Hacker News Reader

Comment by IdiocyInAction | Hacker News Reader

As an EU citizen, I hope large portions of the internet will just block us. A couple of days without YouTube, Wikipedia and other services would create sufficient outrage to put pressure on the EU for introducing these idiotic laws.

I mean, GDPR is bad enough for start ups, but Article 13?

View on HN

Article 13 is terrible not because it’s terrible for start-ups, it’s terrible because it’s terrible for people.

I’m pretty close to the rough-end of GDPR in my current job, but it represents real benefits for millions of people. If you asked them what’s a reasonable way to treat their data, I believe the GDPR is close-ish to what a lot of Europeans would want. Or, at least a shift in the right direction.

Article 13 on the other hand is what you get if you ask rights-holders groups what they want, and poses a direct threat to freedom of expression for millions of Europeans.

If you asked them what’s a reasonable way to treat their data, I believe the GDPR is close-ish to what a lot of Europeans would want.

I'm pretty sure that if you asked people whether they would prefer to pay for Facebook and Google with cash or by sharing data for ad targeting, most would choose the latter. The GDPR specifically forbids that option.

Article 13 on the other hand is what you get if you ask rights-holders groups what they want, and poses a direct threat to freedom of expression for millions of Europeans.

And it demonstrates the impossibility of having a powerful bureaucracy that does only the things that you want.

The gdpr doesn't prevent such thing. It just requires consent, care and empowerment.

The GDPR does not allow you to block people who do not consent.

Well, it's never gone to court yet, so I guess you can't say for sure. But that's how it's widely interpreted.

Yes, you need consent. That's the point. That's good for us, the users. Services can still do all what they did before, but we need to agree.

Consent is meaningless if it is forced. Also, if the law allowed that, you would simply get a large banner saying

"To access this website you agree to all our privacy invasion and to sell us your soul. We are not asking you, just informing you."

Except you do have the choice not to view the site. If hackernews said give consent or leave, you could just close the tab.

> I'm pretty sure that if you asked people whether they would prefer to pay for Facebook and Google with cash or by sharing data for ad targeting, most would choose the latter. The GDPR specifically forbids that option.

First, it's important to distinguish between the types of lawful bases with which you are processing data. For example, if you were to provide a service of targeting ads to people, you do not need consent to collect the data you need to target your ads: because you are simply fulfilling the contract. One of the problems with the current Facebooks and Googles of the world is that they assume you don't want targeted ads. I think this is an enormous mistake. Sign me up for targeted ads! I want them! I will freely give you information so that I can get targeted ads! In reality, the Faebooks of and Googles of the world are not offering targeted ads. They are offering indiscriminate ads and also selling your data. This is incredibly important to understand.

Next, even if we decide to offer a service and ask for consent for collection of non-related information, there is nothing stopping us from paying for that collection (as far as I can tell). The law states that consent must be "freely given", however this "freely given" means that you can't threaten consequences for non-consent. There is no provision for thanking your customers.

In other words, I'm pretty sure you can charge $5 a month for a service and then give $5 a month worth of credit as a thank you for being able to use your data. (Note: I tried to find some kind of verification of this, but was unable to find a discussion of it either way. I would be grateful for some evidence even if it contradicts my thesis ;-) )

However, there are massive caveats. First you must inform the customers what you are doing with their data and who your are sending it to. Second you must allow them to withdraw their consent. If they withdraw their consent then you must also do everything in your power to notify the downstream data processors to also stop using that data.

And I think that's the real reason you don't see the Facebooks and Googles of the world trying this. They don't want to work with the data in a trackable way. They want to do whatever the heck they want with your data forever. They don't want to inform you that they've sent your data to an organisation that you might disapprove of. They don't want to allow you to cancel your consent without cancelling your service and also do whatever is necessary to stop the downstream processor from using your data if you object.

There is usually a lot of vitriol here when we discuss GDPR however usually this is a result of distilling the argument down to an either/or situation. Either the company is an abusive monster or the law is trying to remove a legitimate business model. It overlooks the idea that there are serious problems with the way this business model works right now and the law attempts to improve that situation in ways that are both useful and frustrating.

Edit: At the risk of bringing the wrath of the EU down upon my employer, I just realised that we offer a 25 GBP voucher for agreeing to sign up to our newsletter. So, there is at least 1 company who does this and I really don't think there is anything wrong with it.

> Sign me up for targeted ads! I want them! I will freely give you information so that I can get targeted ads!

The same I was getting at here: https://news.ycombinator.com/item?id=18805856

in fact I think I used to get more relevant ads some years ago.

