9 ms·

Well, maybe that's what they think. But EU is coming with new security and AI regulations that will change things forever.

by zibzab 5y ago

cblconfederate 5y ago
For whom?
schleck8 5y ago
I think they've realized that privacy centrism creates an industry in which the EU can compete well, independently from the US and China. Or at least I hope so.
- indymike 5y ago
  It just pours cement on industry~wide invention and replaces it with bureaucratic innovation.
  - 3np 5y ago
    Take it far enough and it will force new innovations in the fields of p2p and distributed networks, homomorphic encryption, etc. It’s still profitable enough with data silos that this is not happening yet
  - orwin 5y ago
    Which invention/innovation couldn't have come out with better privacy laws? I guess Palantir? Do you have another example? Theranos?
    - skohan 5y ago
      It's not about what you can and can't do, it's the friction and cost associated with achieving compliance. I'm not against privacy protections, but having released digital products in Europe I can say that the cost of achieving GDPR compliance could very well make the difference between whether some companies can succeed or not.
      - dvtrn 5y ago
        I wonder if these kinds of discussions can be easier to have if concerns and critiques brought up were framed, from the start with an understanding that the cost to achieve and maintain compliance with the standard is a cost that gets paid either in money or work-hours (like for example SOC2 or PCI), that it can very tangibly halt non-compliance workloads and rollouts; instead of starting from a footing of assuming complaints are the cloaked dressing for being against user privacy. Understanding full well each standard solves different problems, for some of us in tech achieving compliance is a non-trivial amount of critical work and maintaining it similarly isn’t always something you easily drop everything and make happen in a day or two. I think that’s 100% relevant and shouldn’t be immediately responded to as others have by assuming the relevance comes from a position of opposing the regulation or standing against user privacy
        a1369209993 5y ago
        > instead of starting from a footing of assuming complaints are the cloaked dressing for being against user privacy. The problem with this is twofold: a: 'Most' (by loudness or other perception) of the complaints are known to be bad faith because they're coming from malicious actors like Facebook or Google which we know are against user privacy (since that's their business model). b: You have to go out of your way to build a site that interferes with actual user privacy, for example by actively adding Google Analytics scripts or faux-CAPTCHAs, or actively demanding a real name and actively doing something about it if the user lies to you. (Technically you get IP addresses by default, but much like mailing addresses, obscuring these pretty much has to be the user's responsibility, since how else would you respond to them.) So if you want a assumption of good faith, you need to be clear that you're complaining about the bureaucratic compliance overhead (eg having a particular data processing officer or whatever GDPR calls it), rather than about having to change your object-level service to eliminate spyware that you went out of your way to incorporate in the first place.
      - basisword 5y ago
        >> the cost of achieving GDPR compliance could very well make the difference between whether some companies can succeed or not. Is this a bad thing? If we take privacy seriously then it shouldn’t be. We don’t see too many people fighting food or drug regulations intended to keep us safe because it might be costly for companies to comply. Maybe if a company cannot afford to comply with privacy regulation they should not be handling our personal information. I guess the reason it seems heavy handed in the tech/web world is that the barrier to entry started at next to zero and so much of what we put on the web is not monetised that any cost/compliance seems like a massive burden.
    - rsynnott 5y ago
      Theranos is largely agnostic to privacy laws; it came about due to shoddy medical regulation (specifically, while medicines and medical devices deployed to hospitals and homes are heavily regulated in the US, medical labs are not). Also, arguably, shoddy financial regulation. In many countries, large private companies have to submit audited accounts to the regulators, and that would likely have raised alarms about the other problems with the business earlier.
      - whatshisface 5y ago
        Medical labs are heavily regulated. Theranos mislead inspectors by not showing them their entire lab.
        rsynnott 5y ago
