8 ms·

While true in essence, I don’t think that the German society broadly shares the value of privacy to a level that warrants such excessive restrictions. It is imp

While true in essence, I don’t think that the German society broadly shares the value of privacy to a level that warrants such excessive restrictions. It is important to note that Germany‘s tradition of data protection originates from a fear of government overreach through excessive data collection (the original constitutional court decision concerned the census). In my opinion data protection got out of hand when the same standards were applied to private entities while increasingly neglecting the proportionality test, or — less legalese — a risk benefit analysis. It is common in German jurisprudence to widen the scope of protection (‚everything‘ is personal data) but the proportionality test is strict (it’s okay to transfer personal data because the gains outweigh the risks as the data is only moderately private). I think that softening of the proportionally criterion has been influenced by a general fear that every datapoint might be somehow relevant even if there is little evidence. (Disclaimer: Legal theory is slightly simplified, but true to principle)

uniqueuid 5y ago
I agree that there is a widespread feeling that legal protections are missing reality (wirklichkeitsfremd). But I'd argue that the roots of Germany's focus on privacy are not only rooted in protection against the state. Yes, constitutional fundamental rights are protections against the state (Abwehrrechte), but the legal interpretation established by the supreme court also draws on an ideal-typical perception of citizens as informed, rational and responsible people (mündige Bürger), who - through education, intelligence, moral values, dedication and pro-social behavior - create and sustain society. Such self-determined citizens cannot exist in the face of overbearing, and especially invisible or intractable (!) external coercion. That's also the root of informed consent, of course. So in this sense, privacy protections are a safeguard against dumbing down citizens, and I think the general intent is indeed valid.
- tomxor 5y ago
  > perception of citizens as informed, rational and responsible people (mündige Bürger), who - through education, intelligence, moral values, dedication and pro-social behavior - create and sustain society. [...] Such self-determined citizens cannot exist in the face of overbearing, and especially invisible or intractable (!) external coercion. That's excellent, it's these type of arguments that get too little attention when digital "privacy" gets discussed today.
- mellavora 5y ago
  In support of the ideal of citizens as informed, rational and responsible people (mündige Bürger). This is a foundational assumption of post-Hobbesian democracy, which asserts that power originates from the people and is delegated to the government (contrast to other political philosophies such as divine right of rule etc). so the consequence of 'dumbing down citizens' is a destruction of the legitimacy of the government. Just as if the king rules by divine right, he would be silly to promote atheism.
Semaphor 5y ago
As Google Maps Street View showed back then [0], the public at large cares exactly as much about privacy as the media tells them to care about. [0] a huge amount of misinformation going on, making people think there would be live cameras showing them on street view. At least to me, it felt like manufactured outrage by people who didn't understand what was going on (neither the instigators, nor the outraged). edit: It was mainstream enough that there were articles about it: "Webforscher Humer glaubt, die deutsche Skepsis basiere auf falschen Vorstellungen zu Street View. Viele Menschen würden davon ausgehen, dass Google Live-Bilder übertragen wolle" - https://www.onlinekosten.de/news/webexperte-deutsche-verstehen-street-view-nicht_179437.html https://www.onlinekosten.de/news/webexperte-deutsche-versteh... I remember more from the local press back then. But it's hard to find sources about it now.
- detaro 5y ago
  > making people think there would be live cameras showing them on street view that was in no way a mainstream "idea" about it.
  - planb 5y ago
    Oh yes it was! Did you talk to „normal people“ in Germany back then? It’s not like that was the way it was reported by the media, but that’s what people understood.
    - detaro 5y ago
      Yes, and I never encountered that sentiment from actual people.
- pmontra 5y ago
  I really never understood why Germans don't like to expose the outside of their public facing houses to Street View. It would be very frustrating not to be able to see in advance where I'll be going to the next day and prepare accordingly. Examples: Is that shop really at that address? Is there some parking in front of that house? I've been using Street View like that for ages.
pmontra 5y ago
I understand your argument and I agree that all of this is excessive and maybe spiraling out of control. However the core of the case is "I'm German, that web site is Danish, my personal data have no reason to be in the reach of the US government." By the way, Germany and Denmark share a land border. I think it's difficult to argue that even with the cloud it's not easy to explain why to access a Danish university from Germany one couldn't use an EU only set of technology providers. Of course using Akamai (a well known company) is easier than researching, assessing and using some relatively unknown European solution. I'm European, I'd have to Google (ironically) for one.
- germanier 5y ago
  The case is about a German public university, owned by and located in the state of Hessia, that uses a Danish service provider to manage cookies on their website, which in turn uses Akamai. That by the way is the reason this whole thing is tried at the administrative court - the defendant is the state itself.
- rndgermandude 5y ago
  The university is German, their website is therefore "German". They just use a "cookie consent tool" by a Danish company, which in turn processes data using Akamai's infrastructure. I find it problematic that the university requires any cookie consent whatsoever in the first place. They are a public institution (Körperschaft des öffentlichen Rechts), not even a "company" but state-owned, and they run basically a static website and shouldn't have a need for cookies. Any "member" area (students and faculty) would require an account anyway, where you can and have to ask for all kinds of consent during signup anyway. I get the Danish company doesn't want to run a CDN (with DDoS mitigations and all that) on their own, and it's a real problem that the EU economy snoozed when it came to creating competitors to Akamai, Cloudflare, AWS/GCP/Azure. There is a sliver of hope that court decisions like this will create a "demand" for such platforms within the EU, and that finally some companies with some "investment" money to spare (we still have plenty "rich" companies) will fund that. Or maybe at least the US providers will find way to create EU "subsidiaries" which are actually legally shielded from US (and other non-EU) law.
