is much more likely.
    - asymmetric 6y ago
      In what important ways is the GDPR flawed?
      - Silhouette 6y ago
        One important way is ambiguity. For example, it relies on "legitimate interests" as a lawful basis for a lot of different types of processing, but there is no specific, actionable definition of that term. This is compounded by the right of the data subject to object to some processing, but again with only an ambiguous specification of when those rights take precedence over the legitimate interests of the data controller (other than a few specific cases, such as direct marketing). As another example, there is a new subject right to erasure of their data, though again this isn't absolute. Several potential complications were discussed about this right. One is how to handle copies of that data in back-ups, archives or retired equipment. Another is how to deal with data held in deliberately tamper-proof formats, some of which will already have existed before this right to erasure was introduced by the GDPR. Another important way is the compliance costs, and in particular the disproportionate costs to small businesses. For example, it cost mine many hours and thousands of pounds to understand the new requirements, take advice, and update our documentation to be compliant, yet the actual data processing we did was always very light and so wasn't affected much by the new rules either. In other words, it cost us a significant amount of time and money without really benefitting anyone. Related to that is the enforcement mechanism and penalty regime. Regulators are all-powerful, and again, while they can impose some heavy fines on big businesses, those are meaningfully capped. In contrast, the rules allow them to impose penalties high enough to literally destroy any SME. The practical safeguards are the limited resources of regulators and the idea that those regulators are supposed to work collaboratively with data controllers and impose proportionate penalties for any compliance violations that can't be resolved, but this is awfully close to relying on personal judgement and good will, not what is actually written in law. Then there is the reality that the GDPR doesn't actually do that much to protect against some of the biggest threats to personal privacy. For example, I would argue that two of the biggest risks in our modern "big data" world are excessive collection and processing of personal data supplied by third parties and excessive collection and processing of data by governments. The GDPR has done very little to curb either of those things. Every time I go out, I'm still potentially being listened to or photographed by countless other people's devices, which may then be uploading that data to big tech firms along with time and place information. Countless people have probably handed over my phone number or email address to big tech firms by allowing apps to scan their address book. We still see ever more intrusive monitoring of normal people's daily lives by governments, with tech like facial recognition cameras or mass surveillance of communications routinely infringing on personal privacy, and the authorities pushing for these things are entirely unrepentant and rely on the usual vague justifications about security and what a dangerous world we live in. In short, the GDPR imposes significant burdens on data controllers without being clear about what their obligations or how to interpret key details in practice, introduces a penalty regime that hangs like a sword of Damocles over data controllers and represents an existential threat to smaller controllers, and yet at the same time hasn't actually been very effective at reducing the big risks to data subjects or increasing their control over how data about them is used and by whom. None of these concerns is new. All were discussed extensively around the time the GDPR was introduced. But, perhaps because it was a law meant to improve individual privacy and that's a cause many of us support in principle, sometimes people get very defensive of it instead of looking at it critically and asking whether it actually achieves what it set out to do and whether any costs it introduces are proportionate to any benefits it offers.
dkersten 6y ago
Most of these companies wouldn't know how to make much use of the data anyway. My experience working with companies and analytics (even did an analytics startup some years back) is that they haven't a clue about how to actually use it and just heard that more data is somehow better. That to me sounds like they're most likely to sell the data, since they don't know how to use it themselves. Better these companies have less data, not more.
- sharperguy 6y ago
  In practice though with the GDPR, sites either just 403 everyone in the EU to avoid complying, or just shower you in javascript cookie notifications, making your browsing experience more bloated, slow and insecure.
  - foepys 6y ago
    How does it make it more insecure?
    - dheera 6y ago
      Not sure GP's meaning, but just guessing here, maybe it trains people to hit "I agree" to everything without understanding, so when they get an actually security warning they just click right past it.
      - malka 6y ago
        Gdpr means you need to have a disagree button. Just click it for everything
        iso1631 6y ago
        Or just avoid the site completely. xkcd doesn't shower me with such popups, neither does hackernews.
