4 ms·

The UK Government published their plans to water down GDPR. It is bad, bad

69 points by GordonS 5y ago

GordonS 5y ago
I've just responded as part of the public consultation - there are so many questions that it took me 2.5 hours! These proposals really are a disgrace - they weaken data security and privacy in just about every conceivable way, while also giving the security services new mass surveillance powers, and giving the police carte blanche on data collection (including biometrics, like facial recognition). I'm seriously disturbed that there are people in our government so determined for us to slide into authoritarianism.
- noodlesUK 5y ago
  I’m glad that there is a public consultation for this, and we should try our best to fill it out to give the government an understanding that they’ve screwed up, but I fear it will fall on deaf ears.
- Nextgrid 5y ago
  Can you share a link to the public consultation? I’d like to respond as well.
  - GordonS 5y ago
    Sure: https://www.gov.uk/government/consultations/data-a-new-direction https://www.gov.uk/government/consultations/data-a-new-direc...
aquir 5y ago
After bad decisions such as Brexit I don’t even pretend to be surprised. Such a shameful plan - I can just hope that it won’t became the law
- sprafa 5y ago
  How can it not become law? Is there anyone against it?
- arp242 5y ago
  At the end of the day laws like GDPR are only as useful as their enforcement. The UK has never been very good at this – even before Brexit – and EU consumer protection laws were widely ignored in the UK even well before Brexit because they were never enforced. I never had particular high hopes the GDPR would be enforced in any meaningful way in the UK, Brexit or no Brexit.
  - oliwarner 5y ago
    When or where do you consider the ICO has been inactive? https://ico.org.uk/action-weve-taken/enforcement/ https://ico.org.uk/action-weve-taken/enforcement/
krater23 5y ago
The Clickbait-Text on the end of the first post brought me to closing the tab. Sorry...
jka 5y ago
Changes to Article 22 seem worth following fairly closely. As I understand it, the original EU GDPR Article 22[1] disallows the use of solely automated data processes that have a legal or significant effect on individuals. The Digital Marketing Association has a publication to educate marketers about the EU GDPR, and mentions[2] significant effects in the context of online marketing. It explains, for example, that in a situation which borders on exploitation, an individual in debt could be provided with automated advertising about high-interest loans, leading them further towards financial and personal distress. That's an example of a case where no legal effect is necessarily felt; I'm sure there are potential situations in which automated legal decisions would have an even more significant impact. No doubt there is ambiguity in article 22 but I think that the UK Government, TIGRR and others involved should be careful not to open dangerous avenues while in the pursuit of (no-doubt well-meaning) scientific research angles. [1] - https://gdpr.eu/article-22-automated-individual-decision-making/ https://gdpr.eu/article-22-automated-individual-decision-mak... [2] - https://dma.org.uk/uploads/misc/5b322a16cc6a6-gdpr-for-marketers---profiling-_5b322a16cc5e3.pdf#page=10 https://dma.org.uk/uploads/misc/5b322a16cc6a6-gdpr-for-marke...
intricatedetail 5y ago
They cut "red tape" where there isn't any - actually it will be another set of regulation for companies to follow. Then they put tons of red tape where it hurts. E.g. IR35 changes that basically killed independent IT consultant market and raising taxes. Seems like they want to create regulatory capture and safe haven for giants like Facebook and at the same time ensure it has no competition.
- user5994461 5y ago
  The IR35 change was needed to stop companies skipping taxes, benefits, pensions and holidays by hiring contractors. It's not a failure and it was beneficial to low-pay workers. As bad the UK government may be, it's not their fault if private companies decided to stop using high-pay tech contractors. There is nothing that prevent them to.
  - intricatedetail 5y ago
    That's the official propaganda, but if you actually read into details of IR35 changes it doesn't meet any of its goals.
proactivesvcs 5y ago
ORG blog post: https://www.openrightsgroup.org/blog/why-on-earth-is-the-government-mucking-about-with-our-privacy-laws/ https://www.openrightsgroup.org/blog/why-on-earth-is-the-gov...
native_samples 5y ago
Well, I'll speak up for this. These changes are great and way overdue. GDPR is really a uniquely terrible law, a textbook example of how not to write competent law. Really they should just repeal it entirely but moderating it in this way is a close second. Way too much stuff is ambiguous, and consumers never cared at all - witness the total lack of enforcement on US-only firms and the total lack of people in Europe refusing to sign up for such services despite that. GDPR was never much more than a PR move by the Commission to please the sort of people commissioners care about, with a side helping of protectionism. It was never a priority for actual British citizens, as polling confirmed many times over the years. The typical person has much bigger concerns and finds endless consent requests and cookie pop-ups annoying. Nobody outside of the HN set is going to worry about this change.

