5 ms·

The idea that some data is owned, and that people can obtain ownership of data that belongs to other entities is as moronic as claiming that the CO2 i breathed

The idea that some data is owned, and that people can obtain ownership of data that belongs to other entities is as moronic as claiming that the CO2 i breathed is owned by me. Data is data, it's not PII or whatever stupid contraptiion lawyers came up with to keep themselves busy If EU wanted to ban tracked ads, it should make a law bans tracked ads, that simple. Not only it would instantly achieve the desired effect (which GDPR did NOT), it would level the playing field for more ethical companies to thrive within the EU.

breakfastduck 5y ago
You are totally misinterpreting what GDPR is for, so it makes sense you'd be unable to recognize the benefits. Data IS owned, by the person the data pertains to. And companies should not be able to capture that data, sell it and share it without explicit consent. Which GDPR does achieve.
- cblconfederate 5y ago
  > Data IS owned, by the person the data pertains to This is an almost undefined concept. Data is not copyright, they are observations. Plus for many kinds of data ownership is hard to define, e.g. genetic data which is largely shared by all of us.
  - jacquesm 5y ago
    You can try as hard as you can to wriggle out from understanding what this is all about but it is actually pretty clear: data supplied by an individual is the property of that individual, they have the right to informed consent on what it is used for, they can ask you to delete it, they can ask you to update it or review it. In some cases other laws (for instance: tax law) can make it mandatory for you to keep certain records, for which there are exceptions. That's basically it. So it's not an 'undefined concept', it is extremely clear and the text of the law is actually quite legible so there is no real reason not to be informed about this if it affects you in any way (which it likely does).
    - cblconfederate 5y ago
      most of the data relevant to gdpr legal cases are not supplied by the user, they are collected indirectly.
      - jacquesm 5y ago
        This is contrary to what I have seen in my day to day practice over the last couple of years. Now, of course it is possible that my sample size is too small (about 120 companies over that period) but I highly doubt that. Data collected indirectly to would for instance be data used to 'enrich' a profile, for instance by buying it from a third party. That data would still show up in a DSAR, but it would likely not be private data because no company is stupid enough in the current climate to sell that without a very good legal review. Data collected surreptitiously (for instance, GPS location information, device IDs and such) count as user supplied for the purpose of the GDPR, and collecting that without consent and disclosing that you are collecting it and supplying a legal basis for processing is illegal.
      - breakfastduck 5y ago
        I mean this is just false.
    - lmkg 5y ago
      I have certifications in data privacy. The idea that data is "property" or that it is "owned" by anyone is not codified in law. And as an analogy for how GDPR works, I think it's more harmful than helpful. I see GDPR as rejecting the idea that data has an owner, more than anything. GDPR says that the data subject has rights to data about them. If you want to put a label on it, I would say that legally they are a stakeholder in their own data. One stakeholder of several. Not necessarily the most prominent one. GDPR gives you a seat at the table, but it doesn't actually put you in charge, the way that "ownership" implies. The company that collects & processes the data is still the one making decisions like: What data is being collected? What is it used for? What is the Legal Basis for data collection? What Processors will the data be sent to? What countries will the data be processed in? They have a lot of leeway in how they answer these questions and still be compliant with GDPR. So for that reason, my view is that GDPR says there are multiple stakeholders will different rights to how the data is handled. Which if anything is a rejection of the idea that the data has an owner. Certainly you have rights to the data, but some of those rights have limits, and the Controller still has right as well.
  - breakfastduck 5y ago
    It's not undefined in places where we have strict data protection laws, even pre GDPR. I think you're trying as hard as possible to misunderstand it.

breakfastduck 5y ago

You are totally misinterpreting what GDPR is for, so it makes sense you'd be unable to recognize the benefits. Data IS owned, by the person the data pertains to. And companies should not be able to capture that data, sell it and share it without explicit consent. Which GDPR does achieve.

cblconfederate 5y ago
> Data IS owned, by the person the data pertains to This is an almost undefined concept. Data is not copyright, they are observations. Plus for many kinds of data ownership is hard to define, e.g. genetic data which is largely shared by all of us.
- jacquesm 5y ago
  You can try as hard as you can to wriggle out from understanding what this is all about but it is actually pretty clear: data supplied by an individual is the property of that individual, they have the right to informed consent on what it is used for, they can ask you to delete it, they can ask you to update it or review it. In some cases other laws (for instance: tax law) can make it mandatory for you to keep certain records, for which there are exceptions. That's basically it. So it's not an 'undefined concept', it is extremely clear and the text of the law is actually quite legible so there is no real reason not to be informed about this if it affects you in any way (which it likely does).
  - cblconfederate 5y ago
    most of the data relevant to gdpr legal cases are not supplied by the user, they are collected indirectly.
    - jacquesm 5y ago
      This is contrary to what I have seen in my day to day practice over the last couple of years. Now, of course it is possible that my sample size is too small (about 120 companies over that period) but I highly doubt that. Data collected indirectly to would for instance be data used to 'enrich' a profile, for instance by buying it from a third party. That data would still show up in a DSAR, but it would likely not be private data because no company is stupid enough in the current climate to sell that without a very good legal review. Data collected surreptitiously (for instance, GPS location information, device IDs and such) count as user supplied for the purpose of the GDPR, and collecting that without consent and disclosing that you are collecting it and supplying a legal basis for processing is illegal.
    - breakfastduck 5y ago
      I mean this is just false.
  - lmkg 5y ago
    I have certifications in data privacy. The idea that data is "property" or that it is "owned" by anyone is not codified in law. And as an analogy for how GDPR works, I think it's more harmful than helpful. I see GDPR as rejecting the idea that data has an owner, more than anything. GDPR says that the data subject has rights to data about them. If you want to put a label on it, I would say that legally they are a stakeholder in their own data. One stakeholder of several. Not necessarily the most prominent one. GDPR gives you a seat at the table, but it doesn't actually put you in charge, the way that "ownership" implies. The company that collects & processes the data is still the one making decisions like: What data is being collected? What is it used for? What is the Legal Basis for data collection? What Processors will the data be sent to? What countries will the data be processed in? They have a lot of leeway in how they answer these questions and still be compliant with GDPR. So for that reason, my view is that GDPR says there are multiple stakeholders will different rights to how the data is handled. Which if anything is a rejection of the idea that the data has an owner. Certainly you have rights to the data, but some of those rights have limits, and the Controller still has right as well.
- breakfastduck 5y ago
  It's not undefined in places where we have strict data protection laws, even pre GDPR. I think you're trying as hard as possible to misunderstand it.