        dheera 6y ago
justapassenger 6y ago
Did you read the law and then work on complying with it? Spirit of the law is great. Implementation and end result is a typical bureaucracy mess, with not much benefit for end user, that functions mostly as a way for government to have a leverage over companies for non-compliance, whenever they want to put pressure on them.
- throwaway210222 6y ago
  "that functions mostly as a way for government to have a leverage over companies" Which is why you NEVER comply: you get exemptions.
- hrktb 6y ago
  While there are byzantine parts, I think it has been a net positive for the user. People focus mostly on the cookie popups, but forcing companies to delete data after the user stopped using the service for too long, or even giving a legal stand on users requesting their data to be deleted wouldn’t have happened any other way I think. In a lot of european countries GDPR came on top of other existing customer protection, but it helped make companies think about compliance as needed for continued business, instead of something akin to properly filing random local paperwork.
  - nicbou 6y ago
    Add to that the ability to download you own data, so that it isn't held hostage by companies.
downandout 6y ago
TBH I'm glad companies stay away from my data if they don't know how to get consent, store data securely, or even what those things mean. “Storing data securely” and “getting consent” are both wildly different from full compliance with the onerous requirements of GDPR. You can do both of these things in absolute good faith and still be in violation. Unless you have a team of legal scholars working for you, odds are that you are in violation of at least one provision of this massive, unwieldy legislation - no matter how respective of user privacy you are. That is why the UK is abandoning it. GDPR, as written, is a business-killing mess.
- ric2b 6y ago
  > That is why the UK is abandoning it. GDPR, as written, is a business-killing mess. GDPR has been in place for years, which businesses has it killed? Do you have an example of a company that you consider was not doing anything wrong in your personal opinion but still got a GDPR fine?
closeparen 6y ago
Consider lawful basis. Does your processing fall under the lawful basis you think it does? Who the hell knows. Making an educated guess as to what the regulators and courts will think is legal scholarship, one of the most expensive professional services money can buy. And even if you get billed for hundreds of hours of the most premium legal minds thinking about it they can still be wrong. Words like “reasonable” and “legitimate” in the law are not something it is safe for a layperson to reason about. They have specific meanings depending on the nuances of case law, judicial understanding of legislative intent, ideological leanings of the judge you happen to draw, etc. No company is competent at this, some just have enough money at stake and enough to spend on lawyers that they’re willing to risk it.
- klingon77 6y ago
  Apparently those supporting GDPR would rather have the EU fine Google than to ensure small businesses can survive and be productive with technology, even when the fine to Google is a small amount compared to how much Google makes in the EU. Makes perfect sense, no?
  - labawi 6y ago
    Is that a sarcastic comment? Because GDPR allows for liquidating fines, even for Google. I believe it has a cap of 2% annual global turnover, per infraction, or something similar. Problem is, GDPR is not enforced. I haven't heard of small companies being investigated, let alone having any fines imposed, even when blatantly violating GDPR.
    - klingon77 6y ago
      It’s the law, and it places undue burden on small companies that may not have the technical resources to modify their site/apps/data as expected, as many of them contracted out the work initially at great expense. An email address is considered PII, so if users request their data be deleted, the small business is honest and says they can’t, and the user and others raise this to the government, you think that small company won’t be fined? That company, worried about doing things illegally, may end up giving a bunch of money to a contractor to fix their application- and for what? To allow users to request that their email address be anonymized or removed? That’s stupid.
hnick 6y ago
For cases like this I think consistent enforcement is the most important thing. In the short term it may sound great that a lot of companies are erring on the side of caution and not using the data, when perhaps they could. But if there's no enforcement this gives a huge competitive advantage to companies who just don't care at all. They might crowd out the former set. If such companies were not erring on the side of caution, and using some data in a natural way like they used to rather than avoiding it like the plague, they may provide competitive pressure against this dishonest set. It is a lot like paying taxes. If I am an honest small business owner who pays my taxes but my competitors in the field are known for underhanded cash schemes that dodge tax, I'm not going to last long. I need the law to go after them or I'm done unless I start playing the same game. After dabbling in a small business compliance can be a real killer and it's my honest opinion a lot of people just play it dumb except where they know it matters, and hope for the best.

