6 ms·

This can be an unpopular opinion but I work at a company in the EU and feel the law is very positive for consumers in general. In today's world users hand over

This can be an unpopular opinion but I work at a company in the EU and feel the law is very positive for consumers in general. In today's world users hand over their data to a huge number of companies for all kinds of different reasons and it's important to know that those companies are pushed by the law to only collect and retain the information they need to provide their services.

gpderetta 2y ago
more than unpopular is polarizing.
james-bcn 2y ago
The only part of GDPR most people know about are the website pop-ups, which probably was a bad idea. They don't know about all the other stuff that is really positive.
- piva00 2y ago
  The GDPR is not the ePrivacy Directive (the "cookie law"), the ePrivacy Directive predates the GDPR by many years.
- rakoo 2y ago
  The pop-up is not part of the law. The law says user should be aware and able to do informed changes, not that they should be annoyed. That part is entirely on companies
  - gls2ro 2y ago
    Yes popups are not part of the law. they are an implementation choosen by the websites. Also I put a bit of responsibility on us, the consumers. It does not seem to me that popups are such a real issue since no website reported: we are removing popups because users are so annoyed that they stopped visiting our website.
  - aleph_minus_one 2y ago
    > The law says user should be aware and able to do informed changes, not that they should be annoyed. Then tell us how companies should implement this law both - without annoying the user - not being in a risk of getting sued If the law does not make this relatively easy, one has a right to be furious about the EU.
    - wizzwizz4 2y ago
      It's written in plain English: you can read it yourself. Articles 5, 12, 24 and 25. The main problem, and the reason certain parties are working so hard not to comply, is that GDPR makes several business models illegal. (Not that I see that as much of a problem.)
      - aleph_minus_one 2y ago
        > It's written in plain English: you can read it yourself. Articles 5, 12, 24 and 25. This is what the law says, but not how shysters/pettifoggers interpret it. :-(
      - roenxi 2y ago
        > It's written in plain English: you can read it yourself. That isn't how the law works for things like this though; what is plain to a lawyer is different to an untrained person. People make that mistake with tax law all the time; they read something and come up with a plain interpretation that shows they don't have to pay their taxes and that delusion persists until someone explains the actual, less plain, reading. It isn't the worst starting point but winging the law with untrained readings is not really acceptable for running a business.
        wizzwizz4 2y ago
        People also come up with "plain interpretations" of the laws of physics that allow them to construct perpetual motion machines. Arrogance and wishful thinking are a bad combination, no matter the field.
  - shagie 2y ago
    If I go to the EU website ( https://european-union.europa.eu https://european-union.europa.eu ) and see a pop up, surely there's a better way of implementing that it if it wasn't the best way to do so. If there is a pop up there, for just accessing the home page of the European Union, is that site collecting too much data? There's even a bit at the bottom of https://gdpr.eu https://gdpr.eu > We use cookies to ensure that we give you the best experience on our website. If you continue to use this site we will assume that you are happy with it.
    - ryanisnan 2y ago
      I'm being a bit snarky, but maybe the better way involves not tracking people to death.
