12 ms·

Before the discussion descends into the usual "that's stupid and will kill all tech startups" vs. "that's right because all cookies are evil incarnate", I'll sa

Before the discussion descends into the usual "that's stupid and will kill all tech startups" vs. "that's right because all cookies are evil incarnate", I'll say again: This is a perfect example of the kind of legal processes we have now. The EU and Germany in particular have decades of privacy regulation and core values behind them. These core values won't change. Regulation for the past decades has ignored that tech routinely violates these values, and it's catching up now. Rules won't be as dramatic as in the past, but will differ widely from the us. In this context, it's legally important to account for entrepreneurial freedom (guaranteed by the constitution), but if there's an overriding reason to protect consumers, then it is entirely irrelevant how long companies have been doing this, how many do this and in what other countries they do it. To sum up, the law sometimes bites late, but it bites hard, and arguments surrounding competitiveness, business culture or internet culture are legally completely irrelevant.

nkmnz 5y ago
The arguments you list in the end are not legal arguments, but political ones, so it’s not a big surprise they are „legally completely irrelevant“ - unless politics turns them into law.
sokoloff 5y ago
“The wheels of justice turn slowly, but grind exceedingly fine.”
- selfhoster11 5y ago
  Except when it gets stuck on monopolies and oligopolies, but that's not a problem, right?
  - uniqueuid 5y ago
    They also grind very selectively. The fundamental hope that democracy is based upon is that they will eventually (in finite time) grind all problems, even if not right away.
    - igorkraw 5y ago
      I'm hopeful. "The logic of political survival" (https://mitpress.mit.edu/books/logic-political-survival https://mitpress.mit.edu/books/logic-political-survival ) is one of many books that make a decent case for democratic systems simply being better than authoritarian (in the long run), the more democratic the better. This old journal article while dated and possibly no longer accurate about the arab world give a military perspective on the same dynamics https://www.meforum.org/441/why-arabs-lose-wars https://www.meforum.org/441/why-arabs-lose-wars It's important to remember that 100 years ago (if you squint, 150 years no contest, there basically was no democracy in the modern sense (universal suffrage, no special rights), kings and queens and aristocrats still held most power and wealth in most places around the world. It's very easy to forget that the descendants of these aristocrats in places where lasting measures against the lingering power of the old rich weren't taken (i.e., they weren't executed and their wealth was left intact) are usually still in the richest 100 families of the country and wield considerable political influence. I will stop here now because dang has repeatedly asked me not to make statements likely to inflame "boring" political discussions but I do think that as more and more people realize that they are not in fact temporarily embarrassed millionaires the old power bases of corruption and uncapped dynastic wealth will follow the way of dynastic hegemony over nations.
      - BitwiseFool 5y ago
        >"the more democratic the better" I no longer believe this to be the case. I am pro-democracy but I am not a suffrage maximalist. During the last election cycle I looked at the myriad of obscure positions I had the right to vote for on the ballot and I realized most of what I was voting for I was unqualified to weigh in on. For instance, why do I vote for the Railroad Commissioner? Why do I vote for my local county's community college board of trustees seat 5 and 6? You could say that I should be informing myself before I go to cast the ballot. While you wouldn't be wrong for saying that is my responsibility as a voter, I can assure you virtually no one actually does this. I also find the down ballot candidate's pitches so generic and milquetoast that there isn't enough substance to actually distinguish between them. What's worse is that the obscure positions have either unopposed candidates or just two. And most of the time, people just look for the (R) or the (D) by the name and that's what they go on.
  - intended 5y ago
    The legal wheels are grinding on Amazon for a while because it’s a unique case in america. American courts check if something harms consumers, and Amazon is able to show that it transfers the lowest cost to its customers. One of the biggest legal changes in the past few years was a new direction altogether to determine anticompetitive behavior. If I recall correctly, FB’a recent acquisition of giphy (?) was also stopped on anti competitive grounds. Point being that this stuff isn’t necessarily easy, the other side has very good lawyers who tell them what not to do on top of this being novel.
    - gumby 5y ago
      > The legal wheels are grinding on Amazon for a while because it’s a unique case in america. American courts check if something harms consumers... It’s not unique at all. The old trusts that were broken up at the dawn of antitrust (that’s where the name comes from) were of a similar structure and even more dominant. The “consumer harm” test (really “short term consumer cost” test) was a deliberate crippling of antitrust doctrine during the Reagan era. The process is only now starting to return to its roots. Consumers can be harmed by a low price when it is predatory, either to drive out competitors (so price can go up later) or to transfer business to a monopolist who can charge higher prices elsewhere and/or stave off competitive technological or entrepreneurial threats. This doctrine blessed such predatory tactics while pretending to be a high-minded consumer-friendly approach.
      - pessimizer 5y ago
        > The process is only now starting to return to its roots. I'd like to cynically say that the rhetoric and arguments have finally started to return to their roots within this particular administration, but there's no evidence of a process actually being carried to completion yet.
        gumby 5y ago
        There’s been legal theory movement over the past 15 years or so to revisit this shift. All you’re seeing now is some of the peaks of an undersea mountain range. This movement has been gaining in different agencies for years. I think it’s a secular shift rather than something administration-specific. Of course the rentiers can still squash things, and will. But I think the tide is against them. Matt Stoller has done great work both documenting this and contributing.