Dudeo, people are just going to sign up, get their money back for their data, then ask you to delete the data right away. You have to still provide the service, just now for free.

> ... pay for Facebook and Google... by sharing data for ad targeting... The GDPR specifically forbids that option.

All I can say is that this is not my lived experience of Google and Facebook in the EU. This is also not those companies’ interpretation of that law (nor a common one).

There are real arguments against the burden the GDPR puts on companies who hold/process significant PII (which I am sympathetic to), but this is not one of them.

> ... powerful bureaucracy that does only the things that you want.

The same could be said of any democracy. My point is that there is no democratic basis for Article 13. It’s only getting support because IP law is too boring and abstract for most people to get worked up about.

Do you have a source for that?

Well since you can't make sharing of personal data a prerequisite for using a service unless it can be shown that data is actually necessary for the operation of the service it could be argued that this follows.

The question was if there is a source on the claim that most people would prefer intrusive ads to paying for a service.

Sorry, I had assumed the question was for a source on "The GDPR specifically forbids that option.", I didn't give the source, but an argument why it follows from the rules of the GDPR.

A service could offer an ad-free version for a fee.

If you provide a free service which is only accessible after you give permission to data processing, then that permission is not freely given and thus invalid (as long as such processing is not strictly necessary to provide the service) - see Article 7 and Recital 43.

That's not quite accurate. The law allows you to legitimately ask for permission to share the data for advertising purposes, but you have to be transparent with the details, and the advertiser has to have the same safeguards on the data as your company (they aren't allowed to re-sell it without the original company's knowledge, for example).

That's not fully accurate either. All that you wrote is true, but user's permission must be freely given - this means access to the service cannot be restricted if user refuses to give permission (as long as that permission isn't strictly required to provide the service itself, but then probably permission is not the right basis for processing data).

Agreed.

I used the word prerequisite for a reason - you can ask for permission, but you can't try to force permission by withholding the service.

Article 7 and Recital 43 of GDPR.

Permission must be freely given in order to be valid. It is not freely given, if access to a service requires the permission and that permission is not strictly necessary for the service.

However I believe it is good that such option is forbidden, after all the years of abuse of user data at the hands of Google, Facebook and other advertisement companies. Note that ads can still be shown without all the creepy targeting, and ads could still be used to pay for the service, without stealing user data (yes, I call it stealing, because these companies go to great lengths to trick the user into giving the permission). It remains to be shown if ads without tracking could be sustainable to keep services free.

Yes, in the same way (as an exaggerated example) it forbids people selling their organs for profit or jobs with no salary etc

But the parent is right, this is not only about companies, this has a direct impact on users and freedom of expression

I had absolutely no issue getting my family members to pay for an account at diasp.eu when google+ shut down.

They were rather happy to do so since one of its selling points is that they do not track users for advertising. Do not underestimate the general publics tracking/advertising fatigue.

Forgive me but doesn't that mean they were actually using google+ in the first place? Which seems.... unlikely? Or at least incredible outliers.

You won't get the majority of people on Facebook to pay for the service after you've been giving it to them for "free" for 10 years, you'd maybe convert 10% if that, at which point what use is facebook with most of the users gone?

We were all using google+ to share images. Some of them are on facebook (my mother and sister in particular), but the rest of my extended family is not there. But we were all on G+, I told them if they wanted to see baby pictures you have to sign up.

I couldn't care less about anyone outside my family, if they want to contact me they can email or call me by phone.

It's difficult to ask for users to pay for a service that was always free, indeed, furthermore facebook is not growing its user base anymore.

But a competitor can emerge by providing an alternative service, for a fee, marketing it as "the service that doesn't spy on you".

Now, sure, that will be a niche service, and social networks can't be niche services. The protonmail of facebook or twitter will probably never emerge.

For semi-private file sharing (ie family-wide, not worldwide), paying services are great. If you want as big of a circle of "friends" as possible, you are in a "winner-takes-all" situation, and being free helps to be the winner.

My understanding of the GDPR (did a course on it for work) is that it allows data sharing for advertising to named companies, but holds you and the advertiser responsible for ensuring that no-one else gets your data without permission and for letting you know if any such data breach occurs.

But I agree with you on the principle that bureaucracy very seldom does only the things I want.

Well consumers can still give information to google if they want to, gdpr does not disallow it.

What is now forbidden is to gather identifiable data about people without consent and ability to remove it.

