8 ms·

Unfortunately, despite having appropriate laws for many years, these privacy rules are broken en masse. And why? If every EU country would simply check their to

Unfortunately, despite having appropriate laws for many years, these privacy rules are broken en masse. And why? If every EU country would simply check their top 1000 websites (and apps) pro actively, this would problem would not exist. Now we have the situation that everybody does it so you would be stupid not to follow. Something similar with unsolicited mailing (both snail and e), the rules are clear but trampled by small and large companies and institutions. It is not that this government lacks the expertise or creativity. Yearly aerial images are collected to search for illegal buildings and extensions. The same government's tax department actively scrapes the web and social media to collect and store personal data to create a fraud profile on all their citizens.[0] [0]: https://www.dutchnews.nl/2023/09/tax-office-scraped-social-media-for-database-info-nrc/ https://www.dutchnews.nl/2023/09/tax-office-scraped-social-m...

miohtama 3y ago
Regulation that is not thoughtful and enforceable is not good regulation. Spam was made “illegal” more than a decade ago in the US and in the EU. It did not reduce the amount of spam. The same thing with GDPR: only honest and good actors suffer, while dishonest actors or megacorps like Google get an advantage and because of this advantage they manage to grow their business.
- dylan604 3y ago
  >while dishonest actors or megacorps why the distinction? if spam is illegal, it doesn't matter your size or incorporation status. if you break the rules, you've broken the rules. the ability to spam doesn't really increase by size of corp. a single person can hire services to spam just as effectively has evilCorp
  - GlickWick 3y ago
    Because an inversion of responsibility happens at some turning point of organization size. A small company that wants to survive has to spend a lot of effort and engineering hours becoming compliant with the legislation. If they fail to do so, the following legal battle and potential fines have a high probability of bankrupting them. They must be proactive to avoid this. Large corporations instead get to be reactive. They comply where it’s convenient and otherwise operate on an “ask forgiveness later” mindset. Legal battles and billion dollar fines barely register and instead of becoming destructive events, just become minor taxes on doing business. As much as I appreciate the spirit of the legislation, the implementation has actually empowered large companies and is squeezing out small business.
    - dylan604 3y ago
      I disagree. You know when you're doing shady things with your software. Just don't do it.
      - GlickWick 3y ago
        You disagree with what exactly? In the case of being a small business, it’s not even about being shady. Imagine you were building a simple step tracking database for a pedometer app. All it does is store a user id and some daily steps. You have zero intent to market or share it in any way, no ad personalization, no third parties, etc. Before GDPR you’d just spin this up and be fine. Now you need to deal with data consent policies, data deletion tools, potential exfiltration policies if your DB isn’t in the EU, etc. Enjoy the engineering and legal costs there. Mega corp can just ignore most of this and pay later. It’s a massive difference.
        dylan604 3y ago
        there's no need to transmit the collected data away from the device. boom! nobody is storing data. it's all local to the device. that's an easy decision to make. you don't even need to collect an ID of any type. this app on this device counted steps. nobody outside of the app on that device needs to know. transmitting that information to the company servers is a decision that can easily be not made to do, and when it is, you're already at risk. so, why do it?
        GlickWick 3y ago
        There's far too many use cases where you need persistent data stores that are not on the device. Feels like deliberate ignorance here.
- j-a-a-p 3y ago
  Agree, there are the usual suspects. For small companies the rules, especially on cookies, are intimidating and therefore ignored - however because are small so is the impact of it. For larger companies, the financial incentive to bend the privacy rules is significant. And there are the evilCorps like Uber who have a trample the rules strategy [0] (and any platform that abuses workers rights). Not sure how this relates to privacy rules, but it feeds the assumption that if a company ignores one set of rules, they are also inclined to break other rules. An interesting niche I have worked in, social enterprises, a lot of people have a strong moral high ground feeling. Their message is supposedly not commercial, or it has importance while in fact it is still commercial (fund raising, an event, ...). And especially these companies get a lot of attention. [0] https://en.wikipedia.org/wiki/Controversies_involving_Uber#:~:text=Ignoring%20and%20evading%20local%20regulations,-Uber%20has%20been&text=Uber's%20strategy%20was%20generally%20to,would%20pay%20for%20any%20citations https://en.wikipedia.org/wiki/Controversies_involving_Uber#:....
- iamacyborg 3y ago
  > Spam was made “illegal” more than a decade ago in the US No, it wasn't. CAN-SPAM regulation lives up to its name, it legalises spamming so long as an exceptionally low baseline is met.

