Hacker News Reader

I don't think this is a very well through out opinion of GDPR. GDPR applies equally to all companies that trade in Europe, not just US companies. So it's difficult to describe it as an attack on US companies.

Additionally GDPR simply enshrines some pretty basic social norms around informed consent and transparency. It doesn't prevent anyone doing anything that's privacy invasive, it just requires that:

1) You tell people what you are doing with their data (in plain English)

2) You get their informed consent and give them the option to opt-out (additionally you can't bundle multiple "purposes" together).

Both of those things seem pretty fair to me, and it certainly a standard that we apply to other aspects of life (with sex being the most obvious example).

So Facebook could train their self-harm detecting AI in the EU, and it can deploy it there. It just needs to ask and get consent from people first, and honour their personal choices.

Equally they could train and deploy their face recognition technology in the EU as well. But again they need to get informed consent, and they can't coerce people by only offering their self-harm technology if they also opt into their face recognition technology (they can't bundle multiple "purposes").

Altogether I think that this is pretty simple and fair, and really technology companies are only suffering because in the past they have collected personal data indiscriminately on the basis that it might be useful some day. And for companies that rely on tricking people into handing over personal data, I don't think the world will suffer without them.

As I've commented below it's disingenuous to say that GDPR applies equally to all companies when it was conceived with US tech companies in mind and is designed to alter their business models.

1) Some of the ideas in there are welcome.

2) When you put roadblocks in front of every data point it's difficult to develop a half decent pattern matching system. A consent prompt upon joining ought to suffice.

> technology companies are only suffering because in the past they have collected personal data indiscriminately on the basis that it might be useful some day

Perhaps, but the "might be useful someday" part is a route for many an innovation that I want to preserve.

I think this law will force people building AI's and ML systems to innovate more and be more thoughtful of how they use peoples data.

Companies like DeepMind are already showing that collecting every data point under the sun is unnecessary, and that ML systems can be built with privacy in mind. Anyone that can't be bothered to put the effort in can, quite frankly, die at the hands of the market.

I don't think that's disingenuous at all. Incidentally, most of the big tech companies are in the US. But there's some in Europe that are hit equally hard by this regulation. Examples: Booking.com (Dutch, but American owned, pays taxes primarily in the Netherlands): between 60 and 90 billion USD worth; Spotify (Swedish) purportedly worth 30ish billion USD.

In other words: I really doubt that this is a targeted attack on the US/US companies.

Finally, I think a lot of GDPR is at least as hard to implement for non tech companies as it is in tech/information type companies. The latter at least have lots of in house expertise in both tech and usually tech related law. It's just really expensive for them. More traditional companies that run some crazy IT system built by an outsourcer 20 years ago might have a bigger problem.

Disclaimer and source: implemented several GDPR components when working at Booking.com.

>it's really a further effort to go after US tech companies

That makes no sense. The rules are not different for US companies so how can it be an attack on them?

>The social network has also kept out of Europe facial recognition software that tracks when photos of users are posted across the platform.

Are you sad about this? If so, why?

> The rules are not different for US companies so how can it be an attack on them?

That seems like a disingenuous question, the companies that are mainly impacted by these laws are US companies. It might theoretically apply to all companies but in reality they had a handful of US companies in mind when they wrote theses regulations.

As for the impeded innovation question, yes I feel that something is lost when a "cool" and useful feature is prevented from materializing.

Facial tracking isn't "cool" and useful. It's creepy and dangerous and I want to be able to opt out of it.

I'm in favor of "opt out", I just don't want to eliminate the option.

The GDPR is in favor of "opt in". It doesn't eliminate the option either, it just makes sure that people are allowed to make informed decisions about their data.

>the companies that are mainly impacted by these laws are US companies.

Any company who handles personal data is impacted. Facebook and Google are not the only ones which do. European online shops and banks also have to comply.

Just because Facebook and Google generate the most press on this issue doesn't mean it is an attack on them in particular. Privacy and data concerns are real societal issues. Tackling them is absolutely necessary and the EU is doing a good job by ruling that we own our data.

Hindering the kind of innovation that violates the citizen's privacy is pretty much the point of the law. A company having a database of my mental health status is incredibly creepy to me. As is the facial recognition thing.

There is a lot of good that can come out of a database on the mental health of a large population. I think you should be able to opt out of such collection but I'm not in favor of banning such collection altogether.

Realistically, the benefits are better ad targeting and improved addictiveness of the platform. Iotw, no benefit for me.

Sure in the best case you can do a lot of good with such data. But that would probably need the data to be open to researchers, not in some corporate silo somewhere.

And in the worst case, pervasive surveillance data can do a lot of harm. Just ask yourself what an organization like the Stasi could have done with that kind of data.

It should be opt-in.

GDPR makes things opt-in, it means you have to consent. I fail to see how that is a bad thing.

Codifying terrible a ruling into law.

Care to elaborate?