> I'm pretty sure that if you asked people whether they would prefer to pay for Facebook and Google with cash or by sharing data for ad targeting

They would chose not to have Google and Facebook. The basic principals of capitalism that products are something people want or need. Surveillance capitalism gets around this by exploiting the fact that an average citizen does know nothing about data collection and its scale and the implications for their privacy. GDPR is trying to fix this and also the fuck all attitude to security that most companies have.

> Article 13 is terrible not because it’s terrible for start-ups, it’s terrible because it’s terrible for people.

the two aren't mutually exclusive and Europe is right now in a deep growth slump also caused by middle class not moving into entrepreneurship due all the red tape and inefficiencies around having to deal with the particularities of every European state, with the EU aggregating without unifying a mess of regional particularities (i.e. vatmoss)

we desperately need the EU to cater both to the individual and the small business interests working out the kinks of the common market.

VAT and a vast majority of the laws surrounding commerce at least are simple and have been abstracted away by various platforms ages ago. I invite you to read up on the subject and revise your stance (your premise may or may not be true, I will not claim to know either way) based on something that is actually true.

VAT is absolutely not abstracted away and intra-EU VAT is anything but simple. Why speak when you have no idea what you are talking about?

VAT is very far from simple across the EU and there have been recent changes for online shopping (depending on the amount/turnover per year if might be necessary to charge VAT based on the buyer residence instead of company registration)

Another instance in most EU countries tips (in restaurants/bars) should be subject of VAT, not in the UK for instance.

Different exceptions for deductibles like water for employees (but not coffee and so on)

I think it all depends on how far you want to stretch the definition of "simple". I run a sole proprietorship and don't have to worry about national VAT until I cross a certain threshold. However, if I do business with customers in another EU state, I immediately need to account for VAT and report it.

Add to that mistranslated directives (!), misinformed and uncooperative tax officials and you quickly realize that both "ease of doing business" and the single market are all a bunch of baloney. If I ever launch a B2C service, you can bet your ass I won't be aiming it at the EU market. I'll leave that for when I can afford an expert to handle all the bureaucratic nonsense that doing business in the EU involves.

wrong and with an attitude, what a combo.

why is this grey, it's absolutely on point and true.

it's the poisonous Brexit climate, any criticism to the EU is now shot on sight around liberal circles.

GDPR was never intended to be "good for startups". Just like pro-climate policies are never intended to be good for the economy.

GDPR was intended to be good for peoples privacy. Pro-climate policies are meant to be good for the climate.

Somethings gotta give. People are generally more important than startups. Climate is generally more important than economy. Because without people, there are no startups. And without climate, there is no economy, people, or startups.

You're contradicting yourself.

> pro-climate policies are never intended to be good for the economy

> without climate, there is no economy, people, or startups

I think eikxyz means that pro-climate policies are not designed to allow quick profits; they will actually constrain some actors in the economy. They also may help to ensure the survival of the economy itself, so that at least some economic actors can still function.

The thing to do here is to read everything this person has said and to take in the bigger picture of what they are trying to say. Focusing on the details like this is doing yourself a disservice, because it makes it look like you don't have the skills they taught you in school.

That some benefits will naturally occur as a side effect of a policy does not actually change the intention of that policy.

So who is benefiting from this article 13? The copyright holders.

Not the people, not the startups, not the EU companies.

There are things to be said about GDPR and climate, but not so much about article 13. It's just retarded and insane. These people have totally no clue.

"Artificial intelligence can recognize faces today, filter out preferences and even park independently. It should be easy to distinguish between original and parody." - Says the Germany's equivalent to the RIAA

https://twitter.com/gema_news/status/1098263167636041729

"You can talk at a distance instantly today, it should be easy to transport people instantly."

"They can modify human DNA today, so curing cancer should be easy"

I think eikxyz was only arguing in favour of the GDPR, not article 13, which is indeed obviously retarded and insane.

this is the standard of current debate: "people are more important than ...". Well done! Well done! I guess that does give carte blanch to any and all regulations that can be said to be "for the people", so all of them. Wow, nobody though about this before, really good. You are a master philospher, Sir! Pay no mind though to the people who had arranged themselves in mutually beneficial relations that these regulations hinder or destroy because they are not real people. Only those persons who need their PII "protected" (not from the state of course) are really real anyway.

Idiots like this fool are also running the EU, my god was the internet a great place before his ilk got here.

GDPR and Article 13 (in The Directive on Copyright) are totally different and unrelated things.

I happen to be a small business owner in the EU and I have many customers who are the same. We all have registered with the ICO (UK) for something like £60 pa and filled in a short questionnaire. We have read the clear guidance on what records to keep and what to not keep - it's not rocket science. That is GDPR for most small businesses. Now, if your business is predicated on building profiles on people or pestering them on the phone or flogging ads etc then I can't help you there - it may be a pain.

