Comment by closeparen | Hacker News Reader

Comment by closeparen | Hacker News Reader

Parent Full thread

>if the implication is that nobody should provide their personal data because it can be abused then is it not obvious that the use of personal data should be regulated?

I honestly thought this kind of reasoning was a right-wing caricature. No, it is not obvious that choices with risks attached should always be regulated away.

Disclosing information in proportion to trust is a basic life skill. I understand that many in the tech community are frustrated to see the general public failing to exercise this discipline, and maybe regulation is the best way to protect them from themselves, but that's not obvious.

>If the majority banks lost your money regularly, would you blame customers of the bank for using banks -- or would you say that banks should have stricter regulations to stop people from being screwed?

False dichotomy. You want a spectrum of financial products that depositors can choose from according to their risk tolerance. It's essential that we have stable, regulated, insured checking accounts. It's also essential that we have self-directed brokerage accounts.

>"just slapp[ing] some Amazon adds on [your] site" is not the correct approach to handling users' personal data.

A site sending your browser Amazon ads does not oblige it to execute or display them. And this isn't some secret backend upload. If someone is willing to use a site with this revenue model, why is that your business?

> No, it is not obvious that choices with risks attached should always be regulated away.

The assumption is that all users are actively making a choice. Many are not aware of the choices they are making, and I think it's wrong to punish them for it -- when companies profit off this lack of literacy and people rush to their defense whenever people start talking about regulation.

I don't want companies like Google and Amazon to be able to hoard massive amounts of personal information about a large portion of the world's population, and not have to respect the rights of the people whose information they have acquired.

> You want a spectrum of financial products that depositors can choose from according to their risk tolerance.

If effectively everyone of importance just uses Amazon (or Google) ads then you don't get a "spectrum" and there's no choice involved. You have an option to either use or not use a majority of the internet. Yes, you can use ad-blockers but that's not a long-term solution.

> A site sending your browser Amazon ads does not oblige it to execute or display them. And this isn't some secret backend upload. If someone is willing to use a site with this revenue model, why is that your business?

Most users are not aware of how these things work. I agree that if everyone knew how to block those ads and what the actual problems are with them, then things like GDPR might be less necessary (though the right to retract consent is something that should be enforced).

But even then, ad-blockers are a defense against an industry that is over-stepping ethical boundaries every day. At which point do you say that companies which inflict systemic violations of ethics on billions of people should be held accountable? Or is it always the fault of the people because they didn't care enough about their personal information?

Seems to come down to having to protect users from their own lack of understanding.

What ethical boundaries do you think are being overstepped through advertising?

It’s not advertising itself that is problematic. I’d be fine with an image loaded from the origin serevr. It’s the attached pervasive tracking and monitoring, coupled with the real security risks that come with the current incarnation of advertising technologies.

The irony is that if instead of passing legislation to try and "protect users/citizens from their own lack of understanding", a government would instead invest heavily in educating their users/citizens on privacy matters in order to minimize the unknowing populace, i.e. the "fodder" for shady data selling companies (like Facebook/Google). Then you would have companies arguing undue interference with their businesses (I don't know the correct term). And my guess is that's the way big companies prefer it since they can lobby easier when it's not laws but instead "education initiatives" and other fuzzy programs. And they could also counter-invest heavily in another set of "public education programs" where they could try to inform the users/citizens about how valuable they are when they don't understand/care about how their data is monetized. And with the advertising power/know-how these companies wield that match would be easily won against some random government propaganda.

I could imagine a major ad campaing where this question is posted all over the city:

"What ethical boundaries do you think are being overstepped through advertising?

Think for yourselves, don't let the government tell you what to think!

Sincerly, your friends the advertising business"

That's a hard fucking question for me to answer concisely, so I wont do that. Sry.

Once upon a time, someone similarly pointed out that, if "they" wanted to improve vehicle safety, rather than mandating seat belts, air bags, and antilock brakes, they should just put an 8" long, razor sharp spike in the middle of the steering wheel---to make the dangers obvious.

The current state of data privacy doesn't even include the spike.

As you point out, education is a fine idea, but it isn't going to work if there is a major industry based on it not working.

Facebook don't sell data they sell access to customers based on data. Thats a very important distinction.

And that provides a profiling oracle that can be used to determine data about individuals. Once they interact, you know. It's not even difficult to pull off.

Yes just like your Safeway loyalty card or your credit card uses the data you give. Or you voting and comments on this website is used to determine how to treat you here. Or the analytical data you have on your website. Or amazon.

Are you going to stop using all these services that track you some way or another?

Most digital companies wouldn't exist if they weren't allowed to use the data.

So instead of just blanket calling it something it isn't and something that certainly isn't unique to FB or Google why not actually discuss the fundamentals rather than scapegoting someone just because they are some of the most successful.

> Most digital companies wouldn't exist if they weren't allowed to use the data

This is a statement you're not possibly able to prove, and you've even left "the data" open, so you can quibble about the definition in future replies (despite the GDPR clearly giving one).

Terminating replies here due to the gross intellectual dishonesty; have a great night.

