6 ms·

I think they've realized that privacy centrism creates an industry in which the EU can compete well, independently from the US and China. Or at least I hope so.

indymike 5y ago
It just pours cement on industry~wide invention and replaces it with bureaucratic innovation.
- 3np 5y ago
  Take it far enough and it will force new innovations in the fields of p2p and distributed networks, homomorphic encryption, etc. It’s still profitable enough with data silos that this is not happening yet
- orwin 5y ago
  Which invention/innovation couldn't have come out with better privacy laws? I guess Palantir? Do you have another example? Theranos?
  - skohan 5y ago
    It's not about what you can and can't do, it's the friction and cost associated with achieving compliance. I'm not against privacy protections, but having released digital products in Europe I can say that the cost of achieving GDPR compliance could very well make the difference between whether some companies can succeed or not.
    - dvtrn 5y ago
      I wonder if these kinds of discussions can be easier to have if concerns and critiques brought up were framed, from the start with an understanding that the cost to achieve and maintain compliance with the standard is a cost that gets paid either in money or work-hours (like for example SOC2 or PCI), that it can very tangibly halt non-compliance workloads and rollouts; instead of starting from a footing of assuming complaints are the cloaked dressing for being against user privacy. Understanding full well each standard solves different problems, for some of us in tech achieving compliance is a non-trivial amount of critical work and maintaining it similarly isn’t always something you easily drop everything and make happen in a day or two. I think that’s 100% relevant and shouldn’t be immediately responded to as others have by assuming the relevance comes from a position of opposing the regulation or standing against user privacy
      - a1369209993 5y ago
        > instead of starting from a footing of assuming complaints are the cloaked dressing for being against user privacy. The problem with this is twofold: a: 'Most' (by loudness or other perception) of the complaints are known to be bad faith because they're coming from malicious actors like Facebook or Google which we know are against user privacy (since that's their business model). b: You have to go out of your way to build a site that interferes with actual user privacy, for example by actively adding Google Analytics scripts or faux-CAPTCHAs, or actively demanding a real name and actively doing something about it if the user lies to you. (Technically you get IP addresses by default, but much like mailing addresses, obscuring these pretty much has to be the user's responsibility, since how else would you respond to them.) So if you want a assumption of good faith, you need to be clear that you're complaining about the bureaucratic compliance overhead (eg having a particular data processing officer or whatever GDPR calls it), rather than about having to change your object-level service to eliminate spyware that you went out of your way to incorporate in the first place.
    - basisword 5y ago
      >> the cost of achieving GDPR compliance could very well make the difference between whether some companies can succeed or not. Is this a bad thing? If we take privacy seriously then it shouldn’t be. We don’t see too many people fighting food or drug regulations intended to keep us safe because it might be costly for companies to comply. Maybe if a company cannot afford to comply with privacy regulation they should not be handling our personal information. I guess the reason it seems heavy handed in the tech/web world is that the barrier to entry started at next to zero and so much of what we put on the web is not monetised that any cost/compliance seems like a massive burden.
      - Lord_Baltimore 5y ago
        It is a trade-off which is not always acknowledged. It is not something that has 0 potentially negative consequences. And the competition and innovation that is stifled is often invisible (hard to see what could have been). If you had less intervention with respect to privacy would there be more dynamic market-driven initiatives to fill the gaps? Would there be more incentive to develop technology that would be effective for privacy? I don't know. Regulation is just hard because reality is complex and dynamic and regulation is often complex but not very dynamic.
        guitarbill 5y ago
        > If you had less intervention with respect to privacy would there be more dynamic market-driven initiatives to fill the gaps? This is hilarious. Because we had that, and it was lacking, to put it mildly. And some people still have that, in a way that's easy to compare (e.g. EU vs US, CA vs other states). For me, the results are in and obvious. Privacy regulations are the only thing that reflects the privacy externalities they might impose on society back onto them (and the shareholders).
      - skohan 5y ago
        I don't think it's necessarily a bad thing. Like you say, some regulations are needed, and we wouldn't want to allow unsafe cars on the road just because crash-tests are a barrier to entry for startups. However it does serve as a moat for players with more capital, and that's something we should also be mindful of. For instance, maybe we could have some of the requirements scale and only kick in when a product meets certain thresholds in terms of numbers of users.
  - rsynnott 5y ago
