Hacker News Reader

Comment by yasp | Hacker News Reader

With this and GDPR the EU is seemingly begging to be cordoned off from the broader internet.

I'm on the fence with GDPR until I see how it is enforced. There's a lot of amateur internet litigating going on out there assuming GDPR will be used like the hammer of Thor and enforced to the upmost absurdity, but things like reasonable security exceptions and such are what I want to know about.

There's a lot of nuance that could swing things in any direction. The devil is always in the details.

> I'm on the fence with GDPR until I see how it is enforced.

Can't we just look at how the previous incarnation was enforced to get an idea? Also, I think we can say it's a damned if you do damned if you don't situation. Unenforced, the law is worthless and punished only those who abided. Equitably enforced hurts a lot of smaller players. Inequitably enforced has everyone praying they are on the good side of the enforcers. Viewing through the enforcement lens can make it clearer the value, or lack of value, of the legislation akin to the value of previous versions.

To the topic of the article, the enforcement lens needs to be used as well. Even if people agreed with the potentially impending copyright laws, legislators need to take enforcement concerns seriously. This is why baby steps are ideal.

>Equitably enforced hurts a lot of smaller players.

So? The goal of the law is user data privacy and control. It doesn't matter if the abuser is Google or someone operating a site from their dorm, violation and misuse of user data is still the same.

Sure. I mean we could use arguments like that to justify egregious or heavily-enforced punishments on all sorts of crime. The real goal should be to bring everyone, users and companies, along towards the goal. This looks much different in practice than it does in theory. One of those practices is balancing good with bad and working towards things. While equitable enforcement is the ideal of the enforcement options, it would require the law be written to know its practical limitations which is not the case.

What you'll find is that accomplishing a goal is about implementation not intention. In many cases, inadequate attempts actually work against the goal.

> So? The goal of the law is user data privacy and control. It doesn't matter if the abuser is Google or someone operating a site from their dorm, violation and misuse of user data is still the same.

The issue is that competition is a powerful consumer protection mechanism. A regulation that prohibits 15% of current hostile practices but also impairs competition can allow the major incumbents to be 500% more hostile to customers because the customers now have no alternatives.

It allows the incumbents to do all the bad things the law doesn't prohibit but they couldn't do if their customers had a choice.

Not sure why this is downvoted. That is the goal of the law, I don't see how one can disagree with that. It favors user priorities and control very strongly, and I'd add it does that because companies like Google have been playing it fast and loose with user privacy for decades and have all but annihilated the trust of the general public with regard to it.

Selective enforcement gives them even more power though. If a rule/law is only acceptable because it won't be enforced much then it's actually a much worse law for freedom than one that will be enforced across the board.

The EU have come to the conclusion that they probably won't have a major internet company so they are willing to destroy the whole market to help legacy industries and assuage the anti American notions of their members.

I don't think that's it. Brussels is indeed building its own kafkaesque state because they have little pragmatic sense of how things work. As an EU citizen i have little understanding of why these laws are being introduced and whether they have even been debated with us. GDPR is a mountain of bureaucracy that is already turning itself to another cookie law, with people being currently trained to click yes to consent on every website (i certainly do, its just easier than going through the alternative for each and every article i read). This law ... just seems impossible to implement but i wouldn't be surprised if it passes, even just to please the lawmakers who made it.

Wtf does GDPR has to do with clicking a button? Im happy I can request all data a company has stored about me and tell them to delete it

The consent boxes are what GDPR will mean to most people in a few months. Deleting your data is a good thing, but that option has been available from the biggest data hoarders for years, and it's not exactly popular. In fact most users dont even know/care it exists.

But deletion hasn’t been available (and most “deletion” request functions have been in response to legal and governmental pressure already) and I recall seeing multiple stories about “deleted” material not being deleted.

Gdpr is a response to the prior attempts to let the industry “self regulate” not actually doing anything.

Does it over regulate? Personally I don’t think so - people talk about the complexity but that’s mostly due to the need to be absolutely explicit everywhere, and need to ensure that there aren’t loophole that can be abused by some company with enough lawyers.

The industry did do some things, for one internet giants are in a certain competition to appear privacy-conscious. For another, adtech did introduced some options (e.g. adchoices) but they were arguably too little. The thing is however people don't care about their privacy as much as their governments would like them to care, hence the regulation. But it's opinionated , extreme regulation meant to disrupt everything rather than fix the things that need fixing, and that never works.

The GDPR has a lot of clauses that seem nonsensical to an end user, but actually setup a situation where those data collectors must reveal the true extent of their data or risk massive penalties by having falsely disclosed..

Until now there was no way to guage the truth in anything they tell you and no penalties for lies.

I m not personally afraid of the data that commercial companies have collected on me , as i was consciously using their websites when i did . But it's more uneasy to think of the data collected by various security services. I am glad that GDPR is making people believe all their private data belongs to them (this is not true in modern states - government owns much of your data). At some point people are going to start asking questions about private data usage by governements. E.g. it is only a few years since governments started buying and using stolen private bank files to search for tax frauds etc.

The "consent or no dice" coercion will get fixed later on (2019 as it seems) with ePR [1]. Right now you have a choice to not use the platform. It isn't a fair choice (hence ePR) but its there. And, you have the choice to request your data. Its a big step up, but its not yet where it should be. Baby steps.

At least the EU does something about this data gathering mania (as for why, see Bruce Schneier's essay "Data is a toxic asset so why not throw it out?" [2]); the USA, for example, doesn't (yet). The USA just repealed net neutrality. Its good in a way because now we can watch the long term effects from the other side of the pond. I suggest Americans do the same with GDPR. Observe and learn from each other.

