3 ms·

In what important ways is the GDPR flawed?

Silhouette 6y ago
One important way is ambiguity. For example, it relies on "legitimate interests" as a lawful basis for a lot of different types of processing, but there is no specific, actionable definition of that term. This is compounded by the right of the data subject to object to some processing, but again with only an ambiguous specification of when those rights take precedence over the legitimate interests of the data controller (other than a few specific cases, such as direct marketing). As another example, there is a new subject right to erasure of their data, though again this isn't absolute. Several potential complications were discussed about this right. One is how to handle copies of that data in back-ups, archives or retired equipment. Another is how to deal with data held in deliberately tamper-proof formats, some of which will already have existed before this right to erasure was introduced by the GDPR. Another important way is the compliance costs, and in particular the disproportionate costs to small businesses. For example, it cost mine many hours and thousands of pounds to understand the new requirements, take advice, and update our documentation to be compliant, yet the actual data processing we did was always very light and so wasn't affected much by the new rules either. In other words, it cost us a significant amount of time and money without really benefitting anyone. Related to that is the enforcement mechanism and penalty regime. Regulators are all-powerful, and again, while they can impose some heavy fines on big businesses, those are meaningfully capped. In contrast, the rules allow them to impose penalties high enough to literally destroy any SME. The practical safeguards are the limited resources of regulators and the idea that those regulators are supposed to work collaboratively with data controllers and impose proportionate penalties for any compliance violations that can't be resolved, but this is awfully close to relying on personal judgement and good will, not what is actually written in law. Then there is the reality that the GDPR doesn't actually do that much to protect against some of the biggest threats to personal privacy. For example, I would argue that two of the biggest risks in our modern "big data" world are excessive collection and processing of personal data supplied by third parties and excessive collection and processing of data by governments. The GDPR has done very little to curb either of those things. Every time I go out, I'm still potentially being listened to or photographed by countless other people's devices, which may then be uploading that data to big tech firms along with time and place information. Countless people have probably handed over my phone number or email address to big tech firms by allowing apps to scan their address book. We still see ever more intrusive monitoring of normal people's daily lives by governments, with tech like facial recognition cameras or mass surveillance of communications routinely infringing on personal privacy, and the authorities pushing for these things are entirely unrepentant and rely on the usual vague justifications about security and what a dangerous world we live in. In short, the GDPR imposes significant burdens on data controllers without being clear about what their obligations or how to interpret key details in practice, introduces a penalty regime that hangs like a sword of Damocles over data controllers and represents an existential threat to smaller controllers, and yet at the same time hasn't actually been very effective at reducing the big risks to data subjects or increasing their control over how data about them is used and by whom. None of these concerns is new. All were discussed extensively around the time the GDPR was introduced. But, perhaps because it was a law meant to improve individual privacy and that's a cause many of us support in principle, sometimes people get very defensive of it instead of looking at it critically and asking whether it actually achieves what it set out to do and whether any costs it introduces are proportionate to any benefits it offers.
- jiofih 6y ago
  Most laws are fairly ambiguous. Jurisprudence and intent play a big role in the justice system, it works to protect people from wrongdoing and not as a strict logical set of rules. Being filmed in public, having your data handed to third-parties, facial recognition and mass surveillance are precisely some of the issues the GDPR has addressed, and it has already had massive impact; especially on tech companies (I’ve seen it firsthand). You talk about burdens but maybe you’re just angry you wasted money on a consultant? I honestly haven’t seen the bad side of it.
  - Silhouette 6y ago
    While many laws are somewhat ambiguous, usually the intent is reasonably clear, and there are courts to decide cases where there is a disagreement about interpretation. The GDPR doesn't have either that clarity of intent or that independent, impartial form of adjudication. We didn't hire a consultant. Those guys were charging thousands per day, and no business our size has that kind of money to spend. We did take real legal advice from a real lawyer, but the main cost was our time understanding the new rules and updating things to be seen to be compliant. I am irritated that a lot of my own time, as a founder and at that time lead technical person for a business, was wasted on a bureaucratic exercise, and likewise for other key people. That hurt us, and once again, it benefitted no-one. Not our customers. Not our staff. Not our suppliers. Literally no-one was better off because, for example, we rewrote our documents to provide information in some new format that was specified by the GDPR. Personal irritation aside, even if you just took the cost to us and scaled it by the number of businesses in the country to estimate the economic impact, that would mean billions in lost productivity as a result of the new rules. And that's clearly an underestimate, as the costs were running into millions for a lot of large organisations. A law that is going to cause that kind of economic hit should be justified by a greater benefit to society in some way, but I just don't see that "massive impact" you mentioned. There have been a few incremental changes here and there, but there hasn't been a big change in culture. The attitude at bigger organisations is still often about how they can tick the required boxes while continuing to do what they want with the data. Just look at Facebook's resistance to even disclosing what personal data it has and how it's been using it, for example, despite data subjects having a clear right to that information under the GDPR. Tracking is still going on everywhere, and if anything it's getting worse as the technological capabilities increase. Ironically, it's recent actions by Apple, not the GDPR, that have started to make some significant improvements in this area for users on their platform. Small organisations are still often ignorant of their obligations under the GDPR and not compliant anyway. Governments are still encroaching further into individual privacy all the time. Individual privacy hasn't been improved at all in these kinds of situations. This will be my last comment on this thread, because HN tends to downvote any comments critical of the GDPR, even if based on direct personal experience of implementing it, and that doesn't encourage open and constructive discussion. But I hope the above helps to explain why I have reached a different conclusion about these issues to you.

