13 ms·

Europe's GDPR privacy law is headed for red tape bonfire within 'weeks'

99 points by taubek 2y ago

jdiez17 2y ago
Uh oh. I'm all for cutting the red tape, but (in my opinion) the GDPR is: 1) easy to comply with if you're not doing nasty stuff with people's data, 2) actually needed. Any opposing views?
- superkuh 2y ago
  It's easy as long as you're a corporation. It's onerous for a human person. Like the EU's excellent Digital Markets Act, GDPR should be altered to only apply to corporations. It'd be better if like the DMA it only applied to very large corporations, but just corporations is still way better than the status quo.
  - johnnyanmac 2y ago
    It's also easy if you simply stop trying to track users and only store the most necessary data. Like, no one ever seem to consider this. Meanwhile, this same community a few days back were discussing the idea of trying to abolish advertisement. That's truly bluesky thinking if we're still justifying user tracking in 2025.
    - superkuh 2y ago
      I only "store" my webserver's logs and user submitted comments. But someone can still put the legal pressure on me, a random person, to force me to do work to turn over those logs/etc. It's wild. Like having a security camera, hosting a BBQ for the neighborhood, and having a neighbor demand access to the recorded video with legal threats. This whole thing really only makes sense in the context of for-profit incorporated persons. It should not apply to me, a random human person.
      - kuschku 2y ago
        You have up to 30 days to respond to access/edit/delete requests. It's accepted practice to only keep logs for e.g. 48 hours and respond to any request with 2 days delay "we've got no logs from that timeframe anymore".
      - AndrewStephens 2y ago
        Why do you store your webserver's logs? My reading of the GDPR (I am not a lawyer) is that it strongly encourages site owners to store the very minimum amount of data about visitors - something that I wholeheartedly agree with. Server logs are useful for debugging the site but also contain potentially identifying information (IP addresses) so I have my site delete them after 48 hours. User submitted comments are obviously required for the usage of your site, so you are in the clear there.
        superkuh 2y ago
        I read the logs with my human eyes manually because I am interested in learning about the web and internet. In fact today I found a whole new useful search engine because I saw it's spider in my logs. 64.62.202.82 "GET /library/Math/Mathematical%20Methods%20for%20Physicists_%20A%20concise%20introduction_%20Tai%20L%20Chow_%202000.pdf -" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Centurybot/1.0; +http://www.rightdao.com/bot.html) Chrome/131.0.0.0 Safari/537.36" It turns out that http://www.rightdao.com/ http://www.rightdao.com/ is a great old-style search engine that actually returns many tens of pages and thousands of results. As opposed to google that only ever returns <400, bing <900, and kagi <200. I guess I keep logs because I want to interact more directly with the internet as a whole and experience the serendipity that comes with that.
        kuschku 2y ago
        Then keep your logs for 14 days, and remove IPs from them after 48h. Tools for that exist, you don't keep unnecessary data, and you're in the clear.
- DarkWiiPlayer 2y ago
  Smaller entities should still be required to fix/delete your personal data on request, imho. I'd also appreciate if the exception was conditional on not selling any data or using it for external advertising (i.e. "you might also like" suggestions would be okay, as long as they're part of the same service)
- cbeach 2y ago
  I shut down a couple of my websites that provided a service for free (streetlend.com and cointouch.com) because the GDPR was too ambiguous for me to be 100% sure I complied with - and in the past online I have encountered vexatious people who have to tried to damage my reputation. On one of my other websites, those people used GDPR privileges (eg making vexatious SAR requests) simply to make my life more difficult. At the end of the day, I create helpful and fun websites for free in my spare time because I enjoy it. EU regulation created jeopardy and friction that meant I couldn't justify doing this anymore.
- johnnyanmac 2y ago
  You're on a forum supported by a startup accellerator for entrepreneurs who want to get stuff up and running with as little friction as possible. It's fairly obvious that Sinclair's quote would ring true here.
diggan 2y ago
> The GDPR is seen as one of Europe's most complex pieces of legislation by the technology sector Really? Now I'm no bureaucrat, merely an engineer, but GDPR was relatively easy to read through, even the official document (https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679 https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELE...) is only 88 pages long, this cannot realistically be "one of Europe's most complex pieces of legislation". A lot of privacy-conscious SME basically had to do nothing to be compliant, telling me it seems to hit the mark of being not too complicated. Most of the cases I've heard people complaining about GDPR being "complicated" or "impossible to implement correctly" have been from people/organizations who are breaking GDPR, and have no way of reaching compliance without removing things they ultimately earn money from, which in my mind is the exact purpose of GDPR. Most orgs don't seem to be introspective enough to understand why they are having such a hard time with GDPR though. I hope that their proposed "simplification package" doesn't actually remove what makes GDPR useful and good, but since they seem to be making a bunch of bad-faith arguments for this simplification, I'm not super optimistic.
- mentalgear 2y ago
  On the spot > Most of the cases I've heard people complaining about GDPR being "complicated" or "impossible to implement correctly" have been from people/organizations who are breaking GDPR
- james-bcn 2y ago
  Yes I agree. A lot of the stuff in GDPR are things that companies should be doing anyway.
- deleted 2y ago
  [deleted]
- pjc50 2y ago
