6 ms·

I was not aware that there is actually something being done against some of the giants who think they stand above the law. It's going to be a test whether GDPR

I was not aware that there is actually something being done against some of the giants who think they stand above the law. It's going to be a test whether GDPR is worth its salt. If it can be bypassed by that simple T&C trick, then it's just has been another expensive waste of time. I have a feeling they will allow that as otherwise Facebook's predatory business model will make no sense until they find a way to trick users into consent. Given that people are just clicking the boxes without reading now, this could work...

neskiredk 6y ago
Indeed, this will be important going forward. Living in EU, with local laws (denmark) being what they are. I hope the conclusion of this suit, will be similar to our laws that state: Any contract signed, that through its terms, makes you relinquish your state-afforded rights. Is by definition void. Example of a void contract: When Buying a used car, Salesmen makes you sign a contract: "No warranty nor cancelation of contract possible after purchase".
- pfortuny 6y ago
  Mmhhh, is it so strong? I guess what is void is that specific clause. Otherwise, any vendor could include a clause saying "you relinquish some rights" just in the middle of the text and, after the fact, claim that the contract was void and require you to return an item (say, a car). So, I guess you mean that specific clause?
  - tovej 6y ago
    I believe this is how it typicaly works. At least the few laws I've read (Finnish law) voids the offending clauses, not the entire contract.
  - bildung 6y ago
    In German law that would, as a default, actually make the whole contract void, yes. Many contracts therefore contain a clause that hedges against that situation (i.e. something like "if one or more of these items is found void, the rest still applies")
    - majewsky 6y ago
      The legal term for this is "severability clause": https://en.wikipedia.org/wiki/Severability https://en.wikipedia.org/wiki/Severability ("salvatorische Klausel" in German)
    - jdmichal 6y ago
      Specifically, the idea of a voided clause voiding the entire contract is sometimes a feature -- severability is not always desired. A simplistic example would be a contract with two clauses, one specifying that A sends B widgets, and the other specifying that B sends A money. You would not want those to clauses to be severable.
s_dev 6y ago
I have a feeling that GDPR is actually mostly about giving tools to reign in the tech giants rather than stomping on the little guys.
- Jenk 6y ago
  So far there is no suggestion of an ulterior motive. GDPR is just there to protect the privacy of EU citizens and that's that.
  - s_dev 6y ago
    >GDPR is just there to protect the privacy of EU citizens and that's that. From what exactly? You'll see where I was going when you try to answer that simple question. Because your answer will be -- tech giants.
    - alkonaut 6y ago
      From having their information processed/sold without their consent. There is nothing implicit in the regulation that targets "tech giants".
      - s_dev 6y ago
        Nothing explicit* in the regulation -- but -- it IS the tech giants that egregiously guilty of: >From having their information processed/sold without their consent. The targeting of tech giants is implicit here.
        tremon 6y ago
        Sure. That must be why the first fines were levied at a restaurant, a hospital and a bank.
        alkonaut 6y ago
        Yes some of the tech giants are guilty of this. And some aren't. And also some non-giants are guilty of this. And some non-giants aren't. This is a possible kick in the nuts for Facebook and Google. It's not so much for Apple or Netflix, for example. I don't think it's fair to make the grouping "tech giants " here. It's the "ad-giants". It's the companies whose business model is personal information. It's a small subset of the tech giants. In fact, much smaller adtech companies probably have a lot more to lose from GDPR than fb and google have. Facebook, unlike a lot of online services, would still be able to target ads just because they know what people like without using any information people haven't consented to. A random news website on the other hand has to start showing me (a man) ads for women's clothing because news sites can't be as sure about my gender (or taste in fashion) as facebook is. So as weith so many things, I think the GDPR is just serving to reinforce the position of facebook, not the other way around.
dgellow 6y ago
Look at https://www.enforcementtracker.com/ https://www.enforcementtracker.com/. Sort by fines desc :)
- skinkestek 6y ago
  Wonderful, thanks! Now we are talking :-)
- 4ad 6y ago
  A drop in the ocean.
  - alkonaut 6y ago
    Indeed. The regulation allows for pretty stiff fines I believe, so with fines this small for companies whose entire business model is persanal data (e.g. Google and Facebook but not an airline or retail chain) the math should be "How large should the fine be in order for it to cost MORE for this company, than actually complying". Complying with the GDPR isn't "free". It's like these companies belive "oh we can't possibly comply with that because it would hurt our bottom line!".
    - dgellow 6y ago
      Give it some time. H&M got a €35mio fine in November 2020 for a document from 2014 stored in a network drive that contained employees personal data. If you do not comply, the more you wait the more risky that becomes.
- tremon 6y ago
  Some companies will never learn. Search for Vodafone, for example.
- TedDoesntTalk 6y ago
  Do you know what is done with the money from these fines? Does it merely fund the enforcement teams (seems excessive), or is it put into some EU “general fund”?
tyfon 6y ago
You can't really trick them into consenting either as the law specifies you need a informed consent. Just having a flag in the database that the user ticked without knowing what they agreed to does not qualify.
- varispeed 6y ago
  I am referring to the fact that people click on the consent boxes without reading what they are agreeing to. I am not sure if informed consent is even possible at this stage. You can put all the details before the user and you will never know they read it. Maybe you could do a test to see if user read, memorised and understood, but still they can just click answers until it goes away.
wongarsu 6y ago
> I have a feeling they will allow that as otherwise Facebook's predatory business model will make no sense until they find a way to trick users into consent Luckily European courts don't really give a damn about Facebook or their business model. It's not that European courts never play favorites with large companies, but Facebook isn't really known for paying a lot of taxes here and doesn't have many employees in Europe (at least an order of magnitude less than e.g. Volkswagen). Facebook is seen as a foreign company that doesn't know how to play by the rules, and was a major motivation for creating the GDPR in the first place.
- EastSmith 6y ago
  I am wondering if a recent Apple announcement of a 1 bln investment in a Berlin tech-hub is so Apple can have a friendlier relationship with EU law.
krsdcbl 6y ago
This specific case has a lot to do with Max Schrems & noyb pressing the issue to be litigated, he's a very engaged activist for privacy https://en.m.wikipedia.org/wiki/Max_Schrems https://en.m.wikipedia.org/wiki/Max_Schrems
- Nicksil 6y ago
  https://en.wikipedia.org/wiki/Max_Schrems https://en.wikipedia.org/wiki/Max_Schrems
marmaduke 6y ago
Indeed. Working in research with human data, we spend a ton of time taking GDPR into account and it would be a huge disappointment to see a corp bypass that for profit when we for non profit research cannot.

