Hacker News Reader

Comment by adrianN | Hacker News Reader

What alternative do you propose? The free market obviously fails to address privacy issues, I don't see how anything besides stricter regulation can help the affected people here.

View on HN

Decrease the cost of compliance by communicating super-clearly.

- The UK ICO's Guide to the GDPR is a good step. Kudos to those who got the budget passed to do that. https://ico.org.uk/for-organisations/guide-to-the-general-da...

- Produce clear example cases before things are litigated. That way, you don't run into the problem of "Well, nobody really knows how things are going to shake out and people are trying to stay in the middle of the pack in terms of compliance" (Which is what I heard from an entrepreneur at a panel at Slaughter & May)

- Hire someone to write The Manga Guide to GDPR Compliance, in the style of https://nostarch.com/mg_databases.htm Or in the style of http://lawcomic.net/guide/?p=1585.

- Post video courses with the same sort of content.

Part of the problem here is that law firms have a strong incentive to publish SEO-optimised content which proclaims that compliance is difficult and confusing and that you should hire an expert law firm.

I'm not a policymaker, but GDPR seems overly-reactionary, over-reaching, and not well thought-out. I think the negative unintended consequences are likely much greater than however much it actually protects the privacy of individuals (which I don't think will be much at all).

GDPR is mostly a regulation that was a directive (DPD) before. If you handled data responsible before and didn't do shady stuff with it, there is little extra to do to be GDPR compliant.

Except if you had targeted advertising you now need to allow users to use the same service without targeting. (ie 'without detriment')

I don't think GDPR is flawless, but at some point if we don't do anything, privacy violations are going to become so common place and so entrenched in the online economy that we can't fix it anymore.

At that point, the discussion would be all about all the "jobs we would destroy" and "businesses opportunities we would shut down!", and heavy lobbying would make sure it gets nowhere.

Do you think that the GDPR has really changed anything for either Facebook or its users? Do you think that anything changed in the way data is being handled? All i see is a bunch of highly paid law firms writing up 200 additional pages in terms and conditions to shield the company, but nothing really changed as far as daily business is concerned.

Considering that GDPR is only in full effect after May 25th 2018, there is nothing to talk about in regards to its effect right now.

It seems most of their GDPR user facing changes have been made: https://techcrunch.com/2018/04/17/facebook-gdpr-changes/

Two hundred extra pages of new privacy info in the T&Cs would fail GDPR:

The information you provide to people must be concise, transparent, intelligible, easily accessible, and it must use clear and plain language.

https://ico.org.uk/for-organisations/guide-to-the-general-da...

If a company has money to hire lawyers to make an extra 200 pages of T&Cs, I'm sure they will have the money to argue that those pages are "concise, transparent, intelligible, easily accessible, and it must use clear and plain language".

Not yet, it'll take a few lawsuits. See the work of Max Schrems:

https://en.wikipedia.org/wiki/Max_Schrems

https://www.fbclaim.com

Apparently they are already GDPR compliant (FB). In their case it's actually easy to justify their legitimate interest because their entire business is the handling of private data. Ironically, even though GDPR is supposed to affect things like facebook more, it changes very little about the way they work.

Whether their business model is handling data is irrelevant; they must ask for consent to use that data for ads and such - and that's even if they already have collected the data to provide a service requested by the user.

They recently came out with a new screen asking users to consent to a bunch of things, so they weren't compliant until then, and I wouldn't bet they are now.

Thinking on the run here, but: the reason big companies have an advantage here is that they grew big before regulations, and their current size can deal with the regulations easily; while small companies don't have the resources to deal with the regulations. So how about a levy on these larger companies that goes straight to small companies to help with the regulatory burden of such regulations?

Not that I am advocating this approach, but regulations that are more about liability and transparency (towards journalists and shareholders) might help.

Liability means that mistakes are (hopefully) punished more proportionally to their effects, which allows one to scale measures as the business grows. Meanwhile, the transparency means that any potential issues are easier to spot, making it possible for suits to be brought. Note that transparency towards users has been shown to be rather ineffective, similar to how no-one reads the eula.

I propose allowing people to use their private data as a form of monetary exchange. Iow, GDPR disallows apps/sites to ask a user if they would allow targeted advertising or would like to pay for the app. There is no good reason for this in my eyes. Transparency is great but don't force people to not be allowed to use their personal data in an exchange.

>The free market obviously fails to address privacy issues,

No it doesn't. Everything was working completely fine before.

Reply on news.ycombinator.com