Comment by kodablah | Hacker News Reader

Comment by kodablah | Hacker News Reader

> Time will tell how effective the GDPR is going to be [...] Nevertheless, we should acknowledge the fact that EU law has got many of the foundational principles around data protection right.

This post accidentally explains many Americans' issues with the GDPR. By focusing on intent and idealism to buttress justifications for the law's presence, proponents use righteousness as an excuse for heavy government interference. Almost everyone agrees with the ideals of data privacy. But recognizing reality, some advocate for not asking clearly ineffective institutions to police such things since often said technology laws and policing tend to hurt more than help. They also give a mandate for more government intrusion in technology (e.g. welcoming GDPR tacitly encourages the copyright directive) as policy makers can't help themselves. Rather, more measured approaches like education, consumer awareness, encouragement of alternatives, transparency requirements, and enforcement of existing statutes (fraud, personal info, etc) are leaped over.

Tech that people willingly trade info for (and arguably would do so regardless of awareness) is not analogous to food ingredients or medicine. You can't legislate every harm out of existence, and this is the fundamental difference in the two sides. One side is concerned with government oversight in these matters and where it leads, the other is not. Usually we'd say to each their own, yet we communicate on a global medium, so ideally we'd lean towards fewer restrictions (especially if you consider the legislative implementers on the American side).

The way the EU usually works is that they say "we are concerned about X, Y and Z's effect on our citizens" to industry, and industry responds "we'll self-regulate to ensure X, Y and Z do not have the effect you're concerned about". If self-regulation doesn't work out, a directive is passed.

Industry, in this case, didn't even try to self-regulate, so a series of directives with gradually more teeth were passed over the last 20-odd years.

> If self-regulation doesn't work out, a directive is passed.

We can do better! Public education campaigns and support for alternatives for starters. The "they didn't fix the issues, so new laws will fix their issues" is myopic at the least, and potentially harmful if it doesn't fix the issues either.

A significant part of the GDPR - and in fact the bit most software people complain about - is forcing the companies in question to educate the public on what their data is being used for.

That's not a reasonable approach to public awareness IMO. "Forcing" these private companies to do this and that is only going to result in it being done in the least meaningful way possible. It doesn't matter whether it's the DPD, the EU cookie law, or the GDPR. So much deja vu...

That's ok - if the company can't convince the user that it'd be good for them to opt in to all 200 "partners" they'd like to share data with, the user can click the big shiny "fuck off" button that's required to be there. It's not there, or not obvious? That's a GDPR violation.

What's myopic is expecting people to "do better" when they make more money (or even think they'll make more money) by doing worse.

Nobody expects that. It has become unfortunate that if you are not in favor for the GDPR as implemented, you must be against its principles and in favor of privacy-violating companies.

Public education campaigns don't work when the people they are educating have no power in a problematic relationship.

You can educate me about green energy all you want, but if all the power providers I can switch to are burning coal, you're just wasting your time and money.

Passing laws is the opposite of myopic behaviour. To put it bluntly - theft is outlawed, not something we discourage solely through, uh, education campaigns.

There was 20 years of that. 20 YEARS

Actually more than that, but I'm just using one of the shorter timelines involved.

So if the rather hands-off approach didn't work, campaigns didn't work, capitalism didn't work because it was always on the side of violating privacy? Well there comes the hammer.

> The way the EU usually works is that they say "we are concerned about X, Y and Z's effect on our citizens" to industry, and industry responds "we'll self-regulate to ensure X, Y and Z do not have the effect you're concerned about".

The problem in this context is identifying adtech as the industry rather than the adversary. It's like identifying a problem with spam and then asking the spammers to self-regulate. It's misapprehending the nature of the problem.

So then you say the spammers wouldn't self-regulate by not spamming so we're going to regulate email. Everybody hire a lawyer if you want to use email. And then the spammers still give you the finger because the internet spans the globe and they just set up in countries that won't enforce your rules, and the rules increase costs on everybody else.

What we need here are technical solutions. Browsers that resist tracking and fingerprinting. Technology to resist correlation attacks. The dissolution of unitary identity systems. More software that runs on your machine and not the adversary's machine. Make tracking too hard and there is no more tracking industry.

The thing most needed there is funding. There is profit in tracking and not so much profit in anti-tracking, so if you want anti-tracking then provide money for it. And for goodness sake stop passing laws against anti-tracking measures.

