Comment by nannePOPI | Hacker News Reader

Comment by nannePOPI | Hacker News Reader

Parent Full thread

You must have a really short memory to say that "regulators are not enemies". Just look at any history book, tell me what you find.

Since English is not my first language, it tires me to write in it, so I'll give a little example that will destroy the "GDPR protects privacy" once and for all. If I make a website with a comment system, or maybe a forum, I need to reveal to the world my identity otherwise the EU will go after me.

You see, before GDPR I could put up a website, put on WHOIS privacy using a company unreachable by the EU, and then create a cool forum where I criticize the stupid policies of the european governments (and I can tell you, there are a lot).

My identity would be REALLY protected, and even my political stance. "Who is this guy explaining people why we're so bad? Damn him!", would say the evil bureaucrats while stroking his Stalin-inspired mustache.

Instead now I need to write a stupid page where I say "[MY NAME] will manage your data this and this way". So, the government will know my political stance and my opinions, will have a complete name to easily link to the website. But there is more! After that, not only they'll have my name, but yet an extra set of law, with wide space for interpretations, that they can use to persecute me further. They can drag me to court because "I didn't treat data right", and it doesn't matter if I was complying or not, the risk of going to court is enough for many people to just not open the website.

Of course, I make the political example, but think about sexual fetishes forum and things like that. The EU wants me to reveal to the world what my sexual preferences are, with all the risks that come with it! That's what the GDPR is. I can't even make a website to discuss my sexual tastes without telling the world who I am!

To sum it up: if you create a website, your privacy will be lost, and everyone will be able to know that you are the creator of that website. Then, many people won't create websites because they'll be scared of being dragged to court. Small, indpendent, websites will die and only big companies will rule the internet. This is the reality and I don't know how people who supposedly use the internet in a professional way can't see it.

> You must have a really short memory to say that "regulators are not enemies". Just look at any history book, tell me what you find.

A bumpy ride from early agriculture, where people died of sickness and war all the time, to the relatively stable modern era of great wonders we all take for granted - hot water, long-lasting food of greater variety than even kings had just a hundred years ago, of powerful medicine and safe surgeries, of wash machines and air travel and the Internet.

All of that built on accumulation of knowledge and stabilization of societies, in which regulators always played a crucial role.

The history books do not paint the picture that "regulators are enemies". You just have to focus less on kings and wars, and more on how a society looked and lived in any given era, and why.

> Instead now I need to write a stupid page where I say "[MY NAME] will manage your data this and this way".

Are you referring to the Data Protection Officer (DPO) requirement?

I believe this is the relevant article: https://gdpr-info.eu/art-37-gdpr/

If I understand correctly, you only need to appoint a DPO in cases where you are either a public entity (you are not) or in cases where your site requires "regular and systematic monitoring of data subjects on a large scale", or in a couple of other special cases where you process extremely sensitive data.

Presumably you aren't doing that on "your" forum/webpage, so you don't need to appoint a DPO.

I think you are making a bit of a storm in a teacup here.

You need to reveal who is managing the data in any case, which is separate from the DPO.

Is it Article 13.1.a we are talking about here? It says

> the identity and the contact details of the controller and, where applicable, of the controller’s representative;

See, the main question here is which identity it is that must be disclosed. The definition in article 4.7 has this to say:

> ‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;

What exactly falls under "other body" may be important here. What it does not say is that it must be a legal person.

Let us say that you have a forum on omgweirdfetishes.eu. You may say that the controller is The OMG Weird Fetishes Forum. Now it may be arguable that in itself counts as "other body", but generally there's the concept of "Unincorporated Association" which is just any group of people with a common purpose, it would be hard to argue that that doesn't fall under the "other body". In some countries, e.g. Denmark, an unincorporated association is even recognized as a legal entity in its own right.

So say that "The OMG Weird Fetishes Forum is driven by The OMG Weird Fetishes Forum Association. The members of the The OMG Weird Fetishes Forum Association consists of the users of The OMG Weird Fetishes Forum", and then identify the data controller as "The OMG Weird Fetishes Forum Association, contact details: webmaster@omgweirdfetishes.eu"

If you are this afraid to tell your customers and/or users your name, they are right not to trust you.

ps -- if you want not to be required to disclose anything under the GDPR, don't collect any personal data. No ips, usernames, access logs, etc.