One important way is ambiguity. For example, it relies on "legitimate interests" as a lawful basis for a lot of different types of processing, but there is no specific, actionable definition of that term. This is compounded by the right of the data subject to object to some processing, but again with only an ambiguous specification of when those rights take precedence over the legitimate interests of the data controller (other than a few specific cases, such as direct marketing). As another example, there is a new subject right to erasure of their data, though again this isn't absolute. Several potential complications were discussed about this right. One is how to handle copies of that data in back-ups, archives or retired equipment. Another is how to deal with data held in deliberately tamper-proof formats, some of which will already have existed before this right to erasure was introduced by the GDPR. Another important way is the compliance costs, and in particular the disproportionate costs to small businesses. For example, it cost mine many hours and thousands of pounds to understand the new requirements, take advice, and update our documentation to be compliant, yet the actual data processing we did was always very light and so wasn't affected much by the new rules either. In other words, it cost us a significant amount of time and money without really benefitting anyone. Related to that is the enforcement mechanism and penalty regime. Regulators are all-powerful, and again, while they can impose some heavy fines on big businesses, those are meaningfully capped. In contrast, the rules allow them to impose penalties high enough to literally destroy any SME. The practical safeguards are the limited resources of regulators and the idea that those regulators are supposed to work collaboratively with data controllers and impose proportionate penalties for any compliance violations that can't be resolved, but this is awfully close to relying on personal judgement and good will, not what is actually written in law. Then there is the reality that the GDPR doesn't actually do that much to protect against some of the biggest threats to personal privacy. For example, I would argue that two of the biggest risks in our modern "big data" world are excessive collection and processing of personal data supplied by third parties and excessive collection and processing of data by governments. The GDPR has done very little to curb either of those things. Every time I go out, I'm still potentially being listened to or photographed by countless other people's devices, which may then be uploading that data to big tech firms along with time and place information. Countless people have probably handed over my phone number or email address to big tech firms by allowing apps to scan their address book. We still see ever more intrusive monitoring of normal people's daily lives by governments, with tech like facial recognition cameras or mass surveillance of communications routinely infringing on personal privacy, and the authorities pushing for these things are entirely unrepentant and rely on the usual vague justifications about security and what a dangerous world we live in. In short, the GDPR imposes significant burdens on data controllers without being clear about what their obligations or how to interpret key details in practice, introduces a penalty regime that hangs like a sword of Damocles over data controllers and represents an existential threat to smaller controllers, and yet at the same time hasn't actually been very effective at reducing the big risks to data subjects or increasing their control over how data about them is used and by whom. None of these concerns is new. All were discussed extensively around the time the GDPR was introduced. But, perhaps because it was a law meant to improve individual privacy and that's a cause many of us support in principle, sometimes people get very defensive of it instead of looking at it critically and asking whether it actually achieves what it set out to do and whether any costs it introduces are proportionate to any benefits it offers.

jiofih 6y ago
Most laws are fairly ambiguous. Jurisprudence and intent play a big role in the justice system, it works to protect people from wrongdoing and not as a strict logical set of rules. Being filmed in public, having your data handed to third-parties, facial recognition and mass surveillance are precisely some of the issues the GDPR has addressed, and it has already had massive impact; especially on tech companies (I’ve seen it firsthand). You talk about burdens but maybe you’re just angry you wasted money on a consultant? I honestly haven’t seen the bad side of it.
- Silhouette 6y ago
  While many laws are somewhat ambiguous, usually the intent is reasonably clear, and there are courts to decide cases where there is a disagreement about interpretation. The GDPR doesn't have either that clarity of intent or that independent, impartial form of adjudication. We didn't hire a consultant. Those guys were charging thousands per day, and no business our size has that kind of money to spend. We did take real legal advice from a real lawyer, but the main cost was our time understanding the new rules and updating things to be seen to be compliant. I am irritated that a lot of my own time, as a founder and at that time lead technical person for a business, was wasted on a bureaucratic exercise, and likewise for other key people. That hurt us, and once again, it benefitted no-one. Not our customers. Not our staff. Not our suppliers. Literally no-one was better off because, for example, we rewrote our documents to provide information in some new format that was specified by the GDPR. Personal irritation aside, even if you just took the cost to us and scaled it by the number of businesses in the country to estimate the economic impact, that would mean billions in lost productivity as a result of the new rules. And that's clearly an underestimate, as the costs were running into millions for a lot of large organisations. A law that is going to cause that kind of economic hit should be justified by a greater benefit to society in some way, but I just don't see that "massive impact" you mentioned. There have been a few incremental changes here and there, but there hasn't been a big change in culture. The attitude at bigger organisations is still often about how they can tick the required boxes while continuing to do what they want with the data. Just look at Facebook's resistance to even disclosing what personal data it has and how it's been using it, for example, despite data subjects having a clear right to that information under the GDPR. Tracking is still going on everywhere, and if anything it's getting worse as the technological capabilities increase. Ironically, it's recent actions by Apple, not the GDPR, that have started to make some significant improvements in this area for users on their platform. Small organisations are still often ignorant of their obligations under the GDPR and not compliant anyway. Governments are still encroaching further into individual privacy all the time. Individual privacy hasn't been improved at all in these kinds of situations. This will be my last comment on this thread, because HN tends to downvote any comments critical of the GDPR, even if based on direct personal experience of implementing it, and that doesn't encourage open and constructive discussion. But I hope the above helps to explain why I have reached a different conclusion about these issues to you.