Hacker News Reader

Comment by bad_user | Hacker News Reader

I find such reasoning to be bullshit.

Example: DuckDuckGo had no issues in ensuring people’s privacy for years and I’m fairly sure that they have zero problems with GDPR. And they are not and have never been at Google’s scale.

What happens actually is that privacy-violating companies are trying to keep doing whatever it was they were doing, but then discovering that no sane individual would opt-in to being tracked, without having access blocked of course, which then leads to lost revenue anyway.

So they are trying to game the system, which gets expensive of course. Now you need lawyers and experts in dark patterns. But when your entire business model depends on people's ignorance, you really can't claim the high moral ground.

Such articles are engaging in sponsored FUD.

View on HN

> I’m fairly sure that they have zero problems with GDPR

My understanding, from a friend there, is GDPR imposes significant costs on their operations. The problem isn’t the intent of the law. It’s its implementation. The administrative burdens imposed by the mandated bureaucracy is massive.

How big is the team at DDG? I handled GDPR compliance for a company big enough to have probably helped draft the law and it wasn't that bad at all. Many of the systems were already in place because they've been industry best-practices for a while (encryption, de-identification, internal access guards).

The two things that needed to be developed were systems around rights of erasure & access. Both of these are pretty straight-forward systems -- it's a REST API for getting user details from a system, and deleting user details from the system.

I believe people are making GDPR out to be a much worse than it is.

> deleting user details from the system.

What are you considering 'user details' ?

Primarily data that can be used to identify the user and these have a pretty good definition.

If you have a database with users in it, that's basically the row in the Users table, along with everything in the database that has a user_id, which depending on the data you're talking about, might be enough to just set the user_id to `null`, but if unsure and if possible, then cascade delete is the safe choice.

Basically that's nothing that a normal RDBMS doesn't do efficiently already. If you are using a RDBMS, you should have had a sane deletion policy on your foreign keys already.

It gets more complicated with NoSQL databases of course, but you knew already that by using a NoSQL that's essentially technical debt you're postponing. But having worked on many such systems in the past, it's not a tragedy and certainly not something that couldn't be solved in the last 2 years since the GDPR was adopted.

Honestly, GDPR was adopted 2 years ago and people now act all surprised that it came into effect.

> these have a pretty good definition

thank you for your response. I've been trying to find this in GDPR docs but i can't seem to find a clear definition. Can you link me to the definition if you have it handy by any chance.

I can tell you couple of examples where simple delete from database is not enough.

One example is a analytics pdf report that was sent to management with geo diagram with number of purchases dotsizes/zipcode in a city.

DuckDuckGo is a single company operating in a single vertical and their entire purpose was to provide a certain type of privacy-preserving service.

The vast majority of companies aren't violating privacy in any meaningful way, and the GDPR still imposes large costs on them.

the second paragraph is just not true. every popular website without privacy as a selling point has dozens of trackers. journalism and social media have been tilted heavily towards clickbait because ads are perceived as the only way to make money. the only companies that will get to continue doing what they do without much hassle are widely liked services like netflix and spotify.

"meaningful"

The idea that every tracker and targeted ad is some sort of meaningful privacy violation is pretty silly.

As it turns out not everyone agrees with you. That doesn't make it silly, that makes it a difference of opinion.

And in any case, the point is that together all those little violations are a meaningful violation of your privacy.

I think of the GDPR as similar to clean operations with regards to environmental impacts.

If, right now, there was made a law that fairly charged for all externalities on environmental damage of their products, then the companies that do things "right" with regards to environmental practice would be some of the most profitable.

The GDPR is the similar type of law, but for data hoarding of PII. If you're doing privacy and handling user data that preserves users' rights, you likely wont have much anything to change. Sure, you'll have to put together 5 documents how you do use data... but everyone does in the EC.

If you're a hoarder, spread PII everywhere it shouldnt be, or otherwise do bad things your users would find unconscionable, it's going to be a very rough time.

As an American, I try to buy sustainable products.. But the GDPR makes it easy to see which tech maintains my privacy of my data.

Doesn’t DDG use Bing and Yahoo? I’m not sure how well would they work in a vacuum where they can’t take advantage the benefit of “tracking” through outsourcing.

Yahoo also uses Bing. You may be thinking of Yandex, another search engine DDG taps from besides Bing.

DuckDuckGo is a search engine - meaning its possible to use their tool without the collection of any data, even creating a user account. Many other tools are doing nothing nefarious with data but its not possible to use their tool without collecting data.

It's neat that DuckDuckGo was able to find a business model through showing ads based on what you search into the search box. For me personally, I don't see much of a difference between being shown ads on what I searched at that moment and having a cookie stored in my browser and getting showed ads based on that later on.

None of this disproves what the article is saying anyway - Google & Amazon will be the best equipped to handle the nuances of any data laws and as bureaucracy increases, they will benefit the most, storing more data.

> Many other tools are doing nothing nefarious with data

You're missing the point of the danger then.

Facebook isn't doing anything "nefarious" with the data either. And yet Cambridge Analytica happened.

Fact of the matter is, it's not what you do with the data that counts the most, the biggest problem being that the data gets collected in the first place without users being aware of it, or aware of implications.

How many users do you think are aware that Facebook follows them around the web and that this might affect their credit score, or the price they pay for their health insurance in the future? How many people in a minority, e.g. of a certain religion or of a certain sexual orientation, do you think are aware that their habits can be used to precisely identify their identity and preferences, which could put many such individuals in life threatening situations?

Of course, you might be a responsible company, you might actually do good by your users and customers, but if the users don't expect tracking to be part of the service and if making them aware makes those users to not opt-in, then you are doing something nefarious by definition.

Which is what GDPR is about.

> zero problems with GDPR

Do they comply with right to be forgotten etc?

What do you think the RtbF means for a service like DDG?

Right to remove results

That wouldn't be possible in GDPR.

It sounds like you didn't read the article.

https://news.ycombinator.com/newsguidelines.html

Please don't insinuate that someone hasn't read an article. "Did you even read the article? It mentions that" can be shortened to "The article mentions that."

Reply on news.ycombinator.com