        Well, depends on how you define ‘heavily’. Theranos did hide a lab, but even beyond that they were depending on rules that allowed novel tests with very minimal oversight, provided they were done in a lab rather than in the field.
        rsynnott 5y ago
        (Also, the regulator was presumably aware that Theranos made proprietary medical devices; it said so on their website. So, when they were shown a lab full of Siemens stuff, they should probably have asked about that. The problem here was really hiding in plain sight, and a competent, sufficiently empowered regulator would have caught it)
      - indymike 5y ago
        Theranos happened because the founders chose to lie. Plenty of laws were violated there. Medical regulation is not to blame. Investor hubris is.
        rsynnott 5y ago
        Oh, sure! But the primary purpose of regulatory enforcement is to catch people lying, and Holmes was pretty effective at exploiting the weak points in the regulatory regime to avoid that detection.
    - jan_Inkepa 5y ago
      I shrunk down the interactive (with server-side or external functionality, like third-party comment-boxes) features my sites a lot because of being worried about GDPR, basically killing a small community and having a direct negative effect on users. The overhead/worry is real, even if as a consumer I'm a big fan of it. The toolchain/conventions may eventually catch up so that things are GDPR-compliant by default, but the downsides are still very palpable. [ And even with all of those cutbacks, I'm still not really compliant on all my sites... (legacy software/not knowing what exactly my data server is logging/etc.) ] But, as a direct answer to your question: I don't think many things in principle are impossible with the current privacy laws. But that doesn't mean it's not having a chilling effect.
      - basisword 5y ago
        Although I understand your worry about not being compliant, from my understanding it’s unwarranted. The intent of any enforcement action is not punitive but to enforce compliance. In other words small companies will be told “please comply” and given a chance to comply. It’s only if they refuse that action such as fines is taken. Maybe this has changed but at least when I was studying this a few years ago this seemed to be the case.
  - lumost 5y ago
    Alternately, it may counter incentives towards digital monopolies. I’m not convinced that large amounts of personal data is required for search to work well, at the very least I’m not convinced the personal data must leave an individuals control. We don’t see a lot of innovation in this direction as hyper personalized search seems to work reasonably well and the startup costs to compete are massive.
    - christophilus 5y ago
      I’d love it if Duck Duck Go would let me assign priority to websites. Prefer Wikipedia, GitHub, StackOverflow over spammy copy cats. Maybe the ability to flag results as spammy copy cats would also be nice.
      - alisonkisk 5y ago
        They already do this at scale for everyone. Sometimes they fail.
      - WarOnPrivacy 5y ago
        I'd love it if DDG didn't pointlessly ignore operands.
    - truffdog 5y ago
      > may counter incentives towards digital monopolies. Doesn't the cost of compliance inherently favor larger companies with better lawyers and deep experience in passing audits?
- cblconfederate 5y ago
  because that strategy has worked well so far?
- marcinzm 5y ago
  Here's the issue. Google can use private data in the US to design a model such as say a personal voice assistant. It then deploys this model in the EU and then uses no EU private data either for training or running it live. Google can then use non-private data to adjust the model to the EU market. A company in the EU has to design the whole model with no private data which means they will have more difficulty competing with Google rather than less.
  - kevingadd 5y ago
    Poverty wages, child labor, ignoring emissions regulations, evading taxes, etc are all ways a company could improve margins and charge lower prices. That doesn't mean you want to legalize all of that just to compete in the global market.
    - marcinzm 5y ago
      Why do you put words in my mouth that we should legalize something when I said nothing of the kind? If this is how you react when someone points out flaws with a legislative approach then good luck ever getting one that isn't flawed.
    - pessimizer 5y ago
      It's ultimately going to be a race to the bottom if you allow companies who engage in those practices all over the world into your market on even terms. That's honestly what tariffs are for. Tax your citizens for engaging in commerce with companies that gain efficiencies through operating in ways that disagree with local values.
      - MichaelZuo 5y ago