Now Article 13: It is designed to try and make the likes of YouTube responsible for not carrying copyrighted works by putting the onus back on them. I believe they hide behind carrier status. I understand that A13 looks a bit like an anti-meme effort but it isn't because that is generally covered by parody or reasonable use regulations.

In the end, are you really sure you want the world to block us?

> In the end, are you really sure you want the world to block us?

Yes. Let's end the cycle of pretending that we can prevent information from being free.

Unless someone has some work of their own, that other people start to use and make money off it. Then that one wants copyright. Then its no longer information flying free for everyone.

That is more on the side of licensing.

> Copyright is a dinosaur of an idea that belongs in the annals of history and out of the present.

Then don't copyright the content you make, just release it out into the public domain. Be the change you want to see.

But let's be honest, the people most vocal against Article 13 are those who want to leech other people's creations for free. Not those people actually creating the content.

> the people most vocal against Article 13 are those who want to leech other people's creations for free.

Why would such people be at all concerned about Article 13? Torrent sites and swarms have been in flagrant disregard of the law since forever, one more law isn't going to change much. Likewise the other popular pirate mechanism, the old "upload an archive with the content to Mega or similar" technique, already frequently uses encrypted archives to make sure only people coming through the right channel (often an ad laden website + several even more ad laden URL shorteners) get access to the content, making a filter requirement ineffectual there as well.

Torrents aren't really good for small things that quickly change like news whereas websites like reddit are and I'm pretty sure the people who are pushing for articles 11 and 13 are news agencies. Here is my thought process:

News agencies know they are using dark patterns to skirt by GDPR while still using targeted advertising but since they know the fines will eventually start hitting, they want to move to paywalls. However, A paywall for a news company is practically useless as any major story one makes gets linked to and paraphrased by dozens of other news agencies within minutes. Users won't pay for a news website when they can get practically the same stories only slightly delayed at a free one that just paraphrases and links back to the original. Article 11 solves that problem and article 13 is to prevent 1 user who does pay for a website from copying the entire article and pasting it in a comment (I see that and archive/outline links all the time here and on reddit).

> the people most vocal against Article 13 are those who want to leech other people's creations for free

If we're going to be completely honest here, this is constructed as a personal attack and therefore doesn't merit the storage it takes up.

In the EU you can't easily release content into the public domain, in Germany it's impossible to do that.

What's more, since there is only one collecting society for each type of media (which is always the case afaik), German law allows the collecting society to just assume that all works in existence are made by their members.

When someone plays music at an event, the collecting society will try to collect royalties from them, even if it's just CC or public-domain music, and the organiser is guilty until proven innocent.

I know of numerous photographers who find their work ripped-off; without copyright protection they would have no comeback on that.

In a world where everyone has a copying machine in their pocket more powerful than anything built by mankind ever before, the economic value of a copy is zero.

Copyright is a power grab around that fact. It wouldn't matter as much if they didn't extend it to a duration of two lifetimes.

> I understand that A13 looks a bit like an anti-meme effort but it isn't because that is generally covered by parody or reasonable use regulations.

That's exactly the problem. Stuff of that is protected, and with good reason. But upload filter that would be mandated by article 13 can't detect that fair use. By enforcing them for all platforms like Youtube all of this will vanish from the european internet.

You don't and can't know this and it is obvious because you are speculating about a future fact. It would help all of us if you couched it as such so that no reader can be deluded into thinking you have based your arguments on the kind of certainty that they seem to be based on.

We can predict some things with a reasonable amount of certainty. For example, if companies have one high-risk high-cost option (relying on sophisticated solutions able to distinguish edge cases like fair use) and low-risk low-cost option (blocking everything that is suspicious), we can expect them to chose the later.

I'm building a platform that allows anyone to make games, and share them on the web.

Do you think I will stay in Europe with my company if this bill passes? You must be crazy.

This is why A13 requires the platform to have an actual human being revise the decision if something is wrongfully blocked. I think it's in chapter 4 or 8 of the article IIRC.

Wow, so not only do you have to spend millions of dollars to create an automated filter (YouTube reportedly spent 60), you also have to spend $X on humans to review false positive claims and $Y on copyright infringement cases in which your automated filter wasn't good enough. Talk about barriers to entry.

> I understand that A13 looks a bit like an anti-meme effort but it isn't because that is generally covered by parody or reasonable use regulations.