  Eh, you can see in this thread how all sorts of things are confusing. What, exactly, requires a cookie banner? Does an IP address in a log count as personal information on its own? And so on. I can see why it was intended to be generic, but the lack of clear guidance and especially the lack of de minimis exemptions (one of the things mentioned to be addressed!) are a very real problem. "What tests do I have to perform before asserting that I am CE compliant" is a similar, even vaguer question.
terminalbraid 2y ago
At the minimum I'd hope they a) do away with the worthless cookie banners requirement b) cut some generous but reasonable slack to small organizations. Interesting timing with the digital sovereignty movement.
- diggan 2y ago
  > do away with the worthless cookie banners requirement Not a GDPR thing, and the reason you see the banner is because companies refuse to understand the regulation correctly. > cut some generous but reasonable slack to small organizations Some more slack you mean, since they already have a lot of slack compared to larger organizations? What exactly is so cumbersome for a small business to comply with? They're generally "common sense" requirements, and most organizations who already take care of their data basically had to do nothing to be compliant. What are you doing that is so complicated or essential that it's hard to comply, as a SME?
  - volemo 2y ago
    > Not a GDPR thing, and the reason you see the banner is because companies refuse to understand the regulation correctly. Companies will never "understand the regulation correctly" because it's not in their interests. That is why the regulation should be bulletproof: as concise as possible while forcing the exact behaviour regulators intend.
    - diggan 2y ago
      > possible while forcing the exact behaviour regulators intend That's what I'm seeing happened? 1. Companies store personal data willy nilly 2. Regulators create directives that force companies to stop doing that, or at least be upfront about it 3. Companies who still want to do it, are at least up front about it, telling users what is happening 4. Users now complain about regulators that companies are letting them know, missing the fact that the only companies who are adding those banners, are companies who are hellbent on doing these things anyways. The blame seems misdirected to me.
cbmask 2y ago
The politicians cite competitiveness as the motivator for relaxing the GDPR. The real reason for the EU lagging behind the US in "big tech" is of course the lack of venture capital and the red tape in registering corporations. The GDPR does not prevent US big tech from operating in the EU. As it stands, this is just another attack on EU citizens' rights. It is also the least of the EU's current problems. De-industrialization due to high energy prices is, but of course von der Leyen will not mention that.
- diggan 2y ago
  > The GDPR does not prevent US big tech from operating in the EU. Of course it doesn't, that'd be stupid. But it does require them to be compliant, otherwise they'll face fines and eventually they'll chose to either be compliant, or exit the market. As a EU citizen with rights, I love this, exactly what I want from my inter-continent union of countries.
  - ta1243 2y ago
    > otherwise they'll face fines and eventually they'll chose to either be compliant, or exit the market. Or declare war against the EU, which is the option they've gone for.
  - wongarsu 2y ago
    And complying with the GDPR isn't that difficult as a startup. You can build your systems from the ground up to be able to accommodate GDPR requirements. There is some documenting paperwork you are supposed to have internally, but enforcement is quite lenient if you show good-faith efforts to comply.
- Muromec 2y ago
  > and the red tape in registering corporations. what red tape? from what I understand you have your articles of incorporation, your id an register with chamber of commerce. I mean it varies from country to country and licenses and all the EU stuff exists, but what red tape is there when registering the company itself?
- 2y ago
perch56 2y ago
Before tossing GDPR onto the bonfire, perhaps the EU should first look at DORA.
djha-skin 2y ago
I think simplifying the law for companies smaller than the 500 person cutt-off makes sense. The Brussels effect is strong. I was just in a company of approximately ~150 people in America and a significant portion of our time went to GDPR/California law takedown requests. User data was everywhere, it was a nightmare. No one thinks of this stuff when everyone is still in sink or swim mode. We got it done though. Maybe it's an argument for the other side though as well. The architecture of the system was designed to track people as much as possible so we could do A/B, app design, and marketing more effectively. It felt like it was the company's life blood. I would say the law should at least make people get their architecture right when small so that when they're big it's not impossible to comply later. One last thought: our company was small in head count but is getting much bigger right now in revenue. I've heard of small head count, billion dollar companies. What of them?
- xmodem 2y ago
  I spent four years working at a European fintech that serviced millions of end-users, and we had a self-service GDPR portal for users to export or request deletion of the data we had on them. (In some cases we were required to hold onto certain data due to other laws). Any feature that stored new user data had to get integrated into the tool, and then signed off from legal and the team that maintained the tool. It got very little usage - maybe a few hundred to a thousand requests per year IIRC. I shudder to think what you could have been doing that would attract that volume of requests. Was it Clearview AI?
xeonmc 2y ago
Quite apropos that this article was cookie-walled with a "We value your privacy. Customize/Agree" modal screen
- Rygian 2y ago
  Which is not compliant with GDPR if those were the only two prominent options. Disagree must be as prominent as Agree.
  - andrewla 2y ago
    Wait, are you implying that regulations are hard to comply with, poorly documented, and enforcement is extremely selective to the point where they no longer achieve their intended function? Big news if true. They should do something about that.
