5 ms·

EU tech law seems to be a bit of a rollercoaster. GDPR was conceptually a great thing (although its actual implementation smacks strongly of boomers with filof

EU tech law seems to be a bit of a rollercoaster. GDPR was conceptually a great thing (although its actual implementation smacks strongly of boomers with filofaxes ranting about FaceTok and Google Siri), the right to repair is good, the USB-C thing is useful. The cookie permission thing didn't work though. It's sad to see the EU now joining the "let's use child abuse as an excuse to steal the internet" bandwagon. The UK Government has been doing this for years, and is trying it right now with the Online Safety Bill. I never know what to think of the motivation behind this stuff. Is it a well-meaning but naive attempt to protect the vulnerable, or is it the establishment desperately trying to destroy the threat posed by open communication and the empowerment of individuals?

Y-bar 4y ago
Why do you think GDPR is some boomer with filofaxes thing? I'm young enough to be born at about the introduction of the original Mac and have worked with ecom for a long time now and GDPR from my perspective is an excellent law with the exception of some lacklustre enforcement. Our clients all cleaned out their already collected data, they implemented deletion, and extraction/change-on-request by customers, they limited their tracking and data collection among many other things. Not only was it an immediate privacy win for their customers, it made further development easaier because we did not have to deal with as much data, and it also protects the clients in the event of a data breach since there is less customer data to lose.
- shapefrog 4y ago
  GDPR is a light turned on that illuminated all the shitty behaviour that was "best practices" taking place in the darkness. Its no surprise that Zuck and co spent billions opposing it
- mjw_byrne 4y ago
  "Why do you think GDPR is some boomer with filofaxes thing?" I handle the GDPR compliance for my company so I've had to get stuck into the topic. Once you start actually trying to apply the various definitions and rules to the real world, they quickly break down. Examples: 1. The core concept in GDPR, personal data, is defined sloppily: "data relating to an identifiable natural person". It doesn't work because "relating to" is a hand-wave. Your name is obviously personal data, but (according to mainstream legal interpretation) so are IP addresses, despite the fact that people do not have IP addresses, network interfaces do. 2. Personal data is not defined in terms of the context in which it appears, which is crucially important. If I have the text "John Smith" in a database in a column called "name" and it actually relates to a person called "John Smith", that's clearly personal data. But what if someone uses my platform to spin up a VM with the hostname "johnsmith" - is that personal data? According to my lawyers, the answer is "maybe". I know lawyers have a tendency to be like that, but the law itself shouldn't leave the question open. 3. The construction of the law is poorly thought-out and leads to silly contradictions, e.g. if you have someone's personal data and you are told to stop processing it, you must stop processing it. But storage, erasure and transmission are all classed as processing, and it's logically impossible not to do at least one of these things. All that being said, I'll repeat that I fully agree with GDPR's objectives and I think its real-world impact is positive. I just wish more people who understand how computers work had been involved in drafting it. EDIT: embarrassing punctuation mistake.
  - Y-bar 4y ago
