3 ms·

That is precisely the intent of the law: align the incentives of users and service providers, making storing PII annoying enough that the service provider will

That is precisely the intent of the law: align the incentives of users and service providers, making storing PII annoying enough that the service provider will ask themselves "do I really need this data in the first place?"

aleph_minus_one 2y ago
> making storing PII annoying enough that the service provider will ask themselves "do I really need this data in the first place?" No, the service provider will rather ask himself: "Where can I find a really good lawyer who can tell me how to handle shitty EU laws without getting into a risk of getting sued?" In other words: this law is a job creation scheme for lawyers.
- OKRainbowKid 2y ago
  Usually, complying with the law is the best solution if you do not want to get sued.
  - aleph_minus_one 2y ago
    The problem is that it is often hard to interpret what the laws mean (they are made by politicians and not computer scientists), and which behaviour risks you getting sued and which not.
    - p_l 2y ago
      Complying with GDPR by not taking data you do not need is easy. Lawyers mainly worked on producing disinformation about it because confusing people made for better consulting fees, but especially once guidance on "legitimate use" filtered out from legalese, they kinda stopped having an angle ... unless what you actually want to do is to violate GDPR and trade in PII, then you need to lawyer up
      - aleph_minus_one 2y ago
        > Complying with GDPR by not taking data you do not need is easy. If your claim was true, the solution would be easy: I simply find a need for all data that I collect. Problem solved? For sure not, which obviously falsifies your "idea" that it is so easy.
        p_l 2y ago
        It does not, because what falls under legitimate interest is also quite clearly described. Is it necessary for performing the service to end user? Is it necessary to support technical or legal issues in providing the service? (Trading data with other entities, marketing, etc ARE NOT, logging, debugging, security/audit logs ARE). Creating BS claims for "legitimate interest" like IAB does is just setting yourself for big fines for breaking the law.
- estebank 2y ago
  If you're technically unable to comply with the requirements of fetching all PII for a given person and subsequently delete it, you have no business storing that PII in the first place. Your line of argument is like complaining that seatbelts are government overreach that increases the cost of cars.
ranger_danger 2y ago
Well, that seems like a good idea, but will that lead to a larger rise in more anonymous services? It also seems like KYC (know your customer) style laws may be incompatible with ECD (E-commerce directive, similar to USA Section 230) laws too.

aleph_minus_one 2y ago

> making storing PII annoying enough that the service provider will ask themselves "do I really need this data in the first place?" No, the service provider will rather ask himself: "Where can I find a really good lawyer who can tell me how to handle shitty EU laws without getting into a risk of getting sued?" In other words: this law is a job creation scheme for lawyers.

OKRainbowKid 2y ago
Usually, complying with the law is the best solution if you do not want to get sued.
- aleph_minus_one 2y ago
  The problem is that it is often hard to interpret what the laws mean (they are made by politicians and not computer scientists), and which behaviour risks you getting sued and which not.
  - p_l 2y ago
    Complying with GDPR by not taking data you do not need is easy. Lawyers mainly worked on producing disinformation about it because confusing people made for better consulting fees, but especially once guidance on "legitimate use" filtered out from legalese, they kinda stopped having an angle ... unless what you actually want to do is to violate GDPR and trade in PII, then you need to lawyer up
    - aleph_minus_one 2y ago
      > Complying with GDPR by not taking data you do not need is easy. If your claim was true, the solution would be easy: I simply find a need for all data that I collect. Problem solved? For sure not, which obviously falsifies your "idea" that it is so easy.
      - p_l 2y ago
        It does not, because what falls under legitimate interest is also quite clearly described. Is it necessary for performing the service to end user? Is it necessary to support technical or legal issues in providing the service? (Trading data with other entities, marketing, etc ARE NOT, logging, debugging, security/audit logs ARE). Creating BS claims for "legitimate interest" like IAB does is just setting yourself for big fines for breaking the law.
estebank 2y ago
If you're technically unable to comply with the requirements of fetching all PII for a given person and subsequently delete it, you have no business storing that PII in the first place. Your line of argument is like complaining that seatbelts are government overreach that increases the cost of cars.

ranger_danger 2y ago

Well, that seems like a good idea, but will that lead to a larger rise in more anonymous services? It also seems like KYC (know your customer) style laws may be incompatible with ECD (E-commerce directive, similar to USA Section 230) laws too.