    - Muromec 2y ago
      it's not that it's hard to comply, it's fighting malicious compliance which is hard. nevertheless, it's a good damn question why every single operator that has "accept all" and doesn't have "reject all" right there on the consent banner isn't fined on the spot. I think the commission noted this behavior and malicious compliance is already factored into the DMA act. The "deregulation" of GDPR could as well be retrofitting all the lessons learned into the GPDR v2.
      - andrewla 2y ago
        That's cute. Worth noting first that this is not really the GDPR (nobody here has said that it is directly, but in other threads people are making that assumption), this is the ePrivacy Directive (which is probably what the EU should be revising in light of these universally hated popups). The EU hands out arbitrary fines to large companies that range in the hundreds of millions of dollars, and ask companies to comply with these "technology-neutral" guidelines [1] which are so opaque that it is impossible to decipher when you are and are not in compliance with them. > The methods for giving information, offering a right to refuse or requesting consent should be made as user-friendly as possible This is wonderfully clear and explains exactly when you will and won't be the victim of extortion-level fines from the EU. You call it malicious compliance; sure, but when this is what everyone else is doing, and you decide that you want to go against "industry norms" for your website, you are painting a giant target on your back. [1] https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:32002L0058:en:HTML https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX...
sega_sai 2y ago
I think the title is clickbait'y. The EU proposes to simplify the law rather than abolish it, which makes sense to me.
- drooopy 2y ago
  politico is known for its clickbait titles.
  - mmooss 2y ago
    They are owned by Axel Springer, whose CEO and part-owner is extreme neo-capitalist Mathias Döpfner, and their news follows his philosophy (or similar ones) as if they are fact, at least at times. The headline depicting privacy regulation as a 'bonfire' is not surprising; I think they were different before the recent corruption of professional journalism by similar people (there is some good journalism remaining!). Regarding Döpfner, he tried to fire an editor at Business Insider (another Axel Springer publication) because Wall St power player Bill Ackman didn't like their coverage of Ackman's wife. [0] He's taken positions such as, "I am all for climate change"; and ""Free west, fuck the intolerant Muslims and all the other riff-raff." [1] Politico has published articles saying, "Time to Admit It: Trump Is a Great President. He's Still Trying To Be a Good One.", claiming "The most consequential presidents divided the nation - before “reuniting it on a new level of understanding." (by founding editor and global editor-in-chief John Harris). [2] And another that claimed, as news and not opinion, that disinformation concerns were a "panic" and now outmoded. [3] At least some of their coverage of American politics assumes - again as news fact, not opinion - that anything the left does is ridiculous. I actually want to know the reality of things, as much as possible, so I will hardly read them anymore. [0] https://www.semafor.com/article/04/21/2024/axel-springers-trump-years https://www.semafor.com/article/04/21/2024/axel-springers-tr... [1] https://www.theguardian.com/world/2023/apr/13/axel-springer-ceo-mathias-dopfner-leaked-messages-reported https://www.theguardian.com/world/2023/apr/13/axel-springer-... [2] https://www.politico.com/news/magazine/2025/01/21/harris-column-trump-great-president-00199564 https://www.politico.com/news/magazine/2025/01/21/harris-col... [3] https://www.politico.eu/article/nobody-tricked-vote-donald-trump-disinformation-panic-over/ https://www.politico.eu/article/nobody-tricked-vote-donald-t...
_petronius 2y ago
As a big GDPR fanboy, one thing I would be happy for them to remove is the portability between providers requirement: it was essentially dead on arrival, is not implemented, and could be done away with. The other EU-level regulation that needs to be either removed or completely rethought (since it will clearly not be enforced in a way that makes sense) is the cookie regulation. It was well-intentioned, badly implemented, and the GDPR addresses more of the core problems, it is time to do away with it. But as a whole, I push back against the idea that deregulation is the primary way in which the EU can or should become competitive with the US on technology. Lack of public investment, worse ability for companies to offer equity incentives, and timid private investment are all much bigger problems than consumer protection regulations.
- Avamander 2y ago
  > I would be happy for them to remove is the portability between providers requirement: it was essentially dead on arrival, is not implemented, and could be done away with. Well, they actually shouldn't. There are non-EU email providers that show exactly what would happen - customers wouldn't be able to transfer out their email from that service provider. Unlucky if they won't notice that limitation in time. > The other EU-level regulation that needs to be either removed or completely rethought (since it will clearly not be enforced in a way that makes sense) is the cookie regulation. It was well-intentioned, badly implemented, and the GDPR addresses more of the core problems, it is time to do away with it. Or simply start handing out fines for malicious compliance.
m00dy 2y ago
Cookie consent banners might be one of the most frustrating aspects of modern web browsing. A better solution could have been a thoughtful extension or fork of HTTP, specifically for EU implementations, something that handles consent through HTTP headers instead. That would allow users to easily opt in or out, either globally or per tab, without the clutter. Ideally, technical regulations like these should be designed by people with a strong understanding of technology, to ensure practical and user-friendly solutions.
- DarkWiiPlayer 2y ago
  It would have been easy to write in generic wording that the "do not track" header must be respected by websites. I'be been wondering for ages why this wasn't implemented.
