Hacker News Reader

Comment by thegrimmest | Hacker News Reader

Am I the only one who thinks this is all a bit mental? Say you have a (real, physical) business. And say you have some customers who are regulars. You can use your eyes to see what your customers frequently buy/engage with and your brain to remember. You can also use a notepad to write things down. This is commonplace - "The usual today John?".

Now say John travels to another town, and the proprietor of a similar establishment in that town, wanting to provide John with the best level of service, calls you to ask "Hey, what does John like?", and you tell them.

Now we just supplement your eyes and notepad with technology, and replace phone calls with packet exchanges. What has changed exactly? Don't you have a right to record who transacts with you? Isn't that information yours, to do with as you please? Can "John" command us to forget we ever saw him? Where in this sequence are anyone's rights violated? How is any of this reasonable?

View on HN

> Now say John travels to another town, and the proprietor of a similar establishment in that town, wanting to provide John with the best level of service, calls you to ask "Hey, what does John like?", and you tell them.

That was already way too invasive, yes. You could probably get away with it before, because the scale was so small that it wasn't quite as horrible. There is after all a difference between occasionally violating one person's privacy and violating the privacy of thousands of people a minute. Not an actual ethical difference, but there are finite legal resources to go around.

Also, I object to this idea that because the pieces of behavior are acceptable the combined effect is automatically okay. It's perfectly legal to own and use a camera. It's perfectly legal to own an use a telephoto lens. It's even legal to look at your neighbor's house. Nonetheless, taking a camera and pointing it through a telephoto lens at a neighbor's house and recording 24/7 is an excellent way to get arrested.

All of what we're discussing is within the realm of decency, not law. Yes it's impolite to gossip about people, always has been. It's however tyrannical and totally inappropriate to legislate decency.

If the gossip was scaled up enough you might have laws created around it (actually some jurisdictions have anti-libel laws which is basically equivalent to gossip). We don't currently attempt to legislate decency because in most cases the system self-regulates, just like it used to do with the shopkeeper & fungus cream scenario mentioned in another comment. Then technology came along and increased the possibility of information sharing (and potential harm) by orders of magnitude, and once it's been determined that the system no longer self-regulated laws such as the GDPR were drafted.

well online-mob-cancellations fuelled by social media are exactly what scaled up gossip leads to. so we are already there and it's about time that something is being done about that.

It’s not tyrannical, unless the very existence of laws is tyranny. Law is the legislation of decency. Any other kind of law we call “unjust”.

"decency" is not definable, that's why it's tyrannical to legislate about it. Laws serve to establish a framework merely for peaceful coexistence. To use them to try to make everyone decent is surgery with a sledgehammer.

Right, and that's why we have GDPR consent and legitimate interests and all those other terms to come to something that is legally definable.

All of those things are basically religious terms to me. Some people subscribe to the religion that they have a "right to be forgotten" or a "right to their data". I don't subscribe to this religion, I want out.

You can lobby for the law to be changed. Don't be surprised you can't get a critical mass for "Yes, I'd like businesses to be able to track me".

You could just as equally declare copyright law or property law to be a religion and insist you don't want to subscribe to it, but society as a whole does, and so if you want to participate you just have to lump it.

What if the laws were the other way, and business were being mandated to track everything they can about the people they interact with? How would this tyranny be different from the one existing currently? Just because the majority decides something, that doesn't mean it's not tyrannical. People should be free to peacefully interact with each other as they individually see fit. Some people may track, some may choose not to, advertise that fact. Any picking of sides is totally arbitrary and therefore unjust.

Is it not tyrannical to prevent you from selling copies of Lord of the Rings without paying the author by that same logic?

If the majority of society was in favour of tracking everything then the opponents of that would have the same options of lobbying to change people's minds. As seen in the difference between end user reactions to GDPR vs ACTA, that seems like it would be much easier.

Yes? Copyright law was widely regarded as tyrannical when first introduced. Anything to which violence is an inappropriate response should not be legislated.

Why is violence an inappropriate response to someone threatening your livelihood by violating your copyright?

Because once you've told something to someone it's not yours anymore? Sure you can sign an agreement, but the consequences of violating it are civil, not criminal.

The European union has evolved from the European Economic Union, and they are generally pretty pro-business and pro-freedom.

One thing you want to keep an eye on that is actually harmful to business (and economic freedom) is if some part of the economy gets caught up in a race-to-the-bottom. This is a situation where everyone's best move is to defect, and then defect again, all the way down until no one is free/making a profit/happy/etc anymore.

In this case there is a clear race to the bottom situation where everyone ends up having to track everything about everyone, just to keep up with the competition. As this would be pretty much truly be a panopticon-like tyranny by any other name, that's clearly not desirable.

In this case the EU is trying to make legislation that stops the race from going all the way down, by leveling the playing field so that everyone can conveniently say "see, we can't go further because it's actually illegal now".

So the net (long-term) freedom is actually increased by this measure.

During WWII in Europe, numerous people in occupied territories learned that it is very important to be able to retain your privacy and ensure people don't learn too much about you. While people of Jewish ancestry are often taken as the canonical example, many other groups of people and individuals learned that "I have nothing to hide" is most definitely never true.