  - gumby 5y ago
    I think the justice department hasn’t gotten involved in those cases for the last 40 years so, no, they don’t get stuck on them at all. :-( Fortunately antitrust appears to be moving back to its century-plus-old roots.
- BitwiseFool 5y ago
  I want to believe this, but I sense this is just a comfortable platitude we tell ourselves. There are countless examples of both high and low profile injustices that have been carried out with no substantial consequences. You could say it is selection bias that I look towards those, but in the case of refuting an assertion, I think they count.
sharken 5y ago
[flagged]
phh 5y ago
FWIW my stance on privacy regulation is that it is severely needed, both for consumers AND for businesses, because data deregulation can only lead to unbreakable monopolies, while fully applied GDPR allows user to resell the private data Google got on them, to the next, newcomer, bidder. That being said I don't really agree with the premise of your comment. A law that isn't applied shouldn't be considered a law, and saying "you should just have applied the law from the start" isn't always fair. For instance, in France, woman were not allowed to wear trousers until maybe 5 or 10 years ago. French privacy laws 1980s already had a real scope on privacy, but it was barely applied. Applying a 40 years old law out of nowhere would simply be targeted attacks to the current disgraced company. Now, GDPR is really recent, so I won't put it in the "hasn't been used for so long it's dead" basket. Though I kinda think that the portability part of GDPR will (I'm crossing fingers it will still happen, because I think it's the best part)
- dash2 5y ago
  > For instance, in France, woman were not allowed to wear trousers until maybe 5 or 10 years ago. That law was a dead letter from 1800. It’s the equivalent of the old English law memes, like that you can shoot an arrow at a Welshman within the precinct of Hereford.
  - bryanrasmussen 5y ago
    that seems to have been the parent comment's point?
    - ClumsyPilot 5y ago
      Id we dont enforce privacy for 200 years, then he'd have a point
      - phh 5y ago
        It's been 44 years in France. It was older than current facebook's age when facebook appeared. France abolished the guillotine more recently than this privacy law pased in France. When I was born, it was already no longer discussed. It's not 200 years old, but it definitely is OLD.
ciarcode 5y ago
Perfect summary of what is happening right now in Europe. German citizen in particular have a strong privacy-oriented culture after what happened during WWII. https://time.com/5290043/nazi-history-eu-data-privacy-gdpr/?amp=true https://time.com/5290043/nazi-history-eu-data-privacy-gdpr/?...
- woodpanel 5y ago
  I'm always amazed by my countrymen chest-pounding themselves about their alledged cultural resilience against the surveilance state. Not only did none of us live during the Nazi-Era, but most of us that lived at least during the Stasi-Era (in the West) are routinely falling short of living up to their own moral standards. They champion getting rid off tax-privacy, they champion getting rid off non-digital currency, they champion blocking social-networks because of "foreign desinformation" (i.e. domestic opposition), they take no offense that a think-tank owned for-profit media-conglomerate does the domestic deletion and blocking of social media accounts (Bertelsmann > Arvato -> FB/Twitter/…). And most hilariously, progressive luminaries like Daniel Cohn-Bendit or Volker Beck – which during the 1980s gained political traction by "fighting" against having A NATIONAL CENSUS AT ALL – are nowadays championing throwing out medical-data privacy alltogether and having to hand out your unlocked phone to the police at their whim. (Needless to say how cultural chest-pounding thouse luminaries were in the 1980s)
  - cycomanic 5y ago
    > And most hilariously, progressive luminaries like Daniel Cohn-Bendit or Volker Beck – which during the 1980s gained political traction by "fighting" against having A NATIONAL CENSUS AT ALL – are nowadays championing throwing out medical-data privacy alltogether and having to hand out your unlocked phone to the police at their whim. Can you provide some sources for that, I haven't closely followed German politics in recent years (as I've been living overseas), but I'm quite surprised that DCB would champion police search powers like that.
  - pasabagi 5y ago
    I think the idea that germans are the victims of history (and that's why they're so sensitive about oppression) is actually older than the stasi, or the nazis. Hitler, for instance, uses the theme an awful lot in his speeches. It just got a big boost from the post-holocaust psychological judo where germans recast themselves as the victims of the nazi dictatorship, rather than the enthusiastic supporters. It leads to some funny statements, to be sure. The woman who said she felt like Sophie Scholl because she had been in coronavirus lockdown was one example - but honestly, if you mess with somebody's parking place, they're about two sentences away from saying you're literally the NS-diktatur. Still, if it leads to a sense of urgency over privacy, I'm all for it.
sebow 5y ago
> it's legally important to account for entrepreneurial freedom (guaranteed by the constitution) Is this even true for any european country? Don't get me wrong, this is vastly applies right now and the only problems appear at a high level, but If i'm not mistaken no european country has a fundamental text that protects what you're talking about.
nehalem 5y ago
While true in essence, I don’t think that the German society broadly shares the value of privacy to a level that warrants such excessive restrictions. It is important to note that Germany‘s tradition of data protection originates from a fear of government overreach through excessive data collection (the original constitutional court decision concerned the census). In my opinion data protection got out of hand when the same standards were applied to private entities while increasingly neglecting the proportionality test, or — less legalese — a risk benefit analysis. It is common in German jurisprudence to widen the scope of protection (‚everything‘ is personal data) but the proportionality test is strict (it’s okay to transfer personal data because the gains outweigh the risks as the data is only moderately private). I think that softening of the proportionally criterion has been influenced by a general fear that every datapoint might be somehow relevant even if there is little evidence. (Disclaimer: Legal theory is slightly simplified, but true to principle)