  - nickff 2y ago
    From the implementation and enforcement, it seems like GDPR was an attempt to make tracking visitors so expensive and difficult that it would eliminate targeted marketing, without negatively impacting consumer choices. The 'do not track' header would not achieve this goal.
    - DarkWiiPlayer 2y ago
      It would if "do not track" had to be treated as an automatic "only essential cookies" choice to avoid cookie banners altogether. At first it would only affect a couple of users, but sooner or later enough "life hack" videos would be out there informing plenty of users about how to get rid of those annoying cookie banners.
- johnnyanmac 2y ago
  cookie consent banners are a workaround GDPR, not a requirement from GDPR. If companies just stopped trying to track people by default, then we'd have the best of both worlds. But as we see with Apple and DMA, they will instead do their best to drag it out.
deleted 2y ago
[deleted]
JCWasmx86 2y ago
If the GDPR is simplified, the fines should be drastically raised. (At least for companies) E.g. to minimum 20% of the global last years revenue, for bigger companies (FAANG-Scale) to minimum 70% of the revenue. The GDPR must make companies afraid of breaking the law.
- Muromec 2y ago
  (looking at the DMA act) they know, they know.
bcye 2y ago
GDPR is not complex because it is hard to comply with but because seemingly no one wants to. EU-US data transfers have been declared illegal numerous times [1], but instead of supporting European cloud providers those decisions are barely enforced and quickly circumvented by a new data transfer act. Cookie banners are not hard to implement if you don't try to share user data with your "864 most trusted partners", there are clear guidelines [2] now on how they need to be designed, but instead of criticising these not being properly enforced, the requirement for them itself is criticised. How is it that Meta can regular break the law, with 7 of the 10 highest fines (or probably around a third of all fines) going against them [3] with seemingly no action taken to prevent this from continuing onwards. noyb has managed to achieve more than a billion euro in fines with only 6 million euros in funding, we could be focusing on supporting NGOs doing incredible work for their budget and getting our DPAs to probably enforce the law. The issue with GDPR is not the law but the seeming unwillingness to enforce it leading to unclarity what is expected and what not. [4] [1]: https://noyb.eu/en/23-years-illegal-data-transfers-due-inactive-dpas-and-new-eu-us-deals https://noyb.eu/en/23-years-illegal-data-transfers-due-inact... [2]: https://noyb.eu/en/noybs-consent-banner-report-how-authorities-actually-decide https://noyb.eu/en/noybs-consent-banner-report-how-authoriti... [3]: https://www.enforcementtracker.com/?insights https://www.enforcementtracker.com/?insights [4]: https://noyb.eu/en/data-protection-day-only-13-cases-eu-dpas-result-fine https://noyb.eu/en/data-protection-day-only-13-cases-eu-dpas...
- benterix 2y ago
  > How is it that Meta can regular break the law, with 7 of the 10 highest fines (or probably around a third of all fines) going against them [3] with seemingly no action taken to prevent this from continuing onwards. Because until now we've been treating American companies very leniently, with an occasional slap on the wrist. For example, when Poland wanted to regulate Uber, the American ambassador warned the Polish government that if they do that, they will regret it.[0] And because at that time the USA was in the business of of protecting the East NATO flank, the Polish government turned turned a blind eye on Uber. Now that the USA turned away from Europe, nobody cares about the interest of American companies. When Trumps ambassador (Tom Rose) threatened the current government in the same way recently regarding planned "digital tax", the minister answered "We're nobody's fief". [0] https://phys.org/news/2019-04-hundreds-cab-drivers-protest-uber.html https://phys.org/news/2019-04-hundreds-cab-drivers-protest-u...
junto 2y ago
Whilst I don’t like cookie banner, I personally appreciate the EU GDPR simple style of cookie banners which are simply three options: - accept all - necessary only - reject all So many websites outside the EU have a mass of dark patterns for which I increasingly reject all or leave the website. GDPR is really simple. Only store data that you really need to service the customer’s needs, always permit the customer to correct incorrect data and allow them to delete it unless you have a legal reason to keep it. Report GDPR failures within 72 hours where customer data has been compromised and treat PII carefully. In the US - fuck the customer. I know which I prefer.
more_corn 2y ago
Let’s roll back the stupid cookie notification. Replace it with “sites must respect the user setting in the browser” so we can set it once and be done with all that nonsense.
Woodi 2y ago
So cookie banners go first? As an obsolote "requirement" when all that tracking will be finaly banned? Right ? Just like paper journals - they don't do any identify-your-page-flipper... And employer will be finally allowed to know his employee name and address?? Without additional paper trail? No, they won't allow that, it will be to sane.
M95D 2y ago
> "the simplification plan will focus on reporting requirements for organizations with less than 500 people" I consider this extremely bad! It should be based on revenue, not people. I can imagine extremely big data trading companies with less than 500 people. I can even imagine Meta/Facebook doing various employee redistribution shenanigans and managing to fit inside that limit.
xinayder 2y ago
I see lots of comments supporting it but I can see they are mostly from the business side. What does "simplification" mean for users? I'm expecting companies to be given way more room for exploiting user consent for shady data collection practices.
boruto 2y ago
I don't live in Europe. I still believe GDPR is god send. I just send a chat-gpt generated e-mail to the company to forget me citing GDPR and voila it just works. just have to lie as bit that i am a resident of EU though.