by m12k 6y ago

tobyhinloopen 6y ago

Yes this sounds like a great thing

lanevorockz 6y ago

This is an illusion, only thing that happened is that you only get access to websites if you give away your GDPR consent. I love the ignorance of people over here thinking that GDPR is nothing more than just that accept button that people click in order to get access to the websites.

switch007 6y ago
I have never observed a non-techie do anything other than blindly click the call to action (i.e. agree to everything). The entire scheme seems sneakily designed to actually encourage users to give more and explicit consent, avoiding the situation where consent was a grey area. It seems to have been spun to a great extent.
- kalleboo 6y ago
  > The entire scheme seems sneakily designed to actually encourage users to give more and explicit consent The law itself says that the default option should be to opt-out. Any site that doesn't have precisely equally prominent "agree to all" and "deny all" buttons violate the GDPR. The problem seems to be in the complete lack of enforcement.
- devonbleak 6y ago
  My biggest annoyance lately is having to go set my cookie preferences on every. single. site. If only there was some sort of browser standard that I could set in the preferences there and sites would just obey it....
  - knorker 6y ago
    You mean like how we've been able to set cookie behavior in the browser since cookies were invented? Konqueror even had "confirm cookies" as default for a while back then.
    - ysavir 6y ago
      I think they're referencing the Do Not Track header.
      - knorker 6y ago
        Ok. So we already have do not track and cookie control. So what the hell is the EU doing?
  - thwarted 6y ago
    Remember P3P? https://en.m.wikipedia.org/wiki/P3P https://en.m.wikipedia.org/wiki/P3P
dundarious 6y ago
That is a huge and often unacknowledged factor. However, there are small (smaller than many think) victories even in having those click barriers -- a few percent more people can choose not to click. And unrelated to the GP's point and your response, but the ability to ask for all your data is a huge benefit.
- deleted 6y ago
  [deleted]
rlpb 6y ago
> ...you only get access to websites if you give away your GDPR consent. If a model box only has "I consent" and "Learn more" buttons, then I don't consider clicking on "I consent" to mean freely given GDPR consent. Since it's the only reasonable way of viewing the website, and the GDPR doesn't permit a consent-wall, it's non-consent, and any use of my personal data following that event remains illegal. It's not a problem with the GDPR; it's a problem with the ICO failing to put a stop to this.
- dheera 6y ago
  If there is a modal box I usually right click and get rid of the modal box with dev tools. That way I never gave any consent. Nowadays I have browser plugins that do that for me, but same idea. In any case I block cookies on all sites except for a few whitelisted ones so big "ha" to them if they think they can cookie me up. "Functional cookies" my ass. The sites work just fine without them.
  - anoncake 6y ago
    Do you really think those websites actually check if you "gave consent" before tracking you?
    - dheera 6y ago
      It feels good to not agree successfully in the lack of a "I don't agree" button. I block their cookies anyway. :) I need to find better ways to mess with their fingerprinting though, or maybe throw back some bogus cookies at them with badly-formatted data instead of blocking them.
      - pasabagi 6y ago
        Is this something people do? Is it possible for a user to edit a cookie in a malicious way? Do servers typically trust cookies they have placed on a user's machine?
        6y ago
Nursie 6y ago
> only thing that happened is that you only get access to websites if you give away your GDPR consent Well that seems untrue, as someone that regularly either outright declines, or goes through and chooses "functional only". I do occasionally see websites that say "we no longer serve the european market". That's a shame but it's up to them.
- Macha 6y ago
  Yeah, the only sites I really come across that do that are local/regional US news sites, which by their nature I'm not really _that_ interested in, I've just been linked from reddit/HN.
bajsejohannes 6y ago
