TBH I'm glad companies stay away from my data if they don't know how to get consent, store data securely, or even what those things mean.
Words like “reasonable” and “legitimate” in the law are not something it is safe for a layperson to reason about. They have specific meanings depending on the nuances of case law, judicial understanding of legislative intent, ideological leanings of the judge you happen to draw, etc.
No company is competent at this, some just have enough money at stake and enough to spend on lawyers that they’re willing to risk it.
Because GDPR allows for liquidating fines, even for Google. I believe it has a cap of 2% annual global turnover, per infraction, or something similar.
Problem is, GDPR is not enforced. I haven't heard of small companies being investigated, let alone having any fines imposed, even when blatantly violating GDPR.
An email address is considered PII, so if users request their data be deleted, the small business is honest and says they can’t, and the user and others raise this to the government, you think that small company won’t be fined? That company, worried about doing things illegally, may end up giving a bunch of money to a contractor to fix their application- and for what? To allow users to request that their email address be anonymized or removed? That’s stupid.
If you know how to get a company fined, could you please share, so I can report and have action taken against companies that violate and misuse personal data?
I’m sure that’ll go over well.
Then maybe you can submit an Ask HN to see how many startups will self-report to you.
There are over 26M small businesses in the EU. You’d better get started...
By the way, GDPR isn’t just about misuse of PII, it’s about use of PII after it’s been asked to have been removed; and most sites use email addresses as usernames which are PII, so that’s all over the application logs, comments, etc. and when people submit a PII removal request, you can’t share or store the PII in the request itself, so better not use Slack, email, etc. and accidentally refer to the PII to be removed. If you do and need to follow-up again with clean-up, don’t refer to it then either, or you could get stuck in a endless loop of PII removal. Also, how do you know you removed the PII of the user who didn’t specify all of it I’m the removal request? You ask them for it- but does that allow the PII they sent at that point to be kept? I don’t know!you know why? Because it’s not fucking defined in the law clearly enough. What if they requested removal of data that wasn’t their PII?
The law is not like code. Thank god.
I really don't get the fear mongering over this.
Where are the examples of companies following the spirit of it getting punished regardless?
The law is clear that enforcement is primarily done via helping companies correct mistakes, not immediately handing out fines, and that's what has been happening.
And that's if you can get said legal minds to take a firm position in the first place, instead of the more usual five - six figure "maybe"
It's very much more healthy (and lawful) than just mucking on, stuffing data into limitless digital vaults and then not having a clue when all that data gets leaked.
In the good old days, paper records had the good manners to take up physical space. It was clear when you had too many records because it was a serious inconvenience to your business.
That to me sounds like they're most likely to sell the data, since they don't know how to use it themselves. Better these companies have less data, not more.
(b) many people make the disagree button small, hard to see, or require clicking through multiple screens to get to
GDPR really should have dictated "agree" and "disagree" be of equal visual weight and button styling and dictated disagreeing to be a 1-click action.
I'm pretty sure that everyone doing our (b) is not compliant at all. The problem is that GDPR isn't being enforced very well.
It does mandate something to that effect: the user should not have to spend more effort to disagree than to agree.
Purely anecdote, but zero companies I know in Germany, Italy or France are doing this. (The ones in Switzerland are.)
There is a cosmetic fix that produces an email so there is something to show a regulator if they come knocking. The logic being investing anything more than that is a crap shoot, given nobody knows how each of the EU’s 28 data regulators will interpret the rules.
But from what I have seen, most of that time was spent on the legal and policy site, not on actually implementing the technical changes required to properly handle, store and delete data.
I can absolutely guarantee you that the overwhelming majority EU companies could not properly carry out a GDPR deletion request.
In France in particular the right to access/change/delete any and all data a company has on you was there long before GDPR (by decades) so most serious company are well used and prepped for it.
They range from start-ups to national champions, but I won't disagree with you on the poor organization of most European companies point. Everyone one re-papered existing systems to some degree of compliance. Given nobody agrees on what full compliance is, they're all right in their own ways.
With Blizzard it went a bit different. They do have online automated tool to download your own data, but with a twist: they refused to provide what they consider security risk information. They did provide a lot of data (even years old chat logs) but did not provide the information I was looking for: list of processes running on my PC, which they scan periodically, as an anti-cheating mechanism. I went further and filed a GDPR infringement complaint to the national office but it failed. Last option was to sue, but I gave up.
Both Epic and Blizzard are US based.
The GDPR applies to all processing of all personal data regardless of whether that's pieces of paper in a filing cabinet or an entirely online social network.
Insurance? Private doctor? Youth services? Family (or any other) court? Pharmacy (in most of Europe)? Police (even in the most trivial of cases, and without judicial approval, and of course without verification or recourse)
Worse than that: the exception goes further than merely keeping data as well. Insurance company wants to change/add to your medical record? Immediately? Doctor? Court? Police? All can change your medical file, both adding and deleting (sometimes limited to what they added themselves). YOU want to change it? Not possible!
