The Next Privacy Battle in Europe Is Over the Proposed ePrivacy Regulation
nytimes.com
nytimes.com
Here is the most recent draft if anyone wants to read it.
Just to start a bit of a discussion, I read prior drafts and this one is MUCH better than previous drafts. Before very simple things like placing cookies for basic analytics, fraud detection, DDoS prevention, etc. were in a grey area. Now they are explicitly allowed by this draft.
If prior versions would've passed as-is, I would be legitimately worried for the future of tech in Europe, but this seems quite similar to GDPR now.
This worries me in this case in particular, but it's a worry in general: how to reach audiences outside the science/tech sphere. Not many programmers want to be Youtubers, but that seems to be the only reasonable choice.
This statement starts with the assumption that the data mining was okay in the first place. My metaphor is a bit hyperbolic, but it's like members of organized crime complaining about the passage of RICO in the U. S. "Well, now how are supposed to make a living?" Mmm, you weren't supposed to be making a living through organized crime in the first place.
If you think it's not OK that's your opinion, but do a survey among regular folk of "is it OK to have web sites mine your data to provide you with targeted ads and free services like search, maps, email or you wish to pay $5 a month" and see the results. Make sure to include there people from all walks of life and age and all over the world.
Personally I like having choices. Data mining should be just another mechanism to pay for the services provided. I know for a fact that if these companies didn't have "data mining" as a mechanism to provide otherwise free services I would have never used those free services for the past 15 years or so, growing up in a country where electronic payments were available much later and the per capita yearly income was super low.
I simply don’t believe your assertion that the choice is between free services or paying a monthly fee.
What, in your opinion, is the correct number of disclaimers before one is allowed to respond, "duh, I already covered that"? Besides, organized crime involves a much broader set of actions than just killing people. Traditionally it has included such mundane activities as trash collection. Nothing wrong with collecting the trash that people leave at the curb, right?
Regardless, it's tech companies jumping on the hype (derived from the word "hyperbolic") train to tell us of the woes that will befall us should such a thing pass. The world hasn't yet come to an end with the passage of GDPR, I doubt it will should this regulation go through.
But is it right to let companies track users simply because the users say it's ok?
To put it another way: I think the EU would be right to consider it's citizens not as adults that are able to make decisions on integrity or privacy.
Yes. Are we not free individuals capable of consent?
> I think the EU would be right to consider it's citizens not as adults that are able to make decisions on integrity or privacy.
I find this paternalistic, authoritarian attitude to be immoral. Sad to see the ideas of the Enlightenment, of Locke and the founding fathers, so casually discarded.
What remains to be decided here is whether the collection of data by "surveillance capitalists" is corrosive enough to society to be forbidden or restricted as well.
> The individual is not held sacrosanct,
By you perhaps, but those are the principles of the Enlightenment and modern western society and have served us far better than collectivism.
> especially when he/she acts against the group.
Right, sharing my data with another individual or company isn't "acting against the group" or even involving the group.
> What remains to be decided here is whether the collection of data by "surveillance capitalists" is corrosive enough to society to be forbidden or restricted as well.
Not if you respect individual, natural rights. Furthermore, scientific/medical research, traffic prediction, spam detection, self-driving all are arising out of voluntary submission of data by free individuals. I don't see any sense in hindering innocent, positive efforts out of a desire for retribution against "surveillance capitalists" based on the "guilty until proven innocent" model of preemptive regulation. Thankfully the principles of individual, natural rights have been codified into the US Constitution to a large degree.
Nor was the individual held to be above the rule of law in Enlightenment thought. The law was thought to be made by individuals acting collectively (a departure from having a single individual, i.e. monarch, doing it), so if anything the Enlightenment introduced the "collectivism" by pushing lawmaking down into a demographic that was much more populous. What do you think voting in a constitutional convention is? Individuals collectivizing! Just like Soviet farmers!!!!! Oh no!
