6 ms·

In practice though with the GDPR, sites either just 403 everyone in the EU to avoid complying, or just shower you in javascript cookie notifications, making you

In practice though with the GDPR, sites either just 403 everyone in the EU to avoid complying, or just shower you in javascript cookie notifications, making your browsing experience more bloated, slow and insecure.

foepys 6y ago
How does it make it more insecure?
- dheera 6y ago
  Not sure GP's meaning, but just guessing here, maybe it trains people to hit "I agree" to everything without understanding, so when they get an actually security warning they just click right past it.
  - malka 6y ago
    Gdpr means you need to have a disagree button. Just click it for everything
    - iso1631 6y ago
      Or just avoid the site completely. xkcd doesn't shower me with such popups, neither does hackernews.
    - dheera 6y ago
      (a) not everyone has a disagree button today (b) many people make the disagree button small, hard to see, or require clicking through multiple screens to get to GDPR really should have dictated "agree" and "disagree" be of equal visual weight and button styling and dictated disagreeing to be a 1-click action.
      - dkersten 6y ago
        GDPR doesn't dictate anything about styling or anything, it just says you have to ask for consent, you're not allowed to bundle consent with anything else (eg you can't say that I have to give consent for me to be able to use the site) and IIRC it does even have a clause about consent having to be asked for in a clear understandable form. I'm pretty sure that everyone doing our (b) is not compliant at all. The problem is that GDPR isn't being enforced very well.
      - shock 6y ago
        > GDPR really should have dictated "agree" and "disagree" be of equal visual weight and button styling and dictated disagreeing to be a 1-click action. It does mandate something to that effect: the user should not have to spend more effort to disagree than to agree.
joostdevries 6y ago
Are you in the EU? I'm a developer in the EU and that is patently not true. Developers have to have mechanisms in place to delete gdpr data when required and not store data that's not required for you goals. In my experience gdpr puts a real and meaningful curb on the strong impetus to gather everything and sell it.
- JumpCrisscross 6y ago
  > Developers have to have mechanisms in place to delete gdpr data when required and not store data that's not required for you goals Purely anecdote, but zero companies I know in Germany, Italy or France are doing this. (The ones in Switzerland are.) There is a cosmetic fix that produces an email so there is something to show a regulator if they come knocking. The logic being investing anything more than that is a crap shoot, given nobody knows how each of the EU’s 28 data regulators will interpret the rules.
  - yoz-y 6y ago
    The companies in France in worked for all did substantial work to comply with GDPR.
    - JumpCrisscross 6y ago
      Everyone did substantial work. But the net effect was making binders of policy and PowerPoint presentations. It’s an “impress a regulator” scheme. Not a hard requirements test, nor a private liability one.
    - the_duke 6y ago
      Many companies invested a lot of time. But from what I have seen, most of that time was spent on the legal and policy site, not on actually implementing the technical changes required to properly handle, store and delete data. I can absolutely guarantee you that the overwhelming majority EU companies could not properly carry out a GDPR deletion request.
  - kergonath 6y ago
M2Ys4U 6y ago
The GDPR is not a law that only regulates the internet. The GDPR applies to all processing of all personal data regardless of whether that's pieces of paper in a filing cabinet or an entirely online social network.
- candiodari 6y ago
  That's not true unfortunately. It has a blanket exception for anything remotely government related (meaning government itself and anyone the government authorizes), and in fact guarantees far more and wider access to your most sensitive data, not less. And it allows the government to authorize whoever they please to not just keep more data about you, tighter and more closely linked together, but to keep this from you, and to prevent you from doing anything about it. Which, since the process now exists, they have prodigiously used. Insurance? Private doctor? Youth services? Family (or any other) court? Pharmacy (in most of Europe)? Police (even in the most trivial of cases, and without judicial approval, and of course without verification or recourse) Worse than that: the exception goes further than merely keeping data as well. Insurance company wants to change/add to your medical record? Immediately? Doctor? Court? Police? All can change your medical file, both adding and deleting (sometimes limited to what they added themselves). YOU want to change it? Not possible! Weird since insurance company access to your data, and "the right to be forgotten" was one of the main selling points of this legislation, but since insurance companies are semi-government in almost all of Europe these days, a lot of them fall into the blanket exception. And of course, you yourself ... cannot access this data. You cannot see it (sorry "you can, unless there's a reason not to let you see it", wanna bet there's always a reason?). For particular parts (espectially names, for example which doctor put something there about you are kept secret from you). Thankfully these institutions hate eachother, so there is some protection left because if anyone wants this data, they have to file requests in 5 different places. But there is no more legal protection against this happening. It is now far easier, in the Netherlands, to get a serious crime stricken off your judicial record than, say, getting a doctor or pharmacist's claim that you falsely came in for a heart problem out of your medical file, say to threaten or attack them for painkillers, or even just getting the name of which doctor put that there (and of course such misleading information can kill you if you ever really do have a heart problem, and god help you if you need pain killers or ...) GPDR protects you from Amazon offering you gift ideas for your kids' birthday if you object to that. You want a mental health stay 40 years ago to not be used in a family court case against you? THAT it makes MUCH easier. Faking such a thing and using it in a court case against you, that, too, it makes a lot easier.