[1] https://en.wikipedia.org/wiki/EPrivacy_Regulation_(European_...

[2] https://www.schneier.com/essays/archives/2016/03/data_is_a_t...

That's because they are so well hidden and not in the least bit advertised. We just all assume the worst of companies and generally are proven correct.

Last I checked one of the biggest datahoarders of all, facebook, did not actually delete your data when you told them to, instead the squirreled it away somewhere in a data warehouse just in case.

There should be a NO button too, right? Personally, I just bounce from most pages that show any kind of overlay that is not adblocked. There are lots of sites and my time is short. I can just hit the next search result.

Ding ding ding! It's not an unreasonable strategy, either - the choice is only the taxes from local operations, or huge fines + effective tariffs on doing business to encourage local firms to spring up. I know what I would do, if I was France and had exactly 0 Googles.

Gdpr is actually a good thing. It's at least weird that USA-based companies must follow it, but the law itself is very good thing for a customer and not that bad for companies until they like collecting data and doing dirty stuff with it.

"USA-based companies must follow it"

US based companies are not subject to EU law. The only reason a US based company might care about the the GDPR is if they have assets in the EU that the EU could seize. Other than that, we will happily ignore the EU's attack(s) on memory.

https://news.ycombinator.com/item?id=16965880

I would have preferred promulgating a set of standards to be GDPR compliant, and allowing companies the option to choose whether to conform. Individuals in turn could choose whether to use GPDR compliant services or not. Rather than hitting all companies globally over the head with a hammer. Eventually this strategy of legislative aggression is going to blow up in the EU's face.

That's the argument for why health codes should be optional, that customers can choose whether or nor to eat in dirty restaurants and the market will settle the issue. Nope. I don't want to play that game. I want everyone to obey a mandatory set of minimum rules.

It's about information imbalance. Without mandatory minimums it is too easy for businesses to hide faults from consumers. I don't want websites to use business judgment when deciding whether to protect consumer privacy. I want them to fear massive retaliatory fines should they not do the bare minimum necessary to protect the public from harm.

"I want them to fear massive retaliatory fines " is exactly why America/Asia is currently dominating Europe in technology. No start up and innovation can happen in such an outwardly hostile business environment

No startup or innovation should happen at the cost of harming the userbase.

You can take the good with the bad or have neither in some idealistic world where only one exists. You can even limit the bad (oftentimes limiting the good as well), but you shouldn't say in absolute terms that innovation with some bad should never occur even if there is significant good.

Ultimately it comes down to whether a user should be free to choose whether to use such a service. Ostensibly the user is receiving some benefit despite this "harm". If the harm outweighed the benefit there would be no user.

> I would have preferred promulgating a set of standards to be GDPR compliant, and allowing companies the option to choose whether to conform.

EU countries had data protection laws for years before GDPR. Moreover, GDPR is only partially more strict than the existing Swedish data protection laws. I cannot name a single company that gave a damn about these laws.

That's why GDPR, even with all it's ambiguities, is a good thing.

Ok? That companies chose not to conform is more indicative that consumers ultimately didn't care very much.

Nope. It's only indicative that companies think they are entitled to not give a damn about any European laws.

Absolutely not. GDPR is the kind of thing that should have been passed worldwide 20 years ago. If companies will not respect your data and your privacy, they deserve to be punished severely.

It's amazing how clueless some people are about the damage that regulation that isn't well thought out can cause to small businesses.

GDPR isn't a well thought out regulation because the regulators couldn't even take the time to give examples of how to to migrate common internet infrastructure in order to be compliant. Instead they just threw out their shitty law and told the world to figure it out.

This new link tax further proves to me that the bureaucrats in the EU have no idea what they are doing and have no technical knowledge.

Just because you are small, doesn't mean you get to abuse user data. No, parent is right, this is long overdue, and if a few data abusers must pay, so be it. Its too important to make exclusions for those that cannot keep up. If you can't stand the heat, get out of the kitchen.

>If you can't stand the heat, get out of the kitchen.

And that is the goal, isn't it?

To drive out smaller competitors from online spaces so that only the big boys can play.

It's amazing how clueless some people are about the damage that software that isn't well thought out can cause to its users.

${SOCIAL_NETWORK} isn't a well thought out business because the owners couldn't even take the time to consider common privacy expectations in order to respect their customers. Instead they just threw out their shitty service and told the world to figure it out.

This new practice of blocking EU users further proves to me that the execs in ${SOCIAL_NETWORK} have no idea what they're doing and have no good intentions.

A fundamental right to remuneration for your creative work that can’t be signed away is in exactly the same spirit as a fundamental right to privacy that can’t be signed away. In both cases you start with a legal protection that’s good and necessary in some cases, declare it a travesty that people are signing away that right en masse against the EU’s opinion of their best interests, and close the door to that sort of contract. In both cases this flies in the face of established internet customs, so you shrug and say “in a society there must be rules, you can’t escape the law just because you’re on the internet and have gotten used to doing it.”

> fundamental right to privacy that can’t be signed away

If you're talking about the GDPR, from what I understand you can sign your privacy away. What can't be done, is to require you to sign your privacy away as a condition to use some service, unless there's no way to provide that service without using your personal data.

And this is how power hungry people/organizations throughout history have implemented disastrous policies in the interest of the "greater good".

It’s also how and why pretty much every law in the history of humanity gets written, so singling out only the worst examples doesn’t really say if it is our worst tendency or our best.

Reply on news.ycombinator.com