Yes, you just need to find a way of convincing filters your parody is a parody (or other types of fair use) and not C.I. Oh wait there's no way

> In the end, are you really sure you want the world to block us?

Well this is a double edge sword. EU still produces something like 20% of the global GDP and if a company can ignore such a market than let it be. There will be many alternative projects spawn to fill the market need (if there is a real one, not talking about surveillance capitalism products here). Is this that bad for the EU? I don't think so.

GDPR regulates companies processing personal identifiable information, if your startup can't comply with that it shouldn't exist for the same reasons that a food startup that can't comply with food safety regulations shouldn't exist.

Article 13 is straight up impossible to implement.

> if your startup can't comply with that

most startups can and will. but it basically adds up the requirement of lawyering up to every startup that wants to operate here de facto annihilating the possibility for single man operations to bootstrap an idea cashless.

It doesn't do that, because you don't need to toe the line.

there's no avoiding gdpr. how do you do presales without? it's not just about the trackers. every information is impacted from prospect contacts book to hiring, all that information requires consent and a public policy and a dpo.

and someone has to write that policy and someone has to be your dpo. and that's operating costs that a garage level startup will not be able to sustain.

Of course you are correct that the things you have just mentioned require some knowledge of the laws governing personal information. I just dispute the notion that this is required or even healthy.

If you are of the position that the popular extremely invasive form of "marketing" is something that absolutely has to happen, then what I say will never apply to you. Especially as it pertains to it being self-evident that you're not violating anyone's rights.

GDPR is just fine, if you've got your shit together and has some actual benefits for users, like being able to request all my saved data and its deletion. And of course disallowing websites handing my data to every possible ad network without my consent.

Laws are for people, not companies. Thinking about startups before discussing it's impact on your fellow people is frankly a very worrying trend.

my 2 cents: A few days of outrage will do absolutely nothing to stop or change the law. AFAICT, many the EU bureaucrats and politicians fervently believe that they are doing the right thing here, even if it's clearly bonkers.

It's like Brexit that way.

Also: as said elsewhere, article 13 is probably all good news for YouTube, so I doubt that they do anything deeply confrontational. Plus, even if they did, they would just be portrayed as evil lobbying/scheming bastards arm twisting the EU into giving them what they want.

> as said elsewhere, article 13 is probably all good news for YouTube

This part is not clear to me. On one hand they are big enough to prevent copyrighted material being published. They could also offer filtering services to smaller parties.

But on the other hand, YouTube is still full of copyrighted material. You can find basically any videoclip, cd-rip, or anything else on there. There are even entire movie rips on there, that regularly get deleted. Do they currently pay some big license owner a fee for this? I don't think so (but I'm not sure).

So if this article 13 passes, YouTube will have to remove all of this material. Not only that, but they have to prevent such material being published in the first place. Or somehow make sure that a certain videoclip/cd-rip is payed off to the proper license owner.

I'm not sure if it's even possible for YouTube to make such a filter, without having either a lot of false negatives or positives.

> my 2 cents: A few days of outrage will do absolutely nothing to stop or change the law.

Yep, it's going to be just another "oh lol there's a protest" and a week later nobody remembers it.

I'd be happy if wikimedia just completely blocked all of Europe for a 2-3 weeks.

Well, there's an EU election soon, blocking for a couple of weeks before that would probably suffice to change a few minds.

Have you read the content of article 13?

GDPR is good, Article 13 is bad.

The constant conflating of the two by private data protection oponents is really wearing thin.

"Username checks out" as they say on the alien website.

There is nothing hard about implementing GDPR, esp. for startups that start from ground zero.

The copyright directive is a whole different beast. Those two don't belong together.

I am saying that after implementing GDPR for a large organization with millions of customers and multiple departments.

GDPR was never meant to help business. It was intended to protect individuals from business.

Honestly, if your business can't survive without adhering to basic data protection principles then the world is better of without your company.

As a user, GDPR is great for me.

As a user, article 13 is bad for me.

> As a user, article 13 is bad for me.

Why?

Copyright law is already hideously draconian (in the US especially). Every fucking time the copyright cartels push for more power, more control, more leeway, they get it. It's been going on for a century or more, which is why we end up with ridiculous copyright terms like Life of Author + 70 years.

The last thing I want is to give even more power to these obsolete middlemen to act as gatekeepers of information and culture.

I'm not totally against copyright as an idea, but I'm certainly against the form of it we have now.

>> GDPR is bad enough for start ups

What?? I have maned to full GDPR compliant product in several startups. What am I doing wrong?

Yes

Reply on news.ycombinator.com