    > so are IP addresses, despite the fact that people do not have IP addresses And car registration numbers and passport numbers and street addresses are also personal identifiable information despite the fact that people does not have those either. Just like IP addresses. This is a good thing. > Personal data is not defined in terms of the context in which it appears This is a good thing because it closes a dozen loopholes and allows good-faith actors to remain on the right side of the law without much effort. > if you have someone's personal data and you are told to stop processing it, you must stop processing it. But storage, erasure and transmission are all classed as processing, and it's logically impossible not to do at least one of these things This just shows a poor understanding of the law, or you are just hand-waving things you have no knowledge about. This is not how the GDPR works. At all.
    - mjw_byrne 4y ago
      > And car registration numbers and passport numbers and street addresses are also personal identifiable information despite the fact that people does not have those either. Just like IP addresses The analogy doesn't work. A passport number is always "of" a person, because passports are issued to people. An IP address is often, (even usually, for IPv4), far-removed from an individual. Also see M95D's response above: "no it's not". You're confident that there's a good reason why an IP address is personal data and he's confident it's not personal data. This is what I mean when I say it's a poorly-written law. > This is a good thing because it closes a dozen loopholes and allows good-faith actors to remain on the right side of the law without much effort. Fair enough; in my opinion, ambiguity and hand-waving in legislation is too high a price to pay, and is also unnecessary. It's literally their job to codify the rules rigorously. > This just shows a poor understanding of the law, or you are just hand-waving things you have no knowledge about. This is not how the GDPR works. At all. I know my example isn't a real contradiction (and see also M95D's response in which he points out how the rules actually apply). I'm giving an example of language and terminology in the law which is on its face confusing and sloppy.
  - M95D 4y ago
    > 1. The core concept in GDPR, personal data, is defined sloppily: "data relating to an identifiable natural person". It doesn't work because "relating to" is a hand-wave. Your name is obviously personal data, but (according to mainstream legal interpretation) so are IP addresses, despite the fact that people do not have IP addresses, network interfaces do. No, it's not, unless you have logs or database records that links the IP address to a person (such as a login from that IP). And I bet you do, that's why it bothers you. > 2. Personal data is not defined in terms of the context in which it appears, which is crucially important. If I have the text "John Smith" in a database in a column called "name" and it actually relates to a person called "John Smith", that's clearly personal data. But what if someone uses my platform to spin up a VM with the hostname "johnsmith" - is that personal data? According to my lawyers, the answer is "maybe". I know lawyers have a tendency to be like that, but the law itself shouldn't leave the question open. Users can leave data that identifies them in various places. Sometimes they do it intentionally, sometimes not. It's your job to warn them and obtain consent. 3. The construction of the law is poorly thought-out and leads to silly contradictions, e.g. if you have someone's personal data and you are told to stop processing it, you must stop processing it. But storage, erasure and transmission are all classed as processing, and it's logically impossible not to do at least one of these things. In this case, removing data is a legal obligation you have. Processing data (by deleting it) to obey law is one of the exceptions in GDPR (art.6/1./c, and also art.17/3./b). https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-17-gdpr/ https://gdpr-info.eu/art-17-gdpr/
jonathanstrange 4y ago
The problem with these directives is that they have to be codified into national laws. This takes a long time and is a complicated process. It seems much easier to enact them than to take back mistakes. That alone seems to guarantee an authoritarian future or, at least, a bureaucratic nightmare in the long term. A small mistake here or there might appear to be harmless (e.g. cookie permissions), but what about the cumulative effects 50 years in the future?

