6 ms·

European Parliament Voted to Ban Remote Biometric Surveillance

Nextgrid 5y ago
This is nice in theory but I no longer have hope that it'll be effective. Remember that the GDPR is supposed to rid us of any non-consensual data collection and annoying cookie pop-ups, and yet years after it went into effect it's still not being enforced anywhere near enough and companies openly breach it.
- s_dev 5y ago
  https://www.enforcementtracker.com/ https://www.enforcementtracker.com/ I see ten fines applied to big tech companies that are over 10 million Euro and three that are over 50 million Euro. GDPR is definitely being enforced but mostly on big tech companies not small ones which I'd imagine is part and parcel of the intent of the regulation.
  - kiba 5y ago
    It's the annoying banners and all the likely useless business information that sites think worth collecting.
  - Nextgrid 5y ago
    Compare the amount total fine amount to Google or Facebook with their yearly profits, the majority of which are earned by illicit data collection. Not to mention, to this day both these companies are still breaching the GDPR, so the fines clearly didn't have any effect and they are still happy to continue acting in bad faith regarding personal data.
    - _v7gu 5y ago
      The reason the fines are low is because they exist to push for compliance, not to punish. That's also why they are increasing up to 4% global revenue. If that's not enough, the maximum can always be increased. More money for the EU countries. It's really funny how US-oriented thinking made HN go up in arms about how GDPR fines were too excessive to how ineffective they are meanwhile the fine structure didn't change at all.
      - Nextgrid 5y ago
        > they exist to push for compliance, not to punish Well that clearly doesn't seem to be working. > It's really funny how US-oriented thinking made HN go up in arms about how GDPR fines were too excessive to how ineffective they are meanwhile the fine structure didn't change at all. Just FYI I'm UK-based and never had any of these US-centric concerns regarding the GDPR.
        _v7gu 5y ago
        s/US/common law/ The fines are not enough right now, but they'll just keep on increasing until compliance is satisfied. There's no reason to start high and bringing small companies to ruin when everything will work out in the long term
        pgeorgi 5y ago
        > Well that clearly doesn't seem to be working. Those "privacy score cards" for apps on both iOS and Android, filled out for 1st to 3rd party apps? GDPR in action. The ability to reject tracking (which might cost money for a subscription or something - which will actually be tracking-free, instead of earning on both ends of the market, by selling a subscription _and_ tracking the hell out of their customers)? GDPR in action. There are some dark patterns around the cookie consent popups, but it's up to people to report them, there's no EU privacy police squad digging up these cases on their own. There are only so many hours Max Schrems can spend every day (it's rumored to be 24hs or less, except maybe for one day a year) on running his non-profit to do that for you, me and everybody. That stuff has ramp-up time, and as mentioned, the goal is compliance, not collecting fees. As practices _under GDPR_ are becoming established, and stuff went through court a few times, I'd expect schedules for compliance to shorten. It would be a PR disaster for all things privacy if DPAs were to go all in on some case (taking 4% of global annual revenue), then losing the case in court. Given how many media companies are big in advertising and surveillance tech as well (with media mostly existing to attract eyeballs for their "real" business[0]), there'd be no end to the assault on privacy. Rather take it slow. [0] e.g. https://venturebeat.com/2015/09/29/business-insider-buyer-axel-springer-just-lost-its-case-against-adblock-plus/ https://venturebeat.com/2015/09/29/business-insider-buyer-ax... "Adblock Plus said Axel Springer’s lawyers asserted that “The core business of the plaintiff is to deliver ads to its visitors. Journalistic content is just a vehicle to get readers to view the ads.”"
  - techpression 5y ago
    The only decent fine was the Amazon one and even that one was minuscule compared to their net income. It was also covered in secrecy and will likely be overturned and drastically lowered like the other big cases like British airways and Marriott. This for a law that took four years to finalize, to me it sums up to a very mediocre outcome, at best. You are right that it’s being enforced, there’s just not very much force in the enforcing.
    - s_dev 5y ago
      Whats app was fined 250 Million. It might be a small % of their revenue but it's a significant cut of their profits for that year.
      - C19is20 5y ago
        Where do(es) the [income from the] fine(s) go?
      - Nextgrid 5y ago
        Is WhatsApp still a separate company? The real reason WhatsApp exists is to provide Facebook a backdoor into people's contacts so they can infer their social graph. Whatever "revenue" WA earns is peanuts, the real value is the collected data.
      - techpression 5y ago
        If you only look at it as pure loss, which would be wrong, WhatsApp (Facebook) most likely made a lot more money (and will continue to so) with the data, than they were fined.
  - still_grokking 5y ago
    That's simply not true. That is a laughable case count compared to all the violations just everywhere. If it would be enforced all of US BigTech would need to be outright banned from the EU until the US fixes its no-go issues like CLOUD Act or that secret FISA court. That's the one part. The other part is that also almost no domestic companies comply. More or less every business and all the country governments in the EU breach the GDPR in one or another way (for example by using US BigTech products behind the scenes as all governments do, or simply just collecting personal information without consent labeling it "legitimate interest" like almost every websites does). All big German media outlets have for example right now a case in court for noncompliance with the GDPR. It will take years in court of course, and than nothing will happen, as every time before. The same goes for things like "Privacy Shield v3.0" the EU Commission is working on. This new version is obviously illegal for the same reasons as it was the case for v1 and v2. But they don't care. The courts need many years to stop it again. Until then this illegal regulations that obviously violate the GDPR will stay in place.
