4 ms·

> The EU is merely leading the way here, you can expect all of the developed world to have similar data protection laws on the books sooner or later. While i d

> The EU is merely leading the way here, you can expect all of the developed world to have similar data protection laws on the books sooner or later. While i do believe in being privacy conscious, i don't believe that this will be the case anytime soon (or at least until a generational shift happens). No business is interested in having to suddenly comply with such regulations and essentially no longer being able to utilize the data of individuals however they please. Ergo, corporate interests will probably lead to lots of lobbying in this regard, just look at what happened with net neutrality and the advertising around it. > Operating in the EU is not a liability if you treat your users data in a respectful and responsible way. I think that all of this boils down to profit margins and viewing people as just numbers on a sheet somewhere, to extract wealth from. Just look at how scummy many of the cookie banner implementations are, designers being paid to implement as many dark patterns as possible, at least up until lawsuits started.

jacquesm 5y ago
Think of it as the law catching up with technology. > No business is interested in having to suddenly comply with such regulations and essentially no longer being able to utilize the data of individuals however they please. Indeed, hence the need for regulation. > Ergo, corporate interests will probably lead to lots of lobbying in this regard, just look at what happened with net neutrality and the advertising around it. Sure. But since EU citizens will be enjoying those protections and US citizens will not eventually this will translate into an advantage for companies doing business from the EU and into the US. For that reason alone there will be a big incentive for the US to make a law that is symmetrical to remove this advantage. > I think that all of this boils down to profit margins and viewing people as just numbers on a sheet somewhere, to extract wealth from. This is a big factor, but not the only factor: data that is in isolation worthless can become very valuable or even dangerous when combined with other worthless or innocent data. There are plenty of examples of this. The balance clearly lies in protecting consumers from the fall-out of these and the more purposeful abuses. This is a matter of raising consciousness about what rights you already have, not necessarily of giving you new ones. > Just look at how scummy many of the cookie banner implementations are, designers being paid to implement as many dark patterns as possible, at least up until lawsuits started. Agreed. The EU did the right thing with the GDPR, it laid bare how many companies were outright scandalous in how they were dealing with the data that they were entrusted with, they were bad stewards and it is good to see this level of enforcement because that means that companies will wise up to it and find better - and cleaner - ways of monetizing their products and services. Once they have those they will realize that regulatory capture can be theirs if they lobby for these rights to be extended to everybody. The EU is too large a market to miss out on.
- Nextgrid 5y ago
  > since EU citizens will be enjoying those protections and US citizens will not eventually this will translate into an advantage for companies doing business from the EU and into the US. For that reason alone there will be a big incentive for the US to make a law that is symmetrical to remove this advantage. Given the lack of similar regulation in the US despite the situation being so bad that unsolicited spam subsidises the postal service and that even government agencies sell user data I’m not sure there is a desire for this from the general population. It doesn’t help that politicians rely on a lot of what would breach the GDPR to help their reelection such as targeted advertising and unsolicited (and often misleading - pretending to be written by the official itself) email and phone campaigns.
  - bcrosby95 5y ago
    Um, CCPA is a thing. It's not as stringent as GDPR, but I would call it "similar" regulation. This stuff tends to happen at the state level in the USA.
  - jacquesm 5y ago
    Politicians are data subjects too. They are in this boat right along with everybody else.
  - dmitriid 5y ago
    > Given the lack of similar regulation in the US CCPA
- Mirioron 5y ago
  >Sure. But since EU citizens will be enjoying those protections and US citizens will not eventually this will translate into an advantage for companies doing business from the EU and into the US. For that reason alone there will be a big incentive for the US to make a law that is symmetrical to remove this advantage. Except it's literally the other way around. EU companies will be at a disadvantage because they cannot use the data to neither improve their service or to monetize it in some way. >The EU is too large a market to miss out on. Is it? Then what does that make China and the US? Or the rest of Asia? They don't seem to make nearly as many rules that require a service to change the entirety of their monetization system. If companies have to agree to EU terms then why wouldn't they do the same to China? After all, it's too big a market to ignore. The EU keeps making more rules for all kinds of things. Eventually this is going to catch up with us - if it hasn't already done so. The EU isn't exactly the tech center of the world nor does it seem to have a great trajectory or bright future. When it comes to tech all we seem to have is cars. Everything else is foreign developed, designed, and manufactured.
