Hacker News Reader

Comment by skrebbel | Hacker News Reader

I still don't understand how roughly the same people can do so well at the GDPR and at the same time screw up so badly on this copyright stuff.

I mean, sure, GDPR isn't perfect but at its core it's a pro-citizen thing that has some decent vision behind it and had to resist a lot of corporate lobbying to make it through. This copyright bill seems to be the opposite in every respect.

If anyone can explain to me how the same organizations can do both these things at about the same time then I'd love to learn :-)

View on HN

Both GDPR and this new proposal are pro big internet businesses, and anti small businesses & community run organizations. Both increase consumer annoyance. And both will likely in the end not help consumers with privacy or otherwise.

It seems like the same group could definitely be responsible. I see no contradiction.

GDPR is strictly pro-consumer. Data hoarders like Google or Facebook are the ones that were hurt the most.

Google and Facebook were hurt somewhat but they'll be fine. Smaller competitors had to take relatively more resources to comply.

The two most noticeable effects of the GDPR on average consumers so far seem to be a dramatic increase in unwanted messages from just about every organisations they've ever communicated with and the loss of access to various web sites based outside the EU. The intent may have been noble, but the execution was awful, to the point where the GDPR now seems to be widely regarded in non-techie circles with the same contempt as the "cookie" law that results in all of those annoying messages on web sites.

It looks as though the proposed copyright changes are more of the same, horrible for smaller businesses and potentially resulting in the EU being actively cut out of even more Internet services because compliance is too onerous. Let's hope they do a better job of fixing it or forget the whole thing this time around.

>The two most noticeable effects of the GDPR on average consumers so far seem to be a dramatic increase in unwanted messages from just about every organisations they've ever communicated with and the loss of access to various web sites based outside the EU. The intent may have been noble, but the execution was awful, to the point where the GDPR now seems to be widely regarded in non-techie circles with the same contempt as the "cookie" law that results in all of those annoying messages on web sites.

The GDPR became law two years ago; lots of companies that really should have known better ignored it until the eleventh hour. It is materially similar to the Data Protection Directive, which was passed in 1995. Had companies actually paid attention to the DPD, the GDPR would have been largely unnecessary. The GDPR isn't trivial to comply with, but data protection is not a trivial matter.

The proposed Copyright Directive is in parts severely misguided and I will be petitioning my MEPs accordingly.

Very stringent regulation is in the interests of large businesses. They have the resources while smaller businesses do not.

We've seen this in reports after GDPR go live where Google's advertising market share went up: they had the resources to demonstrate compliance as well as a better ability to get consent (google vs random ad exchange asking for your consent.. google vs a restaurant you go to a few times a year..).

People announce good intentions and create laws and regulations embodying these intentions. They don't look at what the second and third order responses are likely to be, just at what they consider bad behavior and what looks to be a first order response to that. It is very, very hard to create laws and regulations that will have the actual effect that you intend but it is very easy to write laws that have good names and have superficial appeal.

Whether the subject is market structure, privacy, or taxation, far too many supposedly intelligent people adopt or accept the superficial response rather than the well thought through one. You wouldn't accept that approach in your code but you're happy to accept it in national and international governance.

People are then shocked that they don't obtain their desired results and argue for new, improved, superficial laws and regulations.

This is true about a lot of regulations, e.g. slaughterhouse regulations in the USA. That doesn't mean you shouldn't have those regulations, or at least some version of those regulations.

> This is true about a lot of regulations

Managing how the regulatory burden falls is a core part of lawmaking. GDPR fails in this respect.

Complain-investigate regimes (where complaints frequently trigger a regulatory interaction) are effective. They're also among the most-onerous forms of oversight. (Second to mandatory licensing and auditing.)

Add to that the power of each of the EU's twenty-eight national data regulators to interpret the rules. Result? A law that's great for Facebook and Google and terrible for almost anyone else. To wit, Facebook and Google's shares of EU advertising has risen since GDPR went into effect.

Cry me a river. I don't want every little startup compiling my information, and selling it once they fail.

My complaint isn’t with the objective of the rules. It’s with its implementation. One can be totally privacy-first, retaining zero customer data, and still incur costs and risks because of GDPR.