junon 5y ago
> I don’t think that the German society broadly shares the value of privacy to a level that warrants such excessive restrictions I live here. Privacy awareness is very high, compared to everywhere else I've personally been. Nobody likes having their picture taken, nobody likes being filmed, nobody likes answering questions for strangers. And they'll tell it to your face too. Go onto Google street maps for Germany and see how far you get.
- Sebb767 5y ago
  To be fair, recent tech has eroded that a lot. People are still not happy about all of it, but the resistance has been dropping - usage of Facebook and Google products is now pretty widespread and people (especially young ones) seem to be far more lenient in that regard.
  - pasabagi 5y ago
    On the other hand, the proliferation of hacking and fraud could drive a swing to the opposite direction. It's got to the point where being hacked, blackmailed, or being the target of fraud is a regular occurrence, and a lot of that is driven by hackers having easy access to private data which lends plausibility to emails or text messages. When you get to the point where judges and lawmakers have, more likely than not, personal experience of threatening emails containing private information, there's a lot of incentive to reduce the amount of data collection - and correspondingly, a lot of popular support for the idea.
  - ATsch 5y ago
    I think this is less due to a genuine change of heart and more because the lack of enforcement by the government in regards to big tech has left people without much choice.
    - Sebb767 5y ago
      You always have a choice. But you can't deny that the services offered by these companies are really good and, not to mention, completely free. It's easy to give up long term drawbacks for short term benefits.
usrbinbash 5y ago
> I don’t think that the German society broadly shares the value of privacy to a level that warrants such excessive restrictions. Even if that is the case, it would still not be an argument against such regulations. If someone else is okay with the data transfer, he can opt-in if he wants to. I should not carry the burden of having to opt-out of it.
nehalem 5y ago
I disagree with both (longer) replies — but sure appreciate the style of debate. The reason to allow data transfer to the US for (arguably) trivial data is that a private entity might choose Akamai as their subjectively best option. Restricting data flow for (arguably) no good reason puts restrictions on other who can invoke their own fundamental rights. Leaving aside that it’s also not great to force the technologically inferior solution for (arguably) moot policy reasons. As to the argument of informed consent, I think that’s another severe misconception. In my opinion, consent is only one option to legalise data processing. The fact that GDPR (and older German legislation) lists legitimate interest is important. We should — in my opinion — not fall for the fallacy that data is a whole different universe that can be split off from everything else. For most of our lives, data just flows with contracts, relationships, torts and whatnot. I do acknowledge that in the case, the university is Public and does not have (relevant) fundamental rights. Also that web analytics is likely one of the consent only scenarios. But we’re drifting into theory anyway.
- ClumsyPilot 5y ago
  >"The reason to allow data transfer to the US for (arguably) trivial data is that a private entity might choose Akamai as their subjectively best option" And what if it's China/Russia, and its 'best' because it pays for private data? Does the argument still hold? At the end of the day, this is simple: is it my data, or not? If it's my property, why should someone elae have freedom over it?
  - mellavora 5y ago
    Or, for a not-far-fetched example, say the data goes to a country where 1) you have relatives, and 2) homosexuality is a capital offense, and your search results may be use to implicate you of homosexuality, or by extension your relatives in that country, and the country's police are monitoring search histories.
    - ClumsyPilot 5y ago
      Actually that is an excellent point, this is a real possibility for immigrants from the middle east and some other places
estaseuropano 5y ago
10 year old survey, but it seems the data disagrees with your perception. I'd imagine since then awareness has risen massively, so if anything people would likely be more concerned today. https://joinup.ec.europa.eu/sites/default/files/document/2014-12/Part%20I%20of%20Special%20Eurobarometer%20359%20-%20Attitudes%20on%20Data%20Protection%20and%20Electronic%20Identity%20in%20the%20European%20Union.pdf https://joinup.ec.europa.eu/sites/default/files/document/201... See page 55 for per country chart.
- freeflight 5y ago
  > I'd imagine since then awareness has risen massively, so if anything people would likely be more concerned today. It's sadly the opposite; It's so normalized that a whole generation was born into it and don't even see anything wrong about it. All a lot of them see is how Google is giving them "free services" and how Facebook allows them to make "free friends", and then they declare; That's the web, and that's how the web has always been and how it should be. And who can blame them; They never knew any other web than the glorified digital mall [0] it has mostly become. [0] https://staltz.com/the-web-began-dying-in-2014-heres-how.html https://staltz.com/the-web-began-dying-in-2014-heres-how.htm...
bserge 5y ago
telmo 5y ago
> While true in essence, I don’t think that the German society broadly shares the value of privacy to a level that warrants such excessive restrictions. You are wrong. I have been living in Germany for almost a decade and it absolutely does. In fact, it is one of the things that I appreciate the most about German culture. Maybe privacy preferences are a bit incoherent sometimes, but nothing is perfect, and I much prefer that we err on the side of protecting privacy too much than too little. Especially in this brave new world we live in, were culture is being slowly but surly manipulated by powerful interests to erode the right to privacy more and more.
raxxorrax 5y ago
I disagree. Aside from the possiblity of collected data landing in the hands of government fairly easily, this isn't the only reason for privacy protection. I would also dispite that it got out of hand in some cases, although it is often just applied wrongly. It isn't as popular anymore since the normal user is just annoyed by the cookie popups and in his mind data protection instead of the site owner tracking people like there is no tomorrow.