- whoknowswhat11 5y ago
  The GDPR created TONS of annoying cookie popups. Under GDPR you MUST pop-up consent requests with explicit consent. Luckily at least the EU website now does them at the bottom rather than the top. https://europa.eu/european-union/index_en https://europa.eu/european-union/index_en for an example that is a bit less annoying - the EU website used to do a blocking top banner that was super annoying back when GDPR was being taken seriously, now they just bury it (like lots of others do).
  - rhn_mk1 5y ago
    > Under GDPR you MUST pop-up consent requests You actually don't, if you don't do any activity that calls for consent.
    - whoknowswhat11 5y ago
      Please see the EU website itself - All normal websites are using cookies. The EU itself is doing a banner - they have (thankfully) made it a lot less obtrusive where you can still use the site now without giving explicit consent. But this is I think the "big lie" of the GDPR folks - no banners needed, when even the EU itself and its agencies etc all use it. So you expect random joe blow website to overthink this even further, go against what they see the EU itself doing? It's total garbage.
      - pgeorgi 5y ago
        I'm browsing europa.eu a fair while now (in a private browser session to avoid any old cookie from maybe interfering) and the only banner they show is "An official website of the European Union - How do you know?" There are two links to the cookie page (https://europa.eu/european-union/abouteuropa/cookies_en https://europa.eu/european-union/abouteuropa/cookies_en or equivalent for the currently used language), one in the top nav bar, one in the bottom. Interestingly, that page talks about the cookie banner and how they need consent for analytics and stuff, but I never saw that. So, given how they explicitly state that they need it for analytics, I went to my browser settings and disabled sending the DNT header - and there was the cookie consent popup. So: State outright and by default that you don't want to be analyzed and they won't bother you. My only question is why they see a need to do analytics. Without that they wouldn't require that stuff _at all_.
jdasdf 5y ago
*Except for themselves.
blibble 5y ago
I wish I'd stop seeing headlines posted that the European Parliament has voted to do X Y and Z, suggesting that this will be implemented ... the European Parliament doesn't have the ability to legislate it has the ability to "suggest" legislation and the ability to block any that has been proposed, but that's it and I doubt the commission or the council will be interested in banning this technology
- jahnu 5y ago
  But that it votes on something is significant and often leads to implementation of something similar eventually. And since you know that it does not mean implementation and I know this then we both should assume many or enough people know this.
  - blibble 5y ago
    it rarely leads to implementation as the make up of the EP is completely different to that of the Council the Council sets the legislative agenda, and the Council consists of the member states governments similar to how the US senate was before the 17th amendment
    - smnrchrds 5y ago
      > it rarely leads to implementation So is the EU in a perpetual state of legislative gridlock?
      - MomoXenosaga 5y ago
        Is the US? https://apnews.com/article/congress-moves-to-avert-partial-government-shutdown-8f5b5b0c6c4cb12af8316ffc0b098771 https://apnews.com/article/congress-moves-to-avert-partial-g... The European Union muddles on through in a very undramatic and ugly fashion, same like every other government.
      - still_grokking 5y ago
        No, it isn't. After "long talks" (maybe there is even money involved, who knows) with the parliament the things that the Council and / or Commission want get implemented. Maybe the parliament is allowed to keep some wording form it's proposals as long as it stays mostly symbolic form the practical point of view. The EU is a "democracy simulation" as we call it. Neither the Council nor the Commission are elected by the EU people but the laws are made by those institutions in practice.
gremloni 5y ago
European governance really seems to work in that they keep getting common sense legislation right and passed over and over.
- richlandlord 5y ago
  Until it is not common sense and the only way to go around it is to leave the Union and then everyone panics.
  - mhh__ 5y ago
    Other than immigration policy was absolutely not what Brexit was about, unless you mean made up stories about EU banana regulations or Boris Johnson's kippers.
  - gremloni 5y ago
    It remains to be seen how wise of a decision that was. Early signs are not promising. Compromise leaves everyone a loser but better than before.
  - pjmlp 5y ago
    So far is hasn't been working that well.
- Kenji 5y ago
  You have no clue. The EU is an illegitimate, antidemocratic, aggressive, power hungry entity that will destroy anything in its path, in particular the sovereignty of countries and civilians. One out of a million legislations is sensible, the rest is colonialist garbage.
fidesomnes 5y ago
who benefits?
still_grokking 5y ago
Who cares what the EU Parliament voted for? They can't make laws. It will start to be interesting when the EU Commission makes its point. And everybody knows the true rulers of the EU want to extend the surveillance and police state further no mater what the people's parliament thinks about that. This has by now a long tradition. All previous regulation went in that direction. They won't make just now a 180 turn. That's clear. Some evidence: https://www.justsecurity.org/36098/era-mass-surveillance-emerging-europe/ https://www.justsecurity.org/36098/era-mass-surveillance-eme... https://www.statewatch.org/automated-suspicion-the-eu-s-new-travel-surveillance-initiatives/ https://www.statewatch.org/automated-suspicion-the-eu-s-new-... https://www.tagesspiegel.de/gesellschaft/sicherheitspolitik-europa-plant-den-ueberwachungsstaat/14956574.html https://www.tagesspiegel.de/gesellschaft/sicherheitspolitik-...