99 points by taubek 2y ago

Uh oh. I'm all for cutting the red tape, but (in my opinion) the GDPR is: 1) easy to comply with if you're not doing nasty stuff with people's data, 2) actually needed. Any opposing views?

superkuh 2y ago
It's easy as long as you're a corporation. It's onerous for a human person. Like the EU's excellent Digital Markets Act, GDPR should be altered to only apply to corporations. It'd be better if like the DMA it only applied to very large corporations, but just corporations is still way better than the status quo.
- johnnyanmac 2y ago
  It's also easy if you simply stop trying to track users and only store the most necessary data. Like, no one ever seem to consider this. Meanwhile, this same community a few days back were discussing the idea of trying to abolish advertisement. That's truly bluesky thinking if we're still justifying user tracking in 2025.
  - superkuh 2y ago
    I only "store" my webserver's logs and user submitted comments. But someone can still put the legal pressure on me, a random person, to force me to do work to turn over those logs/etc. It's wild. Like having a security camera, hosting a BBQ for the neighborhood, and having a neighbor demand access to the recorded video with legal threats. This whole thing really only makes sense in the context of for-profit incorporated persons. It should not apply to me, a random human person.
    - kuschku 2y ago
      You have up to 30 days to respond to access/edit/delete requests. It's accepted practice to only keep logs for e.g. 48 hours and respond to any request with 2 days delay "we've got no logs from that timeframe anymore".
    - AndrewStephens 2y ago
      Why do you store your webserver's logs? My reading of the GDPR (I am not a lawyer) is that it strongly encourages site owners to store the very minimum amount of data about visitors - something that I wholeheartedly agree with. Server logs are useful for debugging the site but also contain potentially identifying information (IP addresses) so I have my site delete them after 48 hours. User submitted comments are obviously required for the usage of your site, so you are in the clear there.
      - superkuh 2y ago
        I read the logs with my human eyes manually because I am interested in learning about the web and internet. In fact today I found a whole new useful search engine because I saw it's spider in my logs. 64.62.202.82 "GET /library/Math/Mathematical%20Methods%20for%20Physicists_%20A%20concise%20introduction_%20Tai%20L%20Chow_%202000.pdf -" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Centurybot/1.0; +http://www.rightdao.com/bot.html) Chrome/131.0.0.0 Safari/537.36" It turns out that http://www.rightdao.com/ http://www.rightdao.com/ is a great old-style search engine that actually returns many tens of pages and thousands of results. As opposed to google that only ever returns <400, bing <900, and kagi <200. I guess I keep logs because I want to interact more directly with the internet as a whole and experience the serendipity that comes with that.
        kuschku 2y ago
        Then keep your logs for 14 days, and remove IPs from them after 48h. Tools for that exist, you don't keep unnecessary data, and you're in the clear.
DarkWiiPlayer 2y ago
Smaller entities should still be required to fix/delete your personal data on request, imho. I'd also appreciate if the exception was conditional on not selling any data or using it for external advertising (i.e. "you might also like" suggestions would be okay, as long as they're part of the same service)
cbeach 2y ago
I shut down a couple of my websites that provided a service for free (streetlend.com and cointouch.com) because the GDPR was too ambiguous for me to be 100% sure I complied with - and in the past online I have encountered vexatious people who have to tried to damage my reputation. On one of my other websites, those people used GDPR privileges (eg making vexatious SAR requests) simply to make my life more difficult. At the end of the day, I create helpful and fun websites for free in my spare time because I enjoy it. EU regulation created jeopardy and friction that meant I couldn't justify doing this anymore.
johnnyanmac 2y ago
You're on a forum supported by a startup accellerator for entrepreneurs who want to get stuff up and running with as little friction as possible. It's fairly obvious that Sinclair's quote would ring true here.

diggan 2y ago

> The GDPR is seen as one of Europe's most complex pieces of legislation by the technology sector Really? Now I'm no bureaucrat, merely an engineer, but GDPR was relatively easy to read through, even the official document (https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679 https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELE...) is only 88 pages long, this cannot realistically be "one of Europe's most complex pieces of legislation". A lot of privacy-conscious SME basically had to do nothing to be compliant, telling me it seems to hit the mark of being not too complicated. Most of the cases I've heard people complaining about GDPR being "complicated" or "impossible to implement correctly" have been from people/organizations who are breaking GDPR, and have no way of reaching compliance without removing things they ultimately earn money from, which in my mind is the exact purpose of GDPR. Most orgs don't seem to be introspective enough to understand why they are having such a hard time with GDPR though. I hope that their proposed "simplification package" doesn't actually remove what makes GDPR useful and good, but since they seem to be making a bunch of bad-faith arguments for this simplification, I'm not super optimistic.

