Hacker News Reader

The idea is that the fines as supposed to act as a deterrent, but unfortunately there's been a shitload of really bad practices stemming from the fact that many consultants have drawn the erroneous conclusion that pre-ticked opt-in boxes are legal. Fines were handed out regarding a few specific cases, but very few businesses know about this and most of the ones that do claim it doesn't concern them for whatever reason. Furthermore, the Danish authorities set a very dangerous precedent when they refused to take on Google with the sole reason that Google are to big and that someone else have to do it.

But yes, until the situation has stabilized and someone has gotten very badly hurt from a financial perspective, the only sensible thing is to block non-HTML content by default and only whitelist the stuff you actually want to run.

> - Too many websites place tracking cookies first and then let you disable them

Under GDPR, unless the website owner can prove a legitimate interest (which is pretty hard to do and doesn't work for advertising), this is illegal.

> - Too many apps use some kind of analytics without any consent

Unfortunately usage analytics can qualify as a legitimate interest, but the actual data used and the purpose matters and you might be able to drop a tracking cookie for improving your service, but AFAIK collecting health data, GPS location or other sensitive information won't fly for analytics without explicit consent.

And we are talking about first party analytics only. Having analytics cookies dropped as part of an advertising network without consent will not fly either.

> - The GDPR has different mechanisms to give companies a "legitimate interest in collecting data". How this is enforced is kind of unclear.

Not sure what you mean by "enforced", but there are rules for establishing a legitimate interest and just because companies claim they have it, doesn't mean that they actually do.

It's basically up to the data protection authorities to do their jobs. Give them some time, there are a lot of lawsuits already.

> It does have the concept of "consent" so that data should only be collected if people agree to it being collected.

How does this work in practice? Sites just say "we collect data, click OK to accept". Where's the option to say no?

The [back] button.

The back button is too late. You already gave them a visit, a cookie might have been placed and your IP address was provided.

That is an excellent question, because this is indeed how it works on many sites. However, it is actually wrong. The proper way would be to have users opt-in.

This was even reinforced with a court decision recently: https://www.technologylawdispatch.com/2019/10/cookies-tracki...

> "we collect data, click OK to accept

That's not compliant with the GDPR plain and simple. For example ads on a website are not required for that site to work (even if it's the only revenue), so the site cannot store data only to track users to show ads. The way a complliant site should work is it can say

"if you want to allow tracking cookies to get more relevant ads you can do so in settings".

I.e. no must be default in case of non-acceptance - and the site must still function.

Yeah. I just visited some news site and they gave me a cookie notice:

> We use cookies for analytics, advertising and to improve our site.

> You agree to our use of cookies by closing this message box or continuing to use our site.

Hopefully they will be fined huge amounts of money.

Exactly. At least some site will be fined, and that news site might make a calculation that it's a better business decision to comply than keep violating the law.

In practice that's a violation of Art. 7 GDPR [0]. In particular, recital 42 [1] makes clear that consent can't be regarded as "freely given" if "the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment."

[0]: https://gdpr-info.eu/art-7-gdpr/

[1]: https://gdpr-info.eu/recitals/no-42/

> Data shouldn't be collected in the first place, because you can't probably protect it properly anyways (leaks etc.).

That's an absurd argument, any data can be leaked. Your bank data can be leaked, mine was, should bank be banned to hold any personal data for that reason?

Of course. But not every service needs the same amount of personal data like a bank account. Just think of all the apps that want access to your contacts, often for no particular reason.

Obviously, if fewer services collect data, the overall chance of lots of data being leaked goes down.

> Of course. But not every service needs the same amount of personal data like a bank account. Just think of all the apps that want access to your contacts, often for no particular reason.

I'm not arguing whether data can be collected with wrong intends.

I'm arguing that the fact that it can be leaked isn't an argument in itself because everything can be leaked.

The person you’re replying to was quoting you saying no data collection should be done.

Now you’re saying banks have to collect data and saying other things.

So you do agree data does have to be collected at some level?

Yes I do agree. But not on the scale it is collected right now.

Please also note that I basically repeated what Snowden said in the video.

A technical solution is good, but it only protects the tech savvy. The GDPR gives us several additional guarantees compared to the technical solution:

- It protects everyone equally.

- It shifts the incentives towards not collecting, since the data becomes a liability.

- It empowers citizen to know what was collected through the use of GDPR requests. It further allows the citizen to know what that data was used for.

- It allows citizens to ask the collecting entity to remove any and all data they have about them.

- Finally, it allows legal recourse when data that was never supposed to get collected inevitably leaks.

So there are multiple things the GDPR does that a purely technical solution does not provide. As usual, the best protection is to have both. Used ublock, didn’t give consent, but still suspect foul play? Send the company a GDPR request, and if data was collected, ask for it to be deleted (and additionally report it to your gdpr regulation entity).

Also:

> - Too many websites place tracking cookies first and then let you disable them.

>

> - Too many apps use some kind of analytics without any consent

I’m pretty sure both of those are straight up illegal, thanks to the cookie law and the GDPR.

Is there a EU FF:FF:FF:FF:FF:FF GDPR request?

Love those cookie warnings. We need more popups like that. Imagine all the quality time spent clicking, knowing, for sure, that you are getting a cookie.

I agree. Power centers need rules on what we can remember and say; it's what they derive their protection and power from. Personal responsibility is the last thing they want people to have.

> Data protection suggests that it is okay in the first place to collect data, as long as it is going to be protected. But this is a problem. Data shouldn't be collected in the first place, because you can't probably protect it properly anyways (leaks etc.).

Article 5 of GDPR specifically deals with the reduction of what's collected and the destruction of data after it has served its purpose. The legislators were well aware that what isn't there cannot be lost, stolen or misused.

Not collecting personal data in the first place is always the preferred scenario.