4 ms·

GDPR solves exactly this, they are legally not allowed to sell this data in EU without explicit consent from you describing who to sell it to.

frankjr 3y ago
Wouldn't this be covered by some innocent looking paragraph hidden in the middle of the contract when buying the car?
- xxs 3y ago
  it won't stand in regards to GDPR. GDPR consent has to be freely given (and taken at any time), can't use legal lingo either.
- bryanrasmussen 3y ago
  legal consent in GDPR needs to be understandable, can not be hidden in any way, and easy to remove. The common lawyer's hack of hiding it in a big long unreadable contract won't cut it, and should lead to fines. Everybody talks crap about the GDPR, but as someone who, while not a lawyer, has worked on technical laws and standardization, I gotta say they really did a great job on not letting any companies have an easy out.
  - xxs 3y ago
    gotta agree, it's a very approachable piece of regulation for a non-lawyer.
- JumpCrisscross 3y ago
  > innocent looking paragraph hidden in the middle of the contract This is the source of the problem and requires legislation to fix. Starting with clickwrap.
- ledoge 3y ago
  Facebook tried to pull something similar, and it was eventually ruled illegal: https://noyb.eu/en/noyb-win-personalized-ads-facebook-instagram-and-whatsapp-declared-illegal https://noyb.eu/en/noyb-win-personalized-ads-facebook-instag...
  - _v7gu 3y ago
    God I love noyb. I wish I lived in Austria so I could contribute.
reacharavindh 3y ago
Has there ever been a legal precedent of a company violating GDPR like this and had to pay substantial enough penalty in accordance to GDPR?
- scapecast 3y ago
  yes --> GDPR enforcement tracker, see https://news.ycombinator.com/item?id=39813801 https://news.ycombinator.com/item?id=39813801
- DougBTX 3y ago
  Biggest fine from last year was apparently $1.2 billion.
  - 0xEF 3y ago
    A fine is just a license fee to break the law. Shut down their business for X months/years, instead, require them to continue wages for their lower level employees and remove any management directly connected with the violation of privacy. Unless we make the penalty extremely harsh, change will not happen in this instance. The selling of PID is far too profitable to be deterred by mere fine
    - piva00 3y ago
      GDPR fines grow to up to 4% of global revenue if a company keeps infringing on it, and they are applied over and over again if the behaviour doesn't stop. Taking a 4% global revenue fine is not something a company can do many times, it doesn't become just a cost of business, it has material impact.
      - shiroiushi 3y ago
        4% is small. Why can't it be 100%? (i.e., the company is forfeit) Sure, it'll have a "material impact" at only 4%, but a determined company could just do it anyway. This doesn't actually force them to stop.
loeg 3y ago
The GPDR doesn't solve exactly this, because GM is an American company selling American drivers' data to other American companies. The GPDR is irrelevant here.
- fragmede 3y ago
  No one from the EU has ever visited the USA and driven a GM car which then had the data harvested?
  - bryanrasmussen 3y ago
    That wouldn't apply. But if you bought a GM car while in the U.S and imported it to Europe GM better have thought of that eventuality.
- johndunne 3y ago
  I think the point being made was that if the US had a similar version of GPDR, then GM’s activity would have fallen foul of the act.
  - loeg 3y ago
    That hypothetical wouldn't be the GPDR, and also, it doesn't exist. There is no US GPDR for a reason.

frankjr 3y ago

Wouldn't this be covered by some innocent looking paragraph hidden in the middle of the contract when buying the car?

xxs 3y ago
it won't stand in regards to GDPR. GDPR consent has to be freely given (and taken at any time), can't use legal lingo either.
bryanrasmussen 3y ago
legal consent in GDPR needs to be understandable, can not be hidden in any way, and easy to remove. The common lawyer's hack of hiding it in a big long unreadable contract won't cut it, and should lead to fines. Everybody talks crap about the GDPR, but as someone who, while not a lawyer, has worked on technical laws and standardization, I gotta say they really did a great job on not letting any companies have an easy out.
- xxs 3y ago
  gotta agree, it's a very approachable piece of regulation for a non-lawyer.
JumpCrisscross 3y ago
> innocent looking paragraph hidden in the middle of the contract This is the source of the problem and requires legislation to fix. Starting with clickwrap.
ledoge 3y ago
Facebook tried to pull something similar, and it was eventually ruled illegal: https://noyb.eu/en/noyb-win-personalized-ads-facebook-instagram-and-whatsapp-declared-illegal https://noyb.eu/en/noyb-win-personalized-ads-facebook-instag...
- _v7gu 3y ago
  God I love noyb. I wish I lived in Austria so I could contribute.

reacharavindh 3y ago

Has there ever been a legal precedent of a company violating GDPR like this and had to pay substantial enough penalty in accordance to GDPR?

scapecast 3y ago
yes --> GDPR enforcement tracker, see https://news.ycombinator.com/item?id=39813801 https://news.ycombinator.com/item?id=39813801
DougBTX 3y ago
Biggest fine from last year was apparently $1.2 billion.
- 0xEF 3y ago
  A fine is just a license fee to break the law. Shut down their business for X months/years, instead, require them to continue wages for their lower level employees and remove any management directly connected with the violation of privacy. Unless we make the penalty extremely harsh, change will not happen in this instance. The selling of PID is far too profitable to be deterred by mere fine
  - piva00 3y ago
    GDPR fines grow to up to 4% of global revenue if a company keeps infringing on it, and they are applied over and over again if the behaviour doesn't stop. Taking a 4% global revenue fine is not something a company can do many times, it doesn't become just a cost of business, it has material impact.
    - shiroiushi 3y ago
      4% is small. Why can't it be 100%? (i.e., the company is forfeit) Sure, it'll have a "material impact" at only 4%, but a determined company could just do it anyway. This doesn't actually force them to stop.

loeg 3y ago

The GPDR doesn't solve exactly this, because GM is an American company selling American drivers' data to other American companies. The GPDR is irrelevant here.

fragmede 3y ago
No one from the EU has ever visited the USA and driven a GM car which then had the data harvested?
- bryanrasmussen 3y ago
  That wouldn't apply. But if you bought a GM car while in the U.S and imported it to Europe GM better have thought of that eventuality.
johndunne 3y ago
I think the point being made was that if the US had a similar version of GPDR, then GM’s activity would have fallen foul of the act.
- loeg 3y ago
  That hypothetical wouldn't be the GPDR, and also, it doesn't exist. There is no US GPDR for a reason.