Hacker News Reader

Comment by jimmaswell | Hacker News Reader

GDPR seemed unnecessarily overburdensome and limiting last time I looked into it. I don't think we should have anything like it.

I don't really buy this concept that you have a reasonable expectation of privacy on other people's websites and the site owners don't own data collected on their services unless the EULA specifically says something to the contrary.

As a practical matter, if we make it even harder to target advertisements then we'll end up with even more of these "you've run out of articles" type sites. I don't want to have to pay the ISP and then also pay every individual website. Collect all the data on me you want to make it so.

View on HN

Its a thorny legal issue, and frankly I think there is very little support for GDPR in common-law.

If you voluntarily walk into someones private shop, can you demand that the shop owner doesn't catalog that event? Is there an expectation of privacy while walking on the public street? If you voluntarily agree to receive access to a service in exchange for data collection, can that legal contract be invalidated by decree?

Don't take this as some sort of support for Facebook, I personally have never bought into the idea of social media. Luckily for me, I was a full adult long before social media appeared, so I was able to rationally see that the mass privacy invasion vs "free stuff" calculation wasn't worth it.

Having said that, you can't stop people from voluntarily submitting their data in exchange for services - there is simply no legal theory in support of banning that.

> If you voluntarily walk into someones private shop, can you demand that the shop owner doesn't catalog that event?

Unless you know the shop owner, you would not be personally identified, and yes, in fact, it would be illegal to use technology that personally identifies you when you walk into a shop. The event that _somebody_ walked into a shop can be recorded.

> Is there an expectation of privacy while walking on the public street?

Insofar as no records are made of your movement, yes. It is illegal to record somebody else's presence in a public space, although fair use examples exist (in the background of a personal vacation photo, for example). There are zones with video surveillance, but those are generally clearly marked. The general expectation is that nobody who does not happen to be in the same place as you at the same time knows that you have been there.

That is, in very broad strokes, the current legal situation in Germany pre-GDPR.

Doesn't anyone who walks into a shop more than once 'know' the staff? I recognised repeat customers when I worked in retail, even though I didn't know their names, and customised my service to them (e.g "how's the XXX you bought last time?"). That's illegal in Germany?

No, of course not. It's about making records.

> Unless you know the shop owner, you would not be personally identified, and yes, in fact, it would be illegal to use technology that personally identifies you when you walk into a shop.

German law has often seemed silly to me, and this isn't an exception.

The principle is that people have the expectation that their movements in the public space aren't recorded. Anything that violates that expectation is problematic to straight illegal. I don't find that silly, quite the contrary.

I guess software that simply displays your name on a screen, but does not (identifiably) record that fact would be fine, though that would pose the question how the software would connect your face with your name - you would probably have to volunteer a photo for that to work.

Can shop owners in Germany not have surveillance cameras in their buildings? Unless you walk into the grocery store with a mask, you would then be on video and identifiable in some way.

In the US and the UK, almost every business of any value is recording you from the moment you walk in. At the very least, they likely have a camera on the cash register to deter theft. The UK is widely known to record public spaces with some videos being made of following people in London for miles.

Outside of your own home, privacy regarding your physical person is basically nonexistent except in a bathroom stall. In the US, it’s 100% legal to take photos of other people in public without their permission.

I think the barrier to provide the maximum amount of privacy for citizens in every aspect of their lives is too high in most of the modern world. There is simply no precedent for limiting the amount of data that is collected in public that will sway legislators across the world.

> Can shop owners in Germany not have surveillance cameras in their buildings? Unless you walk into the grocery store with a mask, you would then be on video and identifiable in some way.

They can, but you have to be informed of that fact. The business may only use the recordings to investigate a crime, it may not use it for anything else, and they have to be erased after a certain amount of time.

A country that's had both the Gestapo and the Stasi deserves some understanding about laws to prevent privacy infringement. It's not surprising that they're worried about it: they've seen what it can do.

It is illegal to record somebody else's presence in a public space...

So, I can't take a snapshot in a restaurant or on the street if anybody is visible in the background?

Read the sentence you half-quoted a little bit further.

You can, as I pointed out in that very sentence:

> It is illegal to record somebody else's presence in a public space, although fair use examples exist (in the background of a personal vacation photo, for example)

If you were to publish that photo, however, you have to get all identifiable persons' permission or make them unrecognizable. That extends to other information usable to identify somebody such as a readable license plate.

Given that the quoted sentence ends with _...although fair use examples exist (in the background of a personal vacation photo, for example)._ I assume your scenario would fall under this

> If you voluntarily walk into someones shop [business], can you demand that the shop owner doesn't catalog that event?

No. Rather, the GDPR allows the shop owner to ignore such a request (that "someone" walked into the shop).

If you purchase something, and they keep records for invoicing/tax purposes, your request for erasure of that information can also be ignored.

> If you voluntarily agree to receive access to a service in exchange for data collection, can that legal contract be invalidated by decree?

No. However, you do have a right to ask the service to stop processing your personal data even though this may prevent you from accessing that service in the future.

> you can't stop people from voluntarily submitting their data in exchange for services - there is simply no legal theory in support of banning that.