        Couldn’t you use the same line of argument for tariffs on a vast number of imports? (Electronics, software, services, etc.) It could even extend to most consumer product. e.g. Some obscure chemical compound for plastics is much more costly to produce in an environmentally friendly way, therefore it’s nearly all produced in the least regulated jurisdictions, therefore the compound and all derivative products have to be tariffed from those jurisdictions?
thrower123 5y ago
If you wanted to ensure that only companies with the resources of FAAMG could operate in your jurisdiction, you could hardly do better than the EU has done.
- Jensson 5y ago
  I still see plenty of small companies operating online in the country I live in. GDPR isn't particularly hard or expensive to follow if you are small and barely have any data, especially if you build your system to be GDPR compliant from the start. The expensive part comes when you are already large and have to make that large system GDPR compliant after it is already built.
  - systemvoltage 5y ago
    As a consumer, all I got for GDPR is a lipservice in the form of cookie banners and annoyance everywhere on the web.
    - sharken 5y ago
      Exactly, cookie banners are an annoyance where the user ends up clicking Accept All just to make the banner go away.
    - Jensson 5y ago
      You got the ability to demand to see your data from every company and get it deleted, you didn't have that before. They could just keep whatever data they want and there is nothing you could do to discover or stop them from doing that. If you care about privacy at all you should be very happy that is possible today. It is how we got all those articles showing what data Google and all other companies collects about you, since they asked about this referring to this EU law and the companies has to comply. So even if you don't use it yourself it greatly helps you anyway.
      - systemvoltage 5y ago
        I can see this useful for sites that collect a lot of data (Banks, Social Media, etc.) but for buying shoes from a shopify website, I really don't give a shit. If anything, GDPR has been a nuissance to me as a consumer. Being 100% honest. Cookier banners are so ubiquitious that we've all gotten used to just accepting them and moving on. This is the problem with EU regulation. Good intentions, bad implementations and unforeseen consequences. In fact this goes so far into the reasons why EU cannot harbor a growing startup scene or make rockets. I am not against regulations but if you lay a landmind in front of every endeavor in the form of regulations, it bears down on people that want to disrupt existing and overweight companies that can afford to abide by regulations. I've talked to many Europeans and they resonate with the same sentiments. I own a small business and I've gone through the process GDPR compliance. It is not too bad but there is a reason why there are upteen number of GDPR compliance consulting firms and checklist makers out there. What should have happened is a complete solution to privacy in the browser instead of playing cat and mouse games with businesses that will find loop holes.
numair 5y ago
I can guarantee you, from conversations I have had with senior executives at these companies, that they fully believe they’ve got the regulators in their back pockets. Until we throw people like Nick Clegg in prison for their revolving door betrayal of their citizens, you’ll have some suspiciously incompetent and sympathetic politicians handling these issues. The whole Federal Reserve stock trading scandal should show you that these “public servants” will bend their morals for depressingly small amounts of money.
- deleted 5y ago
  [deleted]
- mathattack 5y ago
  Should we be more surprised that they’re selling us out, or more angry that it’s for so little?
  - pjc50 5y ago
    It costs about £150k to become an unelected member of the UK permanent legislature, and bribe your way into an office of state: https://www.dailyrecord.co.uk/news/politics/arise-lord-offord-tory-donor-25213473 https://www.dailyrecord.co.uk/news/politics/arise-lord-offor...
    - toyg 5y ago
      Those are the donations that were declared, to maintain a pretense of propriety. What sits in Panama, you'll probably never know. 150k is too low a price for that seat, particularly since the cash-for-peerages practice is now so old that the competition must be significant. Either there is more undeclared or this guy knows where the bodies are buried.
sulam 5y ago
A certain amount of regulation runs the risk of leaving us in a situation where a competitive moat is established between companies large enough to handle the regulatory burden and everyone else for whom it represents an unsurpassable barrier between them and the EU market. It wouldn’t surprise me at all to find that large tech companies are encouraging “just so” regulation of this sort. [I do not speak for my employer.]
- deleted 5y ago
  [deleted]

