6 ms·

Maybe they attempt to comply with regulation that is often confusingly worded and written by people who are not human computer interaction experts.

geewee 5y ago
I've done a lot of compliance work, and the laws are _very clearly_ worded. This is definitely a case of "let's see what we can get away with"
- franciscop 5y ago
  Exactly, I don't know what people are saying (well, I smell an agenda) but the GDPR is the easiest "specification" I've read.
  - arkh 5y ago
    But if you can't be bothered to read a RFC, 40ish pages of GDPR will be too much for you. You've got code to write, reading and learning is for schmucks.
  - usr1106 5y ago
    These fines have nothing to do with GDPR. GDPR introduced one stop shopping with EU for data controllers. Google does that in Ireland. GDPR is a regulation, legally binding all over EU. And for others offering services to EU residents, although that's probably unenforcable. When they get fined in France the basis is a French law. Probably a law to implement an EU directive. The cookies directive (don't remember the official name) is older than and different from GDPR.
- LunaSea 5y ago
  This is wrong. The GDPR is anything but clear.
  - chmod775 5y ago
    What specifically isn't clear to you?
    - LunaSea 5y ago
      Situations like needing signed pre-approval of all your customers in a data controller position or giving the possibility to refuse when you act as a sub processor and need to update your own subprocessors.
      - vntok 5y ago
        What isn't clear about these situations?
        LunaSea 5y ago
        It is so clear cut that the situation I described is illegal. Sub-processors are not allowed to sign data processing agreements. So not that clear it would seem ...
      - avianlyric 5y ago
        That sounds pretty clear cut to me. Sounds like a pain to implement, but the requirements are simple enough.
        LunaSea 5y ago
        It is so clear cut that the situation I described is illegal. Sub-processors are not allowed to sign data processing agreements. So not that clear it would seem ...
        avianlyric 5y ago
        That’s because you’re trying to do something fundamentally unsafe. A data controller is responsible for all the data they control and how it’s processed, as a result it needs to control and vet the entire data processing chain, regardless of how many processors or sub-processors there are. If GDPR allows controllers to slip out of their obligations by using sub-contractors to firewall their legal responsibilities, then it would be useless as a data protection law. If you want to run a data processor that relies of byzantine structures in an attempt to create plausible deniability, then you’re gonna have a bad time. Ultimately this is just a problem of dependency resolution, and conflicting dependency requirements, but it’s an unavoidable problem if you want to have truly accountable data controllers. Accountability is far more important than operational convenience. Remember GDPR exists to protect EU citizens, not businesses. It explicitly makes life hard for business, to ensure protection for citizens. Don’t like it, then leave, go exploit some other population.
Thiez 5y ago
Oh please. One might argue that the GDPR is a bit vague on some points, but it is very readable for ordinary people, and it clearly states that opting out should not be harder than opting in. So no, these dark patterns that push you into accepting by introducing extra friction for users that reject tracking (by adding artificial delays, having a lot of manual clicking to opt-out, etc) are not a case of genuine confusion. The people who build this functionality are just assholes.
- omgitsabird 5y ago
  This article is about the French Data Protection Act, not GDPR. They might be lex specialis, I don't know. I am just giving a benefit of the doubt that it is a more difficult problem than people make it out to be. I skimmed this [paper](https://epub.wu.ac.at/7523/1/HCIS2020_A%20Human-centric%20Perspective%20on%20Digital%20Consenting_The%20Case%20of%20GAFAM_Soheil%20Human_Florian%20Cech.pdf https://epub.wu.ac.at/7523/1/HCIS2020_A%20Human-centric%20Pe...) which, among its main topic, argues the issue being intentional and ubiquitous, but I am unconvinced.
  - dmitriid 5y ago
    French Data Protection Act has been around since 1978. And was amended in 2018. GDPR (which is basically all such acts from across EU in one legislation) has been around since 2016. If in 2021 your company pretends not to understand the law, your company deserves to be sued into oblivion
    - 123pie123 5y ago
      From my understanding GDPR and all other EU wide ideas or "Laws" are issued as Directives, each country then has to implement the directives in their own countries laws. some/ most implement directives in cut and paste manner some don't.
      - detaro 5y ago
        > GDPR and all other EU wide ideas or "Laws" are issued as Directives, No. The fact that the last letter in "GDPR" is not "D" is a pretty good hint that it's not a Directive ;) It's a Regulation. Regulations apply directly, and are not translated into local law. But omgitsabird is correct that GDPR is not the relevant basis here, but a clause in French Data Protection Law. And this clause exists because of the ePrivacy Directive.

