5 ms·

Putting aside the data collection for a moment, I really appreciate that the data watchdog (data protection supervisor) for the EU actually has the ability to f

Putting aside the data collection for a moment, I really appreciate that the data watchdog (data protection supervisor) for the EU actually has the ability to find this data, has the authority to force the deletion and the policy makers and agencies actually appear to be willing to even entertain discussing where the boundary between privacy and security should lie. It’s refreshing, especially in comparison with how things are done in my country.

dataflow 5y ago
Let's see if the deletion actually happens. GDPR didn't seem to have as many teeth as people were initially hoping for.
- mhitza 5y ago
  I was of the same impression until I've encountered this information last year https://www.enforcementtracker.com/?insights https://www.enforcementtracker.com/?insights
  - dataflow 5y ago
    I'm not sure fines really tell the story here. Have big companies had a significant change in behavior as a result? Have major actors in any space (say) deleted data they'd gathered without legal basis?
    - mattashii 5y ago
      At least they must now put effort into their reasons for collecting data, and share this data with the subject; which was previously impossible or unfeasable. In that regard there have been significant changes.
      - dataflow 5y ago
        Sure, I'm not claiming GDPR has been useless. Just that if GDPR is any indication, this data won't get deleted.
    - krageon 5y ago
      Anecdotally, I have seen a significant uptick in cookie banners that are significantly more compliant. Sadly most companies still ask for things they do not need, but at least they aren't on by default anymore and the dark patterns are declining.
      - dataflow 5y ago
        My reply is essentially the same as to your sibling comment—yes, the situation does improve moving forward, and yes that's great; I'm not arguing it's bad. I'm just saying I have yet to see much evidence of retroactive corrections like deletion of existing data.
        krageon 5y ago
        Nobody that hasn't signed an NDA can report on such deletion and as such you won't see news articles about it :)
  - Nextgrid 5y ago
    This link always gets posted but if there's anything it proves is that the GDPR has a major enforcement problem. Your link shows that to date, ~1.4B euro worth of fines has been dished out - this is across all companies and countries in a span of 4 years. How much do Google and Facebook individually earn from illicit data collection & processing in just a single year? Significantly more than that. So far the only fine for Facebook is 51k (for a technicality, not actually related to their continuous GDPR breaches) and Google 50.6M which is more sizeable but still a drop in the bucket compared to their revenue.
- feisar 5y ago
  Agreed, i wouldn't be suprised if they just moved the data. Have you read Little Brother by Cory Doctorow? https://craphound.com/littlebrother/download/ https://craphound.com/littlebrother/download/
  - dataflow 5y ago
    I have not! And yeah, I can't recall the last time I heard about an organization actually purging large amounts of data in response to a government order.
- kzrdude 5y ago
  Countries are run by people who follow the law, not by those policing it. I mean, it takes long time for a new framework of law to settle in, it will gradually have an effect on industry practice and citizen's expectations. We are "establishing new truths" here. I think it will have a good effect in the long run, even if it's not perfect.
sva_ 5y ago
Is it really so refreshing that they get away with breaking regulations, seemingly without any sort of penalty? > The watchdog ordered Europol to erase data held for more than six months and gave it a year to sort out what could be lawfully kept. They even get a year to figure out in what way they broke the law, to legally keep as much data as possible.
- maxwell86 5y ago
  This is typically the case with new regulations. The cases that make the news with 100 million dollar fines to trillion dollar companies are just the ones in which the prosecution can't even reach someone at the company cause 100 million dollars is a drop in the bucket not worth looking at. Most of the time, when somebody contacts you because of these issues, you have 30 days to comply, and if you discover that the problem is bigger than anticipated, these deadlines can be negotiated. The point of the laws in the EU isn't to collect fines, but rather to make sure that everyone complies. You don't win much by going to trial and letting the other party explain why complying in 30 days is physically impossible. So as long as the other party is willing to comply, the first attorney letter get things moving, and then the issue is resolved.
  - sabas123 5y ago
    > The cases that make the news with 100 million dollar fines to trillion dollar companies are just the ones in which the prosecution can't even reach someone at the company cause 100 million dollars is a drop in the bucket not worth looking at. Is this true? I thought they were based on a % of global revenue and that definitely hurts.
    - mschuster91 5y ago
      That's the upper limit, not a minimum requirement. Levying the full 4% of global income is something that's reserved for those who blatantly refuse to comply with orders of their respective DPO or repeat offenders.
    - merijnv 5y ago
raxxorrax 5y ago
I strongly disagree. Due to institutional closeness I don't think the watchdog is independent enough. It won't be more than a fig leaf and will not be able to resist surveillance ambitions. Could as well be controlled opposition even if this lead to a change. Sure, better than doing nothing, but if you accept this as is you have been served a bad deal.
- dtech 5y ago
  Almost by definition a regulatory watchdog must also be government. Do you have an alternative? Giving private organizations this power ISDS-style seems worse on every level.
suifbwish 5y ago
How exactly do you prove something was deleted unless you know exactly how many copies there were, where they are stored, watched the destruction yourself and then verified after that the data was not recoverable through practical means? Reading something on the internet about someone supposedly deleting their data is not impressive.
- hedora 5y ago
  Inventory tracking of the hardware that contained the data would be a decent start. Also, set the budget for maintaining the dataset to zero.

