Comment by m12k | Hacker News Reader

Comment by m12k | Hacker News Reader

Parent Full thread

Informally, EU citizens own their personal data, and only ever grant revocable licenses to it.

More precisely, to collect any personally identifiable (PII) of an EU citizen, you need their consent. PII includes things like name and email, but also anything like an IP address that can be used to "unmask" a person. Consent must be freely given and can be withdrawn at any time. If requested by a citizen, you must turn over or delete any PII of the inquirer. You must do your best to keep the PII safe, and follow security best practices - and in case of a data breach you must inform the data authorities and affected citizens. You may only ever hand over data to other companies (sub processors) if you have a contract guaranteeing that they will also abide by the above constraints (nice little GPL-esque twist there).

I hate the barrage of popups from websites trying to weasel out of it in order to continue business as usual with ad-tracking. But at its core, the GDPR is actually a pretty good piece of legislation - we now have a right to be forgotten anywhere.

Except on any servers entirely out of EU control. China and Israel for instance, have flatly refused to comply with GDPR and furthermore refute any claimed authority the EU has over anyone or any servers residing in their respective nations. I know I refuse to comply with my small US customer-only physical data storage company even though I regularly get visitors from the EU on my company site (And my site says I specifically only serve US customers mainly because I refuse as an owner to deal with the bullshit surrounding the storage and shipping of encrypted tapes and drives full of data belonging to other people outside of the USA).

Part of the problem with the GDPR is that although many people believe that what you wrote is roughly what the GDPR says and although much of what you wrote is probably more true than not, almost nothing there is strictly correct and in a few places it is wildly misleading. It's not just about collection of data but also about how you process it. Consent is only one of several possible lawful bases for processing, and in practice it's one that many experts have advised against relying on any more than necessary. The right to erasure is actually quite limited in scope. There are multiple mechanisms by which data may be legally shared with other parties, and there's a whole controller/processor system you haven't touched on in relation to that. There are grey areas and ambiguities all over the place, and there are widespread misunderstandings even on points where the GDPR itself is reasonably clear, not helped by media reports often getting the facts wrong themselves around two years ago.

Reply on news.ycombinator.com