- uniqueuid 5y ago
  I agree that there is a widespread feeling that legal protections are missing reality (wirklichkeitsfremd). But I'd argue that the roots of Germany's focus on privacy are not only rooted in protection against the state. Yes, constitutional fundamental rights are protections against the state (Abwehrrechte), but the legal interpretation established by the supreme court also draws on an ideal-typical perception of citizens as informed, rational and responsible people (mündige Bürger), who - through education, intelligence, moral values, dedication and pro-social behavior - create and sustain society. Such self-determined citizens cannot exist in the face of overbearing, and especially invisible or intractable (!) external coercion. That's also the root of informed consent, of course. So in this sense, privacy protections are a safeguard against dumbing down citizens, and I think the general intent is indeed valid.
  - tomxor 5y ago
    > perception of citizens as informed, rational and responsible people (mündige Bürger), who - through education, intelligence, moral values, dedication and pro-social behavior - create and sustain society. [...] Such self-determined citizens cannot exist in the face of overbearing, and especially invisible or intractable (!) external coercion. That's excellent, it's these type of arguments that get too little attention when digital "privacy" gets discussed today.
rusk 5y ago
> it is entirely irrelevant how long companies have been doing this I always thought this. I was recently introduced to the concept of “practice prevails” whereby if you’ve been routinely flouting a rule, and that rule has never been enforced that you can claim the rule is obsolete. I think it’s mainly confined to contract law but it does help to explain the standpoint of those who oppose such retrospective regulatory measures.
- uniqueuid 5y ago
  IANAL but I don't think this holds in competition law and even less in constitutional law (of course).
- jacquesm 5y ago
  These laws are new enough, and clear enough that flouting them routinely isn't going to go down well in court and 'your honor, we've been doing this for years' might get you some extra sanctions. The best way to deal with it is to simply become compliant, it isn't all that hard, 100's of thousands of businesses have adapted and the remainder really has no excuse other than that they are trying to extend their bottom line as long as the legal fees and fines do not exceed their income. The sooner that changes, the better.
- pumnikol 5y ago
_pmf_ 5y ago
> These core values won't change. The Abmahnwesen never dies.
baxtr 5y ago
Maybe. Probably you're right. What I am thinking right now: How will this affect me as European wanting to access US sites? There are already a bunch of sites that completely exclude European traffic on IP level. It's great to have data privacy. I am totally for it. But it comes at a cost. People are not willing to talk about this cost, let alone take it into account when making a decision.
- alibarber 5y ago
  But isn't that a little bit like having your cake and eating it? You get to live in a place that has (democratically) decided to put a particular cost on privacy. That cost being that you don't get to benefit from the cheap-ness of low-privacy offered in other places.
  - jhgb 5y ago
    That sounds like you're against international trade in general, since most countries benefit from buying varying amounts of cheap stuff from other countries, where the rules (and conditions in general) are different. Somehow, for most people, that's not been a problem so far, though.
    - alibarber 5y ago
      I don't think it's really comparable - as the rules at play here are designed to protect the privacy of EU persons. There are plenty of things that I could buy from parts of the US that are considered unsafe in the EU for example, and so it is forbidden for me to engage in trade and get them. They would (theoretically) be confiscated at a border. Despite some politicians best efforts and desires, there's no practical way to stop someone 'importing' privacy damaging web traffic, so the risk of non-compliance is being loaded onto foreign website operators. Therefore should a US website desire to follow EU laws, there would be no restriction on them being accessible to EU people.
      - jhgb 5y ago
        But with international trade you're also eating your cake and having it, too. Doesn't necessarily mean it's the exactly identical cake, and I didn't even claim that. Just that eating your cake and having it too happens all the time.
ckastner 5y ago
> The EU and Germany in particular have decades of privacy regulation and core values behind them. So much this. This is evident, for example, from the very first sentence [1] of the GDPR: The protection of natural persons in relation to the processing of personal data is a fundamental right. [1] https://gdpr.eu/recital-1-data-protection-as-a-fundamental-right/ https://gdpr.eu/recital-1-data-protection-as-a-fundamental-r...
ls15 5y ago
As a consumer I feel more trapped than protected. Instead of really disincentivizing the abuse of data, there is now a complicated network of bureaucracy that has been externalized from the EU via companies to the consumer. For the industry it is now about gathering consent from the user through dark patterns and making sure that each of n rules is fulfilled, while the data itself is most likely just as abused as before.
- mpweiher 5y ago
  > trapped ... dark patterns Yes, this is what it feels like. Now. Because the industry is in a Wil-E-Coyote moment. Their business model has always been more than shady, a shadiness that has now officially been defined as illegal. Industry response to "you are not allowed to do this" has been "but I really wanna", and they think that they can get out of complying with the law via these dark patterns about tricking the user into giving them "consent". All of this crap is illegal. Tricking users into "giving" you "consent" is illegal, as is coercing them. The law is very clear about this. It will take a while for the wheels of justice to grind, but grind they will. In the meantime, we apologise for the inconvenience, but the world will be a better place.
