Hacker News Reader

Comment by _red | Hacker News Reader

Its a thorny legal issue, and frankly I think there is very little support for GDPR in common-law.

If you voluntarily walk into someones private shop, can you demand that the shop owner doesn't catalog that event? Is there an expectation of privacy while walking on the public street? If you voluntarily agree to receive access to a service in exchange for data collection, can that legal contract be invalidated by decree?

Don't take this as some sort of support for Facebook, I personally have never bought into the idea of social media. Luckily for me, I was a full adult long before social media appeared, so I was able to rationally see that the mass privacy invasion vs "free stuff" calculation wasn't worth it.

Having said that, you can't stop people from voluntarily submitting their data in exchange for services - there is simply no legal theory in support of banning that.

View on HN

> If you voluntarily walk into someones private shop, can you demand that the shop owner doesn't catalog that event?

Unless you know the shop owner, you would not be personally identified, and yes, in fact, it would be illegal to use technology that personally identifies you when you walk into a shop. The event that _somebody_ walked into a shop can be recorded.

> Is there an expectation of privacy while walking on the public street?

Insofar as no records are made of your movement, yes. It is illegal to record somebody else's presence in a public space, although fair use examples exist (in the background of a personal vacation photo, for example). There are zones with video surveillance, but those are generally clearly marked. The general expectation is that nobody who does not happen to be in the same place as you at the same time knows that you have been there.

That is, in very broad strokes, the current legal situation in Germany pre-GDPR.

Doesn't anyone who walks into a shop more than once 'know' the staff? I recognised repeat customers when I worked in retail, even though I didn't know their names, and customised my service to them (e.g "how's the XXX you bought last time?"). That's illegal in Germany?

No, of course not. It's about making records.

> Unless you know the shop owner, you would not be personally identified, and yes, in fact, it would be illegal to use technology that personally identifies you when you walk into a shop.

German law has often seemed silly to me, and this isn't an exception.

The principle is that people have the expectation that their movements in the public space aren't recorded. Anything that violates that expectation is problematic to straight illegal. I don't find that silly, quite the contrary.

I guess software that simply displays your name on a screen, but does not (identifiably) record that fact would be fine, though that would pose the question how the software would connect your face with your name - you would probably have to volunteer a photo for that to work.

Can shop owners in Germany not have surveillance cameras in their buildings? Unless you walk into the grocery store with a mask, you would then be on video and identifiable in some way.

In the US and the UK, almost every business of any value is recording you from the moment you walk in. At the very least, they likely have a camera on the cash register to deter theft. The UK is widely known to record public spaces with some videos being made of following people in London for miles.

Outside of your own home, privacy regarding your physical person is basically nonexistent except in a bathroom stall. In the US, it’s 100% legal to take photos of other people in public without their permission.

I think the barrier to provide the maximum amount of privacy for citizens in every aspect of their lives is too high in most of the modern world. There is simply no precedent for limiting the amount of data that is collected in public that will sway legislators across the world.

> Can shop owners in Germany not have surveillance cameras in their buildings? Unless you walk into the grocery store with a mask, you would then be on video and identifiable in some way.

They can, but you have to be informed of that fact. The business may only use the recordings to investigate a crime, it may not use it for anything else, and they have to be erased after a certain amount of time.

A country that's had both the Gestapo and the Stasi deserves some understanding about laws to prevent privacy infringement. It's not surprising that they're worried about it: they've seen what it can do.

It is illegal to record somebody else's presence in a public space...

So, I can't take a snapshot in a restaurant or on the street if anybody is visible in the background?

Read the sentence you half-quoted a little bit further.

You can, as I pointed out in that very sentence:

> It is illegal to record somebody else's presence in a public space, although fair use examples exist (in the background of a personal vacation photo, for example)

If you were to publish that photo, however, you have to get all identifiable persons' permission or make them unrecognizable. That extends to other information usable to identify somebody such as a readable license plate.

Given that the quoted sentence ends with _...although fair use examples exist (in the background of a personal vacation photo, for example)._ I assume your scenario would fall under this

> If you voluntarily walk into someones shop [business], can you demand that the shop owner doesn't catalog that event?

No. Rather, the GDPR allows the shop owner to ignore such a request (that "someone" walked into the shop).

If you purchase something, and they keep records for invoicing/tax purposes, your request for erasure of that information can also be ignored.

> If you voluntarily agree to receive access to a service in exchange for data collection, can that legal contract be invalidated by decree?

No. However, you do have a right to ask the service to stop processing your personal data even though this may prevent you from accessing that service in the future.

> you can't stop people from voluntarily submitting their data in exchange for services - there is simply no legal theory in support of banning that.

And the GDPR doesn't do this. Indeed, I can offer a £5 amazon gift-card in exchange for some personal data that I will share with my client, and provided I'm overt at the time of the collection, and I hand over the data immediately (i.e. do not keep a copy for other uses) there's nothing the data subject can do to screw me out of what's a perfectly reasonable deal. Their right to erasure is irrelevant since I'm not keeping the data; they have no right to stop processing because I'm already done processing. And so on.

”If you voluntarily walk into someones private shop, can you demand that the shop owner doesn't catalog that event?”

On the other end of the spectrum: if you voluntary back up your data in iCloud, can you demand Apple to not look inside it? If you voluntarily visit a sauna, can you demand that the shop owner doesn't videotape your entire visit?

The EU very much agrees with you: allowing data to be collected must be a voluntary act, and they don’t attempt to stop people from voluntary submitting data in exchange for services. The only difference is that the EU thinks “voluntary” cannot be implied or buried inside a lengthy EULA, but must be enforced through opt-in.

> If you voluntarily walk into someones private shop, can you demand that the shop owner doesn't catalog that event?

The data protection act has been demanding that since 1998 (in UK).

Reply on news.ycombinator.com