dataflow 5y ago

Let's see if the deletion actually happens. GDPR didn't seem to have as many teeth as people were initially hoping for.

mhitza 5y ago
I was of the same impression until I've encountered this information last year https://www.enforcementtracker.com/?insights https://www.enforcementtracker.com/?insights
- dataflow 5y ago
  I'm not sure fines really tell the story here. Have big companies had a significant change in behavior as a result? Have major actors in any space (say) deleted data they'd gathered without legal basis?
  - mattashii 5y ago
    At least they must now put effort into their reasons for collecting data, and share this data with the subject; which was previously impossible or unfeasable. In that regard there have been significant changes.
    - dataflow 5y ago
      Sure, I'm not claiming GDPR has been useless. Just that if GDPR is any indication, this data won't get deleted.
  - krageon 5y ago
    Anecdotally, I have seen a significant uptick in cookie banners that are significantly more compliant. Sadly most companies still ask for things they do not need, but at least they aren't on by default anymore and the dark patterns are declining.
    - dataflow 5y ago
      My reply is essentially the same as to your sibling comment—yes, the situation does improve moving forward, and yes that's great; I'm not arguing it's bad. I'm just saying I have yet to see much evidence of retroactive corrections like deletion of existing data.
      - krageon 5y ago
        Nobody that hasn't signed an NDA can report on such deletion and as such you won't see news articles about it :)
- Nextgrid 5y ago
  This link always gets posted but if there's anything it proves is that the GDPR has a major enforcement problem. Your link shows that to date, ~1.4B euro worth of fines has been dished out - this is across all companies and countries in a span of 4 years. How much do Google and Facebook individually earn from illicit data collection & processing in just a single year? Significantly more than that. So far the only fine for Facebook is 51k (for a technicality, not actually related to their continuous GDPR breaches) and Google 50.6M which is more sizeable but still a drop in the bucket compared to their revenue.
feisar 5y ago
Agreed, i wouldn't be suprised if they just moved the data. Have you read Little Brother by Cory Doctorow? https://craphound.com/littlebrother/download/ https://craphound.com/littlebrother/download/
- dataflow 5y ago
  I have not! And yeah, I can't recall the last time I heard about an organization actually purging large amounts of data in response to a government order.
kzrdude 5y ago
Countries are run by people who follow the law, not by those policing it. I mean, it takes long time for a new framework of law to settle in, it will gradually have an effect on industry practice and citizen's expectations. We are "establishing new truths" here. I think it will have a good effect in the long run, even if it's not perfect.

sva_ 5y ago

Is it really so refreshing that they get away with breaking regulations, seemingly without any sort of penalty? > The watchdog ordered Europol to erase data held for more than six months and gave it a year to sort out what could be lawfully kept. They even get a year to figure out in what way they broke the law, to legally keep as much data as possible.

maxwell86 5y ago
This is typically the case with new regulations. The cases that make the news with 100 million dollar fines to trillion dollar companies are just the ones in which the prosecution can't even reach someone at the company cause 100 million dollars is a drop in the bucket not worth looking at. Most of the time, when somebody contacts you because of these issues, you have 30 days to comply, and if you discover that the problem is bigger than anticipated, these deadlines can be negotiated. The point of the laws in the EU isn't to collect fines, but rather to make sure that everyone complies. You don't win much by going to trial and letting the other party explain why complying in 30 days is physically impossible. So as long as the other party is willing to comply, the first attorney letter get things moving, and then the issue is resolved.
- sabas123 5y ago
  > The cases that make the news with 100 million dollar fines to trillion dollar companies are just the ones in which the prosecution can't even reach someone at the company cause 100 million dollars is a drop in the bucket not worth looking at. Is this true? I thought they were based on a % of global revenue and that definitely hurts.
  - mschuster91 5y ago
    That's the upper limit, not a minimum requirement. Levying the full 4% of global income is something that's reserved for those who blatantly refuse to comply with orders of their respective DPO or repeat offenders.
  - merijnv 5y ago

raxxorrax 5y ago

I strongly disagree. Due to institutional closeness I don't think the watchdog is independent enough. It won't be more than a fig leaf and will not be able to resist surveillance ambitions. Could as well be controlled opposition even if this lead to a change. Sure, better than doing nothing, but if you accept this as is you have been served a bad deal.

dtech 5y ago
Almost by definition a regulatory watchdog must also be government. Do you have an alternative? Giving private organizations this power ISDS-style seems worse on every level.

suifbwish 5y ago

How exactly do you prove something was deleted unless you know exactly how many copies there were, where they are stored, watched the destruction yourself and then verified after that the data was not recoverable through practical means? Reading something on the internet about someone supposedly deleting their data is not impressive.

hedora 5y ago
Inventory tracking of the hardware that contained the data would be a decent start. Also, set the budget for maintaining the dataset to zero.