      - shagie 2y ago
        Under the GDPR, an IP address is PII and recording the IP address of a visitor can be problematic. https://gdpr.eu/eu-gdpr-personal-data/ https://gdpr.eu/eu-gdpr-personal-data/ Looking back at the GDPR’s definition, we have a list of different types of identifiers: “a name, an identification number, location data, an online identifier.” A special mention should be made for biometric data as well, such as fingerprints, which can also work as identifiers. While most of these are straightforward, online identifiers are a bit trickier. Fortunately, the GDPR provides several examples in Recital 30 that include: Internet protocol (IP) addresses; cookie identifiers; and other identifiers such as radio frequency identification (RFID) tags. These identifiers refer to information that is related to an individual’s tools, applications, or devices, like their computer or smartphone. The above is by no means an exhaustive list. Any information that could identify a specific device, like its digital fingerprint, are identifiers.
        p_l 2y ago
        The trick is to read through and understand what falls under "Legitimate Interest" (important note: it never involves giving other services access to it!). A very common example is recording the IP address for technical (debugging, ensuring site functionality) and legal (security, audit logs) does fall under Legitimate Interest. Worst case you have to mention it in privacy policy. The thing you can't do is let your marketing team or others grab at it in any way, or sell it to other vendors, and arguably you should not move outside of safe countries.
  - blablabla123 2y ago
    That, the whole pop-up idea was just copy&pasted. It's possible to make commercial websites without it when turning off tracking without logging or having to explicitly opt-in, possibly for added value. There's a lot of confusion while the law is mainly about differentiating which data is needed to operate and which is purely nice to have. That said, there are plenty of GDPR-compliant services that keep data for 10 years mostly in finance or auditing related use cases and nobody bats an eye
kasey_junk 2y ago
I don’t have much of an opinion on the overall value of GDPR, but I’ve been asked multiple times now to create indexes of personal data to _comply_ with the law when said indexes were not wanted for business or technical reasons. An example is in big data repositories where personal data may have been provided but not used for anything. Yes it’s there but nothing uses it. To enable the reporting and deletion requirements you build a system that keeps track of all that, now the data _is_ trivially correlated which seems like the opposite of the intent. Even when I build systems that prunes the data on ingest it feels weird. To conform with a privacy law I’m building a sophisticated filter for finding personal data I don’t even want.
- ranger_danger 2y ago
  What a strange game. The only winning move is not to play.
  - estebank 2y ago
    That is precisely the intent of the law: align the incentives of users and service providers, making storing PII annoying enough that the service provider will ask themselves "do I really need this data in the first place?"
    - aleph_minus_one 2y ago
      > making storing PII annoying enough that the service provider will ask themselves "do I really need this data in the first place?" No, the service provider will rather ask himself: "Where can I find a really good lawyer who can tell me how to handle shitty EU laws without getting into a risk of getting sued?" In other words: this law is a job creation scheme for lawyers.
      - OKRainbowKid 2y ago
        Usually, complying with the law is the best solution if you do not want to get sued.

