Hacker News Reader

Comment by anfogoat | Hacker News Reader

My biggest _annoyance_ with GDPR and its advocates is the constant touting of "giving users control over their data" when in reality it is hindering voluntary actions that by their nature require some of "my data". If I want to service a small group of people with, say, an XMPP network, and those users are willing and eager to just go with it without any of this bs with terms and three-letter EU dictated roles, then it should be possible. When you've made it prohibitive, then you've done something wrong IMO.

My biggest _fear_ regarding GDPR is that, to me at least, it seems like a one-size-fits-all regulation for a world where only organisations are allowed to run services, and where all services are centralized. Which is not the world we live in (yet).

View on HN

So which parts of the GDPR do you actually disagree with in case of this XMPP service? Mostly you need to tell people what you collect, allow removing accounts and history, and tell them if you're sending the data to third-parties. If you're running a private service you most likely already fulfill those requirements. Where's the annoyance?

In the specific case of XMPP, wouldn't I need to have an agreement with every other admin who federates their XMPP server and work out what exactly our roles are as defined by GDPR? XMPP still has active development community around it so this will no doubt get much easier with time, but that's just XMPP.

IANAL, but unlikely. Sending messages is the primary purpose of the service. As long as users are made aware that messages going outside of your domain are shared with 3rd parties, it's on them to make that decision. Same would apply to email, phones, etc.

Maybe not: You need to have a "Legal Basis" and only 1 of them is the "subject has given consent" one.

There's another:

"The processing is NECESSARY FOR THE PERFORMANCE OF A CONTRACT to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract;"

I thought you would have to al least all the admins to agree to follow the GDPR so that data can be retrieved, corrected, and deleted on demand right?

Look at it this way: The service you're using needs a privacy policy, that is not new. The way that policy is organized or shared is no different now, just what rights the user and what obligations the service provider has.

GDPR is simply a response to abusive behavior. May not be the best response, but it was about time.

Then, it is surprising to me that Americans are against a national id card, but are not OK with a privacy protection law.

I believe it's because, in general, Americans distrust government and trust corporations

Giving someone money or trust in exchange for a service or good is a straightforward relationship that implies various social contracts. Americans' relationship with government is far more adversarial.

It's not about trusting corporations, but rather trusting in the benefit of the free market which offers more choices than a government which generally limits choices. A well intentioned government but still with too many unintended consequences

Sounds like a good idea until corporations influence government.

We distrust both but only one has a monopoly on violence that can be pointed in our direction at any time.

I guess we’re just kind of ignoring things like credit bureaus, who sell finacial data about you whether you like it or not, and god help you if you miss a payment. But hey, even if you dont screw up, maybe something gets reported wrong, or maybe you just don’t spend like the algorithm wants you to, and your credit, and thus your life, is ruined.

I guess we’re also ignoring private health insurance companies and how they can just kind of, you know, deny you for any reason. But it’s cool because your insurance is dependent on a benevolent private company providing you employment.

See where I’m going with this? The Ayn Rand “government is violence” nonsense needs to stop. It’s not corporations vs. government, it’s powerful institutions vs. we, the plebes.

There's also economic/financial violence.

Government can come in your house in the middle of the night, guns drawn, and take you away.

Corporations can't.

Tell that to people at Standing Rock.

No, corporations just pay the government to do it on their behalf.

But I'm not railing against _a_ privacy protection law, I'm railing against the GDPR. Fundamentally, for the simple reason that I want the freedom to with my data as I please, regardless of whether or not the service I want to use is meeting EU dictated goalposts or not.

(I'm European, though not in spirit apparently.)

> network, and those users are willing and eager to just go with it without any of this bs

How can you declare they're willing and eager, if you don't have their consent, and they're not informed about your actions?

This Regulation is intended to contribute to the accomplishment of an area of freedom, security and justice and of an economic union, to economic and social progress, to the strengthening and the convergence of the economies within the internal market, and to the well-being of natural persons.

It hinders nothing. It ensures that what you're with user data doing is truly voluntary and that your users really are 'willing and eager" about it beyond you pinky-swearing you'll be good with what you're given.

Be annoyed all you want, the only people whining about the GDPR are those showing their true colors when it comes to user privacy and agency. If you're complaining that it hinders you from using user data as you please, that's precisely the point.

To be clear, I'm annoyed as a user too. Partly by the discrepancy between the claim that I now have control over my data, but can't actually use it since the small independently run services can't accept my data even if I wanted them to, because that acceptance comes with a set of requirements that are prohibitive, and which I, the user, would not want in this instance. However, judging by some of the other responses, I might be wrong about the effects on independently run services (and I'm happy to be).

I'm going to ignore the part about my supposed true colors in respect to user privacy. Too tired.

A system that preserves freedom—not your freedom in every particular case, but the prevalence of freedom in general for people in general—must restrict your freedom to give yours away.

You're not allowed to sell yourself to slavers, even if you want to. Slavers can't exist at all. It's understood that if they did, the slavers would exploit your "freedom" to create a world where, in reality, the circumstances leave you no alternative except to "freely choose" to be a slave.

I don't think it applies to individuals and noncommercial activity, though I have heard anecdotal reports of european cops hassling people shooting pictures on mobile phones

> I don't think it applies to individuals and noncommercial activity

Why would these be unaffected? You have to comply with GDPR as soon as you start processing personal data.

This thread on Reddit seems to have some cogent discussion on exceptions

https://www.reddit.com/r/sysadmin/comments/8litn7/gdpr_for_h...

That's not entirely true. Article 2 defines the scope in various respects, and categories such as "by a natural person in the course of a purely personal or household activity" are specifically not within that scope.

If I want to service a small group of people with, say, a nuclear power plant, and those people are willing and eager to just go with it without any bs or roles, then it should be possible. When you make it prohibitive to handle hazardous materials, then you've done something wrong.

If you and the small group of people are the only living creatures on the planet, then absolutely! That is to say, this isn't really comparable, for obvious reasons.

PII is a hazardous material, and it should be regulated like other hazardous materials, for obvious reasons.

This is so hyperbolic. Hazardous material? So your old IP address that has since changed 27 times being in some forgotten log file somewhere is now basically like uranium or industrial waste. Makes sense.

The processing of personal data should be designed to serve mankind. The right to the protection of personal data is not an absolute right; it must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality. This Regulation respects all fundamental rights and observes the freedoms and principles recognised in the Charter as enshrined in the Treaties, in particular the respect for private and family life, home and communications, the protection of personal data, freedom of thought, conscience and religion, freedom of expression and information, freedom to conduct a business, the right to an effective remedy and to a fair trial, and cultural, religious and linguistic diversity.

http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX...

I suggest you read the rest of it before opining.

This basically boils down to, "just hope that all current and future EU member nation agree with you on what is and isn't morally right."

Good thing different societies and cultures have never disagreed on what is and isn't morally just, amirite?

Reply on news.ycombinator.com