What risks are incurred by storing zero customer data?

Read again. That’s not the risk they’re referring to.

> To wit, Facebook and Google's shares of EU advertising has risen since GDPR went into effect.

Isn't this the expected result? Now only a small number of (relatively) trusted companies have my data, not multiple fly-by-nights who may or may not be trusted ALL trying to gather it. To me, that's a net gain - Google/Facebook would have got that data _anyway_, but I now have less companies trying to gather it _as well_.

The GP is saying that a regulation’s unintended or higher-order effects can create a net negative impact on society. Why “should” such regulations exist?

I'd like to see at least some evidence of the "net negative impact". In the case of slaughterhouses, it impedes the local and smaller-scale (and possibly more-human) commercial slaughter of animals. But slaughterhouses should probably, in general, be regulated. I'm not sure if extant regulations are net negative or positive. But I know that their complete absence would probably be bad. It's not a matter of existence, it's a matter of implementation.

I'm not sure it's net negative in the case of the GDPR. As a sibling (cousin?) poster said, good riddance. No company should be allowed to mismanage my personal data, big or small. Until I see evidence that GDPR compliance is cost prohibitive enough to suppress startup formation, I won't be convinced that the tradeoff isn't worth it.

It's VERY hard to demonstrate net negatives on second and third order effects, especially so as to convince a proponent of the first order effect. You're looking at businesses not created, features not developed, strengthening of colossal businesses (celebrated upthread), and adverse changes that aren't superficially related. The most comprehensive evidence comes from decades long comparisons of countries or differences in regulatory regimes (before and after airline and trucking deregulation in the US) and you still have epic arguments over results and effects.

The other issue is philosophical. You seem to want proof that a company should exist and require extraordinary evidence against a law. I want proof that a law should exist and require extraordinary evidence against a company. As a shorthand its France vs America. You'll note that we're not using Minitel bur rather a board hosted by a VC operation who shares a mindset with the founding team of Uber.

As Frédéric Bastiat said, there is that which is (easily) seen and that which is not (easily) seen.

Hazlitt: “The art of economics consists in looking not merely at the immediate but at the longer effects of any act or policy; it consists in tracing the consequences of that policy not merely for one group but for all groups.”

Smart small businesses will simply try to be reasonable and ignore the more onerous parts (and especially the more onerous interpretations) of GDPR, correctly assuming that no DPA and no noyb-style NGO is going to come after them (and that if it happens, they'll likely get a warning, not a massive fine).

Meanwhile, big data companies are going to be prime targets, and will be forced to either change, or start paying a significant fraction of their global revenue in fines every year until changed or bankrupt.

That is naive. The GDPR is structured to require processes that favor implementation by the management structures already in place in big businesses, leaving the little people scrambling. Being good for the consumer is just a cover story.

They will hurt but the smaller companies will stop operating in the EU altogether. So yes its pro big business, just like the war on drugs has for effect to support the large cartels while getting rid of the small local dealers.

That is incorrect. GDPR allows hoarding data from consumers, but requires explicit consent. The business model of FB is to offer a free service in exchange of consent to tracking and targeted ads. Hoards of internet users are already 'hooked' on FB, and would consent to sharing anything with them if it's a prerequisite to participate in the platform.

New and coming businesses require jumping through more hoops to implement GDPR, while big players with their lawyer armies have no trouble adjusting to regulation, hindering competition.

> and would consent to sharing anything with them if it's a prerequisite to participate in the platform.

It has to be freely given consent, so it cannot be a prerequisite.

Facebook has armies of lawyers and lobbyists dealing with this ambiguity in each of the EU’s twenty-eight capitals.

You are free to not use Facebook.

And I am free to use Facebook and not consent. Your point being?

GDPR vastly increased potential attack surfaces (people taught to click consent buttons without reading, easier fishing - click to login to update your personal information, data portability - scammer can more easily extract personal data by impersonation and much more) and provides false sense of security. It only benefits civil servants and large corporations.

How about distributed systems like Mastodon or Blockchain or IPFS? They might not even be able to comply with GDPR.