You are conflating GDPR and the annoying cookie dialogs. GDPR regulates, among other things, how information is stored and deleted on servers. I have worked at multiple companies in both Europe and the US who take this very seriously and has definitely altered their practices based on this. For example, pre-GDPR, we would "mark as deleted" but not delete. Now we delete.
harperlee 6y ago
The website accept button is not in the GDPR. [EDIT: it's a different law] GDPR covers way more requirements regarding data management. You need complete control over the lifecycle of sensitive data, exhaustive documentation of data transformations, you have concrete obligations regarding disclosure of incidents, data removal, limitations of for what data is used, user consent management, and the obligation to have people personally liable (which is big, just look at AML regulations to see the effect when not only the fuzzy concept of "the company" is liable).
- macinjosh 6y ago
  It does not matter since it is a consequence of the GDPR anyway. Regulators can't just push aside negative consequences of their regulations by simply saying "that's not what we meant nor the outcome we wanted". This is why regulations fail. Regulators think they are providing incentives for good things and disincentives for bad things. In reality, they are just perverting incentives. To fix those problems more rules are added, and the cycle goes on. Pretty soon you have a foot high stack of regulations that small business owners can't afford to consider or follow so they just don't exist at some point.
  - harperlee 6y ago
    Sorry for not being clear: my point was not "the law does not explicitly ask for the button, that's just a misapplication" but more something like "the button thing is another completely different law, GDPR has way more topics and thus when you say 'I love the ignorance of people over here thinking that GDPR is nothing more than just that accept button' I disagree wholeheartedly".
- nmeofthestate 6y ago
  Yeah, that's what I was thinking - people are mixing up GDPR with the "cookies law" that mandated the [Accept All]/[Maze of Settings] choice on all websites that want to use cookies. The cookies mess was pre-GDPR.
Lapoino 6y ago
At least in SAP (german softwarecompany 100.000 employees) we have to follow gdrp very stricktly and we do. I don't know if that was the case before gdrp but we have to centraly clarify if and when we store user data, what we do with it and we have to show that we can delete user data if requested. Not sure how far small companies go through this thow.
- ric2b 6y ago
  SAP makes mega-customizable software installed at thousands of large companies, it's probably on the extreme end of the difficulty spectrum when it comes to complying with GDPR.
kalleboo 6y ago
> thinking that GDPR is nothing more than just that accept button that people click in order to get access to the websites I know of small companies that before GDPR didn't really consider the implications of private data at all. They'd just let their SQL databases grow forever (mark as delete and have "script to actually delete the data" as a TODO that never happened), had random backups lying around on dev machines. GDPR forced them to actual define policy, start deleting old data that was no longer relevant, strip private data from developer test sets. It was a bit more work, and adds a small bit of friction, but these are still important things! Forcing cooks in restaurants to wash their hands after using the bathroom also adds friction to the process but is similarly important.
- Silhouette 6y ago
  GDPR forced them to actual define policy, start deleting old data that was no longer relevant, strip private data from developer test sets. That is the theory. The reality is that many small businesses don't even know the GDPR exists. Others are not complying because they think they will get away with it, and they are probably right. The rules are so ambiguous in some important ways that even those who do intend to comply might not actually be compliant and won't find out until a regulator intervenes. And all of that together means that a small business that does try hard and become compliant is at a significant competitive disadvantage. To be clear, I am a firm believer in strong privacy protections, and my own businesses seek to be in the latter category. But the GDPR is flawed in important ways, and future regulation deviating from it is not necessarily a bad thing. Obviously it depends on whether the deviation is of the selling-out or the fixing-problems variety. Though admittedly, with the current UK government, I fear the former is much more likely.
