Hacker News Reader

Comment by _petronius | Hacker News Reader

I'm really hoping that GDPR enforcement is done in a way that is consistent with the intent of the law, and that we don't end up with a repeat of the cookie regulation (the end result of which was merely training users to click through another popup with reading it at all, and no meaningful improvement in general public understanding of what cookies are, and how or why they are used).

The cookie thing was poorly drafted, as a result advice on complying with it was poor, and it became something to be worked around rather than a meaningful improvement on privacy and an understanding for the general public of how and why tracking works. I have higher hopes for the GDPR, although I still think it is too much of a compromise, and worry about what that means for accomplishing its intent.

View on HN

Good news - unlike the cookie thing, GDPR mandates that you be able to say no. The cookie thing was pointless because it gave nobody any meaningful choice - "click Accept on everything, or don't use the Internet". GDPR is going to make "Let me use your site, but don't use that fact to track me" an option they are legally required to offer. I cannot wait.

GDPR Article 7(4)

When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.

So GDPR does not say its illegal, just that it will be determined on case by case basis.

For legal experts, is this facebook consent obtaining GDPR compliant ?

https://www.facebook.com/legal/terms/update

By using or accessing Facebook Services, you agree that we can collect and use such content and information in accordance with the Data Policy as amended from time to time.

https://gdpr-info.eu/recitals/no-32/ is the definition of consent.

Simply having a term in the general conditions fails the "a clear affirmative act" part.

Saying "use such content" fails the "informed and specific" part - it needs to detail exactly what uses (explicitly listing each) you're consenting to; and it doesn't list the purpose of the use, which is a key part ("When the processing has multiple purposes, consent should be given for all of them")

If facebook has obtained your consent for one (or hundred and one) use-case, it does not mean that it can use it for something else simply by amending ("from time to time") the Data Policy, it would need to get additional explicit, affirmative (opt-in), informed consent to the new processing need of your information.

That's good news, but aren't there legal ways around that for sites that are not based in the EU?

The first question could be: are you in the EU?

yes -> no access

no -> access, but with tracking

So, basically training users to lie about their location.

> The first question could be: are you in the EU?

Just to be clear - it's about EU citizens, not EU located-people, and your location can change. You have to ask if they're EU citizens.

To be doubly-clear, it’s both. GDPR talks about “EU residents”, and that potentially covers people born in EU countries, people who’ve taken EU citizenship, people who are resident in the EU but aren’t citizens, people on holiday in the EU and potentially even people transferring through an EU country while travelling.

https://cybercounsel.co.uk/data-subjects/

Some legal teams have suggested to specifically not adopt that interpretation and rather to assume it covers anyone on EU soil at the time of the data collection or when they make the access/delete requests.

This feels to me as not a lawyer as something that will only be clear after precedent is set.

I for one don’t want to be a test case.

For the ideas like those, there was a post on pagefair https://pagefair.com/blog/2017/tracking-walls/

And dont forget that the next regulation is ePrivacy regulative which might fix workarounds like you are proposing.

The idea of GDPR is about human rights and if you are having a problem with protecting them, than I think GDPR is not a problem, you are.

first question. but first decision even before that is if the company providing the site is under EU regulation.

Most companies just moved the site to their non-eu parts and handled it with internal cost centers. The ones that couldn't do that or that had to show EU sold ads are the ones stuck with the cookie "OK-only" popups.

Yep. This is exactly what will happen except the question will be are you an EU resident. Click no and you get access, click yes and you get turned away. Who is going to click on yes?

It works iff you don't really do business with people in EU - if after getting this "no" you expect to charge credit cards with EU addresses or shipping goods to EU, then this likely won't fly - it requires you to actually refuse their business, not just get them to click "i'm ok".

You could be right but the businessmodel of most of these companies is that you pay with your data.

Look at it this way - the data of EU people is valuable only because someone eventually will get money from those EU people.

Showing targeted ads to EU people is only valuable because someone somewhere expects to sell stuff to EU people based on those ads; behavior data about EU people is only valuable because someone somewhere expects to use that data to get money from those people.

The end users (potential buyers) of that data will need to be GDPR compliant, because they'll be trading with EU and thus have a presence in EU - and they will have to show that they got all that data in a compliant manner and had consent for that. All the major advertisers with all their money won't be able to legally buy or use "tainted" data for which they have no GDPR-style consent, so they won't.

So if USAdCo has no presence in EU, and has been "paid with data", then it's been paid in a worthless currency - EU companies won't/can't buy that data, worldwide companies like CocaCola or Netflix or Amazon or other USA companies who have EU customers won't/can't buy that data since they have EU presence and will need to be compliant, and USA companies who don't have EU customers won't buy that data since it's not valuable to them.

What good is all that data if you can't really use or sell it? It's not enough for you to be out of GDPR reach, you also need your main partners to be out of GDPR reach; since if you're trading information that might contain private data, and they want to be compliant, guess what - they'll require you to be compliant as well, since they can't simply say "oh, they sold us that data, it's their problem", they're fully responsible.

> Good news - unlike the cookie thing, GDPR mandates that you be able to say no.

The ePrivacy Directive (aka the cookie directive) also required you to be able to opt out. It was pretty explicit, too:

"Member States shall ensure that the use of electronic communications networks to store information or to gain access to information stored in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned is provided with clear and comprehensive information in accordance with Directive 95/46/EC, inter alia about the purposes of the processing, and is offered the right to refuse such processing by the data controller."

The problem was that some member states cooked up an "implied consent" interpretation, according to which visitors can be assumed to have consented.

The difference between the GDPR (and the new ePrivacy Regulation, which most likely is going to address the issue directly) is that they're regulations; they're directly applicable EU law, not law that has to be transposed into local law by the member states. The EU Commission is also given enforcement powers; and, if I read the upcoming ePrivacy Regulation correctly, can also go after the adtech companies directly rather than the site owners (because ignoring lack of consent is done at the adtech level rather than by site owners, as opposed to a failure of providing a consent mechanism).

I also wouldn't put too much emphasis on the GDPR; while it's likely to cause compliance trouble for adtech companies, the ePrivacy Regulation is more directly applicable.

GDPR isn't really a revelation. In many European countries there already was data protection legislation. The only thing that changes is that now its more enforceable in a unified market.

American companies had a huge unfair advantage compared to their European competition. Now everyone has to deal with the same laws.

Reply on news.ycombinator.com