4 ms·

Wish regulators could hijack their domain and force visitors to a 15 second delay landing page explaining that they were found in violation of the GDPR and “you

Wish regulators could hijack their domain and force visitors to a 15 second delay landing page explaining that they were found in violation of the GDPR and “you will be redirected to Starbucks shortly”. Second infringement make it a two minute delay.

dannyw 5y ago
Just fine Starbucks 1% of their global turnover.
- JumpCrisscross 5y ago
  > Just fine Starbucks 1% of their global turnover Why? They’re literally adding friction to their purchasing process. Nothing they sell is critical. Nobody’s privacy is being violated. They aren’t lying. They’re just being annoying. This is the most trivial non-issue one could possibly get hysterical over.
  - capableweb 5y ago
    > Nothing they sell is critical Does that mean the law doesn't apply to them? You do business in Europe, you follow European laws + the laws of the specific country you're doing business with, doesn't matter what the type of business is.
    - JumpCrisscross 5y ago
      > Does that mean the law doesn't apply to them? The ePD is notoriously ignored and unenforced [1]. It is also not clear what part of the law a simple delay would violate. (Most of the sparing enforcement has been around dropping cookies after someone opts out.) [1] https://petsymposium.org/2019/files/papers/issue2/popets-2019-0023.pdf https://petsymposium.org/2019/files/papers/issue2/popets-201... Figure 5
      - Nextgrid 5y ago
        Not sure about the ePrivacy directive but this flow would be in breach of the GDPR and I’m pretty sure you have to comply with both.
        JumpCrisscross 5y ago
        > this flow would be in breach of the GDPR How, precisely? It's a one and a half second delay. Functionality is not changed one iota. No cookies are loaded. Would it be better if there were an energy-burning inefficient server-side algorithm spinning away?
        Nextgrid 5y ago
        See my other comment for reasons why this would be in breach: https://news.ycombinator.com/item?id=28501088 https://news.ycombinator.com/item?id=28501088
        JumpCrisscross 5y ago
        > my other comment for reasons why this would be in breach: https://news.ycombinator.com/item?id=28501088 https://news.ycombinator.com/item?id=28501088 It's a decent attempt at an argument, but far from convincing. One could argue it's to dissuade opting out. One could also argue it's being presented to show the opt out has teeth. (Non-technical people ascribe meaning to fantasy progress meters. A number of UI studies have shown that.) As for opt out needing to be instant in comparison to opt in, the argument holds no water. If a legacy system were patched for GDPR, it's reasonable for the opt-out to involve more code, not less, as an extra routine undoes the defaults. That or making a record of the opt out is done tediously. (In this case, the argument is moot since the delay is fake.) The toughest argument one could make from the ICO checklist [1] is that a one and a half second spinner delay constitutes a material "detriment" or penalization of withdrawal of consent. Those are technically true to a trivial degree, but immaterial. Far from meriting a 1% fine per the original comment. These kinds of arguments hurt everyone working for privacy by trivializing it to a sympathetically mockable degree. [1] https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/consent/ https://ico.org.uk/for-organisations/guide-to-data-protectio...
- matheusmoreira 5y ago
  One percent? Make it something significant like 50%. Better yet, figure out how much money they made with their surveillance capitalism, including any investments and profits derived from such capital. Fine them exactly that and then some for good measure.

dannyw 5y ago

Just fine Starbucks 1% of their global turnover.

JumpCrisscross 5y ago
> Just fine Starbucks 1% of their global turnover Why? They’re literally adding friction to their purchasing process. Nothing they sell is critical. Nobody’s privacy is being violated. They aren’t lying. They’re just being annoying. This is the most trivial non-issue one could possibly get hysterical over.
- capableweb 5y ago
  > Nothing they sell is critical Does that mean the law doesn't apply to them? You do business in Europe, you follow European laws + the laws of the specific country you're doing business with, doesn't matter what the type of business is.
  - JumpCrisscross 5y ago
    > Does that mean the law doesn't apply to them? The ePD is notoriously ignored and unenforced [1]. It is also not clear what part of the law a simple delay would violate. (Most of the sparing enforcement has been around dropping cookies after someone opts out.) [1] https://petsymposium.org/2019/files/papers/issue2/popets-2019-0023.pdf https://petsymposium.org/2019/files/papers/issue2/popets-201... Figure 5
    - Nextgrid 5y ago
      Not sure about the ePrivacy directive but this flow would be in breach of the GDPR and I’m pretty sure you have to comply with both.
      - JumpCrisscross 5y ago
        > this flow would be in breach of the GDPR How, precisely? It's a one and a half second delay. Functionality is not changed one iota. No cookies are loaded. Would it be better if there were an energy-burning inefficient server-side algorithm spinning away?
        Nextgrid 5y ago
        See my other comment for reasons why this would be in breach: https://news.ycombinator.com/item?id=28501088 https://news.ycombinator.com/item?id=28501088
        JumpCrisscross 5y ago
        > my other comment for reasons why this would be in breach: https://news.ycombinator.com/item?id=28501088 https://news.ycombinator.com/item?id=28501088 It's a decent attempt at an argument, but far from convincing. One could argue it's to dissuade opting out. One could also argue it's being presented to show the opt out has teeth. (Non-technical people ascribe meaning to fantasy progress meters. A number of UI studies have shown that.) As for opt out needing to be instant in comparison to opt in, the argument holds no water. If a legacy system were patched for GDPR, it's reasonable for the opt-out to involve more code, not less, as an extra routine undoes the defaults. That or making a record of the opt out is done tediously. (In this case, the argument is moot since the delay is fake.) The toughest argument one could make from the ICO checklist [1] is that a one and a half second spinner delay constitutes a material "detriment" or penalization of withdrawal of consent. Those are technically true to a trivial degree, but immaterial. Far from meriting a 1% fine per the original comment. These kinds of arguments hurt everyone working for privacy by trivializing it to a sympathetically mockable degree. [1] https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/consent/ https://ico.org.uk/for-organisations/guide-to-data-protectio...
matheusmoreira 5y ago
One percent? Make it something significant like 50%. Better yet, figure out how much money they made with their surveillance capitalism, including any investments and profits derived from such capital. Fine them exactly that and then some for good measure.