- robin_reala 5y ago
  If you consent it’s definitely as abused as previously, but at least in the EU there’s definitely less abuse of people who choose not to consent.
- bborud 5y ago
  Where the letter of the law is more important than the intent, there's always more wiggle room to screw over the consumer. But where intent and interpretation is given more weight, things tend to be less predictable for businesses. There was a story yesterday about someone getting terribly upset about researchers probing the GDPR compliance of the website of a blogger. Some froth developed around people's mouths as the site in question was called a "victim" and any shrugs seen as "victim-blaming". (And I was thoroughly downvoted for pointing out that calling website owners "victims" was a bit more drama than was called for) GDPR and similar legislation has, as you correctly pointed out, had disappointing results. There is no doubt that stronger regulation is needed to stop companies essentially spying on users for financial gain - just as there is no doubt that regulating this in a way that both helps, and doesn't just become an expensive waste of time, is hard.
jabbi 5y ago
To add to that. Data Protection is "kind of" in the constitution of Germany. In the constitution there is a part about free development of personality. The German constitution court thinks that data protection is necessary to achieve the free development of personality, which is why data protection is constitutional right in Germany.
tomp 5y ago
> but it bites hard Do we actually have any proof of this, over the past years? Most of these legislation are a big hurdle for startups (e.g. you have to have a "chief privacy officer" for GDPR) but at best a hiccup for big tech (no, million, even billion dollar fines are nothing but a hiccup to their uninterrupted business models).
- skinkestek 5y ago
  > Most of these legislation are a big hurdle for startups (e.g. you have to have a "chief privacy officer" for GDPR) but at best a hiccup for big tech (no, million, even billion dollar fines are nothing but a hiccup to their uninterrupted business models). I am a consultant. My colleagues and I work for a number of smaller and larger companies in the Nordic countries and elsewhere. My feeling is this isn't as big a problem as HN makes it out to be. As a small company it seems you'll get questions and free advice first, and then only you'll get fined unless the violation is intentional or so severe that you should have realized. I guess that it is much bigger problem for the megacorportations. I guess in addition to the fines doled out so far they've also spent countless hours both at work and at night to try to get passed GDPR, and also I guess it has slowed down internal processes quite a bit just like the Sarbanes-Oxley Act (SOX) did a couple of decades ago.
  - sdoering 5y ago
    I can only agree. I work for an agency (part of a big consultancy) as well as a freelancer for small businesses. It is really easy to comply. Even if you want to use specific services for which there is no alternative. But more often than not there are alternatives (for cookie consent, for analytics, for hosting, for CMS, for newsletters, and so on). Marketing conversion tracking becomes more effort, though. That's true. Because that would mean handing your user's data to the big monopolies like Google or FB.
parasense 5y ago
> but if there's an overriding reason to protect consumers, then it is entirely irrelevant how long companies have been doing this, how many do this and in what other countries they do it. I hear what you're trying to say, but there are problems with this basis. There is no clear established legal-nexus between the your purported statement of "protecting consumers", and banning the use of any data center owned by multi-national corporate entities who host protected data exclusively internal to the EU in accordance with all known EU data-protection regulations. Now to be clear, I'm not saying this is your statement or position.... but it's what you wrote. So it boils down to a false-dichotomy; This is protectionism, but not to be confused with consumer protection. The protectionism is the kind protecting EU owned & operated data centers. I think analogies are awful, but to give an analogy it's like banning a product sold by any multi-national corporation simply on the basis they are not originally EU multi-national corporations. For instance, banning the sale of McDonald's chicken-nuggets, because McDonald's is a foreign corporation, and then alleging the corporation violate the consumer data protection laws because the nuggets are not EU nuggets It makes no sense because there is no causal-link or rational basis, it's all irrational. Just because irrational laws have been the norm for a while, as you say particularly in Germany, doesn't make them rational now. That's a variation of the ad-populism fallacy.
- trasz 5y ago
  Would you trust your data are secure and protected in a datacenter located in China? It’s the same with the US.
  - viro 5y ago
    I think Lithuania would like a word with you. ¯\_(ツ)_/¯ and other EU states I guess
    - trasz 5y ago
      Lithuania is trying hard to troll China, but realistically, they don’t have anything to say wrt where their data is stored, because they are just too small to have a say.
shadowgovt 5y ago
It's also interesting as an example of jurisdictional conflict. US law grants the US government broad (some would argue over-broad) reach into the digital activities of US-based companies independent of where those companies physically house their data. The great truth of the Internet is that it's a location-disrupting technology: modulo latency, the computer next to me on my desk and a computer in Sydney, Australia are logically exactly as close (by which I mean: fully equivalent whether I'm fetching data from one or the other as a client). But of course location still matters for the oldest location-focused institutions on the planet. I predict that unless higher courts just decide to disregard the reasoning in this case, the resolution here will be either an international treaty between the US and the EU to clarify data access rules here or a simple jurisdictional mess: whether an EU citizen's data can be sniffed by a US company from computers in the US will be entirely up to who's government cares most.