neskiredk 6y ago

Indeed, this will be important going forward. Living in EU, with local laws (denmark) being what they are. I hope the conclusion of this suit, will be similar to our laws that state: Any contract signed, that through its terms, makes you relinquish your state-afforded rights. Is by definition void. Example of a void contract: When Buying a used car, Salesmen makes you sign a contract: "No warranty nor cancelation of contract possible after purchase".

pfortuny 6y ago
Mmhhh, is it so strong? I guess what is void is that specific clause. Otherwise, any vendor could include a clause saying "you relinquish some rights" just in the middle of the text and, after the fact, claim that the contract was void and require you to return an item (say, a car). So, I guess you mean that specific clause?
- tovej 6y ago
  I believe this is how it typicaly works. At least the few laws I've read (Finnish law) voids the offending clauses, not the entire contract.
- bildung 6y ago
  In German law that would, as a default, actually make the whole contract void, yes. Many contracts therefore contain a clause that hedges against that situation (i.e. something like "if one or more of these items is found void, the rest still applies")
  - majewsky 6y ago
    The legal term for this is "severability clause": https://en.wikipedia.org/wiki/Severability https://en.wikipedia.org/wiki/Severability ("salvatorische Klausel" in German)
  - jdmichal 6y ago
    Specifically, the idea of a voided clause voiding the entire contract is sometimes a feature -- severability is not always desired. A simplistic example would be a contract with two clauses, one specifying that A sends B widgets, and the other specifying that B sends A money. You would not want those to clauses to be severable.

s_dev 6y ago

I have a feeling that GDPR is actually mostly about giving tools to reign in the tech giants rather than stomping on the little guys.