darrenf 5y ago
> No business is interested in having to suddenly comply with such regulations Just to pick up on this clause - it really needn't have been sudden. The regulation was adopted just over 2 years before enforcement kicked in[0], and of course it was written and debated for a while prior to that. In the UK the ICO researched the implications (for what were then just proposals) back in 2013[1] [0] https://en.wikipedia.org/wiki/General_Data_Protection_Regulation#Timeline https://en.wikipedia.org/wiki/General_Data_Protection_Regula... [1] https://ico.org.uk/media/1042341/implications-european-commissions-proposal-general-data-protection-regulation-for-business.pdf https://ico.org.uk/media/1042341/implications-european-commi... (PDF)
- jacquesm 5y ago
  And before that we had the DPD, which companies routinely ignored because they would never get fined. That's the only part of the GDPR that made companies take notice: the fact that the GDPR has some pretty impressive teeth. I'm actually quite surprised at the restraint on display so far by regulators, but I'm also quite sure that it is a matter of time before a repeat offender will be shown just how powerful this law is.
  - mmarq 5y ago
    Regulators are contacting businesses which they suspect are in breach of GDPR to give them the chance to become compliant (I was in companies that received such communications). If the company is in good faith, they’ll fix whatever the regulator found or explain why haven’t breached the law. These cases don’t get discussed in the media probably because they aren’t published anywhere. Before a company gets a fine, at least for now, it must do some really crazy stuff and/or refuse to cooperate with the regulators.
    - jacquesm 5y ago
      Indeed, I am aware of a few cases like this. But I'm also aware of a couple of companies that have swept breaches under the rug in recent times and if and when those surface they will be in pretty deep trouble.
dmitriid 5y ago
> No business is interested in having to suddenly comply with such regulations jesus christ. enough with this bullshit. Data protection laws had been a thing in European countries for a decade before GDPR. GDPR itself gave everyone two years to comply. GDPR was published in 2016, five years ago. There's no effing "suddenly". If this is "suddenly" for your business, and your business still hasn't figured out how to not collect (and probably sell) user data wholesale, your business deserves to be sued out of existence. > Just look at how scummy many of the cookie banner implementations are Yes. And all of those cookie banners are illegal under GDPR.
- jacquesm 5y ago
  I get you're pissed off but it is probably more productive to keep a lid on it and stay constructive.
  - KronisLV 5y ago
    Maybe i could have also expressed more outright disdain for the practices of these companies in my original post. Then again, i think that the comment that you are responding to, despite its tone, has a fair argument. > If this is "suddenly" for your business, and your business still hasn't figured out how to not collect (and probably sell) user data wholesale, your business deserves to be sued out of existence. > And all of those cookie banners are illegal under GDPR. Here's the thing: if there's profit to be made, both large and small corporations alike are going to look for ways to achieve that, many other concerns (e.g. the actual UX or even ethics) remaining with secondary importance in comparison. It doesn't even matter that some things are illegal sometimes, depending on how likely it is actually to be enforced. I think that this same disposition and attitude will also extend to lobbying and trying to nudge the lawmaking processes in a direction that benefits said companies, to maximize their profits in the future. I'm not saying that things shouldn't be more like EUs outcome (in this one regard, at least), i'm saying that they won't be like that. Just look at the pharmaceutical industry in US, the healthcare industry as a whole, or maybe the education industry or even the military industrial complex, all of which have probably seen lots of lobbying and lawmaking that doesn't necessary benefit the general populace. Furthermore, for some businesses it is simpler to deny access to people who are protected by GDPR, either because of compliance taking more resources then they want to allot, or simply gaining no benefit from serving them content if they cannot use tracking cookies and monetize otherwise free interaction with their content. So rather than figuring out how to not collect and sell user data, they're struggling to find ways around the laws, so that they can keep doing that in any capacity, or in some places, just ignore the laws altogether thinking that they're too small/big to actually be persecuted.