Weird since insurance company access to your data, and "the right to be forgotten" was one of the main selling points of this legislation, but since insurance companies are semi-government in almost all of Europe these days, a lot of them fall into the blanket exception.
And of course, you yourself ... cannot access this data. You cannot see it (sorry "you can, unless there's a reason not to let you see it", wanna bet there's always a reason?). For particular parts (espectially names, for example which doctor put something there about you are kept secret from you). Thankfully these institutions hate eachother, so there is some protection left because if anyone wants this data, they have to file requests in 5 different places. But there is no more legal protection against this happening.
It is now far easier, in the Netherlands, to get a serious crime stricken off your judicial record than, say, getting a doctor or pharmacist's claim that you falsely came in for a heart problem out of your medical file, say to threaten or attack them for painkillers, or even just getting the name of which doctor put that there (and of course such misleading information can kill you if you ever really do have a heart problem, and god help you if you need pain killers or ...)
GPDR protects you from Amazon offering you gift ideas for your kids' birthday if you object to that. You want a mental health stay 40 years ago to not be used in a family court case against you? THAT it makes MUCH easier. Faking such a thing and using it in a court case against you, that, too, it makes a lot easier.
https://ico.org.uk/for-organisations/guide-to-data-protectio...
As for the "you can't get data removed or even access it", here's some specific examples:
https://ico.org.uk/for-organisations/guide-to-data-protectio...
https://ico.org.uk/for-organisations/guide-to-data-protectio...
Like everywhere else, medical and "social work" data (and keep in mind that both the medical and social workers can lock people up for extended periods of time, even in isolation. Extended means decades, even until death, and that under circumstances that are justified using records on which that applies. You can't access, remove or change that data, but it can (and is in practice) used to lock you away legally indefinitely)
Insurance:
https://ico.org.uk/for-organisations/guide-to-data-protectio... (NHS is the insurer in Scotland. Essentially, ANY data that can be used for legal purposes (whether to sue you or to defend itself or any decision it made) is exempt from GPDR. No matter how personal the data. Technically this may even cover publishing such data.
I realize this is for one specific part of Europe, but there are analogues everywhere. And, frankly, look at the size of that list. It's only the beginning, on the left, click open, "right to X" and there's yet another list of exemptions.
As an example, let's say I want to launch a blogging platform. You need some basic tables (data) like User, Posts, Tags, etc. I'd consider this data the business needs for core business. Does there need to be some GDPR compliance thing?
Anecdotally a dumb app I built I was worried about EU visitors and just wanted to block them instead of figure it out (yea yea maybe that's not the right approach but I'm sure the sentiment is common).
Sounds like you have to learn something before starting a business.
We all really enjoyed the days when we could throw together a project and focus on the fun parts. Then came all of the other things we should worry about -- security and scaling, which are at least technical problems, but then things like privacy, moderation, and even legality.
It's fun to put up a file-sharing service; it's less fun to think about the fact that it can be used to share child porn. It's fun to have a new chat site with no filters. It's less fun when people use it to plan crime.
We don't want to face that. We want to make it Not Our Problem. And here, now privacy is another one. We used to just gather up user data and we didn't plan to sell it or lose it so why did we care?
The Internet is a lot less fun than it used to be. Or rather, we just managed to ignore a lot of the problems, usually because we weren't the ones affected by them. And so we didn't fix them ourselves, so laws got passed instead, which are never as good as what we'd have come up with ourselves.
So yeah, it's time for people to learn stuff before starting a business. That's no fun. Too bad.
It wasn't always like this, but it is now and for very good reasons.
Yes. GDPR is about data protection. If you want to do business in its jurisdiction, then you need to know the laws.
In general, GDPR states that you cannot store anything that isn't strictly necessary, unless you outline what you want to collect and what it will be used for in your data policies. You are not allowed to use it for anything else and once its no longer needed for the outlined use, it must be removed. Personally identifiable information has some additional rules (and its important to note that anything could become PII if combined with something else, that would, together, allow for someone to be identified).
My own (EU-based) country's data protection websites states:
1. Everyone has the right to the protection of personal data concerning him or her.
2. Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned, or some other legitimate basis laid down by law.
3. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified.
4. Compliance with these rules shall be subject to control by an independent authority.
This means that every individual is entitled to have their personal information protected, used in a fair and legal way, and made available to them when they ask for a copy. If an individual feels that their personal information is wrong, they are entitled to ask for that information to be corrected.
Spirit of the law is great. Implementation and end result is a typical bureaucracy mess, with not much benefit for end user, that functions mostly as a way for government to have a leverage over companies for non-compliance, whenever they want to put pressure on them.
