4 ms·

Quick fact check. GDPR says IP Addresses are personal data, although this is a clarification of a previous court ruling. Personal data does NOT need consent t

by lmkg 5y ago

Quick fact check. GDPR says IP Addresses are personal data, although this is a clarification of a previous court ruling. Personal data does NOT need consent to process. Consent is only necessary in a minority of cases, and certainly not regular website access. The idea that GDPR <==> is a misunderstanding. (This is closer to true when dealing with website cookies, because of a different and stupider law.) GDPR does not prevent transferring data outside of Europe. It just says that data privacy must be respected, in one of a variety of ways. The problem is the US CLOUD Act, which basically says US companies are bound by US law even when operating in other jurisdictions. EU Courts have ruled that US companies bound by the CLOUD Act cannot safeguard data. And they aren't wrong. By comparison, data transfers to the UK or Japan require nothing more than putting the words "adequacy decision" in your privacy policy. This is because those countries have laws safeguard privacy, as opposed to laws safeguarding law enforcement's access to personal data.

dkyc 5y ago
Thanks for the corrections. What my original statement meant to convey was not simply disagreement with GDPR, but more that two somewhat unrelated edge case decisions ("do 'just' IP addresses count as PII", and "can one work with American suppliers") gave this regulation a scope that I believe wasn't even intended by the original lawmakers (as evident by their own failure to be compliant, see other comment thread), and that very much goes against the realities of the Internet of the past 25 years. That being said, your corrections are valid and give a more precise description of the situation rather than my initial comment.
- lmkg 5y ago
  That's a fair point. At the time GDPR was passed, there was an Adequacy Decision in place (Privacy Shield), so the political expectation was that US<->EU data transfers would be OK. One way of looking at things is that the political landscape ("we can work with the US") were not in alignment with the legal landscape (US law does not prioritize privacy safeguards). Max Schrems & noyb are forcing Europe to reconcile that schism and bring practice into alignment with legal requirements rather than political requirements. This is causing disruption, but I'm of the mind that it's not unjust, it's a matter of finally having to pay the piper.

by lmkg 5y ago

dkyc 5y ago

Thanks for the corrections. What my original statement meant to convey was not simply disagreement with GDPR, but more that two somewhat unrelated edge case decisions ("do 'just' IP addresses count as PII", and "can one work with American suppliers") gave this regulation a scope that I believe wasn't even intended by the original lawmakers (as evident by their own failure to be compliant, see other comment thread), and that very much goes against the realities of the Internet of the past 25 years. That being said, your corrections are valid and give a more precise description of the situation rather than my initial comment.

lmkg 5y ago
That's a fair point. At the time GDPR was passed, there was an Adequacy Decision in place (Privacy Shield), so the political expectation was that US<->EU data transfers would be OK. One way of looking at things is that the political landscape ("we can work with the US") were not in alignment with the legal landscape (US law does not prioritize privacy safeguards). Max Schrems & noyb are forcing Europe to reconcile that schism and bring practice into alignment with legal requirements rather than political requirements. This is causing disruption, but I'm of the mind that it's not unjust, it's a matter of finally having to pay the piper.