    Theranos is largely agnostic to privacy laws; it came about due to shoddy medical regulation (specifically, while medicines and medical devices deployed to hospitals and homes are heavily regulated in the US, medical labs are not). Also, arguably, shoddy financial regulation. In many countries, large private companies have to submit audited accounts to the regulators, and that would likely have raised alarms about the other problems with the business earlier.
    - whatshisface 5y ago
      Medical labs are heavily regulated. Theranos mislead inspectors by not showing them their entire lab.
      - rsynnott 5y ago
        Well, depends on how you define ‘heavily’. Theranos did hide a lab, but even beyond that they were depending on rules that allowed novel tests with very minimal oversight, provided they were done in a lab rather than in the field.
        rsynnott 5y ago
        (Also, the regulator was presumably aware that Theranos made proprietary medical devices; it said so on their website. So, when they were shown a lab full of Siemens stuff, they should probably have asked about that. The problem here was really hiding in plain sight, and a competent, sufficiently empowered regulator would have caught it)
    - indymike 5y ago
      Theranos happened because the founders chose to lie. Plenty of laws were violated there. Medical regulation is not to blame. Investor hubris is.
      - rsynnott 5y ago
        Oh, sure! But the primary purpose of regulatory enforcement is to catch people lying, and Holmes was pretty effective at exploiting the weak points in the regulatory regime to avoid that detection.
  - jan_Inkepa 5y ago
    I shrunk down the interactive (with server-side or external functionality, like third-party comment-boxes) features my sites a lot because of being worried about GDPR, basically killing a small community and having a direct negative effect on users. The overhead/worry is real, even if as a consumer I'm a big fan of it. The toolchain/conventions may eventually catch up so that things are GDPR-compliant by default, but the downsides are still very palpable. [ And even with all of those cutbacks, I'm still not really compliant on all my sites... (legacy software/not knowing what exactly my data server is logging/etc.) ] But, as a direct answer to your question: I don't think many things in principle are impossible with the current privacy laws. But that doesn't mean it's not having a chilling effect.
    - basisword 5y ago
      Although I understand your worry about not being compliant, from my understanding it’s unwarranted. The intent of any enforcement action is not punitive but to enforce compliance. In other words small companies will be told “please comply” and given a chance to comply. It’s only if they refuse that action such as fines is taken. Maybe this has changed but at least when I was studying this a few years ago this seemed to be the case.
- lumost 5y ago
  Alternately, it may counter incentives towards digital monopolies. I’m not convinced that large amounts of personal data is required for search to work well, at the very least I’m not convinced the personal data must leave an individuals control. We don’t see a lot of innovation in this direction as hyper personalized search seems to work reasonably well and the startup costs to compete are massive.
  - christophilus 5y ago
    I’d love it if Duck Duck Go would let me assign priority to websites. Prefer Wikipedia, GitHub, StackOverflow over spammy copy cats. Maybe the ability to flag results as spammy copy cats would also be nice.
    - alisonkisk 5y ago
      They already do this at scale for everyone. Sometimes they fail.
    - WarOnPrivacy 5y ago
      I'd love it if DDG didn't pointlessly ignore operands.
  - truffdog 5y ago
    > may counter incentives towards digital monopolies. Doesn't the cost of compliance inherently favor larger companies with better lawyers and deep experience in passing audits?
cblconfederate 5y ago
because that strategy has worked well so far?
marcinzm 5y ago
Here's the issue. Google can use private data in the US to design a model such as say a personal voice assistant. It then deploys this model in the EU and then uses no EU private data either for training or running it live. Google can then use non-private data to adjust the model to the EU market. A company in the EU has to design the whole model with no private data which means they will have more difficulty competing with Google rather than less.
- kevingadd 5y ago
  Poverty wages, child labor, ignoring emissions regulations, evading taxes, etc are all ways a company could improve margins and charge lower prices. That doesn't mean you want to legalize all of that just to compete in the global market.
  - marcinzm 5y ago
    Why do you put words in my mouth that we should legalize something when I said nothing of the kind? If this is how you react when someone points out flaws with a legislative approach then good luck ever getting one that isn't flawed.
  - pessimizer 5y ago
    It's ultimately going to be a race to the bottom if you allow companies who engage in those practices all over the world into your market on even terms. That's honestly what tariffs are for. Tax your citizens for engaging in commerce with companies that gain efficiencies through operating in ways that disagree with local values.
    - MichaelZuo 5y ago
      Couldn’t you use the same line of argument for tariffs on a vast number of imports? (Electronics, software, services, etc.) It could even extend to most consumer product. e.g. Some obscure chemical compound for plastics is much more costly to produce in an environmentally friendly way, therefore it’s nearly all produced in the least regulated jurisdictions, therefore the compound and all derivative products have to be tariffed from those jurisdictions?

indymike 5y ago

It just pours cement on industry~wide invention and replaces it with bureaucratic innovation.

