Hacker News Reader

Comment by icebraining | Hacker News Reader

I know you dream of laws like the GDPR working, but it doesn't and neither did its predecessor

Didn't it? Maybe I'm biased, but I don't remember breaches like Equifax's or Target's in the EU. I also don't remember the records of 154 million EU voters being exposed.

According to this report[1], the "U.S. accounted for 728 of the 974 incidents around the globe in the first half of 2016." They do say part of the difference may be the disclosure laws, but is that all?

[1] https://blog.gemalto.com/security/2016/09/20/data-breach-sta...

View on HN

Maybe I'm biased, but I don't remember breaches like Equifax's or Target's in the EU.

I am in the EU, and I got a letter from Equifax saying they'd leaked all kinds of stuff about me and offering some token countermeasures several months too late to provide much meaningful protection against any additional risks I faced as a result.

> Didn't it? Maybe I'm biased, but I don't remember breaches like Equifax's or Target's in the EU.

So if you don't remember it ever happening, what did the laws curb again? I'm talking about the effectiveness of adding laws... going from 0 to 0 demonstrates no effectiveness much less the effectiveness required to overcome the societal cost of compliance.

If anything, your argument explains the embedded big business cultural differences and laws like the GDPR added nothing wrt data breach enforcement/prevention.

This is some tiger-rock argumentation.

What's this mean?

https://www.youtube.com/watch?v=xSVqLHghLpw

Right. I wonder how much the US would pay for this rock I found in Europe? There were no large data breaches while this rock was there.

You can't determine the past effectiveness of increased future legislation, especially if it's in an environment with a history of lax enforcement.

I see this self-assured attitude often with users from the US. Do you honestly not think GDPR had any effect? If it only served to remind businesses user privacy is protected by law, then that was an effect. The EU has taken legal action against US companies before, and it has made a difference in this world. Why do you think it won't happen again, apart from your deep-rooted revulsion to mostly all forms of market regulation?

This idea that the US is the breadwinner of the world and a paragon for all to strive for is such a tired old misconception born from not-so-subtle nationalism. The US is not a utopia of happy, well-fed people with homes. You got a big army though, that's for sure.

I work in Google and we had posters about getting ready for GDPR eons ago. Which sounds like having some effect to me.

> Do you honestly not think GDPR had any effect?

Of course I think it had an effect. I just believe it was/is a net negative effect. When I say doesn't/didn't work, I mean what I perceive the intended goal is vs societal costs. Akin to saying anti-drug laws don't work and are ineffective... nobody is saying they have no effect. I believe, if reasonably drafted and incrementally applied, data protection laws could have a positive effect.

> Why do you think it won't happen again, apart from your deep-rooted revulsion to mostly all forms of market regulation?

I'm talking about data protection regulation. Based on my research, many companies were violating existing data protection statues and the regulatory bodies were not punishing them out of apathy and limited resources.

Why do you assume I have an issue with all forms of market regulation? That's false and I'm not sure where I said that. All of the rest of your post is attacking some other kind of argument that I never presented.

I think narcotics legislation has worked fine for most nations. Only one declared war on drugs though, which has not panned out super well I'd say. It has amounted to kicking extra hard on those lying down in many ways.

Attacking this and attacking that, I'm describing a mentality that I come across as a European on HN a lot. It has a little bit to do with you, as I said, I'm picking up on this same sense of "lol look at those dumb Europeans, they don't know what's best for the market," I think you'd agree that this mentality is fairly strong in the US. The US is many things, but humble is not a word I'd use.

You shouldn't pick up that sense, you shouldn't assume people are calling entire peoples dumb, etc. I think that mentality you assume is absolutely not very strong. In many cases, envy and embarrassment is much stronger. By arguing from your assumed perspective you are not doing so in good faith and disappointing.

The laws might have curbed what would have happened if they didn't exist - and did end up happening in places without it, like the US. Remember that the Data Protection Directive is from 1995, before companies were so connected and exposed, so a lack of such breaches before it passed is not very indicative of its lack of effectiveness. But a comparison with other countries might be.

embedded big business cultural differences

Maybe, but law shapes culture too, so that's hard to separate. As an European myself, I'm kind of skeptical that our business people would intrinsically care much more about data protection when their money is on the line.

Reply on news.ycombinator.com