uniqueuid 5y ago

I agree that there is a widespread feeling that legal protections are missing reality (wirklichkeitsfremd). But I'd argue that the roots of Germany's focus on privacy are not only rooted in protection against the state. Yes, constitutional fundamental rights are protections against the state (Abwehrrechte), but the legal interpretation established by the supreme court also draws on an ideal-typical perception of citizens as informed, rational and responsible people (mündige Bürger), who - through education, intelligence, moral values, dedication and pro-social behavior - create and sustain society. Such self-determined citizens cannot exist in the face of overbearing, and especially invisible or intractable (!) external coercion. That's also the root of informed consent, of course. So in this sense, privacy protections are a safeguard against dumbing down citizens, and I think the general intent is indeed valid.

tomxor 5y ago
> perception of citizens as informed, rational and responsible people (mündige Bürger), who - through education, intelligence, moral values, dedication and pro-social behavior - create and sustain society. [...] Such self-determined citizens cannot exist in the face of overbearing, and especially invisible or intractable (!) external coercion. That's excellent, it's these type of arguments that get too little attention when digital "privacy" gets discussed today.
mellavora 5y ago
In support of the ideal of citizens as informed, rational and responsible people (mündige Bürger). This is a foundational assumption of post-Hobbesian democracy, which asserts that power originates from the people and is delegated to the government (contrast to other political philosophies such as divine right of rule etc). so the consequence of 'dumbing down citizens' is a destruction of the legitimacy of the government. Just as if the king rules by divine right, he would be silly to promote atheism.