Well, maybe that's what they think. But EU is coming with new security and AI regulations that will change things forever.

by zibzab 5y ago

Well, maybe that's what they think. But EU is coming with new security and AI regulations that will change things forever.

cblconfederate 5y ago

For whom?

schleck8 5y ago

I think they've realized that privacy centrism creates an industry in which the EU can compete well, independently from the US and China. Or at least I hope so.

indymike 5y ago
It just pours cement on industry~wide invention and replaces it with bureaucratic innovation.
- 3np 5y ago
  Take it far enough and it will force new innovations in the fields of p2p and distributed networks, homomorphic encryption, etc. It’s still profitable enough with data silos that this is not happening yet
- orwin 5y ago
  Which invention/innovation couldn't have come out with better privacy laws? I guess Palantir? Do you have another example? Theranos?
  - skohan 5y ago
    It's not about what you can and can't do, it's the friction and cost associated with achieving compliance. I'm not against privacy protections, but having released digital products in Europe I can say that the cost of achieving GDPR compliance could very well make the difference between whether some companies can succeed or not.
    - dvtrn 5y ago
      I wonder if these kinds of discussions can be easier to have if concerns and critiques brought up were framed, from the start with an understanding that the cost to achieve and maintain compliance with the standard is a cost that gets paid either in money or work-hours (like for example SOC2 or PCI), that it can very tangibly halt non-compliance workloads and rollouts; instead of starting from a footing of assuming complaints are the cloaked dressing for being against user privacy. Understanding full well each standard solves different problems, for some of us in tech achieving compliance is a non-trivial amount of critical work and maintaining it similarly isn’t always something you easily drop everything and make happen in a day or two. I think that’s 100% relevant and shouldn’t be immediately responded to as others have by assuming the relevance comes from a position of opposing the regulation or standing against user privacy
      - a1369209993 5y ago
        > instead of starting from a footing of assuming complaints are the cloaked dressing for being against user privacy. The problem with this is twofold: a: 'Most' (by loudness or other perception) of the complaints are known to be bad faith because they're coming from malicious actors like Facebook or Google which we know are against user privacy (since that's their business model). b: You have to go out of your way to build a site that interferes with actual user privacy, for example by actively adding Google Analytics scripts or faux-CAPTCHAs, or actively demanding a real name and actively doing something about it if the user lies to you. (Technically you get IP addresses by default, but much like mailing addresses, obscuring these pretty much has to be the user's responsibility, since how else would you respond to them.) So if you want a assumption of good faith, you need to be clear that you're complaining about the bureaucratic compliance overhead (eg having a particular data processing officer or whatever GDPR calls it), rather than about having to change your object-level service to eliminate spyware that you went out of your way to incorporate in the first place.
    - basisword 5y ago
      >> the cost of achieving GDPR compliance could very well make the difference between whether some companies can succeed or not. Is this a bad thing? If we take privacy seriously then it shouldn’t be. We don’t see too many people fighting food or drug regulations intended to keep us safe because it might be costly for companies to comply. Maybe if a company cannot afford to comply with privacy regulation they should not be handling our personal information. I guess the reason it seems heavy handed in the tech/web world is that the barrier to entry started at next to zero and so much of what we put on the web is not monetised that any cost/compliance seems like a massive burden.
  - rsynnott 5y ago
    Theranos is largely agnostic to privacy laws; it came about due to shoddy medical regulation (specifically, while medicines and medical devices deployed to hospitals and homes are heavily regulated in the US, medical labs are not). Also, arguably, shoddy financial regulation. In many countries, large private companies have to submit audited accounts to the regulators, and that would likely have raised alarms about the other problems with the business earlier.
    - whatshisface 5y ago
      Medical labs are heavily regulated. Theranos mislead inspectors by not showing them their entire lab.
      - rsynnott 5y ago
        Well, depends on how you define ‘heavily’. Theranos did hide a lab, but even beyond that they were depending on rules that allowed novel tests with very minimal oversight, provided they were done in a lab rather than in the field.
        rsynnott 5y ago
