Hacker News Reader

Comment by ericdykstra | Hacker News Reader

I'm not a policymaker, but GDPR seems overly-reactionary, over-reaching, and not well thought-out. I think the negative unintended consequences are likely much greater than however much it actually protects the privacy of individuals (which I don't think will be much at all).

View on HN

I don't think GDPR is flawless, but at some point if we don't do anything, privacy violations are going to become so common place and so entrenched in the online economy that we can't fix it anymore.

At that point, the discussion would be all about all the "jobs we would destroy" and "businesses opportunities we would shut down!", and heavy lobbying would make sure it gets nowhere.

Do you think that the GDPR has really changed anything for either Facebook or its users? Do you think that anything changed in the way data is being handled? All i see is a bunch of highly paid law firms writing up 200 additional pages in terms and conditions to shield the company, but nothing really changed as far as daily business is concerned.

Considering that GDPR is only in full effect after May 25th 2018, there is nothing to talk about in regards to its effect right now.

It seems most of their GDPR user facing changes have been made: https://techcrunch.com/2018/04/17/facebook-gdpr-changes/

Two hundred extra pages of new privacy info in the T&Cs would fail GDPR:

The information you provide to people must be concise, transparent, intelligible, easily accessible, and it must use clear and plain language.

https://ico.org.uk/for-organisations/guide-to-the-general-da...

If a company has money to hire lawyers to make an extra 200 pages of T&Cs, I'm sure they will have the money to argue that those pages are "concise, transparent, intelligible, easily accessible, and it must use clear and plain language".

Not yet, it'll take a few lawsuits. See the work of Max Schrems:

https://en.wikipedia.org/wiki/Max_Schrems

https://www.fbclaim.com

Apparently they are already GDPR compliant (FB). In their case it's actually easy to justify their legitimate interest because their entire business is the handling of private data. Ironically, even though GDPR is supposed to affect things like facebook more, it changes very little about the way they work.

Whether their business model is handling data is irrelevant; they must ask for consent to use that data for ads and such - and that's even if they already have collected the data to provide a service requested by the user.

They recently came out with a new screen asking users to consent to a bunch of things, so they weren't compliant until then, and I wouldn't bet they are now.

GDPR is mostly a regulation that was a directive (DPD) before. If you handled data responsible before and didn't do shady stuff with it, there is little extra to do to be GDPR compliant.

Except if you had targeted advertising you now need to allow users to use the same service without targeting. (ie 'without detriment')

Reply on news.ycombinator.com