mentalgear 2y ago
On the spot > Most of the cases I've heard people complaining about GDPR being "complicated" or "impossible to implement correctly" have been from people/organizations who are breaking GDPR
james-bcn 2y ago
Yes I agree. A lot of the stuff in GDPR are things that companies should be doing anyway.
deleted 2y ago
[deleted]
pjc50 2y ago
Eh, you can see in this thread how all sorts of things are confusing. What, exactly, requires a cookie banner? Does an IP address in a log count as personal information on its own? And so on. I can see why it was intended to be generic, but the lack of clear guidance and especially the lack of de minimis exemptions (one of the things mentioned to be addressed!) are a very real problem. "What tests do I have to perform before asserting that I am CE compliant" is a similar, even vaguer question.

terminalbraid 2y ago

At the minimum I'd hope they a) do away with the worthless cookie banners requirement b) cut some generous but reasonable slack to small organizations. Interesting timing with the digital sovereignty movement.

diggan 2y ago
> do away with the worthless cookie banners requirement Not a GDPR thing, and the reason you see the banner is because companies refuse to understand the regulation correctly. > cut some generous but reasonable slack to small organizations Some more slack you mean, since they already have a lot of slack compared to larger organizations? What exactly is so cumbersome for a small business to comply with? They're generally "common sense" requirements, and most organizations who already take care of their data basically had to do nothing to be compliant. What are you doing that is so complicated or essential that it's hard to comply, as a SME?
- volemo 2y ago
  > Not a GDPR thing, and the reason you see the banner is because companies refuse to understand the regulation correctly. Companies will never "understand the regulation correctly" because it's not in their interests. That is why the regulation should be bulletproof: as concise as possible while forcing the exact behaviour regulators intend.
  - diggan 2y ago
    > possible while forcing the exact behaviour regulators intend That's what I'm seeing happened? 1. Companies store personal data willy nilly 2. Regulators create directives that force companies to stop doing that, or at least be upfront about it 3. Companies who still want to do it, are at least up front about it, telling users what is happening 4. Users now complain about regulators that companies are letting them know, missing the fact that the only companies who are adding those banners, are companies who are hellbent on doing these things anyways. The blame seems misdirected to me.

cbmask 2y ago

The politicians cite competitiveness as the motivator for relaxing the GDPR. The real reason for the EU lagging behind the US in "big tech" is of course the lack of venture capital and the red tape in registering corporations. The GDPR does not prevent US big tech from operating in the EU. As it stands, this is just another attack on EU citizens' rights. It is also the least of the EU's current problems. De-industrialization due to high energy prices is, but of course von der Leyen will not mention that.

diggan 2y ago
> The GDPR does not prevent US big tech from operating in the EU. Of course it doesn't, that'd be stupid. But it does require them to be compliant, otherwise they'll face fines and eventually they'll chose to either be compliant, or exit the market. As a EU citizen with rights, I love this, exactly what I want from my inter-continent union of countries.
- ta1243 2y ago
  > otherwise they'll face fines and eventually they'll chose to either be compliant, or exit the market. Or declare war against the EU, which is the option they've gone for.
- wongarsu 2y ago
  And complying with the GDPR isn't that difficult as a startup. You can build your systems from the ground up to be able to accommodate GDPR requirements. There is some documenting paperwork you are supposed to have internally, but enforcement is quite lenient if you show good-faith efforts to comply.
Muromec 2y ago
> and the red tape in registering corporations. what red tape? from what I understand you have your articles of incorporation, your id an register with chamber of commerce. I mean it varies from country to country and licenses and all the EU stuff exists, but what red tape is there when registering the company itself?
2y ago

perch56 2y ago

Before tossing GDPR onto the bonfire, perhaps the EU should first look at DORA.

djha-skin 2y ago

I think simplifying the law for companies smaller than the 500 person cutt-off makes sense. The Brussels effect is strong. I was just in a company of approximately ~150 people in America and a significant portion of our time went to GDPR/California law takedown requests. User data was everywhere, it was a nightmare. No one thinks of this stuff when everyone is still in sink or swim mode. We got it done though. Maybe it's an argument for the other side though as well. The architecture of the system was designed to track people as much as possible so we could do A/B, app design, and marketing more effectively. It felt like it was the company's life blood. I would say the law should at least make people get their architecture right when small so that when they're big it's not impossible to comply later. One last thought: our company was small in head count but is getting much bigger right now in revenue. I've heard of small head count, billion dollar companies. What of them?

xmodem 2y ago
I spent four years working at a European fintech that serviced millions of end-users, and we had a self-service GDPR portal for users to export or request deletion of the data we had on them. (In some cases we were required to hold onto certain data due to other laws). Any feature that stored new user data had to get integrated into the tool, and then signed off from legal and the team that maintained the tool. It got very little usage - maybe a few hundred to a thousand requests per year IIRC. I shudder to think what you could have been doing that would attract that volume of requests. Was it Clearview AI?

xeonmc 2y ago

Quite apropos that this article was cookie-walled with a "We value your privacy. Customize/Agree" modal screen