Semaphor 5y ago

As Google Maps Street View showed back then [0], the public at large cares exactly as much about privacy as the media tells them to care about. [0] a huge amount of misinformation going on, making people think there would be live cameras showing them on street view. At least to me, it felt like manufactured outrage by people who didn't understand what was going on (neither the instigators, nor the outraged). edit: It was mainstream enough that there were articles about it: "Webforscher Humer glaubt, die deutsche Skepsis basiere auf falschen Vorstellungen zu Street View. Viele Menschen würden davon ausgehen, dass Google Live-Bilder übertragen wolle" - https://www.onlinekosten.de/news/webexperte-deutsche-verstehen-street-view-nicht_179437.html https://www.onlinekosten.de/news/webexperte-deutsche-versteh... I remember more from the local press back then. But it's hard to find sources about it now.

detaro 5y ago
> making people think there would be live cameras showing them on street view that was in no way a mainstream "idea" about it.
- planb 5y ago
  Oh yes it was! Did you talk to „normal people“ in Germany back then? It’s not like that was the way it was reported by the media, but that’s what people understood.
  - detaro 5y ago
    Yes, and I never encountered that sentiment from actual people.
pmontra 5y ago
I really never understood why Germans don't like to expose the outside of their public facing houses to Street View. It would be very frustrating not to be able to see in advance where I'll be going to the next day and prepare accordingly. Examples: Is that shop really at that address? Is there some parking in front of that house? I've been using Street View like that for ages.

pmontra 5y ago

I understand your argument and I agree that all of this is excessive and maybe spiraling out of control. However the core of the case is "I'm German, that web site is Danish, my personal data have no reason to be in the reach of the US government." By the way, Germany and Denmark share a land border. I think it's difficult to argue that even with the cloud it's not easy to explain why to access a Danish university from Germany one couldn't use an EU only set of technology providers. Of course using Akamai (a well known company) is easier than researching, assessing and using some relatively unknown European solution. I'm European, I'd have to Google (ironically) for one.

germanier 5y ago
The case is about a German public university, owned by and located in the state of Hessia, that uses a Danish service provider to manage cookies on their website, which in turn uses Akamai. That by the way is the reason this whole thing is tried at the administrative court - the defendant is the state itself.
rndgermandude 5y ago
The university is German, their website is therefore "German". They just use a "cookie consent tool" by a Danish company, which in turn processes data using Akamai's infrastructure. I find it problematic that the university requires any cookie consent whatsoever in the first place. They are a public institution (Körperschaft des öffentlichen Rechts), not even a "company" but state-owned, and they run basically a static website and shouldn't have a need for cookies. Any "member" area (students and faculty) would require an account anyway, where you can and have to ask for all kinds of consent during signup anyway. I get the Danish company doesn't want to run a CDN (with DDoS mitigations and all that) on their own, and it's a real problem that the EU economy snoozed when it came to creating competitors to Akamai, Cloudflare, AWS/GCP/Azure. There is a sliver of hope that court decisions like this will create a "demand" for such platforms within the EU, and that finally some companies with some "investment" money to spare (we still have plenty "rich" companies) will fund that. Or maybe at least the US providers will find way to create EU "subsidiaries" which are actually legally shielded from US (and other non-EU) law.

junon 5y ago

> I don’t think that the German society broadly shares the value of privacy to a level that warrants such excessive restrictions I live here. Privacy awareness is very high, compared to everywhere else I've personally been. Nobody likes having their picture taken, nobody likes being filmed, nobody likes answering questions for strangers. And they'll tell it to your face too. Go onto Google street maps for Germany and see how far you get.

Sebb767 5y ago
To be fair, recent tech has eroded that a lot. People are still not happy about all of it, but the resistance has been dropping - usage of Facebook and Google products is now pretty widespread and people (especially young ones) seem to be far more lenient in that regard.
- pasabagi 5y ago
  On the other hand, the proliferation of hacking and fraud could drive a swing to the opposite direction. It's got to the point where being hacked, blackmailed, or being the target of fraud is a regular occurrence, and a lot of that is driven by hackers having easy access to private data which lends plausibility to emails or text messages. When you get to the point where judges and lawmakers have, more likely than not, personal experience of threatening emails containing private information, there's a lot of incentive to reduce the amount of data collection - and correspondingly, a lot of popular support for the idea.
- ATsch 5y ago
  I think this is less due to a genuine change of heart and more because the lack of enforcement by the government in regards to big tech has left people without much choice.
  - Sebb767 5y ago
    You always have a choice. But you can't deny that the services offered by these companies are really good and, not to mention, completely free. It's easy to give up long term drawbacks for short term benefits.