Which is why you NEVER comply: you get exemptions.
People focus mostly on the cookie popups, but forcing companies to delete data after the user stopped using the service for too long, or even giving a legal stand on users requesting their data to be deleted wouldn’t have happened any other way I think.
In a lot of european countries GDPR came on top of other existing customer protection, but it helped make companies think about compliance as needed for continued business, instead of something akin to properly filing random local paperwork.
In the short term it may sound great that a lot of companies are erring on the side of caution and not using the data, when perhaps they could.
But if there's no enforcement this gives a huge competitive advantage to companies who just don't care at all. They might crowd out the former set. If such companies were not erring on the side of caution, and using some data in a natural way like they used to rather than avoiding it like the plague, they may provide competitive pressure against this dishonest set.
It is a lot like paying taxes. If I am an honest small business owner who pays my taxes but my competitors in the field are known for underhanded cash schemes that dodge tax, I'm not going to last long. I need the law to go after them or I'm done unless I start playing the same game. After dabbling in a small business compliance can be a real killer and it's my honest opinion a lot of people just play it dumb except where they know it matters, and hope for the best.
The law itself says that the default option should be to opt-out. Any site that doesn't have precisely equally prominent "agree to all" and "deny all" buttons violate the GDPR.
The problem seems to be in the complete lack of enforcement.
Konqueror even had "confirm cookies" as default for a while back then.
If a model box only has "I consent" and "Learn more" buttons, then I don't consider clicking on "I consent" to mean freely given GDPR consent. Since it's the only reasonable way of viewing the website, and the GDPR doesn't permit a consent-wall, it's non-consent, and any use of my personal data following that event remains illegal.
It's not a problem with the GDPR; it's a problem with the ICO failing to put a stop to this.
That way I never gave any consent.
Nowadays I have browser plugins that do that for me, but same idea.
In any case I block cookies on all sites except for a few whitelisted ones so big "ha" to them if they think they can cookie me up. "Functional cookies" my ass. The sites work just fine without them.
Obviously, it comes from the user's machine so it can be modified before being sent to the server. Unless you're doing something custom/fancy like signing that data you shouldn't trust that it hasn't been tampered with.
Well that seems untrue, as someone that regularly either outright declines, or goes through and chooses "functional only".
I do occasionally see websites that say "we no longer serve the european market". That's a shame but it's up to them.
GDPR regulates, among other things, how information is stored and deleted on servers. I have worked at multiple companies in both Europe and the US who take this very seriously and has definitely altered their practices based on this.
For example, pre-GDPR, we would "mark as deleted" but not delete. Now we delete.
GDPR covers way more requirements regarding data management. You need complete control over the lifecycle of sensitive data, exhaustive documentation of data transformations, you have concrete obligations regarding disclosure of incidents, data removal, limitations of for what data is used, user consent management, and the obligation to have people personally liable (which is big, just look at AML regulations to see the effect when not only the fuzzy concept of "the company" is liable).
I don't know if that was the case before gdrp but we have to centraly clarify if and when we store user data, what we do with it and we have to show that we can delete user data if requested.
Not sure how far small companies go through this thow.
I know of small companies that before GDPR didn't really consider the implications of private data at all. They'd just let their SQL databases grow forever (mark as delete and have "script to actually delete the data" as a TODO that never happened), had random backups lying around on dev machines.
GDPR forced them to actual define policy, start deleting old data that was no longer relevant, strip private data from developer test sets.
It was a bit more work, and adds a small bit of friction, but these are still important things!
Forcing cooks in restaurants to wash their hands after using the bathroom also adds friction to the process but is similarly important.
That is the theory. The reality is that many small businesses don't even know the GDPR exists. Others are not complying because they think they will get away with it, and they are probably right. The rules are so ambiguous in some important ways that even those who do intend to comply might not actually be compliant and won't find out until a regulator intervenes. And all of that together means that a small business that does try hard and become compliant is at a significant competitive disadvantage.
To be clear, I am a firm believer in strong privacy protections, and my own businesses seek to be in the latter category. But the GDPR is flawed in important ways, and future regulation deviating from it is not necessarily a bad thing. Obviously it depends on whether the deviation is of the selling-out or the fixing-problems variety. Though admittedly, with the current UK government, I fear the former is much more likely.
As another example, there is a new subject right to erasure of their data, though again this isn't absolute. Several potential complications were discussed about this right. One is how to handle copies of that data in back-ups, archives or retired equipment. Another is how to deal with data held in deliberately tamper-proof formats, some of which will already have existed before this right to erasure was introduced by the GDPR.
Another important way is the compliance costs, and in particular the disproportionate costs to small businesses. For example, it cost mine many hours and thousands of pounds to understand the new requirements, take advice, and update our documentation to be compliant, yet the actual data processing we did was always very light and so wasn't affected much by the new rules either. In other words, it cost us a significant amount of time and money without really benefitting anyone.