miohtama 3y ago

Regulation that is not thoughtful and enforceable is not good regulation. Spam was made “illegal” more than a decade ago in the US and in the EU. It did not reduce the amount of spam. The same thing with GDPR: only honest and good actors suffer, while dishonest actors or megacorps like Google get an advantage and because of this advantage they manage to grow their business.

dylan604 3y ago
>while dishonest actors or megacorps why the distinction? if spam is illegal, it doesn't matter your size or incorporation status. if you break the rules, you've broken the rules. the ability to spam doesn't really increase by size of corp. a single person can hire services to spam just as effectively has evilCorp
- GlickWick 3y ago
  Because an inversion of responsibility happens at some turning point of organization size. A small company that wants to survive has to spend a lot of effort and engineering hours becoming compliant with the legislation. If they fail to do so, the following legal battle and potential fines have a high probability of bankrupting them. They must be proactive to avoid this. Large corporations instead get to be reactive. They comply where it’s convenient and otherwise operate on an “ask forgiveness later” mindset. Legal battles and billion dollar fines barely register and instead of becoming destructive events, just become minor taxes on doing business. As much as I appreciate the spirit of the legislation, the implementation has actually empowered large companies and is squeezing out small business.
  - dylan604 3y ago
    I disagree. You know when you're doing shady things with your software. Just don't do it.
    - GlickWick 3y ago
      You disagree with what exactly? In the case of being a small business, it’s not even about being shady. Imagine you were building a simple step tracking database for a pedometer app. All it does is store a user id and some daily steps. You have zero intent to market or share it in any way, no ad personalization, no third parties, etc. Before GDPR you’d just spin this up and be fine. Now you need to deal with data consent policies, data deletion tools, potential exfiltration policies if your DB isn’t in the EU, etc. Enjoy the engineering and legal costs there. Mega corp can just ignore most of this and pay later. It’s a massive difference.
      - dylan604 3y ago
        there's no need to transmit the collected data away from the device. boom! nobody is storing data. it's all local to the device. that's an easy decision to make. you don't even need to collect an ID of any type. this app on this device counted steps. nobody outside of the app on that device needs to know. transmitting that information to the company servers is a decision that can easily be not made to do, and when it is, you're already at risk. so, why do it?
        GlickWick 3y ago
        There's far too many use cases where you need persistent data stores that are not on the device. Feels like deliberate ignorance here.
j-a-a-p 3y ago
Agree, there are the usual suspects. For small companies the rules, especially on cookies, are intimidating and therefore ignored - however because are small so is the impact of it. For larger companies, the financial incentive to bend the privacy rules is significant. And there are the evilCorps like Uber who have a trample the rules strategy [0] (and any platform that abuses workers rights). Not sure how this relates to privacy rules, but it feeds the assumption that if a company ignores one set of rules, they are also inclined to break other rules. An interesting niche I have worked in, social enterprises, a lot of people have a strong moral high ground feeling. Their message is supposedly not commercial, or it has importance while in fact it is still commercial (fund raising, an event, ...). And especially these companies get a lot of attention. [0] https://en.wikipedia.org/wiki/Controversies_involving_Uber#:~:text=Ignoring%20and%20evading%20local%20regulations,-Uber%20has%20been&text=Uber's%20strategy%20was%20generally%20to,would%20pay%20for%20any%20citations https://en.wikipedia.org/wiki/Controversies_involving_Uber#:....
iamacyborg 3y ago
> Spam was made “illegal” more than a decade ago in the US No, it wasn't. CAN-SPAM regulation lives up to its name, it legalises spamming so long as an exceptionally low baseline is met.