3 ms·

Making companies liable for the data they collect is a very good thing. Before GDPR logging everything was the default. Now, every business has to think about w

by gizmo 3y ago

Making companies liable for the data they collect is a very good thing. Before GDPR logging everything was the default. Now, every business has to think about what data they collect, what purpose it serves, which parties the data is shared with, and when the data will be deleted. GDPR, like any big new law, has plenty of weird unintended consequences. But it’s a major step forward for privacy and consumer data rights regardless.

chrismorgan 3y ago
Also there has been a huge amount of malicious compliance (though frankly it mostly doesn’t actually legally comply), deliberately muddying the waters and poisoning people’s impressions of GDPR and ePD. People have been convinced to blame GDPR rather than the businesses that have built themselves upon doing hostile and creepy stuff. (Cookie banners are the most obvious example of this. The businesses say “our hands are tied, the EU told us to do this”, whereas in actual fact the EU more told them to stop doing the storing and collecting. And very few cookie banners and such actually comply, and they made them a much bigger deal than they should have legally. All up there was very clear intent to poison perception in many cases.)
- gizmo 3y ago
  I agree with all your observations. Enforcement actions will slowly nudge businesses into compliance, but this will easily take another decade. It takes a long time for the law to solidify in the courts.
- orangecat 3y ago
  If you're trying to regulate a bunch of bad actors, and you don't anticipate that they will try to game whatever regulations you come up with, you are not doing your job well.
  - account42 3y ago
    Sure they should have and probably did expect that there would be bad actors. But should they have expected that pretty much all businesses and even individuals would rather make their users miserable than give up tracking them? Is people adding cookie banners for their personal blogs because they are that addicted to meaningless analytics something anyone would have expected? Also, a lot of the problems are not bad actors finding ways around the law but straight up violating it. The most prominent example is the consent bannes that try to discourage the deny option in various ways. The lawmakers did anticipate that kind of maliciousness and made sure to disallow it. What is lacking is mostly enforcement, and that is not something the lawmakers control.
    - shadowgovt 3y ago
      > Is people adding cookie banners for their personal blogs because they are that addicted to meaningless analytics something anyone would have expected? Yes, emphatically. It's a one-time change for the admin that allows them to maintain the status quo, and they don't visit the site as often as users do.
fogzen 3y ago
They always were liable. But of course, people would have to show they were actually harmed in some way by being “tracked”. GDPR makes it illegal to collect data that doesn’t cause any demonstrable harm to anyone.

by gizmo 3y ago

chrismorgan 3y ago

Also there has been a huge amount of malicious compliance (though frankly it mostly doesn’t actually legally comply), deliberately muddying the waters and poisoning people’s impressions of GDPR and ePD. People have been convinced to blame GDPR rather than the businesses that have built themselves upon doing hostile and creepy stuff. (Cookie banners are the most obvious example of this. The businesses say “our hands are tied, the EU told us to do this”, whereas in actual fact the EU more told them to stop doing the storing and collecting. And very few cookie banners and such actually comply, and they made them a much bigger deal than they should have legally. All up there was very clear intent to poison perception in many cases.)

gizmo 3y ago
I agree with all your observations. Enforcement actions will slowly nudge businesses into compliance, but this will easily take another decade. It takes a long time for the law to solidify in the courts.
orangecat 3y ago
If you're trying to regulate a bunch of bad actors, and you don't anticipate that they will try to game whatever regulations you come up with, you are not doing your job well.
- account42 3y ago
  Sure they should have and probably did expect that there would be bad actors. But should they have expected that pretty much all businesses and even individuals would rather make their users miserable than give up tracking them? Is people adding cookie banners for their personal blogs because they are that addicted to meaningless analytics something anyone would have expected? Also, a lot of the problems are not bad actors finding ways around the law but straight up violating it. The most prominent example is the consent bannes that try to discourage the deny option in various ways. The lawmakers did anticipate that kind of maliciousness and made sure to disallow it. What is lacking is mostly enforcement, and that is not something the lawmakers control.
  - shadowgovt 3y ago
    > Is people adding cookie banners for their personal blogs because they are that addicted to meaningless analytics something anyone would have expected? Yes, emphatically. It's a one-time change for the admin that allows them to maintain the status quo, and they don't visit the site as often as users do.

fogzen 3y ago

They always were liable. But of course, people would have to show they were actually harmed in some way by being “tracked”. GDPR makes it illegal to collect data that doesn’t cause any demonstrable harm to anyone.