Correct. And had individual rights been upheld we could have avoided the costly lessons and lives destroyed by those rights-trampling laws.
> Nor was the individual held to be above the rule of law in Enlightenment thought.
The theory of natural rights, which was central to the Enlightenment, held that the laws and governments were formed only to secure individual rights and could not be made to supersede them. A constitutional convention is voting on how to best uphold and respect those rights, not overrule them.
If we're making tedious lists, don't forget the US state of Nevada. But my point wasn't about prostitution and I wasn't trying to change the subject to prostitution; apparently you find the topic too distracting. What about crack? Not a word about crack?
In England it's illegal to
induce someone to become a prostitute
solicit in a public place
kerb crawl
run a brothel
earn money from someone else being a prostitute
have sex with someone who's been forced into prostitution even if you didn't know
have sex with someone who's been trafficed, even if you didn't know (and trafficing includes being transported around England, not just into England).
So, yes, two people exhanging money for sex is legal, but actually carrying out that arrangement is difficult.
If someone was pushing a law that required all companies implementing data mining/tracking to have a paid version that could not exceed the value they gain from that tracking, I'd be fine with that. I assume it'd be pennies in most cases considering your Facebook account is really only worth like $12 a year to Facebook.
The internet is and has historically been based on fundamentally voluntary actions, quite literally an extension of speech.
Before this law, it was easier to create competitors. What do you consider a "walled garden monopoly"?
Facebook quarterly ARPU was USD$26.76 for US/Canada and USD$8.86 in Europe in Q4 2017. I'm also guessing that people willing to pay for Facebook are more likely to be a high value demographic, and would conversely need to pay more than the average user for that region.
If there was enough demand for this it would already exist.
Despite the amount of noise of complaints, most people are actually very willing to have some of their information used in exchange for all of the free services they get in return.
Most users are just going to accept the terms and move on. Just as they have already done in the past with EULA's. If this does happen, then essentially users are saying they are already happy enough with the choice they have.
And that's exactly the point of GDPR. To give consumers a choice.
But I take your point, since I never mentioned anything about degrees of prohibitiveness.
This is the most insane part of this clueless and destructive law.
It's like europe has resigned to the notion that they don't have a significant internet company so they are determined to destroy the whole industry. They don't seem to be as petty or as prolific in churning out regulations and limitations on other industries.
Companies can simply start charging for services rather than selling data in the EU, if it's really that bad.
Personally, as a British person, I fear companies doing bad things far more than I fear the government overstepping with regulation. People have been making these same claims about regulation destroying industries for some time, and it never actually happens.
Instead, most of the time they actually end up being good.
The major issue here is that user consent won't be sufficient anymore, I don't mind the business model in question and I'm not alone so let us have it, and those who won't consent they're free to take their business elsewhere. This degree of micro managing the industry is unprecedented in a supposed free market system, and ad targeting is far from only benefit to the data, it's just potential killing legislation.
What they do to show these ads is to sell your data, wholesale.
It is still the user's data being shipped off to third parties they don't know anything about, and used to do things they didn't agree up-front to.
> The major issue here is that user consent won't be sufficient anymore, I don't mind the business model in question and I'm not alone so let us have it, and those who won't consent they're free to take their business elsewhere. This degree of micro managing the industry is unprecedented in a supposed free market system, and ad targeting is far from only benefit to the data, it's just potential killing legislation.
Unprecedented? Maybe in the US, but not elsewhere. I'm in the UK, and we have strict regulation over the cigarette industry, for example. Advertising is restricted, as is packaging.
I assume the response will be that there is proven harm that cigarettes do, and advertising isn't comparable, and I would agree it's not as damaging, but that's an extremely low bar to aim for.
The reality is that "taking your business elsewhere" isn't always possible - monopolies, walled gardens, etc... are rampant. The current state of the market shows that there simple are not equivalent versions of all products that don't harvest your data.