        (Also, the regulator was presumably aware that Theranos made proprietary medical devices; it said so on their website. So, when they were shown a lab full of Siemens stuff, they should probably have asked about that. The problem here was really hiding in plain sight, and a competent, sufficiently empowered regulator would have caught it)
    - indymike 5y ago
      Theranos happened because the founders chose to lie. Plenty of laws were violated there. Medical regulation is not to blame. Investor hubris is.
      - rsynnott 5y ago
        Oh, sure! But the primary purpose of regulatory enforcement is to catch people lying, and Holmes was pretty effective at exploiting the weak points in the regulatory regime to avoid that detection.
  - jan_Inkepa 5y ago
    I shrunk down the interactive (with server-side or external functionality, like third-party comment-boxes) features my sites a lot because of being worried about GDPR, basically killing a small community and having a direct negative effect on users. The overhead/worry is real, even if as a consumer I'm a big fan of it. The toolchain/conventions may eventually catch up so that things are GDPR-compliant by default, but the downsides are still very palpable. [ And even with all of those cutbacks, I'm still not really compliant on all my sites... (legacy software/not knowing what exactly my data server is logging/etc.) ] But, as a direct answer to your question: I don't think many things in principle are impossible with the current privacy laws. But that doesn't mean it's not having a chilling effect.
    - basisword 5y ago
      Although I understand your worry about not being compliant, from my understanding it’s unwarranted. The intent of any enforcement action is not punitive but to enforce compliance. In other words small companies will be told “please comply” and given a chance to comply. It’s only if they refuse that action such as fines is taken. Maybe this has changed but at least when I was studying this a few years ago this seemed to be the case.
- lumost 5y ago
  Alternately, it may counter incentives towards digital monopolies. I’m not convinced that large amounts of personal data is required for search to work well, at the very least I’m not convinced the personal data must leave an individuals control. We don’t see a lot of innovation in this direction as hyper personalized search seems to work reasonably well and the startup costs to compete are massive.
  - christophilus 5y ago
    I’d love it if Duck Duck Go would let me assign priority to websites. Prefer Wikipedia, GitHub, StackOverflow over spammy copy cats. Maybe the ability to flag results as spammy copy cats would also be nice.
    - alisonkisk 5y ago
      They already do this at scale for everyone. Sometimes they fail.
    - WarOnPrivacy 5y ago
      I'd love it if DDG didn't pointlessly ignore operands.
  - truffdog 5y ago
    > may counter incentives towards digital monopolies. Doesn't the cost of compliance inherently favor larger companies with better lawyers and deep experience in passing audits?
cblconfederate 5y ago
because that strategy has worked well so far?
marcinzm 5y ago
Here's the issue. Google can use private data in the US to design a model such as say a personal voice assistant. It then deploys this model in the EU and then uses no EU private data either for training or running it live. Google can then use non-private data to adjust the model to the EU market. A company in the EU has to design the whole model with no private data which means they will have more difficulty competing with Google rather than less.
- kevingadd 5y ago
  Poverty wages, child labor, ignoring emissions regulations, evading taxes, etc are all ways a company could improve margins and charge lower prices. That doesn't mean you want to legalize all of that just to compete in the global market.
  - marcinzm 5y ago
    Why do you put words in my mouth that we should legalize something when I said nothing of the kind? If this is how you react when someone points out flaws with a legislative approach then good luck ever getting one that isn't flawed.
  - pessimizer 5y ago
    It's ultimately going to be a race to the bottom if you allow companies who engage in those practices all over the world into your market on even terms. That's honestly what tariffs are for. Tax your citizens for engaging in commerce with companies that gain efficiencies through operating in ways that disagree with local values.
    - MichaelZuo 5y ago
      Couldn’t you use the same line of argument for tariffs on a vast number of imports? (Electronics, software, services, etc.) It could even extend to most consumer product. e.g. Some obscure chemical compound for plastics is much more costly to produce in an environmentally friendly way, therefore it’s nearly all produced in the least regulated jurisdictions, therefore the compound and all derivative products have to be tariffed from those jurisdictions?

thrower123 5y ago

If you wanted to ensure that only companies with the resources of FAAMG could operate in your jurisdiction, you could hardly do better than the EU has done.