And the GDPR doesn't do this. Indeed, I can offer a £5 amazon gift-card in exchange for some personal data that I will share with my client, and provided I'm overt at the time of the collection, and I hand over the data immediately (i.e. do not keep a copy for other uses) there's nothing the data subject can do to screw me out of what's a perfectly reasonable deal. Their right to erasure is irrelevant since I'm not keeping the data; they have no right to stop processing because I'm already done processing. And so on.

> If you voluntarily walk into someones private shop, can you demand that the shop owner doesn't catalog that event?

The data protection act has been demanding that since 1998 (in UK).

”If you voluntarily walk into someones private shop, can you demand that the shop owner doesn't catalog that event?”

On the other end of the spectrum: if you voluntary back up your data in iCloud, can you demand Apple to not look inside it? If you voluntarily visit a sauna, can you demand that the shop owner doesn't videotape your entire visit?

The EU very much agrees with you: allowing data to be collected must be a voluntary act, and they don’t attempt to stop people from voluntary submitting data in exchange for services. The only difference is that the EU thinks “voluntary” cannot be implied or buried inside a lengthy EULA, but must be enforced through opt-in.

> GDPR seemed unnecessarily overburdensome and limiting last time I looked into it. I don't think we should have anything like it.

Can you provide some more color here? Without concrete examples this statements is pointless.

Staffing and training a department to answer legal queries regarding how a particular algorithm came to a particular conclusion

Serious question, you do have documentation that explains how your algorithms work don't you? I mean somenone in your company knows how they work?

Serious answer, those people are not in the business of responding to legal enquires from customers. Even if they did it is still an example of "burdensome".

1) You write it once and put it in your privacy policy

2) Enquiries would be from people who are a) concerned that the decision you made was unfair and would like it reviewed by a human. b) would like an explanation of the decision.

Personally I welcome this. Sitting in a bank and being refused a mortgage because 'computer says no'[0] with no recourse or reason is tough.

If you are profiling for marketing reasons I wonder what kind of enquiries you are expecting?

[0]:https://www.youtube.com/watch?v=AJQ3TM-p2QI

I am not saying its write or wrong. I agree that it makes sense. I was simply responding to GP asking whats an example of 'burdensome'.

Consider the common situation where the algorithm is a machine learning model. Nobody knows how it works; the best you can hope for is a bit of documentation for how the algorithm came to be created.

I don't think that is quite the answer. I think you would explain that the algorithm considers the past data on x to make decisions based on x. So then if you say 'we consider factors like your name in order to work out ethnicity and then use that to determine your credit risk' you get a big fine.

If you say 'we use data about the previous likelyhood of people in your profession and age group having an accident in order to analyze the risk....in order to price your insurance' then you are on safe ground

> GDPR seemed unnecessarily overburdensome and limiting last time I looked into it

That's what I assumed before I looked into it, but after I did it actually seemed quite reasonable.

Can you say what parts you find "overburdensome"?

For a few examples,

-The "Right to Erasure" for one - any user can force you to delete some of your data at any time.

-Being forced to appoint a "Data Protection Officer" can definitely be burdensome to small businesses or startups that are already on the margin. More reasons the US startup scene will probably remain stronger.

-Heightened standard for "consent" to use of user data

> Being forced to appoint a "Data Protection Officer" can definitely be burdensome to small businesses or startups that are already on the margin.

You don't have to. Someone needs this responsibility but is doesn't have to be a specific person. For us the DPO only exists as a mailing address for a subject access request, the role is shared.

> -The "Right to Erasure" for one - any user can force you to delete some of your data at any time.

But only for data you have no real use for, or it would be exempt. The flexibility of the wording works both ways.

> The "Right to Erasure" for one - any user can force you to delete some of your data at any time

Sorry, don't see how this is really a burden. Any small business is going to get such requests so rarely that they can be handled manually. In any case, it's also unlikely that implementing a feature to allow users to do this themselves would have any real cost.

As a consumer I absolutely want this right. As a business owner, I absolutely want to do right by end users. I just don't see any issue with this.

Doesn't "right to erasure" make block-chain based business illegal (since you cannot erase from block-chain)?

I agree with you to a point. When I sign up for a Facebook or LinkedIn type of service and give them a bunch of my personal information, I did that voluntarily and I don't think I should really expect a lot of privacy there. Unless there was an explicit promise otherwise.

Then you have cases like Equifax, where they have a bunch of data about me that I never gave them and they are doing a poor job protecting it. You could argue that I did consent to it as it was probably buried in the terms of credit cards or other credit documents but it's a reasonable expectation in my view that such data would be protected particularly since it includes critical identifying information such as SSN, account numbers, etc.

When I don't sign up for Facebook or LinkedIn, but they do get my data because some user of theirs has my contact info[0], that's when they become pretty much equal to Equifax from an ethical perspective.

[0] LinkedIn with its dark pattern of getting access to people's emails and Facebook with its upload of contact lists on older Android devices.

I don't think the likes of Facebook "ghost profiles" are really a big deal. They do provide some benefit to the users of the services.

It's data about me being shared with someone I didn't want it to be shared with without my consent. As such, it's a really big deal to me.

It's also a really big deal that one can't protect (him|her)self from such data being shared with Facebook. That's why I've compared them with Equifax from a moral standpoint, since the parent comment specifically mentioned Facebook and LinkedIn as an opposition to what Equifax was doing.

Whether or not they do provide some benefit to actual Facebook users is completely irrelevant.

Reply on news.ycombinator.com