3np 5y ago
Take it far enough and it will force new innovations in the fields of p2p and distributed networks, homomorphic encryption, etc. It’s still profitable enough with data silos that this is not happening yet
orwin 5y ago
Which invention/innovation couldn't have come out with better privacy laws? I guess Palantir? Do you have another example? Theranos?
- skohan 5y ago
  It's not about what you can and can't do, it's the friction and cost associated with achieving compliance. I'm not against privacy protections, but having released digital products in Europe I can say that the cost of achieving GDPR compliance could very well make the difference between whether some companies can succeed or not.
  - dvtrn 5y ago
    I wonder if these kinds of discussions can be easier to have if concerns and critiques brought up were framed, from the start with an understanding that the cost to achieve and maintain compliance with the standard is a cost that gets paid either in money or work-hours (like for example SOC2 or PCI), that it can very tangibly halt non-compliance workloads and rollouts; instead of starting from a footing of assuming complaints are the cloaked dressing for being against user privacy. Understanding full well each standard solves different problems, for some of us in tech achieving compliance is a non-trivial amount of critical work and maintaining it similarly isn’t always something you easily drop everything and make happen in a day or two. I think that’s 100% relevant and shouldn’t be immediately responded to as others have by assuming the relevance comes from a position of opposing the regulation or standing against user privacy
    - a1369209993 5y ago
      > instead of starting from a footing of assuming complaints are the cloaked dressing for being against user privacy. The problem with this is twofold: a: 'Most' (by loudness or other perception) of the complaints are known to be bad faith because they're coming from malicious actors like Facebook or Google which we know are against user privacy (since that's their business model). b: You have to go out of your way to build a site that interferes with actual user privacy, for example by actively adding Google Analytics scripts or faux-CAPTCHAs, or actively demanding a real name and actively doing something about it if the user lies to you. (Technically you get IP addresses by default, but much like mailing addresses, obscuring these pretty much has to be the user's responsibility, since how else would you respond to them.) So if you want a assumption of good faith, you need to be clear that you're complaining about the bureaucratic compliance overhead (eg having a particular data processing officer or whatever GDPR calls it), rather than about having to change your object-level service to eliminate spyware that you went out of your way to incorporate in the first place.
  - basisword 5y ago
    >> the cost of achieving GDPR compliance could very well make the difference between whether some companies can succeed or not. Is this a bad thing? If we take privacy seriously then it shouldn’t be. We don’t see too many people fighting food or drug regulations intended to keep us safe because it might be costly for companies to comply. Maybe if a company cannot afford to comply with privacy regulation they should not be handling our personal information. I guess the reason it seems heavy handed in the tech/web world is that the barrier to entry started at next to zero and so much of what we put on the web is not monetised that any cost/compliance seems like a massive burden.
    - Lord_Baltimore 5y ago
      It is a trade-off which is not always acknowledged. It is not something that has 0 potentially negative consequences. And the competition and innovation that is stifled is often invisible (hard to see what could have been). If you had less intervention with respect to privacy would there be more dynamic market-driven initiatives to fill the gaps? Would there be more incentive to develop technology that would be effective for privacy? I don't know. Regulation is just hard because reality is complex and dynamic and regulation is often complex but not very dynamic.
      - guitarbill 5y ago
        > If you had less intervention with respect to privacy would there be more dynamic market-driven initiatives to fill the gaps? This is hilarious. Because we had that, and it was lacking, to put it mildly. And some people still have that, in a way that's easy to compare (e.g. EU vs US, CA vs other states). For me, the results are in and obvious. Privacy regulations are the only thing that reflects the privacy externalities they might impose on society back onto them (and the shareholders).
    - skohan 5y ago
      I don't think it's necessarily a bad thing. Like you say, some regulations are needed, and we wouldn't want to allow unsafe cars on the road just because crash-tests are a barrier to entry for startups. However it does serve as a moat for players with more capital, and that's something we should also be mindful of. For instance, maybe we could have some of the requirements scale and only kick in when a product meets certain thresholds in terms of numbers of users.
- rsynnott 5y ago
  Theranos is largely agnostic to privacy laws; it came about due to shoddy medical regulation (specifically, while medicines and medical devices deployed to hospitals and homes are heavily regulated in the US, medical labs are not). Also, arguably, shoddy financial regulation. In many countries, large private companies have to submit audited accounts to the regulators, and that would likely have raised alarms about the other problems with the business earlier.
  - whatshisface 5y ago
    Medical labs are heavily regulated. Theranos mislead inspectors by not showing them their entire lab.
    - rsynnott 5y ago
      Well, depends on how you define ‘heavily’. Theranos did hide a lab, but even beyond that they were depending on rules that allowed novel tests with very minimal oversight, provided they were done in a lab rather than in the field.
      - rsynnott 5y ago
        (Also, the regulator was presumably aware that Theranos made proprietary medical devices; it said so on their website. So, when they were shown a lab full of Siemens stuff, they should probably have asked about that. The problem here was really hiding in plain sight, and a competent, sufficiently empowered regulator would have caught it)
  - indymike 5y ago
    Theranos happened because the founders chose to lie. Plenty of laws were violated there. Medical regulation is not to blame. Investor hubris is.
    - rsynnott 5y ago
      Oh, sure! But the primary purpose of regulatory enforcement is to catch people lying, and Holmes was pretty effective at exploiting the weak points in the regulatory regime to avoid that detection.
- jan_Inkepa 5y ago
  I shrunk down the interactive (with server-side or external functionality, like third-party comment-boxes) features my sites a lot because of being worried about GDPR, basically killing a small community and having a direct negative effect on users. The overhead/worry is real, even if as a consumer I'm a big fan of it. The toolchain/conventions may eventually catch up so that things are GDPR-compliant by default, but the downsides are still very palpable. [ And even with all of those cutbacks, I'm still not really compliant on all my sites... (legacy software/not knowing what exactly my data server is logging/etc.) ] But, as a direct answer to your question: I don't think many things in principle are impossible with the current privacy laws. But that doesn't mean it's not having a chilling effect.
  - basisword 5y ago
    Although I understand your worry about not being compliant, from my understanding it’s unwarranted. The intent of any enforcement action is not punitive but to enforce compliance. In other words small companies will be told “please comply” and given a chance to comply. It’s only if they refuse that action such as fines is taken. Maybe this has changed but at least when I was studying this a few years ago this seemed to be the case.
lumost 5y ago
Alternately, it may counter incentives towards digital monopolies. I’m not convinced that large amounts of personal data is required for search to work well, at the very least I’m not convinced the personal data must leave an individuals control. We don’t see a lot of innovation in this direction as hyper personalized search seems to work reasonably well and the startup costs to compete are massive.
- christophilus 5y ago
  I’d love it if Duck Duck Go would let me assign priority to websites. Prefer Wikipedia, GitHub, StackOverflow over spammy copy cats. Maybe the ability to flag results as spammy copy cats would also be nice.
  - alisonkisk 5y ago
    They already do this at scale for everyone. Sometimes they fail.
  - WarOnPrivacy 5y ago
    I'd love it if DDG didn't pointlessly ignore operands.
- truffdog 5y ago
  > may counter incentives towards digital monopolies. Doesn't the cost of compliance inherently favor larger companies with better lawyers and deep experience in passing audits?