Y-bar 4y ago

Why do you think GDPR is some boomer with filofaxes thing? I'm young enough to be born at about the introduction of the original Mac and have worked with ecom for a long time now and GDPR from my perspective is an excellent law with the exception of some lacklustre enforcement. Our clients all cleaned out their already collected data, they implemented deletion, and extraction/change-on-request by customers, they limited their tracking and data collection among many other things. Not only was it an immediate privacy win for their customers, it made further development easaier because we did not have to deal with as much data, and it also protects the clients in the event of a data breach since there is less customer data to lose.

shapefrog 4y ago
GDPR is a light turned on that illuminated all the shitty behaviour that was "best practices" taking place in the darkness. Its no surprise that Zuck and co spent billions opposing it
mjw_byrne 4y ago
"Why do you think GDPR is some boomer with filofaxes thing?" I handle the GDPR compliance for my company so I've had to get stuck into the topic. Once you start actually trying to apply the various definitions and rules to the real world, they quickly break down. Examples: 1. The core concept in GDPR, personal data, is defined sloppily: "data relating to an identifiable natural person". It doesn't work because "relating to" is a hand-wave. Your name is obviously personal data, but (according to mainstream legal interpretation) so are IP addresses, despite the fact that people do not have IP addresses, network interfaces do. 2. Personal data is not defined in terms of the context in which it appears, which is crucially important. If I have the text "John Smith" in a database in a column called "name" and it actually relates to a person called "John Smith", that's clearly personal data. But what if someone uses my platform to spin up a VM with the hostname "johnsmith" - is that personal data? According to my lawyers, the answer is "maybe". I know lawyers have a tendency to be like that, but the law itself shouldn't leave the question open. 3. The construction of the law is poorly thought-out and leads to silly contradictions, e.g. if you have someone's personal data and you are told to stop processing it, you must stop processing it. But storage, erasure and transmission are all classed as processing, and it's logically impossible not to do at least one of these things. All that being said, I'll repeat that I fully agree with GDPR's objectives and I think its real-world impact is positive. I just wish more people who understand how computers work had been involved in drafting it. EDIT: embarrassing punctuation mistake.
- Y-bar 4y ago
  > so are IP addresses, despite the fact that people do not have IP addresses And car registration numbers and passport numbers and street addresses are also personal identifiable information despite the fact that people does not have those either. Just like IP addresses. This is a good thing. > Personal data is not defined in terms of the context in which it appears This is a good thing because it closes a dozen loopholes and allows good-faith actors to remain on the right side of the law without much effort. > if you have someone's personal data and you are told to stop processing it, you must stop processing it. But storage, erasure and transmission are all classed as processing, and it's logically impossible not to do at least one of these things This just shows a poor understanding of the law, or you are just hand-waving things you have no knowledge about. This is not how the GDPR works. At all.
  - mjw_byrne 4y ago
    > And car registration numbers and passport numbers and street addresses are also personal identifiable information despite the fact that people does not have those either. Just like IP addresses The analogy doesn't work. A passport number is always "of" a person, because passports are issued to people. An IP address is often, (even usually, for IPv4), far-removed from an individual. Also see M95D's response above: "no it's not". You're confident that there's a good reason why an IP address is personal data and he's confident it's not personal data. This is what I mean when I say it's a poorly-written law. > This is a good thing because it closes a dozen loopholes and allows good-faith actors to remain on the right side of the law without much effort. Fair enough; in my opinion, ambiguity and hand-waving in legislation is too high a price to pay, and is also unnecessary. It's literally their job to codify the rules rigorously. > This just shows a poor understanding of the law, or you are just hand-waving things you have no knowledge about. This is not how the GDPR works. At all. I know my example isn't a real contradiction (and see also M95D's response in which he points out how the rules actually apply). I'm giving an example of language and terminology in the law which is on its face confusing and sloppy.
- M95D 4y ago
  > 1. The core concept in GDPR, personal data, is defined sloppily: "data relating to an identifiable natural person". It doesn't work because "relating to" is a hand-wave. Your name is obviously personal data, but (according to mainstream legal interpretation) so are IP addresses, despite the fact that people do not have IP addresses, network interfaces do. No, it's not, unless you have logs or database records that links the IP address to a person (such as a login from that IP). And I bet you do, that's why it bothers you. > 2. Personal data is not defined in terms of the context in which it appears, which is crucially important. If I have the text "John Smith" in a database in a column called "name" and it actually relates to a person called "John Smith", that's clearly personal data. But what if someone uses my platform to spin up a VM with the hostname "johnsmith" - is that personal data? According to my lawyers, the answer is "maybe". I know lawyers have a tendency to be like that, but the law itself shouldn't leave the question open. Users can leave data that identifies them in various places. Sometimes they do it intentionally, sometimes not. It's your job to warn them and obtain consent. 3. The construction of the law is poorly thought-out and leads to silly contradictions, e.g. if you have someone's personal data and you are told to stop processing it, you must stop processing it. But storage, erasure and transmission are all classed as processing, and it's logically impossible not to do at least one of these things. In this case, removing data is a legal obligation you have. Processing data (by deleting it) to obey law is one of the exceptions in GDPR (art.6/1./c, and also art.17/3./b). https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-17-gdpr/ https://gdpr-info.eu/art-17-gdpr/

jonathanstrange 4y ago

The problem with these directives is that they have to be codified into national laws. This takes a long time and is a complicated process. It seems much easier to enact them than to take back mistakes. That alone seems to guarantee an authoritarian future or, at least, a bureaucratic nightmare in the long term. A small mistake here or there might appear to be harmless (e.g. cookie permissions), but what about the cumulative effects 50 years in the future?