4 ms·

GDPR is one of the worst pieces of legislation in the past decade. It’s deliberately ambiguous, oftentimes nonsensical, was a nightmare to implement, there’s e

GDPR is one of the worst pieces of legislation in the past decade. It’s deliberately ambiguous, oftentimes nonsensical, was a nightmare to implement, there’s enormous amounts of noncompliance, and now plenty of sites that can’t be accessed from the EU, because the company behind it did the math and it was cheaper and easier to not care about the EU customer base at all. Not to mention all the potential avenues for abuse. I have a couple of friends who have used GDPR to actively abuse a relatively small company that they didn’t like (because they probably didn’t have the resources to understand all the implications of GDPR), and they spammed them with personal data and removal requests and threatened legal action. GDPR is bullshit. Your data is a commodity irrespective of GDPR. De-anonymising is trivial. GDPR also double-victimizes businesses that were a part of a hack, i.e. the British Airways hack. On top of the damage inflicted on them by the hack, they also got hit with an 8 figure fine for a data breach. Which is insane, because everyone can get hacked. The only thing GDPR has achieved is that you have a legal right to access the data that somebody holds on you, and to request the deletion of it. Everything else should be scrapped.

petre 5y ago
It's probably the first legislation that deals with user privacy and data transfers. It can be improved and it will most likely be improved. The cookie dialog options should be really a single option placed in the browser's settings, which should be passed to the host through http headers, like DNT. https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/DNT https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/DN... Companies who 'did the math' and it was easier for them to ignore the EU customer base were addicted to ad placement and tracking anyway, so good riddance. Companies should be responsible for their data security. If a bank is hacked and they steal my money, the money is insured and the insurance company pays it back. It's the same with personal data, if a data breach occurs, the company should be insured and the insurance company should cover liabilities.
- sgjohnson 5y ago
  > Companies should be responsible for their data security. If a bank is hacked and they steal my money, the money is insured and the insurance company pays it back. It's the same with personal data, if a data breach occurs, the company should be insured and the insurance company should cover liabilities. Of course, but they shouldn’t be hit with an arbitrary fine on top of that. The fine goes directly to the government’s coffers, and not to cover any liabilities incurred. It’s kicking a man who’s already down. > Companies who 'did the math' and it was easier for them to ignore the EU customer base were addicted to ad placement and tracking anyway, so good riddance. Not necessarily. In most cases it just didn’t make sense for them to hire a lawyer who specialised in the GDPR (I believe they were hard to come by and expensive in the US and the rest of the world), so they just decided to HTTP 451 instead.
  - Kbelicius 5y ago
    > Of course, but they shouldn’t be hit with an arbitrary fine on top of that. GDPR doesn't fine companies for having their security breached. > Not necessarily. Almost certainly necessary since if they weren't "addicted to ad placement and tracking" as GP put it they wouldn't have to stop and thing about GDPR.
    - sgjohnson 5y ago
      https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2020/10/ico-fines-british-airways-20m-for-data-breach-affecting-more-than-400-000-customers/ https://ico.org.uk/about-the-ico/news-and-events/news-and-bl... British Airways were fined under GDPR. > Almost certainly necessary since if they weren't "addicted to ad placement and tracking" as GP put it they wouldn't have to stop and thing about GDPR. How very eurocentric.
      - Kbelicius 5y ago
        They weren't fined for having their security breached. They were fined for not having adequate security measures in place. Again, under GDPR you can't get fined for simply having your security breached as you claimed earlier.

petre 5y ago

It's probably the first legislation that deals with user privacy and data transfers. It can be improved and it will most likely be improved. The cookie dialog options should be really a single option placed in the browser's settings, which should be passed to the host through http headers, like DNT. https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/DNT https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/DN... Companies who 'did the math' and it was easier for them to ignore the EU customer base were addicted to ad placement and tracking anyway, so good riddance. Companies should be responsible for their data security. If a bank is hacked and they steal my money, the money is insured and the insurance company pays it back. It's the same with personal data, if a data breach occurs, the company should be insured and the insurance company should cover liabilities.

sgjohnson 5y ago
> Companies should be responsible for their data security. If a bank is hacked and they steal my money, the money is insured and the insurance company pays it back. It's the same with personal data, if a data breach occurs, the company should be insured and the insurance company should cover liabilities. Of course, but they shouldn’t be hit with an arbitrary fine on top of that. The fine goes directly to the government’s coffers, and not to cover any liabilities incurred. It’s kicking a man who’s already down. > Companies who 'did the math' and it was easier for them to ignore the EU customer base were addicted to ad placement and tracking anyway, so good riddance. Not necessarily. In most cases it just didn’t make sense for them to hire a lawyer who specialised in the GDPR (I believe they were hard to come by and expensive in the US and the rest of the world), so they just decided to HTTP 451 instead.
- Kbelicius 5y ago
  > Of course, but they shouldn’t be hit with an arbitrary fine on top of that. GDPR doesn't fine companies for having their security breached. > Not necessarily. Almost certainly necessary since if they weren't "addicted to ad placement and tracking" as GP put it they wouldn't have to stop and thing about GDPR.
  - sgjohnson 5y ago
    https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2020/10/ico-fines-british-airways-20m-for-data-breach-affecting-more-than-400-000-customers/ https://ico.org.uk/about-the-ico/news-and-events/news-and-bl... British Airways were fined under GDPR. > Almost certainly necessary since if they weren't "addicted to ad placement and tracking" as GP put it they wouldn't have to stop and thing about GDPR. How very eurocentric.
    - Kbelicius 5y ago
      They weren't fined for having their security breached. They were fined for not having adequate security measures in place. Again, under GDPR you can't get fined for simply having your security breached as you claimed earlier.