Rygian 2y ago
Which is not compliant with GDPR if those were the only two prominent options. Disagree must be as prominent as Agree.
- andrewla 2y ago
  Wait, are you implying that regulations are hard to comply with, poorly documented, and enforcement is extremely selective to the point where they no longer achieve their intended function? Big news if true. They should do something about that.
  - Muromec 2y ago
    it's not that it's hard to comply, it's fighting malicious compliance which is hard. nevertheless, it's a good damn question why every single operator that has "accept all" and doesn't have "reject all" right there on the consent banner isn't fined on the spot. I think the commission noted this behavior and malicious compliance is already factored into the DMA act. The "deregulation" of GDPR could as well be retrofitting all the lessons learned into the GPDR v2.
    - andrewla 2y ago
      That's cute. Worth noting first that this is not really the GDPR (nobody here has said that it is directly, but in other threads people are making that assumption), this is the ePrivacy Directive (which is probably what the EU should be revising in light of these universally hated popups). The EU hands out arbitrary fines to large companies that range in the hundreds of millions of dollars, and ask companies to comply with these "technology-neutral" guidelines [1] which are so opaque that it is impossible to decipher when you are and are not in compliance with them. > The methods for giving information, offering a right to refuse or requesting consent should be made as user-friendly as possible This is wonderfully clear and explains exactly when you will and won't be the victim of extortion-level fines from the EU. You call it malicious compliance; sure, but when this is what everyone else is doing, and you decide that you want to go against "industry norms" for your website, you are painting a giant target on your back. [1] https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:32002L0058:en:HTML https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX...

sega_sai 2y ago

I think the title is clickbait'y. The EU proposes to simplify the law rather than abolish it, which makes sense to me.

drooopy 2y ago
politico is known for its clickbait titles.
- mmooss 2y ago
  They are owned by Axel Springer, whose CEO and part-owner is extreme neo-capitalist Mathias Döpfner, and their news follows his philosophy (or similar ones) as if they are fact, at least at times. The headline depicting privacy regulation as a 'bonfire' is not surprising; I think they were different before the recent corruption of professional journalism by similar people (there is some good journalism remaining!). Regarding Döpfner, he tried to fire an editor at Business Insider (another Axel Springer publication) because Wall St power player Bill Ackman didn't like their coverage of Ackman's wife. [0] He's taken positions such as, "I am all for climate change"; and ""Free west, fuck the intolerant Muslims and all the other riff-raff." [1] Politico has published articles saying, "Time to Admit It: Trump Is a Great President. He's Still Trying To Be a Good One.", claiming "The most consequential presidents divided the nation - before “reuniting it on a new level of understanding." (by founding editor and global editor-in-chief John Harris). [2] And another that claimed, as news and not opinion, that disinformation concerns were a "panic" and now outmoded. [3] At least some of their coverage of American politics assumes - again as news fact, not opinion - that anything the left does is ridiculous. I actually want to know the reality of things, as much as possible, so I will hardly read them anymore. [0] https://www.semafor.com/article/04/21/2024/axel-springers-trump-years https://www.semafor.com/article/04/21/2024/axel-springers-tr... [1] https://www.theguardian.com/world/2023/apr/13/axel-springer-ceo-mathias-dopfner-leaked-messages-reported https://www.theguardian.com/world/2023/apr/13/axel-springer-... [2] https://www.politico.com/news/magazine/2025/01/21/harris-column-trump-great-president-00199564 https://www.politico.com/news/magazine/2025/01/21/harris-col... [3] https://www.politico.eu/article/nobody-tricked-vote-donald-trump-disinformation-panic-over/ https://www.politico.eu/article/nobody-tricked-vote-donald-t...

_petronius 2y ago

As a big GDPR fanboy, one thing I would be happy for them to remove is the portability between providers requirement: it was essentially dead on arrival, is not implemented, and could be done away with. The other EU-level regulation that needs to be either removed or completely rethought (since it will clearly not be enforced in a way that makes sense) is the cookie regulation. It was well-intentioned, badly implemented, and the GDPR addresses more of the core problems, it is time to do away with it. But as a whole, I push back against the idea that deregulation is the primary way in which the EU can or should become competitive with the US on technology. Lack of public investment, worse ability for companies to offer equity incentives, and timid private investment are all much bigger problems than consumer protection regulations.

Avamander 2y ago
> I would be happy for them to remove is the portability between providers requirement: it was essentially dead on arrival, is not implemented, and could be done away with. Well, they actually shouldn't. There are non-EU email providers that show exactly what would happen - customers wouldn't be able to transfer out their email from that service provider. Unlucky if they won't notice that limitation in time. > The other EU-level regulation that needs to be either removed or completely rethought (since it will clearly not be enforced in a way that makes sense) is the cookie regulation. It was well-intentioned, badly implemented, and the GDPR addresses more of the core problems, it is time to do away with it. Or simply start handing out fines for malicious compliance.

m00dy 2y ago

Cookie consent banners might be one of the most frustrating aspects of modern web browsing. A better solution could have been a thoughtful extension or fork of HTTP, specifically for EU implementations, something that handles consent through HTTP headers instead. That would allow users to easily opt in or out, either globally or per tab, without the clutter. Ideally, technical regulations like these should be designed by people with a strong understanding of technology, to ensure practical and user-friendly solutions.