  - asymmetric 6y ago
    In what important ways is the GDPR flawed?
    - Silhouette 6y ago
      One important way is ambiguity. For example, it relies on "legitimate interests" as a lawful basis for a lot of different types of processing, but there is no specific, actionable definition of that term. This is compounded by the right of the data subject to object to some processing, but again with only an ambiguous specification of when those rights take precedence over the legitimate interests of the data controller (other than a few specific cases, such as direct marketing). As another example, there is a new subject right to erasure of their data, though again this isn't absolute. Several potential complications were discussed about this right. One is how to handle copies of that data in back-ups, archives or retired equipment. Another is how to deal with data held in deliberately tamper-proof formats, some of which will already have existed before this right to erasure was introduced by the GDPR. Another important way is the compliance costs, and in particular the disproportionate costs to small businesses. For example, it cost mine many hours and thousands of pounds to understand the new requirements, take advice, and update our documentation to be compliant, yet the actual data processing we did was always very light and so wasn't affected much by the new rules either. In other words, it cost us a significant amount of time and money without really benefitting anyone. Related to that is the enforcement mechanism and penalty regime. Regulators are all-powerful, and again, while they can impose some heavy fines on big businesses, those are meaningfully capped. In contrast, the rules allow them to impose penalties high enough to literally destroy any SME. The practical safeguards are the limited resources of regulators and the idea that those regulators are supposed to work collaboratively with data controllers and impose proportionate penalties for any compliance violations that can't be resolved, but this is awfully close to relying on personal judgement and good will, not what is actually written in law. Then there is the reality that the GDPR doesn't actually do that much to protect against some of the biggest threats to personal privacy. For example, I would argue that two of the biggest risks in our modern "big data" world are excessive collection and processing of personal data supplied by third parties and excessive collection and processing of data by governments. The GDPR has done very little to curb either of those things. Every time I go out, I'm still potentially being listened to or photographed by countless other people's devices, which may then be uploading that data to big tech firms along with time and place information. Countless people have probably handed over my phone number or email address to big tech firms by allowing apps to scan their address book. We still see ever more intrusive monitoring of normal people's daily lives by governments, with tech like facial recognition cameras or mass surveillance of communications routinely infringing on personal privacy, and the authorities pushing for these things are entirely unrepentant and rely on the usual vague justifications about security and what a dangerous world we live in. In short, the GDPR imposes significant burdens on data controllers without being clear about what their obligations or how to interpret key details in practice, introduces a penalty regime that hangs like a sword of Damocles over data controllers and represents an existential threat to smaller controllers, and yet at the same time hasn't actually been very effective at reducing the big risks to data subjects or increasing their control over how data about them is used and by whom. None of these concerns is new. All were discussed extensively around the time the GDPR was introduced. But, perhaps because it was a law meant to improve individual privacy and that's a cause many of us support in principle, sometimes people get very defensive of it instead of looking at it critically and asking whether it actually achieves what it set out to do and whether any costs it introduces are proportionate to any benefits it offers.