geewee 5y ago

I've done a lot of compliance work, and the laws are _very clearly_ worded. This is definitely a case of "let's see what we can get away with"

franciscop 5y ago
Exactly, I don't know what people are saying (well, I smell an agenda) but the GDPR is the easiest "specification" I've read.
- arkh 5y ago
  But if you can't be bothered to read a RFC, 40ish pages of GDPR will be too much for you. You've got code to write, reading and learning is for schmucks.
- usr1106 5y ago
  These fines have nothing to do with GDPR. GDPR introduced one stop shopping with EU for data controllers. Google does that in Ireland. GDPR is a regulation, legally binding all over EU. And for others offering services to EU residents, although that's probably unenforcable. When they get fined in France the basis is a French law. Probably a law to implement an EU directive. The cookies directive (don't remember the official name) is older than and different from GDPR.
LunaSea 5y ago
This is wrong. The GDPR is anything but clear.
- chmod775 5y ago
  What specifically isn't clear to you?
  - LunaSea 5y ago
    Situations like needing signed pre-approval of all your customers in a data controller position or giving the possibility to refuse when you act as a sub processor and need to update your own subprocessors.
    - vntok 5y ago
      What isn't clear about these situations?
      - LunaSea 5y ago
        It is so clear cut that the situation I described is illegal. Sub-processors are not allowed to sign data processing agreements. So not that clear it would seem ...
    - avianlyric 5y ago
      That sounds pretty clear cut to me. Sounds like a pain to implement, but the requirements are simple enough.
      - LunaSea 5y ago
        It is so clear cut that the situation I described is illegal. Sub-processors are not allowed to sign data processing agreements. So not that clear it would seem ...
        avianlyric 5y ago
        That’s because you’re trying to do something fundamentally unsafe. A data controller is responsible for all the data they control and how it’s processed, as a result it needs to control and vet the entire data processing chain, regardless of how many processors or sub-processors there are. If GDPR allows controllers to slip out of their obligations by using sub-contractors to firewall their legal responsibilities, then it would be useless as a data protection law. If you want to run a data processor that relies of byzantine structures in an attempt to create plausible deniability, then you’re gonna have a bad time. Ultimately this is just a problem of dependency resolution, and conflicting dependency requirements, but it’s an unavoidable problem if you want to have truly accountable data controllers. Accountability is far more important than operational convenience. Remember GDPR exists to protect EU citizens, not businesses. It explicitly makes life hard for business, to ensure protection for citizens. Don’t like it, then leave, go exploit some other population.

Thiez 5y ago

Oh please. One might argue that the GDPR is a bit vague on some points, but it is very readable for ordinary people, and it clearly states that opting out should not be harder than opting in. So no, these dark patterns that push you into accepting by introducing extra friction for users that reject tracking (by adding artificial delays, having a lot of manual clicking to opt-out, etc) are not a case of genuine confusion. The people who build this functionality are just assholes.

omgitsabird 5y ago
This article is about the French Data Protection Act, not GDPR. They might be lex specialis, I don't know. I am just giving a benefit of the doubt that it is a more difficult problem than people make it out to be. I skimmed this [paper](https://epub.wu.ac.at/7523/1/HCIS2020_A%20Human-centric%20Perspective%20on%20Digital%20Consenting_The%20Case%20of%20GAFAM_Soheil%20Human_Florian%20Cech.pdf https://epub.wu.ac.at/7523/1/HCIS2020_A%20Human-centric%20Pe...) which, among its main topic, argues the issue being intentional and ubiquitous, but I am unconvinced.
- dmitriid 5y ago
  French Data Protection Act has been around since 1978. And was amended in 2018. GDPR (which is basically all such acts from across EU in one legislation) has been around since 2016. If in 2021 your company pretends not to understand the law, your company deserves to be sued into oblivion
  - 123pie123 5y ago
    From my understanding GDPR and all other EU wide ideas or "Laws" are issued as Directives, each country then has to implement the directives in their own countries laws. some/ most implement directives in cut and paste manner some don't.
    - detaro 5y ago
      > GDPR and all other EU wide ideas or "Laws" are issued as Directives, No. The fact that the last letter in "GDPR" is not "D" is a pretty good hint that it's not a Directive ;) It's a Regulation. Regulations apply directly, and are not translated into local law. But omgitsabird is correct that GDPR is not the relevant basis here, but a clause in French Data Protection Law. And this clause exists because of the ePrivacy Directive.