This is nice in theory but I no longer have hope that it'll be effective. Remember that the GDPR is supposed to rid us of any non-consensual data collection and annoying cookie pop-ups, and yet years after it went into effect it's still not being enforced anywhere near enough and companies openly breach it.

s_dev 5y ago
https://www.enforcementtracker.com/ https://www.enforcementtracker.com/ I see ten fines applied to big tech companies that are over 10 million Euro and three that are over 50 million Euro. GDPR is definitely being enforced but mostly on big tech companies not small ones which I'd imagine is part and parcel of the intent of the regulation.
- kiba 5y ago
  It's the annoying banners and all the likely useless business information that sites think worth collecting.
- Nextgrid 5y ago
  Compare the amount total fine amount to Google or Facebook with their yearly profits, the majority of which are earned by illicit data collection. Not to mention, to this day both these companies are still breaching the GDPR, so the fines clearly didn't have any effect and they are still happy to continue acting in bad faith regarding personal data.
  - _v7gu 5y ago
    The reason the fines are low is because they exist to push for compliance, not to punish. That's also why they are increasing up to 4% global revenue. If that's not enough, the maximum can always be increased. More money for the EU countries. It's really funny how US-oriented thinking made HN go up in arms about how GDPR fines were too excessive to how ineffective they are meanwhile the fine structure didn't change at all.
    - Nextgrid 5y ago
      > they exist to push for compliance, not to punish Well that clearly doesn't seem to be working. > It's really funny how US-oriented thinking made HN go up in arms about how GDPR fines were too excessive to how ineffective they are meanwhile the fine structure didn't change at all. Just FYI I'm UK-based and never had any of these US-centric concerns regarding the GDPR.
      - _v7gu 5y ago
        s/US/common law/ The fines are not enough right now, but they'll just keep on increasing until compliance is satisfied. There's no reason to start high and bringing small companies to ruin when everything will work out in the long term
      - pgeorgi 5y ago
        > Well that clearly doesn't seem to be working. Those "privacy score cards" for apps on both iOS and Android, filled out for 1st to 3rd party apps? GDPR in action. The ability to reject tracking (which might cost money for a subscription or something - which will actually be tracking-free, instead of earning on both ends of the market, by selling a subscription _and_ tracking the hell out of their customers)? GDPR in action. There are some dark patterns around the cookie consent popups, but it's up to people to report them, there's no EU privacy police squad digging up these cases on their own. There are only so many hours Max Schrems can spend every day (it's rumored to be 24hs or less, except maybe for one day a year) on running his non-profit to do that for you, me and everybody. That stuff has ramp-up time, and as mentioned, the goal is compliance, not collecting fees. As practices _under GDPR_ are becoming established, and stuff went through court a few times, I'd expect schedules for compliance to shorten. It would be a PR disaster for all things privacy if DPAs were to go all in on some case (taking 4% of global annual revenue), then losing the case in court. Given how many media companies are big in advertising and surveillance tech as well (with media mostly existing to attract eyeballs for their "real" business[0]), there'd be no end to the assault on privacy. Rather take it slow. [0] e.g. https://venturebeat.com/2015/09/29/business-insider-buyer-axel-springer-just-lost-its-case-against-adblock-plus/ https://venturebeat.com/2015/09/29/business-insider-buyer-ax... "Adblock Plus said Axel Springer’s lawyers asserted that “The core business of the plaintiff is to deliver ads to its visitors. Journalistic content is just a vehicle to get readers to view the ads.”"
- techpression 5y ago