dkersten 6y ago

Most of these companies wouldn't know how to make much use of the data anyway. My experience working with companies and analytics (even did an analytics startup some years back) is that they haven't a clue about how to actually use it and just heard that more data is somehow better. That to me sounds like they're most likely to sell the data, since they don't know how to use it themselves. Better these companies have less data, not more.

sharperguy 6y ago
In practice though with the GDPR, sites either just 403 everyone in the EU to avoid complying, or just shower you in javascript cookie notifications, making your browsing experience more bloated, slow and insecure.
- foepys 6y ago
  How does it make it more insecure?
  - dheera 6y ago
    Not sure GP's meaning, but just guessing here, maybe it trains people to hit "I agree" to everything without understanding, so when they get an actually security warning they just click right past it.
    - malka 6y ago
      Gdpr means you need to have a disagree button. Just click it for everything
      - iso1631 6y ago
        Or just avoid the site completely. xkcd doesn't shower me with such popups, neither does hackernews.
      - dheera 6y ago

justapassenger 6y ago

Did you read the law and then work on complying with it? Spirit of the law is great. Implementation and end result is a typical bureaucracy mess, with not much benefit for end user, that functions mostly as a way for government to have a leverage over companies for non-compliance, whenever they want to put pressure on them.

throwaway210222 6y ago
"that functions mostly as a way for government to have a leverage over companies" Which is why you NEVER comply: you get exemptions.
hrktb 6y ago
While there are byzantine parts, I think it has been a net positive for the user. People focus mostly on the cookie popups, but forcing companies to delete data after the user stopped using the service for too long, or even giving a legal stand on users requesting their data to be deleted wouldn’t have happened any other way I think. In a lot of european countries GDPR came on top of other existing customer protection, but it helped make companies think about compliance as needed for continued business, instead of something akin to properly filing random local paperwork.
- nicbou 6y ago
  Add to that the ability to download you own data, so that it isn't held hostage by companies.

downandout 6y ago

TBH I'm glad companies stay away from my data if they don't know how to get consent, store data securely, or even what those things mean. “Storing data securely” and “getting consent” are both wildly different from full compliance with the onerous requirements of GDPR. You can do both of these things in absolute good faith and still be in violation. Unless you have a team of legal scholars working for you, odds are that you are in violation of at least one provision of this massive, unwieldy legislation - no matter how respective of user privacy you are. That is why the UK is abandoning it. GDPR, as written, is a business-killing mess.

ric2b 6y ago
> That is why the UK is abandoning it. GDPR, as written, is a business-killing mess. GDPR has been in place for years, which businesses has it killed? Do you have an example of a company that you consider was not doing anything wrong in your personal opinion but still got a GDPR fine?

closeparen 6y ago

Consider lawful basis. Does your processing fall under the lawful basis you think it does? Who the hell knows. Making an educated guess as to what the regulators and courts will think is legal scholarship, one of the most expensive professional services money can buy. And even if you get billed for hundreds of hours of the most premium legal minds thinking about it they can still be wrong. Words like “reasonable” and “legitimate” in the law are not something it is safe for a layperson to reason about. They have specific meanings depending on the nuances of case law, judicial understanding of legislative intent, ideological leanings of the judge you happen to draw, etc. No company is competent at this, some just have enough money at stake and enough to spend on lawyers that they’re willing to risk it.

klingon77 6y ago
Apparently those supporting GDPR would rather have the EU fine Google than to ensure small businesses can survive and be productive with technology, even when the fine to Google is a small amount compared to how much Google makes in the EU. Makes perfect sense, no?
- labawi 6y ago
  Is that a sarcastic comment? Because GDPR allows for liquidating fines, even for Google. I believe it has a cap of 2% annual global turnover, per infraction, or something similar. Problem is, GDPR is not enforced. I haven't heard of small companies being investigated, let alone having any fines imposed, even when blatantly violating GDPR.
  - klingon77 6y ago
    It’s the law, and it places undue burden on small companies that may not have the technical resources to modify their site/apps/data as expected, as many of them contracted out the work initially at great expense. An email address is considered PII, so if users request their data be deleted, the small business is honest and says they can’t, and the user and others raise this to the government, you think that small company won’t be fined? That company, worried about doing things illegally, may end up giving a bunch of money to a contractor to fix their application- and for what? To allow users to request that their email address be anonymized or removed? That’s stupid.

hnick 6y ago

For cases like this I think consistent enforcement is the most important thing. In the short term it may sound great that a lot of companies are erring on the side of caution and not using the data, when perhaps they could. But if there's no enforcement this gives a huge competitive advantage to companies who just don't care at all. They might crowd out the former set. If such companies were not erring on the side of caution, and using some data in a natural way like they used to rather than avoiding it like the plague, they may provide competitive pressure against this dishonest set. It is a lot like paying taxes. If I am an honest small business owner who pays my taxes but my competitors in the field are known for underhanded cash schemes that dodge tax, I'm not going to last long. I need the law to go after them or I'm done unless I start playing the same game. After dabbling in a small business compliance can be a real killer and it's my honest opinion a lot of people just play it dumb except where they know it matters, and hope for the best.