14 ms·

I don't see why small organizations should get to be more careless with my personal data than anybody else. The value of my privacy doesn't change just because

• ivan_gammel 2y ago
  They should not be careless, but they can be spared some paperwork as long as they stay compliant with the spirit of regulation.
  • diggan 2y ago
    If you're careful about how you store personal data in the first place, meaning you start a greenfield project today, being compliant with GDPR is a breeze. You make it sound like there is a ton of paperwork to fill out because of GDPR if you start a business today, which there isn't.
    • Hojojo 2y ago
      This pretty much. I've had a lot to do with GDPR in the projects I'm involved with. It's largely trivial if you aren't already doing terribly risky things, in which case yeah, it's a pain, but it doesn't change the necessity of fixing issues that put user private data at risk (with or without the GDPR existing). GDPR just puts more incentive on solving issues in regards to privacy instead of just letting companies shrug and move on because it's not their problem if data is stolen or leaked or letting them do what they want with the data without permission.
    • ivan_gammel 2y ago
      >If you're careful about how you store personal data in the first place Unfortunately this is a really big "if" looking at typical businesses. They have no idea about how compliance should work and they also hire barely qualified people to marketing teams (often interns), who may accidentally add some privacy-breaking stuff. To prevent that they hire an external DPO and then deal with the paperwork for that DPO, who never visits the company onsite and never meets real people touching privacy topics. So no, it's not a breeze, because there's generally no enough expertise and temptation to use American non-compliant MarTech is high. One possible solution to that could be a pan-European registry of data processors with enough metadata to a) generate privacy policy, b) request correct consent, c) provide a compliance implementation checklist for non-trivial cases. There could be a small fee for adding services to this registry, but that would make maintaining compliance much easier.
      • diggan 2y ago
        Yeah, compliance for people who weren't careful before indeed is harder than for the rest. I think this works as expected? Consider if wire fraud wasn't illegal before, but next week there is a new law coming into effect that makes it illegal. Of course all the companies who were doing wire fraud since before will struggle to be compliant, some might not even be feasible to run anymore if their core business becomes illegal. Again, sounds like it works as expected, compliance for organizations who been ignorant for a long time is expected to be more cumbersome.
        • ivan_gammel 2y ago
          I think you did not understand my comment. 1. It is a problem for greenfield projects too. Not everyone has sufficient expertise to be fully compliant from the beginning. The accidental non-compliance is possible and there's usually a cost to prevent it. 2. It may work as expected from EU charter perspective, but current implementation is adding extra to an already high bureaucratic workload. My point is, it can be better than that.
          • diggan 2y ago
            > It is a problem for greenfield projects too. Not everyone has sufficient expertise to be fully compliant from the beginning Saying it's complicated because of missing experience or knowledge is like saying creating a CRUD application is difficult. Yes, it might be difficult if you've never done it before, but that doesn't mean the thing itself is complicated, just that you potentially lack experience. Instead, I'd say it would be complicated if it's hard even if you have experience and knowledge about it. And for GDPR and safely storing data, it isn't difficult in a greenfield project if you have experience with it. > but current implementation is adding extra to an already high bureaucratic workload As someone who've helped SMEs become GDPR compliant, in terms of engineering, there really isn't a high bureaucratic workload unless you were already very careless with how you stored data. For the ones who considered how personal data was stored for more than half a second, becoming GDPR compliant was mostly about confirming things rather than having to shift things around. Few companies though, had huge problems as they 1) were revenue dependent on selling user data or 2) never considered how they were storing or protecting personal data at all. If you're speaking from the experience of those last companies, then again I think it works as expected.
• cbeach 2y ago
  The cookie banners don't make companies less "careless" They just introduce a needless bit of friction in the UX. If the EU wanted to prevent digital identity triangulation or cross-domain advertising data gathering, it should have banned it outright. Rather than getting all users to click a stupid banner every time they visit a website.
  • diggan 2y ago
    So, since they didn't ban it outright, doesn't it make it clear that the goal wasn't to remove it fully? The goal was to let users be informed about it, so they can make their own choice, not to remove the choice at all.
  • vkou 2y ago
    You can eliminate friction in your UX by not collecting data you don't need. It's way less work to, you know, not collect that data. I'm not sure why the government is needed to solve a problem that you've gone out of the way to inflict on yourself.
    • cbeach 2y ago
      Let's say I want to improve my site by recording basic user analytics like unique user counts, to produce actionable data. I'm not nefariously collecting their social security number. I'm just putting some uuid in a harmless cookie in their browser so I can track which requests are from a unique browser. Thanks to the GDPR I cannot do this without the stupid cookie warning popup. In this regard, the GDPR is clumsy lawmaking that results in companies having to behave defensively, hoping that users will accept a damaged UX in order that the company is not fined by the EU.
      • const_cast 2y ago
        You don’t require the cookie popup for this. Again, nobody is actually reading the law here. Tech is 99% followers who blindly do whatever without understanding the motivation behind it.
      • 2y ago
• milesrout 2y ago
  It isn't "your data". Which pages you have viewed on my website is my data. It relates to you but is does not belong to you. You don't have any privacy right to control data that belongs to other people and happens to relate to you. Privacy is about the state needing a warrant to enter your home and search it or to wiretap you. The idea it has anything to do with information you GIVE to websites by visiting them is a complete delusion.
  • Hojojo 2y ago
    I'm glad the EU and most Europeans disagree with you. Because this take is just wrong on so many levels and I'm not sure where even to begin.
    • milesrout 2y ago
      ie. you have an instant emotional reaction but no actual arguments.
      • razakel 2y ago
        European law has established various rights regarding data concerning an individual since 1981.
        • milesrout 2y ago
          Thankfully European statutes don't have anything to do with what words actually mean in the English language and don't override basic logic. The idea that you have the right to control eg. my opinions about you, just because they happen to concern you, is fundamentally contrary to the most basic right we all have: freedom of expression. The cornerstone of civil and political rights.
          • razakel 2y ago
            [flagged]
• m463 2y ago
  I wonder if the "modern" war in the ukraine is making people think about privacy.