foepys 6y ago

How does it make it more insecure?

dheera 6y ago
Not sure GP's meaning, but just guessing here, maybe it trains people to hit "I agree" to everything without understanding, so when they get an actually security warning they just click right past it.
- malka 6y ago
  Gdpr means you need to have a disagree button. Just click it for everything
  - iso1631 6y ago
    Or just avoid the site completely. xkcd doesn't shower me with such popups, neither does hackernews.
  - dheera 6y ago
    (a) not everyone has a disagree button today (b) many people make the disagree button small, hard to see, or require clicking through multiple screens to get to GDPR really should have dictated "agree" and "disagree" be of equal visual weight and button styling and dictated disagreeing to be a 1-click action.
    - dkersten 6y ago
      GDPR doesn't dictate anything about styling or anything, it just says you have to ask for consent, you're not allowed to bundle consent with anything else (eg you can't say that I have to give consent for me to be able to use the site) and IIRC it does even have a clause about consent having to be asked for in a clear understandable form. I'm pretty sure that everyone doing our (b) is not compliant at all. The problem is that GDPR isn't being enforced very well.
    - shock 6y ago
      > GDPR really should have dictated "agree" and "disagree" be of equal visual weight and button styling and dictated disagreeing to be a 1-click action. It does mandate something to that effect: the user should not have to spend more effort to disagree than to agree.

joostdevries 6y ago

Are you in the EU? I'm a developer in the EU and that is patently not true. Developers have to have mechanisms in place to delete gdpr data when required and not store data that's not required for you goals. In my experience gdpr puts a real and meaningful curb on the strong impetus to gather everything and sell it.

JumpCrisscross 6y ago
> Developers have to have mechanisms in place to delete gdpr data when required and not store data that's not required for you goals Purely anecdote, but zero companies I know in Germany, Italy or France are doing this. (The ones in Switzerland are.) There is a cosmetic fix that produces an email so there is something to show a regulator if they come knocking. The logic being investing anything more than that is a crap shoot, given nobody knows how each of the EU’s 28 data regulators will interpret the rules.
- yoz-y 6y ago
  The companies in France in worked for all did substantial work to comply with GDPR.
  - JumpCrisscross 6y ago
    Everyone did substantial work. But the net effect was making binders of policy and PowerPoint presentations. It’s an “impress a regulator” scheme. Not a hard requirements test, nor a private liability one.
  - the_duke 6y ago
    Many companies invested a lot of time. But from what I have seen, most of that time was spent on the legal and policy site, not on actually implementing the technical changes required to properly handle, store and delete data. I can absolutely guarantee you that the overwhelming majority EU companies could not properly carry out a GDPR deletion request.
- kergonath 6y ago

M2Ys4U 6y ago

The GDPR is not a law that only regulates the internet. The GDPR applies to all processing of all personal data regardless of whether that's pieces of paper in a filing cabinet or an entirely online social network.

candiodari 6y ago
That's not true unfortunately. It has a blanket exception for anything remotely government related (meaning government itself and anyone the government authorizes), and in fact guarantees far more and wider access to your most sensitive data, not less. And it allows the government to authorize whoever they please to not just keep more data about you, tighter and more closely linked together, but to keep this from you, and to prevent you from doing anything about it. Which, since the process now exists, they have prodigiously used. Insurance? Private doctor? Youth services? Family (or any other) court? Pharmacy (in most of Europe)? Police (even in the most trivial of cases, and without judicial approval, and of course without verification or recourse) Worse than that: the exception goes further than merely keeping data as well. Insurance company wants to change/add to your medical record? Immediately? Doctor? Court? Police? All can change your medical file, both adding and deleting (sometimes limited to what they added themselves). YOU want to change it? Not possible! Weird since insurance company access to your data, and "the right to be forgotten" was one of the main selling points of this legislation, but since insurance companies are semi-government in almost all of Europe these days, a lot of them fall into the blanket exception. And of course, you yourself ... cannot access this data. You cannot see it (sorry "you can, unless there's a reason not to let you see it", wanna bet there's always a reason?). For particular parts (espectially names, for example which doctor put something there about you are kept secret from you). Thankfully these institutions hate eachother, so there is some protection left because if anyone wants this data, they have to file requests in 5 different places. But there is no more legal protection against this happening. It is now far easier, in the Netherlands, to get a serious crime stricken off your judicial record than, say, getting a doctor or pharmacist's claim that you falsely came in for a heart problem out of your medical file, say to threaten or attack them for painkillers, or even just getting the name of which doctor put that there (and of course such misleading information can kill you if you ever really do have a heart problem, and god help you if you need pain killers or ...) GPDR protects you from Amazon offering you gift ideas for your kids' birthday if you object to that. You want a mental health stay 40 years ago to not be used in a family court case against you? THAT it makes MUCH easier. Faking such a thing and using it in a court case against you, that, too, it makes a lot easier.