Hacker News Reader

Comment by olieidel | Hacker News Reader

Having stricter data privacy regulation in the EU is good.

But I'm getting the impression that the authorities prefer to look into local companies where "easy wins" can be had - like in this article.

Let's get this straight: I think the video surveillance here was not okay.

But - shouldn't the authorities rather pursue things which matter more, i.e. maximising the impact of (number of humans affected * magnitude of effect)? The WhatsApp <> Facebook data sharing situation comes to mind. Or the recent change of their privacy policy.

There's lots more. I feel that big (SV) tech companies have much more leeway than local companies, simply because their probability of being fined is lower.

View on HN

And on every headline about an SV company being investigated there are complaints that they are unfairly targeting them and not do enough about local companies.

Big companies are investigated, but a) for more nebulous cases the processes take longer, b) rules to avoid parallel investigations in many places also apply to the tech companies, which takes time for international coordination and somewhat restricts local agencies from acting against them (which is a bit of a loophole, or at least delays it further - see the various Schrems cases against Ireland), c) Whatsapp/Facebook have backed off from some things in Europe already due to previous investigations and agreements around the aquisition.

Pretty much everyhwere, the privacy agencies are working on extremely limited resources, and can not address everything at once. (Yes, this is a problem)

AFAICT the WA <> FB data sharing will not happen to the users in the EU.

Source: https://www.forbes.com/sites/carlypage/2021/01/08/whatsapp-t... says "In a statement given to Forbes, a WhatsApp spokesperson confirmed that there will be no changes to WhatsApp’s data-sharing practices in Europe and the UK."

which makes it even worse looking for rest of the world.

If it is indeed not harmful like Facebook is claiming to be by pushing WhatsApp status updates, they can choose to do it in EU also.

What do you mean? Laws are different in Europe. "Harm" isn't the question, policy is.

Soooo, what you're saying is that I need to pipe all of my WA traffic through a TOR exit node?

I wonder how Facebook treats traffic coming through its TOR address.

https://en.wikipedia.org/wiki/Facebookcorewwwi.onion

I don't think they're not doing both. Also, the probability of getting fined might be lower, but when Facebook gets fined it won't be for 12.7 million.

At least in case of Germany, the article presents their approach:

"Germany’s federal and regional data protection authorities have been keen to focus on steering organizations away from “common” privacy violations under the GDPR—such as video monitoring, cold-calling, etc.—rather than pursuing record fines. Regulators feel such an approach creates a greater understanding of what privacy means and how the GDPR impacts people and work on a day-to-day basis."

I imagine similar thinking applies in other EU countries. Though I sure wish they'd deal with the telemarketers and websites with GDPR-non-compliant GDPR forms already!

There is a long history of EU institutions fining Facebook, Google and the like.

Could the punishment be more swift, more consistent and hurt more? Sure! But they are definitely not turning a blind eye either.

It is in the article. These are not corrective actions but preventive. Teaching other companies.

The problem is that if you only fine the big tech companies, the small companies will just don't bother with the GDPR. What we need is more people working on GDPR cases.

Reply on news.ycombinator.com