nkmnz 5y ago

The arguments you list in the end are not legal arguments, but political ones, so it’s not a big surprise they are „legally completely irrelevant“ - unless politics turns them into law.

sokoloff 5y ago

“The wheels of justice turn slowly, but grind exceedingly fine.”

selfhoster11 5y ago
Except when it gets stuck on monopolies and oligopolies, but that's not a problem, right?
- uniqueuid 5y ago
  They also grind very selectively. The fundamental hope that democracy is based upon is that they will eventually (in finite time) grind all problems, even if not right away.
  - igorkraw 5y ago
    I'm hopeful. "The logic of political survival" (https://mitpress.mit.edu/books/logic-political-survival https://mitpress.mit.edu/books/logic-political-survival ) is one of many books that make a decent case for democratic systems simply being better than authoritarian (in the long run), the more democratic the better. This old journal article while dated and possibly no longer accurate about the arab world give a military perspective on the same dynamics https://www.meforum.org/441/why-arabs-lose-wars https://www.meforum.org/441/why-arabs-lose-wars It's important to remember that 100 years ago (if you squint, 150 years no contest, there basically was no democracy in the modern sense (universal suffrage, no special rights), kings and queens and aristocrats still held most power and wealth in most places around the world. It's very easy to forget that the descendants of these aristocrats in places where lasting measures against the lingering power of the old rich weren't taken (i.e., they weren't executed and their wealth was left intact) are usually still in the richest 100 families of the country and wield considerable political influence. I will stop here now because dang has repeatedly asked me not to make statements likely to inflame "boring" political discussions but I do think that as more and more people realize that they are not in fact temporarily embarrassed millionaires the old power bases of corruption and uncapped dynastic wealth will follow the way of dynastic hegemony over nations.
    - BitwiseFool 5y ago
      >"the more democratic the better" I no longer believe this to be the case. I am pro-democracy but I am not a suffrage maximalist. During the last election cycle I looked at the myriad of obscure positions I had the right to vote for on the ballot and I realized most of what I was voting for I was unqualified to weigh in on. For instance, why do I vote for the Railroad Commissioner? Why do I vote for my local county's community college board of trustees seat 5 and 6? You could say that I should be informing myself before I go to cast the ballot. While you wouldn't be wrong for saying that is my responsibility as a voter, I can assure you virtually no one actually does this. I also find the down ballot candidate's pitches so generic and milquetoast that there isn't enough substance to actually distinguish between them. What's worse is that the obscure positions have either unopposed candidates or just two. And most of the time, people just look for the (R) or the (D) by the name and that's what they go on.
- intended 5y ago
  The legal wheels are grinding on Amazon for a while because it’s a unique case in america. American courts check if something harms consumers, and Amazon is able to show that it transfers the lowest cost to its customers. One of the biggest legal changes in the past few years was a new direction altogether to determine anticompetitive behavior. If I recall correctly, FB’a recent acquisition of giphy (?) was also stopped on anti competitive grounds. Point being that this stuff isn’t necessarily easy, the other side has very good lawyers who tell them what not to do on top of this being novel.
  - gumby 5y ago
    > The legal wheels are grinding on Amazon for a while because it’s a unique case in america. American courts check if something harms consumers... It’s not unique at all. The old trusts that were broken up at the dawn of antitrust (that’s where the name comes from) were of a similar structure and even more dominant. The “consumer harm” test (really “short term consumer cost” test) was a deliberate crippling of antitrust doctrine during the Reagan era. The process is only now starting to return to its roots. Consumers can be harmed by a low price when it is predatory, either to drive out competitors (so price can go up later) or to transfer business to a monopolist who can charge higher prices elsewhere and/or stave off competitive technological or entrepreneurial threats. This doctrine blessed such predatory tactics while pretending to be a high-minded consumer-friendly approach.
    - pessimizer 5y ago
      > The process is only now starting to return to its roots. I'd like to cynically say that the rhetoric and arguments have finally started to return to their roots within this particular administration, but there's no evidence of a process actually being carried to completion yet.
      - gumby 5y ago
        There’s been legal theory movement over the past 15 years or so to revisit this shift. All you’re seeing now is some of the peaks of an undersea mountain range. This movement has been gaining in different agencies for years. I think it’s a secular shift rather than something administration-specific. Of course the rentiers can still squash things, and will. But I think the tide is against them. Matt Stoller has done great work both documenting this and contributing.
- gumby 5y ago
  I think the justice department hasn’t gotten involved in those cases for the last 40 years so, no, they don’t get stuck on them at all. :-( Fortunately antitrust appears to be moving back to its century-plus-old roots.
BitwiseFool 5y ago
I want to believe this, but I sense this is just a comfortable platitude we tell ourselves. There are countless examples of both high and low profile injustices that have been carried out with no substantial consequences. You could say it is selection bias that I look towards those, but in the case of refuting an assertion, I think they count.