DarkWiiPlayer 2y ago
It would have been easy to write in generic wording that the "do not track" header must be respected by websites. I'be been wondering for ages why this wasn't implemented.
- nickff 2y ago
  From the implementation and enforcement, it seems like GDPR was an attempt to make tracking visitors so expensive and difficult that it would eliminate targeted marketing, without negatively impacting consumer choices. The 'do not track' header would not achieve this goal.
  - DarkWiiPlayer 2y ago
    It would if "do not track" had to be treated as an automatic "only essential cookies" choice to avoid cookie banners altogether. At first it would only affect a couple of users, but sooner or later enough "life hack" videos would be out there informing plenty of users about how to get rid of those annoying cookie banners.
johnnyanmac 2y ago
cookie consent banners are a workaround GDPR, not a requirement from GDPR. If companies just stopped trying to track people by default, then we'd have the best of both worlds. But as we see with Apple and DMA, they will instead do their best to drag it out.

deleted 2y ago

[deleted]

JCWasmx86 2y ago

If the GDPR is simplified, the fines should be drastically raised. (At least for companies) E.g. to minimum 20% of the global last years revenue, for bigger companies (FAANG-Scale) to minimum 70% of the revenue. The GDPR must make companies afraid of breaking the law.

Muromec 2y ago
(looking at the DMA act) they know, they know.

bcye 2y ago

GDPR is not complex because it is hard to comply with but because seemingly no one wants to. EU-US data transfers have been declared illegal numerous times [1], but instead of supporting European cloud providers those decisions are barely enforced and quickly circumvented by a new data transfer act. Cookie banners are not hard to implement if you don't try to share user data with your "864 most trusted partners", there are clear guidelines [2] now on how they need to be designed, but instead of criticising these not being properly enforced, the requirement for them itself is criticised. How is it that Meta can regular break the law, with 7 of the 10 highest fines (or probably around a third of all fines) going against them [3] with seemingly no action taken to prevent this from continuing onwards. noyb has managed to achieve more than a billion euro in fines with only 6 million euros in funding, we could be focusing on supporting NGOs doing incredible work for their budget and getting our DPAs to probably enforce the law. The issue with GDPR is not the law but the seeming unwillingness to enforce it leading to unclarity what is expected and what not. [4] [1]: https://noyb.eu/en/23-years-illegal-data-transfers-due-inactive-dpas-and-new-eu-us-deals https://noyb.eu/en/23-years-illegal-data-transfers-due-inact... [2]: https://noyb.eu/en/noybs-consent-banner-report-how-authorities-actually-decide https://noyb.eu/en/noybs-consent-banner-report-how-authoriti... [3]: https://www.enforcementtracker.com/?insights https://www.enforcementtracker.com/?insights [4]: https://noyb.eu/en/data-protection-day-only-13-cases-eu-dpas-result-fine https://noyb.eu/en/data-protection-day-only-13-cases-eu-dpas...

benterix 2y ago
> How is it that Meta can regular break the law, with 7 of the 10 highest fines (or probably around a third of all fines) going against them [3] with seemingly no action taken to prevent this from continuing onwards. Because until now we've been treating American companies very leniently, with an occasional slap on the wrist. For example, when Poland wanted to regulate Uber, the American ambassador warned the Polish government that if they do that, they will regret it.[0] And because at that time the USA was in the business of of protecting the East NATO flank, the Polish government turned turned a blind eye on Uber. Now that the USA turned away from Europe, nobody cares about the interest of American companies. When Trumps ambassador (Tom Rose) threatened the current government in the same way recently regarding planned "digital tax", the minister answered "We're nobody's fief". [0] https://phys.org/news/2019-04-hundreds-cab-drivers-protest-uber.html https://phys.org/news/2019-04-hundreds-cab-drivers-protest-u...

junto 2y ago

Whilst I don’t like cookie banner, I personally appreciate the EU GDPR simple style of cookie banners which are simply three options: - accept all - necessary only - reject all So many websites outside the EU have a mass of dark patterns for which I increasingly reject all or leave the website. GDPR is really simple. Only store data that you really need to service the customer’s needs, always permit the customer to correct incorrect data and allow them to delete it unless you have a legal reason to keep it. Report GDPR failures within 72 hours where customer data has been compromised and treat PII carefully. In the US - fuck the customer. I know which I prefer.

more_corn 2y ago

Let’s roll back the stupid cookie notification. Replace it with “sites must respect the user setting in the browser” so we can set it once and be done with all that nonsense.

Woodi 2y ago

So cookie banners go first? As an obsolote "requirement" when all that tracking will be finaly banned? Right ? Just like paper journals - they don't do any identify-your-page-flipper... And employer will be finally allowed to know his employee name and address?? Without additional paper trail? No, they won't allow that, it will be to sane.

M95D 2y ago

> "the simplification plan will focus on reporting requirements for organizations with less than 500 people" I consider this extremely bad! It should be based on revenue, not people. I can imagine extremely big data trading companies with less than 500 people. I can even imagine Meta/Facebook doing various employee redistribution shenanigans and managing to fit inside that limit.

xinayder 2y ago

I see lots of comments supporting it but I can see they are mostly from the business side. What does "simplification" mean for users? I'm expecting companies to be given way more room for exploiting user consent for shady data collection practices.

boruto 2y ago

I don't live in Europe. I still believe GDPR is god send. I just send a chat-gpt generated e-mail to the company to forget me citing GDPR and voila it just works. just have to lie as bit that i am a resident of EU though.