usrbinbash 5y ago

> I don’t think that the German society broadly shares the value of privacy to a level that warrants such excessive restrictions. Even if that is the case, it would still not be an argument against such regulations. If someone else is okay with the data transfer, he can opt-in if he wants to. I should not carry the burden of having to opt-out of it.

nehalem 5y ago

I disagree with both (longer) replies — but sure appreciate the style of debate. The reason to allow data transfer to the US for (arguably) trivial data is that a private entity might choose Akamai as their subjectively best option. Restricting data flow for (arguably) no good reason puts restrictions on other who can invoke their own fundamental rights. Leaving aside that it’s also not great to force the technologically inferior solution for (arguably) moot policy reasons. As to the argument of informed consent, I think that’s another severe misconception. In my opinion, consent is only one option to legalise data processing. The fact that GDPR (and older German legislation) lists legitimate interest is important. We should — in my opinion — not fall for the fallacy that data is a whole different universe that can be split off from everything else. For most of our lives, data just flows with contracts, relationships, torts and whatnot. I do acknowledge that in the case, the university is Public and does not have (relevant) fundamental rights. Also that web analytics is likely one of the consent only scenarios. But we’re drifting into theory anyway.

ClumsyPilot 5y ago
>"The reason to allow data transfer to the US for (arguably) trivial data is that a private entity might choose Akamai as their subjectively best option" And what if it's China/Russia, and its 'best' because it pays for private data? Does the argument still hold? At the end of the day, this is simple: is it my data, or not? If it's my property, why should someone elae have freedom over it?
- mellavora 5y ago
  Or, for a not-far-fetched example, say the data goes to a country where 1) you have relatives, and 2) homosexuality is a capital offense, and your search results may be use to implicate you of homosexuality, or by extension your relatives in that country, and the country's police are monitoring search histories.
  - ClumsyPilot 5y ago
    Actually that is an excellent point, this is a real possibility for immigrants from the middle east and some other places

estaseuropano 5y ago

10 year old survey, but it seems the data disagrees with your perception. I'd imagine since then awareness has risen massively, so if anything people would likely be more concerned today. https://joinup.ec.europa.eu/sites/default/files/document/2014-12/Part%20I%20of%20Special%20Eurobarometer%20359%20-%20Attitudes%20on%20Data%20Protection%20and%20Electronic%20Identity%20in%20the%20European%20Union.pdf https://joinup.ec.europa.eu/sites/default/files/document/201... See page 55 for per country chart.

freeflight 5y ago
> I'd imagine since then awareness has risen massively, so if anything people would likely be more concerned today. It's sadly the opposite; It's so normalized that a whole generation was born into it and don't even see anything wrong about it. All a lot of them see is how Google is giving them "free services" and how Facebook allows them to make "free friends", and then they declare; That's the web, and that's how the web has always been and how it should be. And who can blame them; They never knew any other web than the glorified digital mall [0] it has mostly become. [0] https://staltz.com/the-web-began-dying-in-2014-heres-how.html https://staltz.com/the-web-began-dying-in-2014-heres-how.htm...

bserge 5y ago

telmo 5y ago

> While true in essence, I don’t think that the German society broadly shares the value of privacy to a level that warrants such excessive restrictions. You are wrong. I have been living in Germany for almost a decade and it absolutely does. In fact, it is one of the things that I appreciate the most about German culture. Maybe privacy preferences are a bit incoherent sometimes, but nothing is perfect, and I much prefer that we err on the side of protecting privacy too much than too little. Especially in this brave new world we live in, were culture is being slowly but surly manipulated by powerful interests to erode the right to privacy more and more.

raxxorrax 5y ago

I disagree. Aside from the possiblity of collected data landing in the hands of government fairly easily, this isn't the only reason for privacy protection. I would also dispite that it got out of hand in some cases, although it is often just applied wrongly. It isn't as popular anymore since the normal user is just annoyed by the cookie popups and in his mind data protection instead of the site owner tracking people like there is no tomorrow.