How do you do that, purely technically? That opens you up to even most basic attacks.

That would require that you provide a service within the EU and that you store personal data, neither of which you do in your example.

if I have a forum I store the email of the users so they can recover the password. Same thing if I put up a simple newsletter to contact my users, I have their emails (newsletters may not be fashionable but they're much more effective than using a facebook page or other systems, since you own the email list of people who want to hear from you).

So, even in the boring world of small websites, you have to comply.

> if I put up a simple newsletter to contact my users, I have their emails

Okay, so then the only requirement of GDPR is that you must make the newsletter opt-in rather than opt-out and you must make the unsubscribe process as easy as the subscribe process.

This is indeed a problem if you run Mailman, which has a somewhat annoying unsubscribe process and which does not have the funding[1] to address this.

[1] http://mailman.9.n7.nabble.com/GDPR-td46775.html

What I’ve read indicates that if you’re not targeting EU users (via ads or as customers), especially if you aren’t commercial, you don’t have to do anything. Is that not true?

This would only matter if you’re profiting from your fetish forum, which seems unlikely. Plus you’d need to have an EU presence, otherwise who cares and who would force you? There’s nothing stopping you from ignoring GDPR in the scenarios you describe. Being a small hobby forum pretty much let’s you pretend GDPR doesn’t exist, while being the likes or FaceBook makes it impossible to ignore.

The law is for everyone, it doesn't matter if I profit from it or how big I am, I still have to reveal who I am if I take data that is often needed, like emails in a forum.

We’ll have to se how it plays out, but I suspect if you operate a small site outside of the EU you won’t be impacted.

Of course you won’t be impacted, but your protection is via selective enforcement. You won’t be in compliance with the law, but the government will lack the resources or determination to punish you. Until that changes.

This is fundamentally dangerous. Once we are all lawbreakers all the time, it creates a powerful tool for oppression and using the law to harass and silence political opponents.

It’s not that slippery slopes don’t exist, but when the only argument against something is the supposed harm that it may lead to via a slippery slope, it’s suspicious and unconvincing. This thread is full of people saying that this is a step on the road to tyranny, and may end there, that’s true, but the arguments don’t seem to really support the claims.

If this really matters to you, and you care about doing more than signaling to others of your ideological persuasion, you need to offer more and better. Slippery slope is too often the lazy fallacy, and not a real case against something. How does this law as written and likely enforced do all of the bad things claimed here?

This is not a slippery slope argument. Situation where the only thing protecting you from unreasonable law is selective enforcement is already bad, no further sliding down the slope needed.

Selective enforcement if you’re in the EU, otherwise who is enforcing it? For the billions of us not in the EU, these arguments are weak as hell.

It is enforced no matter where in the world you are, as long as your site is accessible to EU citizens. And you will be surprised by how much jurisdiction European courts can have. A monetary judgement can be collected from any American company via UFMJRA, for example (http://www.uniformlaws.org/ActSummary.aspx?title=Foreign%20M...).

We’re not talking about a company, we’re talking about a fetish forum without a scrap of money changing hands. Who is enforcing GDPR there exactly? EU paratroopers? Not to mention that most people don’t live in the EU or America, so again, who’s enforcing this on our hypothetical non-business?

It’s really hardcore levels of bullshit being employed in this thread to make a big scary mountain out of a molehill.

The EU could legally jail you the moment you step into its territory, and that includes flights that go through Europe, even without landing.

That doesn’t sound even remotely correct given the nature of the “offense” in this case, for which the remedy is a fine. Can you cite this “jail the moment you step into its territory” thing?

Jail is a place where you're put if there is a chance that you might try to run away from a trial and its resolution. I was in jail - and I did nothing, the case was immediately dropped.

Additionally, while the remedy for this crime is a fine, the remedy for not paying the fine is prison.

Reply on news.ycombinator.com