Related to that is the enforcement mechanism and penalty regime. Regulators are all-powerful, and again, while they can impose some heavy fines on big businesses, those are meaningfully capped. In contrast, the rules allow them to impose penalties high enough to literally destroy any SME. The practical safeguards are the limited resources of regulators and the idea that those regulators are supposed to work collaboratively with data controllers and impose proportionate penalties for any compliance violations that can't be resolved, but this is awfully close to relying on personal judgement and good will, not what is actually written in law.
Then there is the reality that the GDPR doesn't actually do that much to protect against some of the biggest threats to personal privacy. For example, I would argue that two of the biggest risks in our modern "big data" world are excessive collection and processing of personal data supplied by third parties and excessive collection and processing of data by governments. The GDPR has done very little to curb either of those things. Every time I go out, I'm still potentially being listened to or photographed by countless other people's devices, which may then be uploading that data to big tech firms along with time and place information. Countless people have probably handed over my phone number or email address to big tech firms by allowing apps to scan their address book. We still see ever more intrusive monitoring of normal people's daily lives by governments, with tech like facial recognition cameras or mass surveillance of communications routinely infringing on personal privacy, and the authorities pushing for these things are entirely unrepentant and rely on the usual vague justifications about security and what a dangerous world we live in.
In short, the GDPR imposes significant burdens on data controllers without being clear about what their obligations or how to interpret key details in practice, introduces a penalty regime that hangs like a sword of Damocles over data controllers and represents an existential threat to smaller controllers, and yet at the same time hasn't actually been very effective at reducing the big risks to data subjects or increasing their control over how data about them is used and by whom.
None of these concerns is new. All were discussed extensively around the time the GDPR was introduced. But, perhaps because it was a law meant to improve individual privacy and that's a cause many of us support in principle, sometimes people get very defensive of it instead of looking at it critically and asking whether it actually achieves what it set out to do and whether any costs it introduces are proportionate to any benefits it offers.
Being filmed in public, having your data handed to third-parties, facial recognition and mass surveillance are precisely some of the issues the GDPR has addressed, and it has already had massive impact; especially on tech companies (I’ve seen it firsthand). You talk about burdens but maybe you’re just angry you wasted money on a consultant? I honestly haven’t seen the bad side of it.
We didn't hire a consultant. Those guys were charging thousands per day, and no business our size has that kind of money to spend. We did take real legal advice from a real lawyer, but the main cost was our time understanding the new rules and updating things to be seen to be compliant. I am irritated that a lot of my own time, as a founder and at that time lead technical person for a business, was wasted on a bureaucratic exercise, and likewise for other key people. That hurt us, and once again, it benefitted no-one. Not our customers. Not our staff. Not our suppliers. Literally no-one was better off because, for example, we rewrote our documents to provide information in some new format that was specified by the GDPR.
Personal irritation aside, even if you just took the cost to us and scaled it by the number of businesses in the country to estimate the economic impact, that would mean billions in lost productivity as a result of the new rules. And that's clearly an underestimate, as the costs were running into millions for a lot of large organisations. A law that is going to cause that kind of economic hit should be justified by a greater benefit to society in some way, but I just don't see that "massive impact" you mentioned. There have been a few incremental changes here and there, but there hasn't been a big change in culture.
The attitude at bigger organisations is still often about how they can tick the required boxes while continuing to do what they want with the data. Just look at Facebook's resistance to even disclosing what personal data it has and how it's been using it, for example, despite data subjects having a clear right to that information under the GDPR.
Tracking is still going on everywhere, and if anything it's getting worse as the technological capabilities increase. Ironically, it's recent actions by Apple, not the GDPR, that have started to make some significant improvements in this area for users on their platform.
Small organisations are still often ignorant of their obligations under the GDPR and not compliant anyway. Governments are still encroaching further into individual privacy all the time. Individual privacy hasn't been improved at all in these kinds of situations.
This will be my last comment on this thread, because HN tends to downvote any comments critical of the GDPR, even if based on direct personal experience of implementing it, and that doesn't encourage open and constructive discussion. But I hope the above helps to explain why I have reached a different conclusion about these issues to you.
“Storing data securely” and “getting consent” are both wildly different from full compliance with the onerous requirements of GDPR. You can do both of these things in absolute good faith and still be in violation. Unless you have a team of legal scholars working for you, odds are that you are in violation of at least one provision of this massive, unwieldy legislation - no matter how respective of user privacy you are.
That is why the UK is abandoning it. GDPR, as written, is a business-killing mess.
GDPR has been in place for years, which businesses has it killed?
Do you have an example of a company that you consider was not doing anything wrong in your personal opinion but still got a GDPR fine?