Jensson 5y ago
I still see plenty of small companies operating online in the country I live in. GDPR isn't particularly hard or expensive to follow if you are small and barely have any data, especially if you build your system to be GDPR compliant from the start. The expensive part comes when you are already large and have to make that large system GDPR compliant after it is already built.
- systemvoltage 5y ago
  As a consumer, all I got for GDPR is a lipservice in the form of cookie banners and annoyance everywhere on the web.
  - sharken 5y ago
    Exactly, cookie banners are an annoyance where the user ends up clicking Accept All just to make the banner go away.
  - Jensson 5y ago
    You got the ability to demand to see your data from every company and get it deleted, you didn't have that before. They could just keep whatever data they want and there is nothing you could do to discover or stop them from doing that. If you care about privacy at all you should be very happy that is possible today. It is how we got all those articles showing what data Google and all other companies collects about you, since they asked about this referring to this EU law and the companies has to comply. So even if you don't use it yourself it greatly helps you anyway.
    - systemvoltage 5y ago
      I can see this useful for sites that collect a lot of data (Banks, Social Media, etc.) but for buying shoes from a shopify website, I really don't give a shit. If anything, GDPR has been a nuissance to me as a consumer. Being 100% honest. Cookier banners are so ubiquitious that we've all gotten used to just accepting them and moving on. This is the problem with EU regulation. Good intentions, bad implementations and unforeseen consequences. In fact this goes so far into the reasons why EU cannot harbor a growing startup scene or make rockets. I am not against regulations but if you lay a landmind in front of every endeavor in the form of regulations, it bears down on people that want to disrupt existing and overweight companies that can afford to abide by regulations. I've talked to many Europeans and they resonate with the same sentiments. I own a small business and I've gone through the process GDPR compliance. It is not too bad but there is a reason why there are upteen number of GDPR compliance consulting firms and checklist makers out there. What should have happened is a complete solution to privacy in the browser instead of playing cat and mouse games with businesses that will find loop holes.

numair 5y ago

I can guarantee you, from conversations I have had with senior executives at these companies, that they fully believe they’ve got the regulators in their back pockets. Until we throw people like Nick Clegg in prison for their revolving door betrayal of their citizens, you’ll have some suspiciously incompetent and sympathetic politicians handling these issues. The whole Federal Reserve stock trading scandal should show you that these “public servants” will bend their morals for depressingly small amounts of money.

deleted 5y ago
[deleted]
mathattack 5y ago
Should we be more surprised that they’re selling us out, or more angry that it’s for so little?
- pjc50 5y ago
  It costs about £150k to become an unelected member of the UK permanent legislature, and bribe your way into an office of state: https://www.dailyrecord.co.uk/news/politics/arise-lord-offord-tory-donor-25213473 https://www.dailyrecord.co.uk/news/politics/arise-lord-offor...
  - toyg 5y ago
    Those are the donations that were declared, to maintain a pretense of propriety. What sits in Panama, you'll probably never know. 150k is too low a price for that seat, particularly since the cash-for-peerages practice is now so old that the competition must be significant. Either there is more undeclared or this guy knows where the bodies are buried.

sulam 5y ago

A certain amount of regulation runs the risk of leaving us in a situation where a competitive moat is established between companies large enough to handle the regulatory burden and everyone else for whom it represents an unsurpassable barrier between them and the EU market. It wouldn’t surprise me at all to find that large tech companies are encouraging “just so” regulation of this sort. [I do not speak for my employer.]

deleted 5y ago
[deleted]