Jenk 6y ago
So far there is no suggestion of an ulterior motive. GDPR is just there to protect the privacy of EU citizens and that's that.
- s_dev 6y ago
  >GDPR is just there to protect the privacy of EU citizens and that's that. From what exactly? You'll see where I was going when you try to answer that simple question. Because your answer will be -- tech giants.
  - alkonaut 6y ago
    From having their information processed/sold without their consent. There is nothing implicit in the regulation that targets "tech giants".
    - s_dev 6y ago
      Nothing explicit* in the regulation -- but -- it IS the tech giants that egregiously guilty of: >From having their information processed/sold without their consent. The targeting of tech giants is implicit here.
      - tremon 6y ago
        Sure. That must be why the first fines were levied at a restaurant, a hospital and a bank.
      - alkonaut 6y ago
        Yes some of the tech giants are guilty of this. And some aren't. And also some non-giants are guilty of this. And some non-giants aren't. This is a possible kick in the nuts for Facebook and Google. It's not so much for Apple or Netflix, for example. I don't think it's fair to make the grouping "tech giants " here. It's the "ad-giants". It's the companies whose business model is personal information. It's a small subset of the tech giants. In fact, much smaller adtech companies probably have a lot more to lose from GDPR than fb and google have. Facebook, unlike a lot of online services, would still be able to target ads just because they know what people like without using any information people haven't consented to. A random news website on the other hand has to start showing me (a man) ads for women's clothing because news sites can't be as sure about my gender (or taste in fashion) as facebook is. So as weith so many things, I think the GDPR is just serving to reinforce the position of facebook, not the other way around.

dgellow 6y ago

Look at https://www.enforcementtracker.com/ https://www.enforcementtracker.com/. Sort by fines desc :)

skinkestek 6y ago
Wonderful, thanks! Now we are talking :-)
4ad 6y ago
A drop in the ocean.
- alkonaut 6y ago
  Indeed. The regulation allows for pretty stiff fines I believe, so with fines this small for companies whose entire business model is persanal data (e.g. Google and Facebook but not an airline or retail chain) the math should be "How large should the fine be in order for it to cost MORE for this company, than actually complying". Complying with the GDPR isn't "free". It's like these companies belive "oh we can't possibly comply with that because it would hurt our bottom line!".
  - dgellow 6y ago
    Give it some time. H&M got a €35mio fine in November 2020 for a document from 2014 stored in a network drive that contained employees personal data. If you do not comply, the more you wait the more risky that becomes.
tremon 6y ago
Some companies will never learn. Search for Vodafone, for example.
TedDoesntTalk 6y ago
Do you know what is done with the money from these fines? Does it merely fund the enforcement teams (seems excessive), or is it put into some EU “general fund”?

tyfon 6y ago

You can't really trick them into consenting either as the law specifies you need a informed consent. Just having a flag in the database that the user ticked without knowing what they agreed to does not qualify.

varispeed 6y ago
I am referring to the fact that people click on the consent boxes without reading what they are agreeing to. I am not sure if informed consent is even possible at this stage. You can put all the details before the user and you will never know they read it. Maybe you could do a test to see if user read, memorised and understood, but still they can just click answers until it goes away.

wongarsu 6y ago

> I have a feeling they will allow that as otherwise Facebook's predatory business model will make no sense until they find a way to trick users into consent Luckily European courts don't really give a damn about Facebook or their business model. It's not that European courts never play favorites with large companies, but Facebook isn't really known for paying a lot of taxes here and doesn't have many employees in Europe (at least an order of magnitude less than e.g. Volkswagen). Facebook is seen as a foreign company that doesn't know how to play by the rules, and was a major motivation for creating the GDPR in the first place.

EastSmith 6y ago
I am wondering if a recent Apple announcement of a 1 bln investment in a Berlin tech-hub is so Apple can have a friendlier relationship with EU law.

krsdcbl 6y ago

This specific case has a lot to do with Max Schrems & noyb pressing the issue to be litigated, he's a very engaged activist for privacy https://en.m.wikipedia.org/wiki/Max_Schrems https://en.m.wikipedia.org/wiki/Max_Schrems

Nicksil 6y ago
https://en.wikipedia.org/wiki/Max_Schrems https://en.wikipedia.org/wiki/Max_Schrems

marmaduke 6y ago

Indeed. Working in research with human data, we spend a ton of time taking GDPR into account and it would be a huge disappointment to see a corp bypass that for profit when we for non profit research cannot.