GDPR doesn't scapegoat anyone, it applies to anyone interacting with the EU or operating in the EU. The reason why Google/Facebook/Amazon are being mentioned is because they are the most obvious (and prolific) violators of user privacy. If we spent all our time mentioning all of the companies which violate user privacy on a systemic basis, we would never be able to get to the argument.

> Most digital companies wouldn't exist if they weren't allowed to use the data.

GDPR does not deny you the right to use user data, it regulates usage. This is such a ridiculous strawman that it doesn't even classify as a fallacy, it's just simply a lie.

> Are you going to stop using all these services that track you some way or another?

(I have stopped using many of the services you mentioned, but you're actually touching on the reason why regulation is necessary.) It is unreasonable to tell the general public they should stop using the internet if they want to maintain their privacy and dignity. And that's why there need to be regulations to provide protections for the general public when using a technology that is so central to the modern world.

Again. "Violators on users privacy" in what way? You present this as if it's a fact, it's not it's an interpretation. That's the lie here.

You are still using them one of the biggest users of personal data your ISP and that's a service you pay for.

Don't pretend you are stating facts when you are just stating you personal opinion.

Violations as defined in statute by the GDPR, which applies to anyone who collects PII on people within the EU. The ISP thing? I'd expect EU VPNs to start selling pretty well.

> Seems to come down to having to protect users from their own lack > of understanding.

I had the impression that this is rather clearly regulated by the GDPR. A user has to consent to each use of her data. And you have to explain the use in an understandable way, no legalese. Just make a list where you explain in simple words how you want to use the data and add a checkbox to each item (default not checked). I don’t see how this could hurt any ethical business model.

If it's anything like the cookie consent, it will just be an annoyance and nobody will be anything wiser. The amount of "no clue what this is" among non technical people I know is 100%. But the EU pats itself on the back cause they're tackling privacy issues. It's a joke.

The GDPR requires users to be able to say no, and not lose any functionality except that which absolutely requires this data.

If I refuse tracking for ads, then a newspaper can’t refuse me access to their articles.

>>If I refuse tracking for ads, then a newspaper can’t refuse me access to their articles.

This arbitrarily limits the range of businesses that can exist. For the sake of people who value their privacy having nothing denied to them, it reduces the services available to everyone.

> If I refuse tracking for ads, then a newspaper can’t refuse me access to their articles.

they can. a business does not even need to do business with you. it's not a right that a business needs to service you. and btw. this is german law.

The rules involve "degradation of service", which is related to existing customers not new ones. So if you have a newspaper subscription and you request that they no longer use your data for a purpose, they cannot cancel your subscription or degrade your service (unless it is impossible to provide a service without said data).

they can cancel your subscription. because they can always say it is impossible to provide service without said data.

heck they can even rely on other laws to cancel your service any time they want.

in the next years GDPR will change nearly nothing. except that it will kill some smaller businesses.

GDPR is not strongly enforceable, if people think they have a right to something they still need to go to court.

the only thing which might change is that it will be easier to delete accounts and data (which is a good thing).

> The GDPR requires users to be able to say no

Even better, it requires the use to say “yes”.

> If it's anything like the cookie consent,

It won’t. It will just replace the common “no one reads but clicks” TOS. And the user can change her mind anytime she wants.

> The amount of "no clue what this is" among non technical people I know is 100%.

If you can’t explain a non engineer or scientist how personal is collected and used it’s probably not a bad idea to outlaw this practice.

> But the EU pats itself on the back cause they're tackling privacy issues. It's a joke.

It’s certainly not enough but a step in the right direction.

But the GDPR itself is written in legalese. There are many interpretations like yours, but then, without a lawyer, it's a dangerous game to play. The cost of the lawyer may be prohibitive to some small businesses, let alone side-projects.

I'm actually pro-GDPR but this needs to be kept in mind.

A user has to consent to each use of her data.

This is a misunderstanding. Consent is only one acceptable legal basis for processing personal data under the GDPR. Almost everyone is going to use it as little as possible in future because of all the extra red tape involved. Ironically, that probably means a lot of organisations will now be straining to justify processing on some other basis and to minimise use of data subjects' explicit consent and exposure to the associated subject rights.

Just make a list where you explain in simple words how you want to use the data and add a checkbox to each item (default not checked).

It's not that simple, because for example organisations may have legal obligations or legitimate interests in processing data about someone even though it may not be in that person's interest. Consider these:

[ ] I agree that my bank may keep records of the money I owe them.

[ ] I agree that the car rental firm may keep a record of me borrowing their vehicle.

[ ] I agree that the school where I'm applying for a job may do a background check before trusting me to look after kids.

Obviously there are many issues like this where consent for the data processing can't be voluntary and independent of everything else that is going on.

Facebook has been party to gross human subjects research misconduct on multiple occasions. It's not just the advertising.

"I honestly thought this kind of reasoning was a right-wing caricature. No, it is not obvious that choices with risks attached should always be regulated away."

Speaking of false dichotomies...

I think you'll find that self-directed brokerage accounts have more regulations than checking accounts because they provide more opportunity to commit fraud.

Reply on news.ycombinator.com