jacquesm 5y ago

Think of it as the law catching up with technology. > No business is interested in having to suddenly comply with such regulations and essentially no longer being able to utilize the data of individuals however they please. Indeed, hence the need for regulation. > Ergo, corporate interests will probably lead to lots of lobbying in this regard, just look at what happened with net neutrality and the advertising around it. Sure. But since EU citizens will be enjoying those protections and US citizens will not eventually this will translate into an advantage for companies doing business from the EU and into the US. For that reason alone there will be a big incentive for the US to make a law that is symmetrical to remove this advantage. > I think that all of this boils down to profit margins and viewing people as just numbers on a sheet somewhere, to extract wealth from. This is a big factor, but not the only factor: data that is in isolation worthless can become very valuable or even dangerous when combined with other worthless or innocent data. There are plenty of examples of this. The balance clearly lies in protecting consumers from the fall-out of these and the more purposeful abuses. This is a matter of raising consciousness about what rights you already have, not necessarily of giving you new ones. > Just look at how scummy many of the cookie banner implementations are, designers being paid to implement as many dark patterns as possible, at least up until lawsuits started. Agreed. The EU did the right thing with the GDPR, it laid bare how many companies were outright scandalous in how they were dealing with the data that they were entrusted with, they were bad stewards and it is good to see this level of enforcement because that means that companies will wise up to it and find better - and cleaner - ways of monetizing their products and services. Once they have those they will realize that regulatory capture can be theirs if they lobby for these rights to be extended to everybody. The EU is too large a market to miss out on.

Nextgrid 5y ago
> since EU citizens will be enjoying those protections and US citizens will not eventually this will translate into an advantage for companies doing business from the EU and into the US. For that reason alone there will be a big incentive for the US to make a law that is symmetrical to remove this advantage. Given the lack of similar regulation in the US despite the situation being so bad that unsolicited spam subsidises the postal service and that even government agencies sell user data I’m not sure there is a desire for this from the general population. It doesn’t help that politicians rely on a lot of what would breach the GDPR to help their reelection such as targeted advertising and unsolicited (and often misleading - pretending to be written by the official itself) email and phone campaigns.
- bcrosby95 5y ago
  Um, CCPA is a thing. It's not as stringent as GDPR, but I would call it "similar" regulation. This stuff tends to happen at the state level in the USA.
- jacquesm 5y ago
  Politicians are data subjects too. They are in this boat right along with everybody else.
- dmitriid 5y ago
  > Given the lack of similar regulation in the US CCPA
Mirioron 5y ago
>Sure. But since EU citizens will be enjoying those protections and US citizens will not eventually this will translate into an advantage for companies doing business from the EU and into the US. For that reason alone there will be a big incentive for the US to make a law that is symmetrical to remove this advantage. Except it's literally the other way around. EU companies will be at a disadvantage because they cannot use the data to neither improve their service or to monetize it in some way. >The EU is too large a market to miss out on. Is it? Then what does that make China and the US? Or the rest of Asia? They don't seem to make nearly as many rules that require a service to change the entirety of their monetization system. If companies have to agree to EU terms then why wouldn't they do the same to China? After all, it's too big a market to ignore. The EU keeps making more rules for all kinds of things. Eventually this is going to catch up with us - if it hasn't already done so. The EU isn't exactly the tech center of the world nor does it seem to have a great trajectory or bright future. When it comes to tech all we seem to have is cars. Everything else is foreign developed, designed, and manufactured.