  The only decent fine was the Amazon one and even that one was minuscule compared to their net income. It was also covered in secrecy and will likely be overturned and drastically lowered like the other big cases like British airways and Marriott. This for a law that took four years to finalize, to me it sums up to a very mediocre outcome, at best. You are right that it’s being enforced, there’s just not very much force in the enforcing.
  - s_dev 5y ago
    Whats app was fined 250 Million. It might be a small % of their revenue but it's a significant cut of their profits for that year.
    - C19is20 5y ago
      Where do(es) the [income from the] fine(s) go?
    - Nextgrid 5y ago
      Is WhatsApp still a separate company? The real reason WhatsApp exists is to provide Facebook a backdoor into people's contacts so they can infer their social graph. Whatever "revenue" WA earns is peanuts, the real value is the collected data.
    - techpression 5y ago
      If you only look at it as pure loss, which would be wrong, WhatsApp (Facebook) most likely made a lot more money (and will continue to so) with the data, than they were fined.
- still_grokking 5y ago
  That's simply not true. That is a laughable case count compared to all the violations just everywhere. If it would be enforced all of US BigTech would need to be outright banned from the EU until the US fixes its no-go issues like CLOUD Act or that secret FISA court. That's the one part. The other part is that also almost no domestic companies comply. More or less every business and all the country governments in the EU breach the GDPR in one or another way (for example by using US BigTech products behind the scenes as all governments do, or simply just collecting personal information without consent labeling it "legitimate interest" like almost every websites does). All big German media outlets have for example right now a case in court for noncompliance with the GDPR. It will take years in court of course, and than nothing will happen, as every time before. The same goes for things like "Privacy Shield v3.0" the EU Commission is working on. This new version is obviously illegal for the same reasons as it was the case for v1 and v2. But they don't care. The courts need many years to stop it again. Until then this illegal regulations that obviously violate the GDPR will stay in place.
whoknowswhat11 5y ago
The GDPR created TONS of annoying cookie popups. Under GDPR you MUST pop-up consent requests with explicit consent. Luckily at least the EU website now does them at the bottom rather than the top. https://europa.eu/european-union/index_en https://europa.eu/european-union/index_en for an example that is a bit less annoying - the EU website used to do a blocking top banner that was super annoying back when GDPR was being taken seriously, now they just bury it (like lots of others do).
- rhn_mk1 5y ago
  > Under GDPR you MUST pop-up consent requests You actually don't, if you don't do any activity that calls for consent.
  - whoknowswhat11 5y ago
    Please see the EU website itself - All normal websites are using cookies. The EU itself is doing a banner - they have (thankfully) made it a lot less obtrusive where you can still use the site now without giving explicit consent. But this is I think the "big lie" of the GDPR folks - no banners needed, when even the EU itself and its agencies etc all use it. So you expect random joe blow website to overthink this even further, go against what they see the EU itself doing? It's total garbage.
    - pgeorgi 5y ago
      I'm browsing europa.eu a fair while now (in a private browser session to avoid any old cookie from maybe interfering) and the only banner they show is "An official website of the European Union - How do you know?" There are two links to the cookie page (https://europa.eu/european-union/abouteuropa/cookies_en https://europa.eu/european-union/abouteuropa/cookies_en or equivalent for the currently used language), one in the top nav bar, one in the bottom. Interestingly, that page talks about the cookie banner and how they need consent for analytics and stuff, but I never saw that. So, given how they explicitly state that they need it for analytics, I went to my browser settings and disabled sending the DNT header - and there was the cookie consent popup. So: State outright and by default that you don't want to be analyzed and they won't bother you. My only question is why they see a need to do analytics. Without that they wouldn't require that stuff _at all_.