sharken 5y ago

[flagged]

phh 5y ago

FWIW my stance on privacy regulation is that it is severely needed, both for consumers AND for businesses, because data deregulation can only lead to unbreakable monopolies, while fully applied GDPR allows user to resell the private data Google got on them, to the next, newcomer, bidder. That being said I don't really agree with the premise of your comment. A law that isn't applied shouldn't be considered a law, and saying "you should just have applied the law from the start" isn't always fair. For instance, in France, woman were not allowed to wear trousers until maybe 5 or 10 years ago. French privacy laws 1980s already had a real scope on privacy, but it was barely applied. Applying a 40 years old law out of nowhere would simply be targeted attacks to the current disgraced company. Now, GDPR is really recent, so I won't put it in the "hasn't been used for so long it's dead" basket. Though I kinda think that the portability part of GDPR will (I'm crossing fingers it will still happen, because I think it's the best part)

dash2 5y ago
> For instance, in France, woman were not allowed to wear trousers until maybe 5 or 10 years ago. That law was a dead letter from 1800. It’s the equivalent of the old English law memes, like that you can shoot an arrow at a Welshman within the precinct of Hereford.
- bryanrasmussen 5y ago
  that seems to have been the parent comment's point?
  - ClumsyPilot 5y ago
    Id we dont enforce privacy for 200 years, then he'd have a point
    - phh 5y ago
      It's been 44 years in France. It was older than current facebook's age when facebook appeared. France abolished the guillotine more recently than this privacy law pased in France. When I was born, it was already no longer discussed. It's not 200 years old, but it definitely is OLD.

ciarcode 5y ago

Perfect summary of what is happening right now in Europe. German citizen in particular have a strong privacy-oriented culture after what happened during WWII. https://time.com/5290043/nazi-history-eu-data-privacy-gdpr/?amp=true https://time.com/5290043/nazi-history-eu-data-privacy-gdpr/?...

woodpanel 5y ago
I'm always amazed by my countrymen chest-pounding themselves about their alledged cultural resilience against the surveilance state. Not only did none of us live during the Nazi-Era, but most of us that lived at least during the Stasi-Era (in the West) are routinely falling short of living up to their own moral standards. They champion getting rid off tax-privacy, they champion getting rid off non-digital currency, they champion blocking social-networks because of "foreign desinformation" (i.e. domestic opposition), they take no offense that a think-tank owned for-profit media-conglomerate does the domestic deletion and blocking of social media accounts (Bertelsmann > Arvato -> FB/Twitter/…). And most hilariously, progressive luminaries like Daniel Cohn-Bendit or Volker Beck – which during the 1980s gained political traction by "fighting" against having A NATIONAL CENSUS AT ALL – are nowadays championing throwing out medical-data privacy alltogether and having to hand out your unlocked phone to the police at their whim. (Needless to say how cultural chest-pounding thouse luminaries were in the 1980s)
- cycomanic 5y ago
  > And most hilariously, progressive luminaries like Daniel Cohn-Bendit or Volker Beck – which during the 1980s gained political traction by "fighting" against having A NATIONAL CENSUS AT ALL – are nowadays championing throwing out medical-data privacy alltogether and having to hand out your unlocked phone to the police at their whim. Can you provide some sources for that, I haven't closely followed German politics in recent years (as I've been living overseas), but I'm quite surprised that DCB would champion police search powers like that.
- pasabagi 5y ago
  I think the idea that germans are the victims of history (and that's why they're so sensitive about oppression) is actually older than the stasi, or the nazis. Hitler, for instance, uses the theme an awful lot in his speeches. It just got a big boost from the post-holocaust psychological judo where germans recast themselves as the victims of the nazi dictatorship, rather than the enthusiastic supporters. It leads to some funny statements, to be sure. The woman who said she felt like Sophie Scholl because she had been in coronavirus lockdown was one example - but honestly, if you mess with somebody's parking place, they're about two sentences away from saying you're literally the NS-diktatur. Still, if it leads to a sense of urgency over privacy, I'm all for it.

sebow 5y ago

> it's legally important to account for entrepreneurial freedom (guaranteed by the constitution) Is this even true for any european country? Don't get me wrong, this is vastly applies right now and the only problems appear at a high level, but If i'm not mistaken no european country has a fundamental text that protects what you're talking about.