darrenf 5y ago

> No business is interested in having to suddenly comply with such regulations Just to pick up on this clause - it really needn't have been sudden. The regulation was adopted just over 2 years before enforcement kicked in[0], and of course it was written and debated for a while prior to that. In the UK the ICO researched the implications (for what were then just proposals) back in 2013[1] [0] https://en.wikipedia.org/wiki/General_Data_Protection_Regulation#Timeline https://en.wikipedia.org/wiki/General_Data_Protection_Regula... [1] https://ico.org.uk/media/1042341/implications-european-commissions-proposal-general-data-protection-regulation-for-business.pdf https://ico.org.uk/media/1042341/implications-european-commi... (PDF)

jacquesm 5y ago
And before that we had the DPD, which companies routinely ignored because they would never get fined. That's the only part of the GDPR that made companies take notice: the fact that the GDPR has some pretty impressive teeth. I'm actually quite surprised at the restraint on display so far by regulators, but I'm also quite sure that it is a matter of time before a repeat offender will be shown just how powerful this law is.
- mmarq 5y ago
  Regulators are contacting businesses which they suspect are in breach of GDPR to give them the chance to become compliant (I was in companies that received such communications). If the company is in good faith, they’ll fix whatever the regulator found or explain why haven’t breached the law. These cases don’t get discussed in the media probably because they aren’t published anywhere. Before a company gets a fine, at least for now, it must do some really crazy stuff and/or refuse to cooperate with the regulators.
  - jacquesm 5y ago
    Indeed, I am aware of a few cases like this. But I'm also aware of a couple of companies that have swept breaches under the rug in recent times and if and when those surface they will be in pretty deep trouble.

dmitriid 5y ago

> No business is interested in having to suddenly comply with such regulations jesus christ. enough with this bullshit. Data protection laws had been a thing in European countries for a decade before GDPR. GDPR itself gave everyone two years to comply. GDPR was published in 2016, five years ago. There's no effing "suddenly". If this is "suddenly" for your business, and your business still hasn't figured out how to not collect (and probably sell) user data wholesale, your business deserves to be sued out of existence. > Just look at how scummy many of the cookie banner implementations are Yes. And all of those cookie banners are illegal under GDPR.

jacquesm 5y ago
I get you're pissed off but it is probably more productive to keep a lid on it and stay constructive.
- KronisLV 5y ago
  Maybe i could have also expressed more outright disdain for the practices of these companies in my original post. Then again, i think that the comment that you are responding to, despite its tone, has a fair argument. > If this is "suddenly" for your business, and your business still hasn't figured out how to not collect (and probably sell) user data wholesale, your business deserves to be sued out of existence. > And all of those cookie banners are illegal under GDPR. Here's the thing: if there's profit to be made, both large and small corporations alike are going to look for ways to achieve that, many other concerns (e.g. the actual UX or even ethics) remaining with secondary importance in comparison. It doesn't even matter that some things are illegal sometimes, depending on how likely it is actually to be enforced. I think that this same disposition and attitude will also extend to lobbying and trying to nudge the lawmaking processes in a direction that benefits said companies, to maximize their profits in the future. I'm not saying that things shouldn't be more like EUs outcome (in this one regard, at least), i'm saying that they won't be like that. Just look at the pharmaceutical industry in US, the healthcare industry as a whole, or maybe the education industry or even the military industrial complex, all of which have probably seen lots of lobbying and lawmaking that doesn't necessary benefit the general populace. Furthermore, for some businesses it is simpler to deny access to people who are protected by GDPR, either because of compliance taking more resources then they want to allot, or simply gaining no benefit from serving them content if they cannot use tracking cookies and monetize otherwise free interaction with their content. So rather than figuring out how to not collect and sell user data, they're struggling to find ways around the laws, so that they can keep doing that in any capacity, or in some places, just ignore the laws altogether thinking that they're too small/big to actually be persecuted.