gpderetta 2y ago

more than unpopular is polarizing.

james-bcn 2y ago

The only part of GDPR most people know about are the website pop-ups, which probably was a bad idea. They don't know about all the other stuff that is really positive.

piva00 2y ago
The GDPR is not the ePrivacy Directive (the "cookie law"), the ePrivacy Directive predates the GDPR by many years.
rakoo 2y ago
The pop-up is not part of the law. The law says user should be aware and able to do informed changes, not that they should be annoyed. That part is entirely on companies
- gls2ro 2y ago
  Yes popups are not part of the law. they are an implementation choosen by the websites. Also I put a bit of responsibility on us, the consumers. It does not seem to me that popups are such a real issue since no website reported: we are removing popups because users are so annoyed that they stopped visiting our website.
- aleph_minus_one 2y ago
  > The law says user should be aware and able to do informed changes, not that they should be annoyed. Then tell us how companies should implement this law both - without annoying the user - not being in a risk of getting sued If the law does not make this relatively easy, one has a right to be furious about the EU.
  - wizzwizz4 2y ago
    It's written in plain English: you can read it yourself. Articles 5, 12, 24 and 25. The main problem, and the reason certain parties are working so hard not to comply, is that GDPR makes several business models illegal. (Not that I see that as much of a problem.)
    - aleph_minus_one 2y ago
      > It's written in plain English: you can read it yourself. Articles 5, 12, 24 and 25. This is what the law says, but not how shysters/pettifoggers interpret it. :-(
    - roenxi 2y ago
      > It's written in plain English: you can read it yourself. That isn't how the law works for things like this though; what is plain to a lawyer is different to an untrained person. People make that mistake with tax law all the time; they read something and come up with a plain interpretation that shows they don't have to pay their taxes and that delusion persists until someone explains the actual, less plain, reading. It isn't the worst starting point but winging the law with untrained readings is not really acceptable for running a business.
      - wizzwizz4 2y ago
        People also come up with "plain interpretations" of the laws of physics that allow them to construct perpetual motion machines. Arrogance and wishful thinking are a bad combination, no matter the field.
- shagie 2y ago
  If I go to the EU website ( https://european-union.europa.eu https://european-union.europa.eu ) and see a pop up, surely there's a better way of implementing that it if it wasn't the best way to do so. If there is a pop up there, for just accessing the home page of the European Union, is that site collecting too much data? There's even a bit at the bottom of https://gdpr.eu https://gdpr.eu > We use cookies to ensure that we give you the best experience on our website. If you continue to use this site we will assume that you are happy with it.
  - ryanisnan 2y ago
    I'm being a bit snarky, but maybe the better way involves not tracking people to death.
    - shagie 2y ago
      Under the GDPR, an IP address is PII and recording the IP address of a visitor can be problematic. https://gdpr.eu/eu-gdpr-personal-data/ https://gdpr.eu/eu-gdpr-personal-data/ Looking back at the GDPR’s definition, we have a list of different types of identifiers: “a name, an identification number, location data, an online identifier.” A special mention should be made for biometric data as well, such as fingerprints, which can also work as identifiers. While most of these are straightforward, online identifiers are a bit trickier. Fortunately, the GDPR provides several examples in Recital 30 that include: Internet protocol (IP) addresses; cookie identifiers; and other identifiers such as radio frequency identification (RFID) tags. These identifiers refer to information that is related to an individual’s tools, applications, or devices, like their computer or smartphone. The above is by no means an exhaustive list. Any information that could identify a specific device, like its digital fingerprint, are identifiers.
      - p_l 2y ago
        The trick is to read through and understand what falls under "Legitimate Interest" (important note: it never involves giving other services access to it!). A very common example is recording the IP address for technical (debugging, ensuring site functionality) and legal (security, audit logs) does fall under Legitimate Interest. Worst case you have to mention it in privacy policy. The thing you can't do is let your marketing team or others grab at it in any way, or sell it to other vendors, and arguably you should not move outside of safe countries.
- blablabla123 2y ago
  That, the whole pop-up idea was just copy&pasted. It's possible to make commercial websites without it when turning off tracking without logging or having to explicitly opt-in, possibly for added value. There's a lot of confusion while the law is mainly about differentiating which data is needed to operate and which is purely nice to have. That said, there are plenty of GDPR-compliant services that keep data for 10 years mostly in finance or auditing related use cases and nobody bats an eye

kasey_junk 2y ago

I don’t have much of an opinion on the overall value of GDPR, but I’ve been asked multiple times now to create indexes of personal data to _comply_ with the law when said indexes were not wanted for business or technical reasons. An example is in big data repositories where personal data may have been provided but not used for anything. Yes it’s there but nothing uses it. To enable the reporting and deletion requirements you build a system that keeps track of all that, now the data _is_ trivially correlated which seems like the opposite of the intent. Even when I build systems that prunes the data on ingest it feels weird. To conform with a privacy law I’m building a sophisticated filter for finding personal data I don’t even want.

ranger_danger 2y ago
What a strange game. The only winning move is not to play.
- estebank 2y ago
  That is precisely the intent of the law: align the incentives of users and service providers, making storing PII annoying enough that the service provider will ask themselves "do I really need this data in the first place?"
  - aleph_minus_one 2y ago
    > making storing PII annoying enough that the service provider will ask themselves "do I really need this data in the first place?" No, the service provider will rather ask himself: "Where can I find a really good lawyer who can tell me how to handle shitty EU laws without getting into a risk of getting sued?" In other words: this law is a job creation scheme for lawyers.
    - OKRainbowKid 2y ago
      Usually, complying with the law is the best solution if you do not want to get sued.