I'll point out that the EU Government has poured an incredible amount of money into the problem of "privacy and enhancing trust" and related topics - if you're in the EU, even as an individual developer you can likely get some of that money through NLNet. Unfortunately it's a hard problem and the other side has a lot of money too.

> Rather, more measured approaches like education, consumer awareness, encouragement of alternatives, transparency requirements, and enforcement of existing statutes (fraud, personal info, etc) are leaped over.

More measured approaches were tried and didn't work. Previous national laws and EU regulations were less intrusive, which didn't help anyone, the industry still complained back then and consumers were under a far worse protection. The ship for the industry to propose soft non-measures like education and volontary limitations has long sailed. Tech botched it so hard that the EU, usually unable to find any firm stance on anything, got its act together and created GDPR. Which, at the time, even surprised privacy advocates...

I'm not convinced public awareness campaigns and various support for alternatives were reasonably tried. Also, the firmness of one's stance isn't in its words.

> Rather, more measured approaches like education, consumer awareness, encouragement of alternatives, transparency requirements, and enforcement of existing statutes (fraud, personal info, etc) are leaped over.

The GDPR didn't come out of nowhere. There is a whole slew of prior legislation, of course (the Data Protection Directive is from the 90s, for instance), which was generally ignored by big players because it was fairly toothless (fines typically at most in the hundreds of thousands, etc). The industry had a _lot_ of warning, over three decades, that it would be regulated if it didn't improve things. It really has only itself to blame.

To tailor the argument for the audience, please stop bringing me tweaks on this same flawed implementation that is only adding complexity and bugs to the system while not even fixing the majority of original problems. I don't care what the Jira issue comment said this would do or what the PR issue said it would do, I am telling you how it is performing in production, how the last version of the same approach performed in production, and am asking for re-thinking the approach.

What you're saying is that somehow we should have continued doing things that didn't work at all, whereas GDPR actually got companies to care at least a little (seeing from both inside and outside). Yet you insist that instead of doing anything, we should think of the big pie in the sky and continue doing the same not-working alternatives.

Your argument would be more pervasive if it had any examples.

> You can't legislate every harm out of existence

Says country with highest murder rate among developed nations. (Ok, so not a fair comparison but the political argument is the same).

If there is anything US tech companies have shown us it is that the industry or consumers cannot handle data protection and privacy by themselves. There needs to be a good set of legislation to ensure it. Sure GDPR is a bit invasive and detailed in some areas - but the general idea and the way it works is good. To limit data collection, sharing and processing with rules is good. Unfortunately there are a few shortcomings to the law such as requirement to be explicit and notify about suppliers for data processors, documentation and deletion policies.

> Rather, more measured approaches like education, consumer awareness, encouragement of alternatives, transparency requirements, and enforcement of existing statutes (fraud, personal info, etc) are leaped over.

I can assure you that nothing has done more to educate consumers about data privacy than GDPR. Partly by media focus, but mainly by showing consumers what data they give away to companies by making this explicit. Regarding fraud it also has a positive impact as GDPR specifically requires encryption and other security measures. Companies might have not bothered to fix this before, but with GDPR fines of up to 4% of revenue they surely have.

> Ok, so not a fair comparison but the political argument is the same

It's not. We have to avoid these analogies, because for every legislative success one can point to, there is a failure one can point to. For every positive national statistic one can point to, there is a negative statistic one can point to.

> the industry or consumers cannot handle data protection and privacy by themselves

While true, that doesn't always imply extreme measures.

> but the general idea and the way it works is good

Most people agree with the ideals. I argue the way it works is not good, neither as codified nor as implemented. For example, transparency requirements can have value. But such a large unenforced (or worse, selectively enforced) collection of requirements is only adding complexity to the system while providing only negligible benefit.

> I can assure you that nothing has done more to educate consumers about data privacy than GDPR

Exactly. If the only tool you use is a hammer, it's going to also be the most effective regardless if it's the best tool.

> I argue the way it works is not good, neither as codified nor as implemented.

Do you have any proper arguments at all or are you just holding on to your ideology? I'm guessing you do not really know the details of GDPR since you haven't mentioned a single example or specific argument what is a problem in all the text you wrote in multiple comments.

> It's not. Actually it is.

+1. I was against GDPR explicitly because it was obvious something like the Copyright Directive would be next and now the EU is literally ending online freedom of speech.

Reply on news.ycombinator.com