69 points by GordonS 5y ago

I've just responded as part of the public consultation - there are so many questions that it took me 2.5 hours! These proposals really are a disgrace - they weaken data security and privacy in just about every conceivable way, while also giving the security services new mass surveillance powers, and giving the police carte blanche on data collection (including biometrics, like facial recognition). I'm seriously disturbed that there are people in our government so determined for us to slide into authoritarianism.

noodlesUK 5y ago
I’m glad that there is a public consultation for this, and we should try our best to fill it out to give the government an understanding that they’ve screwed up, but I fear it will fall on deaf ears.
Nextgrid 5y ago
Can you share a link to the public consultation? I’d like to respond as well.
- GordonS 5y ago
  Sure: https://www.gov.uk/government/consultations/data-a-new-direction https://www.gov.uk/government/consultations/data-a-new-direc...

aquir 5y ago

After bad decisions such as Brexit I don’t even pretend to be surprised. Such a shameful plan - I can just hope that it won’t became the law

sprafa 5y ago
How can it not become law? Is there anyone against it?
arp242 5y ago
At the end of the day laws like GDPR are only as useful as their enforcement. The UK has never been very good at this – even before Brexit – and EU consumer protection laws were widely ignored in the UK even well before Brexit because they were never enforced. I never had particular high hopes the GDPR would be enforced in any meaningful way in the UK, Brexit or no Brexit.
- oliwarner 5y ago
  When or where do you consider the ICO has been inactive? https://ico.org.uk/action-weve-taken/enforcement/ https://ico.org.uk/action-weve-taken/enforcement/

krater23 5y ago

The Clickbait-Text on the end of the first post brought me to closing the tab. Sorry...

jka 5y ago

Changes to Article 22 seem worth following fairly closely. As I understand it, the original EU GDPR Article 22[1] disallows the use of solely automated data processes that have a legal or significant effect on individuals. The Digital Marketing Association has a publication to educate marketers about the EU GDPR, and mentions[2] significant effects in the context of online marketing. It explains, for example, that in a situation which borders on exploitation, an individual in debt could be provided with automated advertising about high-interest loans, leading them further towards financial and personal distress. That's an example of a case where no legal effect is necessarily felt; I'm sure there are potential situations in which automated legal decisions would have an even more significant impact. No doubt there is ambiguity in article 22 but I think that the UK Government, TIGRR and others involved should be careful not to open dangerous avenues while in the pursuit of (no-doubt well-meaning) scientific research angles. [1] - https://gdpr.eu/article-22-automated-individual-decision-making/ https://gdpr.eu/article-22-automated-individual-decision-mak... [2] - https://dma.org.uk/uploads/misc/5b322a16cc6a6-gdpr-for-marketers---profiling-_5b322a16cc5e3.pdf#page=10 https://dma.org.uk/uploads/misc/5b322a16cc6a6-gdpr-for-marke...

intricatedetail 5y ago

They cut "red tape" where there isn't any - actually it will be another set of regulation for companies to follow. Then they put tons of red tape where it hurts. E.g. IR35 changes that basically killed independent IT consultant market and raising taxes. Seems like they want to create regulatory capture and safe haven for giants like Facebook and at the same time ensure it has no competition.

user5994461 5y ago
The IR35 change was needed to stop companies skipping taxes, benefits, pensions and holidays by hiring contractors. It's not a failure and it was beneficial to low-pay workers. As bad the UK government may be, it's not their fault if private companies decided to stop using high-pay tech contractors. There is nothing that prevent them to.
- intricatedetail 5y ago
  That's the official propaganda, but if you actually read into details of IR35 changes it doesn't meet any of its goals.

proactivesvcs 5y ago

ORG blog post: https://www.openrightsgroup.org/blog/why-on-earth-is-the-government-mucking-about-with-our-privacy-laws/ https://www.openrightsgroup.org/blog/why-on-earth-is-the-gov...

native_samples 5y ago

Well, I'll speak up for this. These changes are great and way overdue. GDPR is really a uniquely terrible law, a textbook example of how not to write competent law. Really they should just repeal it entirely but moderating it in this way is a close second. Way too much stuff is ambiguous, and consumers never cared at all - witness the total lack of enforcement on US-only firms and the total lack of people in Europe refusing to sign up for such services despite that. GDPR was never much more than a PR move by the Commission to please the sort of people commissioners care about, with a side helping of protectionism. It was never a priority for actual British citizens, as polling confirmed many times over the years. The typical person has much bigger concerns and finds endless consent requests and cookie pop-ups annoying. Nobody outside of the HN set is going to worry about this change.