jdasdf 5y ago

*Except for themselves.

blibble 5y ago

I wish I'd stop seeing headlines posted that the European Parliament has voted to do X Y and Z, suggesting that this will be implemented ... the European Parliament doesn't have the ability to legislate it has the ability to "suggest" legislation and the ability to block any that has been proposed, but that's it and I doubt the commission or the council will be interested in banning this technology

jahnu 5y ago
But that it votes on something is significant and often leads to implementation of something similar eventually. And since you know that it does not mean implementation and I know this then we both should assume many or enough people know this.
- blibble 5y ago
  it rarely leads to implementation as the make up of the EP is completely different to that of the Council the Council sets the legislative agenda, and the Council consists of the member states governments similar to how the US senate was before the 17th amendment
  - smnrchrds 5y ago
    > it rarely leads to implementation So is the EU in a perpetual state of legislative gridlock?
    - MomoXenosaga 5y ago
      Is the US? https://apnews.com/article/congress-moves-to-avert-partial-government-shutdown-8f5b5b0c6c4cb12af8316ffc0b098771 https://apnews.com/article/congress-moves-to-avert-partial-g... The European Union muddles on through in a very undramatic and ugly fashion, same like every other government.
    - still_grokking 5y ago
      No, it isn't. After "long talks" (maybe there is even money involved, who knows) with the parliament the things that the Council and / or Commission want get implemented. Maybe the parliament is allowed to keep some wording form it's proposals as long as it stays mostly symbolic form the practical point of view. The EU is a "democracy simulation" as we call it. Neither the Council nor the Commission are elected by the EU people but the laws are made by those institutions in practice.

gremloni 5y ago

European governance really seems to work in that they keep getting common sense legislation right and passed over and over.

richlandlord 5y ago
Until it is not common sense and the only way to go around it is to leave the Union and then everyone panics.
- mhh__ 5y ago
  Other than immigration policy was absolutely not what Brexit was about, unless you mean made up stories about EU banana regulations or Boris Johnson's kippers.
- gremloni 5y ago
  It remains to be seen how wise of a decision that was. Early signs are not promising. Compromise leaves everyone a loser but better than before.
- pjmlp 5y ago
  So far is hasn't been working that well.
Kenji 5y ago
You have no clue. The EU is an illegitimate, antidemocratic, aggressive, power hungry entity that will destroy anything in its path, in particular the sovereignty of countries and civilians. One out of a million legislations is sensible, the rest is colonialist garbage.

fidesomnes 5y ago

who benefits?

still_grokking 5y ago

Who cares what the EU Parliament voted for? They can't make laws. It will start to be interesting when the EU Commission makes its point. And everybody knows the true rulers of the EU want to extend the surveillance and police state further no mater what the people's parliament thinks about that. This has by now a long tradition. All previous regulation went in that direction. They won't make just now a 180 turn. That's clear. Some evidence: https://www.justsecurity.org/36098/era-mass-surveillance-emerging-europe/ https://www.justsecurity.org/36098/era-mass-surveillance-eme... https://www.statewatch.org/automated-suspicion-the-eu-s-new-travel-surveillance-initiatives/ https://www.statewatch.org/automated-suspicion-the-eu-s-new-... https://www.tagesspiegel.de/gesellschaft/sicherheitspolitik-europa-plant-den-ueberwachungsstaat/14956574.html https://www.tagesspiegel.de/gesellschaft/sicherheitspolitik-...