cblconfederate 5y ago

because that strategy has worked well so far?

marcinzm 5y ago

Here's the issue. Google can use private data in the US to design a model such as say a personal voice assistant. It then deploys this model in the EU and then uses no EU private data either for training or running it live. Google can then use non-private data to adjust the model to the EU market. A company in the EU has to design the whole model with no private data which means they will have more difficulty competing with Google rather than less.

kevingadd 5y ago
Poverty wages, child labor, ignoring emissions regulations, evading taxes, etc are all ways a company could improve margins and charge lower prices. That doesn't mean you want to legalize all of that just to compete in the global market.
- marcinzm 5y ago
  Why do you put words in my mouth that we should legalize something when I said nothing of the kind? If this is how you react when someone points out flaws with a legislative approach then good luck ever getting one that isn't flawed.
- pessimizer 5y ago
  It's ultimately going to be a race to the bottom if you allow companies who engage in those practices all over the world into your market on even terms. That's honestly what tariffs are for. Tax your citizens for engaging in commerce with companies that gain efficiencies through operating in ways that disagree with local values.
  - MichaelZuo 5y ago
    Couldn’t you use the same line of argument for tariffs on a vast number of imports? (Electronics, software, services, etc.) It could even extend to most consumer product. e.g. Some obscure chemical compound for plastics is much more costly to produce in an environmentally friendly way, therefore it’s nearly all produced in the least regulated jurisdictions, therefore the compound and all derivative products have to be tariffed from those jurisdictions?