nehalem 5y ago

While true in essence, I don’t think that the German society broadly shares the value of privacy to a level that warrants such excessive restrictions. It is important to note that Germany‘s tradition of data protection originates from a fear of government overreach through excessive data collection (the original constitutional court decision concerned the census). In my opinion data protection got out of hand when the same standards were applied to private entities while increasingly neglecting the proportionality test, or — less legalese — a risk benefit analysis. It is common in German jurisprudence to widen the scope of protection (‚everything‘ is personal data) but the proportionality test is strict (it’s okay to transfer personal data because the gains outweigh the risks as the data is only moderately private). I think that softening of the proportionally criterion has been influenced by a general fear that every datapoint might be somehow relevant even if there is little evidence. (Disclaimer: Legal theory is slightly simplified, but true to principle)

uniqueuid 5y ago
I agree that there is a widespread feeling that legal protections are missing reality (wirklichkeitsfremd). But I'd argue that the roots of Germany's focus on privacy are not only rooted in protection against the state. Yes, constitutional fundamental rights are protections against the state (Abwehrrechte), but the legal interpretation established by the supreme court also draws on an ideal-typical perception of citizens as informed, rational and responsible people (mündige Bürger), who - through education, intelligence, moral values, dedication and pro-social behavior - create and sustain society. Such self-determined citizens cannot exist in the face of overbearing, and especially invisible or intractable (!) external coercion. That's also the root of informed consent, of course. So in this sense, privacy protections are a safeguard against dumbing down citizens, and I think the general intent is indeed valid.
- tomxor 5y ago
  > perception of citizens as informed, rational and responsible people (mündige Bürger), who - through education, intelligence, moral values, dedication and pro-social behavior - create and sustain society. [...] Such self-determined citizens cannot exist in the face of overbearing, and especially invisible or intractable (!) external coercion. That's excellent, it's these type of arguments that get too little attention when digital "privacy" gets discussed today.

rusk 5y ago

> it is entirely irrelevant how long companies have been doing this I always thought this. I was recently introduced to the concept of “practice prevails” whereby if you’ve been routinely flouting a rule, and that rule has never been enforced that you can claim the rule is obsolete. I think it’s mainly confined to contract law but it does help to explain the standpoint of those who oppose such retrospective regulatory measures.

uniqueuid 5y ago
IANAL but I don't think this holds in competition law and even less in constitutional law (of course).
jacquesm 5y ago
These laws are new enough, and clear enough that flouting them routinely isn't going to go down well in court and 'your honor, we've been doing this for years' might get you some extra sanctions. The best way to deal with it is to simply become compliant, it isn't all that hard, 100's of thousands of businesses have adapted and the remainder really has no excuse other than that they are trying to extend their bottom line as long as the legal fees and fines do not exceed their income. The sooner that changes, the better.
pumnikol 5y ago

_pmf_ 5y ago

> These core values won't change. The Abmahnwesen never dies.

baxtr 5y ago

Maybe. Probably you're right. What I am thinking right now: How will this affect me as European wanting to access US sites? There are already a bunch of sites that completely exclude European traffic on IP level. It's great to have data privacy. I am totally for it. But it comes at a cost. People are not willing to talk about this cost, let alone take it into account when making a decision.

alibarber 5y ago
But isn't that a little bit like having your cake and eating it? You get to live in a place that has (democratically) decided to put a particular cost on privacy. That cost being that you don't get to benefit from the cheap-ness of low-privacy offered in other places.
- jhgb 5y ago
  That sounds like you're against international trade in general, since most countries benefit from buying varying amounts of cheap stuff from other countries, where the rules (and conditions in general) are different. Somehow, for most people, that's not been a problem so far, though.
  - alibarber 5y ago
    I don't think it's really comparable - as the rules at play here are designed to protect the privacy of EU persons. There are plenty of things that I could buy from parts of the US that are considered unsafe in the EU for example, and so it is forbidden for me to engage in trade and get them. They would (theoretically) be confiscated at a border. Despite some politicians best efforts and desires, there's no practical way to stop someone 'importing' privacy damaging web traffic, so the risk of non-compliance is being loaded onto foreign website operators. Therefore should a US website desire to follow EU laws, there would be no restriction on them being accessible to EU people.
    - jhgb 5y ago
      But with international trade you're also eating your cake and having it, too. Doesn't necessarily mean it's the exactly identical cake, and I didn't even claim that. Just that eating your cake and having it too happens all the time.

ckastner 5y ago

> The EU and Germany in particular have decades of privacy regulation and core values behind them. So much this. This is evident, for example, from the very first sentence [1] of the GDPR: The protection of natural persons in relation to the processing of personal data is a fundamental right. [1] https://gdpr.eu/recital-1-data-protection-as-a-fundamental-right/ https://gdpr.eu/recital-1-data-protection-as-a-fundamental-r...

ls15 5y ago

As a consumer I feel more trapped than protected. Instead of really disincentivizing the abuse of data, there is now a complicated network of bureaucracy that has been externalized from the EU via companies to the consumer. For the industry it is now about gathering consent from the user through dark patterns and making sure that each of n rules is fulfilled, while the data itself is most likely just as abused as before.