The sheer number of lobbying groups each of these tech companies is involved in is amazing. Google doesn't seem to publish an EU counterpart to this that I know of, but here's how many organizations Google is backing: https://www.google.com/publicpolicy/transparency.html
The people will consent even if they don't like it so you need to remove this force factor.
Its like here in germany its prohibited that you let an employee work for more than 8hrs straight. In special cases you may extend this to 10hrs but only with good reasons. Everything above is just plain illegal, even if the employee states he did it voluntarily. The company is still liable then.
"The bill also requires companies to offer people the same communications services whether or not they agree to have their data collected."
So consent isn't enough anymore.
And those same groups filed against LinkedIn, Apple, and Amazon too: https://www.zdnet.com/article/gdpr-attacks-first-google-face...
It sounds to me like the critics of the law were right. Instapaper pulling out before it took affect was a good move if they weren't ready. The cases were filed minutes after the law took affect.
UN, Article 12: http://www.un.org/en/universal-declaration-human-rights/
EU, Article 8: http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:120...
So this isn’t about preparing for gdpr... it’s about whether googles interpretation of it is correct.
GDPR was written for lawyers and lobbyists. Those who can lobby the EU’s twenty-eight data regulators will do fine. Those who can’t must reconsider their pricing and exposure to Europe.
As with any regulation, there are issues which need to be sorted out. But one thing is crystal clear to me: this helps making people aware of what is happening to their data and their lifes. There is no excuse for not being able to come up with a viable business model without productizing users and making them subject to social and political manipulation.
I wonder why no one writes about how products could use GDPR and other regulations to their advantage instead of whining about the demise of the ad industry.
How so? TV and media have been doing it since forever - not as efficient but still. It's a valid model if you want open, pluralistic services.
Why do e.g. FB not offer a level of service that is viable without personally identifiable information being used for targeting?
There seems to be a BIG difference in the effectiveness and mechanisms of statistical target groups vs. individual targeting. If you've followed the Cambridge Analytica scandal, you know to what degree this information can be abused.
And lets not kid ourselves, very few people would pay $100+ for facebook, even though it would be interesting to see them offer that option.
If I need to lure users into using my platform by pretending to be "free" so I can get a monopoly going, then that just underlines my point of a non-viable business model.
You just described every startup in SV, but in any case facebook did not have ads platform in its growth phase.
Again with this madness. Please convince me how this does not violate the right of people to come into contracts with each other? The internet is not a private space as the EU's lawmakers seem to want it to be, but a public space like the real world. If you want privacy, you buy a house, and similarly you get a subscription service online. I appreciate that everyone is sensitive with their privacy these months, but please try to be rational. FWIW, as an EU citizen i am sometimes offended by the stupidity of our lawmakers.
This can be seen as an extension to such a law.
It appears that consumers are in the weaker position in the contract here because major ISP can in (silent) agreement to refuse to provide a fair contracts. For example they are in such position because majority of consumers do not care.
> they are in such position because majority of consumers do not care
is like stating that users are idiots that need a nanny state.
Usually no, but regardless it does not mean that they could not cooperate to create unfriendly environment without any real options.
Let me give you a simple example. Let say company X and Y are providing service Z.
For this service alone profit for company X is $1 per customer and $2 for company Y.
If they sold the information about their customers then their profit would be $11 and $12 accordingly.
Now would either of companies get any competitive advantage from not selling customer data?
>is like stating that users are idiots that need a nanny state.
No. These kind of laws do not care about the idiots. They care about the rest of us.
We should be not forced into position where the options are the following:
1) €20, 100 Mbs, full tracking, 2) €20, 20 Mbs, no tracking.
This law states that the consumers should be not forced into a position where they have to compare products by tracking.
If it still did not click for you then here is an analogy. Customers should be not forced to choose between products
1) €12, totally safe, 2) €10, kills you maybe.
It is not ethical.
They do. That, or duopolies. Their *polies might be on a tighter leash, but that's about it.