Well then the only solution left is to make any big business so small that there are no entrenched players.

Or live in a corporate ruled regulation free dystopia.

How is GDPR pro business if companies had to stop contact costumers?

Can you imagine how much businesses are ilegal now? Telemarketing is ilegal now, consultancy companies can't recruit new people via email or phone. People are yet to realize the true impact of GDPR.

> How is GDPR pro business if companies had to stop contact costumers?

GDPR is pro big business. For example, Google, Facebook have not changed their tracking activities at all. OTOH, many small businesses had to stop tracking people and gather less data.

Agreed

Watch out, the shills are out in force today.

There’s a lot of money in personalized ads and many people here bring home the bacon due to tracking, so GDPR is threatening their future.

It’s amazing to witness. I mean, several years back I was naive enough to think that the smart people of HN are above such hypocrisy. How wrong I was.

I have been involved btw in implementing GDPR compliance. The companies facing difficulties are those that were irresponsible with user data to begin with. And indeed GDPR is a threat to their business model if they don’t change. Which is good – if GDPR wouldn’t be a threat to the business model of irresponsible companies, then it wouldn’t be relevant at all.

Also that line about big companies being the only ones capable of implementing GDPR is ridiculous payed marketing via tainted publications like TechCrunch and it’s catching on apparently.

But yes, it’s about time companies show some responsibility for it. Because if your whole business model relies on the ignorance of users, you’re doing something nefarious.

Ya, pointing out it's (EU) government mandated attack on memory (in a thread about mandated memory blacklists), all the way down to who visited your property; must be shills.

Shocking that the shills are on the right side of the WOGPC, OR (less surprising) your assumption is incorrect.

I doubt you will address the real issue; that this a EU gov mandated memory hole and the GDPR is the obvious framework to start with in the historically standard incrementalism approach.

Because it's not "the same people". This is legislation in a huge bicameral legislature with a multitude of interested parties, including 28 member states and eight political groups. That's before we even consider lobbying interests. Such legislation is usually a tug-of-war that involves lots of horsetrading and compromise (similar to the US Congress, really), because it requires majorities in both houses of the legislature. So you have the various political factions duke it out in the lower house (European Parliament) and the member states in the upper house (Council of the EU). The current proposal has seen a lot of back-and-forth between the conflicting interests of the member states (for example, Germany likes Article 11, but doesn't like Article 13, while other member states have different priorities).

Think how much tax payer money those bureacrats wasted. Unbelievable

The copyright proposal is from Mr. Voss, CDU politician.

He already tried to push a similar law in germany, somewhat successfully in that the parliament basically holed it out to be effectively worthless for what he attempted to do.

The reason this gets any support at all is because of corporations like Axel Springer SE (not to be confused with Springer S+B Media) which are the utmost cancer on modern journalism and media.

Of course, once it got through they managed to get delisted on Google News as a reaction and IIRC it took about 48 hours for them to cave in instead of demanding money from Google.

At the moment the CDU fraction in the EU parliament is pushing this and trying to pressure other parties into voting yes.

It should be noted that as in all governments, the EU does do several things at once and different interest groups may propose laws so the people who build up the GDPR may have no involvement in this.

maybe they adhered to the same principles, seeing content mafiosi as citizens, too. The article makes it sound as if having your news article cited would become opt-in.

The GDPR tricked people into being ok with the gov deciding what you can remember, this just takes the next step. It's a standard incrementalism approach, shrouding them in "just for the corps" to start.

The government doesn't decide what you can remember, your customers do.

Gov decided on classes of stuff you need permission to remember, and that's just the beginning, next the blacklists will be explicit (like this proposal).

And then fascism of course.

Na, the member states are just going to xEXIT, taking their self-determinism with them.

Are you aware that GDPR made every business that relied on finding costumers trough phone or email ilegal?

How can you defend a legislation that makes everyone illegal, even outside your jurisdiction?

That's not the case. They can find costumers through various channels, but they need consent first, they can't spam.

Not correct. They can't contact without positive consent. How can they prompt consent if they can't contact them in the first place?

Reply on news.ycombinator.com