Hacker News Reader

Comment by amelius | Hacker News Reader

Question: it's been almost a year now since GDPR has come into effect. Has there been evidence that people from the EU have been able to completely withdraw themselves from the user-tracking universe?

View on HN

I doubt it. We need some prosecutions of Oath, Vox and so on before they start implementing the consent request properly.

Oath is the business embodiment of cancer, it needs to be sued out of existence. It provides absolutely zero value and just makes the internet more toxic.

It should be implemented in a "global" way. Instead of filling in no tracking forms for each website, they should be forced to honor DNT (do not track) header. Similarly on OS level, it should be possible to say to all apps that I don't want any tracking.

No, because the mills of justice grind slowly (translated German proverb), and because the DPAs are horrendously under-funded and overloaded.

However, I do have the impression that the situation has already started improving significantly, and as the fines and other enforcement actions start happening, these practices will become less attractive (as in "I don't want this in my company because my competitor had it and got bankrupted by the fines").

A nice aspect of GDPR is the civil enforcement, allowing NGOs to sue on behalf of individuals whose data was abused. This helps resolve the problem that the DPAs are useless and it is infeasible for you to sue Facebook. NOYB.eu is one of the NGOs doing some work in that area (mostly pushing the DPAs to do their job by filing complaints, for now) that has led to fines.

> A nice aspect of GDPR is the civil enforcement, allowing NGOs to sue on behalf of individuals whose data was abused.

Is there a practical way to demonstrate, in a court of law, that one's data has been stored/used/traded in an illegal way?

For example, assume I use a specifically generated unique email address when signing up to one service. After a while I get spam on that email address from a different company. Can I use this as evidence in a lawsuit? How strong will the case be? Would it help if I ask a trusted party (notary) to deal with the generated email address (so nobody ever sees it except the notary and the company)? What options do I have in collecting evidence?

In a civil suit, you'd typically need "preponderance of the evidence", i.e. you have to convince the judge that it's more likely than not.

In practice, the worst data sellers will pretend to act legally, so they'll often admit in some fine print what they're doing.

Also, if the judge asks the representative of the company whether the company is selling your data, the possible answers are "yes", "I don't know", or "no". The former two mean you win. The latter means the representative risks jail time if it later comes out that the company did sell the data.

yes. websites across the world have been banning whole EU countries like there’s no tomorrow. but on the plus side we now we know how it feels for the Chinese and their firewall. only ours is called GDPR. to put this in context: there are more websites accessible from Hong Kong than from the EU.

Which means the shitty companies are removed from the market and websites and companies that respect their users stop getting undercut by their unethical competition.

Well, I guess the really shitty companies simply ignore the GDPR. They might even use some shady business construct to move money and data between companies, while shielding themselves from the regulator.

there are right now companies from the EU that don't respect GDPR.

this is not a right/wrong issue. like most of reality, it's full of grey.

> there are more websites accessible from Hong Kong than from the EU.

After a quick search, I couldn't find a source that claims that any website is blocked in Hong Kong, and several that claim that no website is blocked.

The Internet connection is monitored, there's pressure and self-censorship, but there's no blocked access to websites. It's easy to be bigger than zero.

EDIT: The biggest collection of the websites I could find lists 1129 that are still blocking access to EU citizens, and 252 that stopped (presumably, once they've become GDPR compliant): https://data.verifiedjoseph.com/dataset/websites-not-availab...

I know for a fact the great firewall does not extend to Hong Kong. We can deploy APIs there AND use HTTPS/ communicate with the outside world/ use Google services. How insane.

>The Internet connection is monitored[...]

While I agree that there is pressure from pro-Chinese Government henchmen to intimidate free press in HK, I am curious as to where you get this assertion that the internet is monitored. That would imply some kind of government surveillance. I have never heard of any systematic internet monitoring in HK of the kind done in other countries, like mainland China.

there's no censorship, direct or indirect, in HK. that is why there is less of the Internet in the EU than in HK.

I've not come across a single website that has banned me access to it based on the EU GDPR (except maybe I think some news site that was linked on here once?)

Care to share some examples?

I regularly come across those that are blocking EU users. Guitar Center is a pretty big one: https://www.guitarcenter.com

The Chinese regime blocks sites that are critical of the Chinese regime.

GDPR on the other hand has absolutely no political selectivity. It's just a bunch of self selected US sites that can't be bothered to properly implement GDPR (until they get their own version of it).

That makes your claim about the number of websites accessible from Hong Kong about as relevant for freedom of speech as the lack of chlorinated chickens in Europe's supermakets for the variety of food we get to eat.

Reply on news.ycombinator.com