mpweiher 5y ago
> trapped ... dark patterns Yes, this is what it feels like. Now. Because the industry is in a Wil-E-Coyote moment. Their business model has always been more than shady, a shadiness that has now officially been defined as illegal. Industry response to "you are not allowed to do this" has been "but I really wanna", and they think that they can get out of complying with the law via these dark patterns about tricking the user into giving them "consent". All of this crap is illegal. Tricking users into "giving" you "consent" is illegal, as is coercing them. The law is very clear about this. It will take a while for the wheels of justice to grind, but grind they will. In the meantime, we apologise for the inconvenience, but the world will be a better place.
robin_reala 5y ago
If you consent it’s definitely as abused as previously, but at least in the EU there’s definitely less abuse of people who choose not to consent.
bborud 5y ago
Where the letter of the law is more important than the intent, there's always more wiggle room to screw over the consumer. But where intent and interpretation is given more weight, things tend to be less predictable for businesses. There was a story yesterday about someone getting terribly upset about researchers probing the GDPR compliance of the website of a blogger. Some froth developed around people's mouths as the site in question was called a "victim" and any shrugs seen as "victim-blaming". (And I was thoroughly downvoted for pointing out that calling website owners "victims" was a bit more drama than was called for) GDPR and similar legislation has, as you correctly pointed out, had disappointing results. There is no doubt that stronger regulation is needed to stop companies essentially spying on users for financial gain - just as there is no doubt that regulating this in a way that both helps, and doesn't just become an expensive waste of time, is hard.

jabbi 5y ago

To add to that. Data Protection is "kind of" in the constitution of Germany. In the constitution there is a part about free development of personality. The German constitution court thinks that data protection is necessary to achieve the free development of personality, which is why data protection is constitutional right in Germany.

tomp 5y ago

> but it bites hard Do we actually have any proof of this, over the past years? Most of these legislation are a big hurdle for startups (e.g. you have to have a "chief privacy officer" for GDPR) but at best a hiccup for big tech (no, million, even billion dollar fines are nothing but a hiccup to their uninterrupted business models).

skinkestek 5y ago
> Most of these legislation are a big hurdle for startups (e.g. you have to have a "chief privacy officer" for GDPR) but at best a hiccup for big tech (no, million, even billion dollar fines are nothing but a hiccup to their uninterrupted business models). I am a consultant. My colleagues and I work for a number of smaller and larger companies in the Nordic countries and elsewhere. My feeling is this isn't as big a problem as HN makes it out to be. As a small company it seems you'll get questions and free advice first, and then only you'll get fined unless the violation is intentional or so severe that you should have realized. I guess that it is much bigger problem for the megacorportations. I guess in addition to the fines doled out so far they've also spent countless hours both at work and at night to try to get passed GDPR, and also I guess it has slowed down internal processes quite a bit just like the Sarbanes-Oxley Act (SOX) did a couple of decades ago.
- sdoering 5y ago
  I can only agree. I work for an agency (part of a big consultancy) as well as a freelancer for small businesses. It is really easy to comply. Even if you want to use specific services for which there is no alternative. But more often than not there are alternatives (for cookie consent, for analytics, for hosting, for CMS, for newsletters, and so on). Marketing conversion tracking becomes more effort, though. That's true. Because that would mean handing your user's data to the big monopolies like Google or FB.

parasense 5y ago

> but if there's an overriding reason to protect consumers, then it is entirely irrelevant how long companies have been doing this, how many do this and in what other countries they do it. I hear what you're trying to say, but there are problems with this basis. There is no clear established legal-nexus between the your purported statement of "protecting consumers", and banning the use of any data center owned by multi-national corporate entities who host protected data exclusively internal to the EU in accordance with all known EU data-protection regulations. Now to be clear, I'm not saying this is your statement or position.... but it's what you wrote. So it boils down to a false-dichotomy; This is protectionism, but not to be confused with consumer protection. The protectionism is the kind protecting EU owned & operated data centers. I think analogies are awful, but to give an analogy it's like banning a product sold by any multi-national corporation simply on the basis they are not originally EU multi-national corporations. For instance, banning the sale of McDonald's chicken-nuggets, because McDonald's is a foreign corporation, and then alleging the corporation violate the consumer data protection laws because the nuggets are not EU nuggets It makes no sense because there is no causal-link or rational basis, it's all irrational. Just because irrational laws have been the norm for a while, as you say particularly in Germany, doesn't make them rational now. That's a variation of the ad-populism fallacy.

trasz 5y ago
Would you trust your data are secure and protected in a datacenter located in China? It’s the same with the US.
- viro 5y ago
  I think Lithuania would like a word with you. ¯\_(ツ)_/¯ and other EU states I guess
  - trasz 5y ago
    Lithuania is trying hard to troll China, but realistically, they don’t have anything to say wrt where their data is stored, because they are just too small to have a say.

shadowgovt 5y ago

It's also interesting as an example of jurisdictional conflict. US law grants the US government broad (some would argue over-broad) reach into the digital activities of US-based companies independent of where those companies physically house their data. The great truth of the Internet is that it's a location-disrupting technology: modulo latency, the computer next to me on my desk and a computer in Sydney, Australia are logically exactly as close (by which I mean: fully equivalent whether I'm fetching data from one or the other as a client). But of course location still matters for the oldest location-focused institutions on the planet. I predict that unless higher courts just decide to disregard the reasoning in this case, the resolution here will be either an international treaty between the US and the EU to clarify data access rules here or a simple jurisdictional mess: whether an EU citizen's data can be sniffed by a US company from computers in the US will be entirely up to who's government cares most.