Would it surprise you that it is in fact Germany that now has very strong privacy protections these days?

Do you have opinions about different laws? That some are arbitrary and unjust, whereas others are good? How do you form these opinions?

By whether these laws enforce negative rights or positive ones. You should have a right to do whatever you want as long as you're not directly interfering with the rights of others to do the same. That's what it means to be free.

Is this demarcation a form of religion? Or can you demonstrate its objectivity?

The demarcation represents a minimum set of restrictions on behavior which fundamentally differentiate civilization from its opposite - namely the presupposition of peaceful coexistence. From there, there is no means to derive the degree of compulsion to cooperate, so better not at all.

Why is peaceful coexistence the supreme goal? What if my religion, in contrast with yours, holds out another goal as more important than that?

I'd actually challenge you to find a law in society that doesn't have some origin in vague decency - the legal framework built above decency is something we expect to be rather stable over the long term but, at a really basic level, we have a law to not murder people because we really don't appreciate it when people do it - not because there is some natural law inscribed in our DNA stating that murder must be a crime.

Laws conform with societal ethics and those ethics absolutely change over time and are never uniformly agreed to by all individuals.

Lastly - scale absolutely does matter when it comes to laws we want to enforce. We don't want to enforce a no-gossip law because the invasiveness of enforcement would be unbelievably deep, so decency is there to tell you that while you won't get arrested for doing a thing you should feel guilty about it - most members of society get equipped with this guilt during their upbringing and so criminally malicious gossip is a problem we mostly ignore at a societal level.

Laws are absolutely BS in their inherent nature and a construct of society that could easily shift radically with large political shifts - but that doesn't mean they're invalid.

We have laws not to murder people because the state assumes a monopoly on violence. In absence of retributive justice we did and do continue to murder each other in blood feuds that last generations. This is perfectly normal human behavior. The state is there merely to provide a framework in which people who hate each other can be expected to surrender their natural right to use violence.

To me that's where the right of one group (the government) to legitimately use force ends. The sledgehammer that is the legal system should only be used to administrate the peace.

Beyond that, the only concept that can really be impartially measured is liberty. How free are you? In the graph of all possible actions, which are legitimately available to you? Everything else is an attempt to define good or evil, or right and wrong, and is therefore some form of religion. In a world where we are all equal, have no oracle to discern good from evil, and disagree diametrically, the only reasonable thing to do is optimize for liberty, and let everyone figure it out for themselves.

Scale does matter, but not in regards to rights. If you have the right to do a thing, you have the right to do it a million times. If you have the right to write something down, you have the right to keep it in a database. If you can publish your letters, you can do so over HTTP as well. This isn't a new conversation. People have been publishing memoirs of their private correspondence since the printing press. What disturbs me is how we seem to be shifting our consensus that they have the right to do so.

The state needs not have a monopoly on violence. Dueling was outlawed in France in 1626, and early modern France was certainly a state. The dueling laws only became necessary because our mores on violence changed.

Early modern France was a monarchy, not a democracy and liberté, égalité, fraternité had yet to be uttered there.

> We have laws not to murder people because the state assumes a monopoly on violence.

This theory utterly fails to explain laws against murder from the millennia when there was no such thing as a state that claimed monopoly on violence. In the feudal system there was no such thing as a unified state entity, it was just a bunch of people invested with certain rights organised into nested hierarchy of fealty, no monopolies there, but still they had no problem ruling people guilty of committing murder.

> If you have the right to do a thing, you have the right to do it a million times.

You've never seen those signs that say you get only one free cup of coffee have you?

The source of legitimacy of feudal monarchies was divine right. This is not the case today. Our governments derive legitimacy from the consent of, and in defence of the liberty of, the governed. This is why I object to these laws. They only constrain my liberty to interact peacefully with other people, and I certainly don't recall consenting.

> You've never seen those signs that say you get only one free cup of coffee have you?

Indeed I've seen the signs. I would very much object to similar laws.

You are free to leave if the governed collectively have decided on laws you don't agree with, and they'll probably ask you to if you go on about your demand to be granted veto rights on all legislation.

As an aside, I'm slightly curious how you explain the legality of said sign using your absolutist libertarian framework.

Actually, never mind. I saw your other replies and it's clear you see epicycles as a badge of honour.

"free to leave" isn't really an excuse for tyranny is it?

The legality of the sign is derived from the fact that it's on private property, from which the owner has a right to expel anyone for any reason. Violating the rules of the sign is simply grounds for expulsion from said property, not criminal consequences. That's the difference between a rule and a law.

> If you have the right to do a thing, you have the right to do it a million times.

Voting is an obvious exception.

> monopoly on violence

So, you’re using Max Weber’s theory of the state in a contradictory way in my reading. Weber’s theory of the state as being the society which derives its authority from a legitimate monopoly on violence was contrasted _against_ the very “natural liberties” that you seem to espouse (e.g. the rights of peeping toms, the rights of private shopkeepers, and the limitation of the government). Either you argue that the legitimacy of the state stems from its legitimate monopoly on violence as a community (thus allowing it to dictate “decency” as you say) or you argue that the legitimacy of the state derives from the citizenry’s own natural rights to self governance and liberty.

I'm not strictly arguing for Weber. I'm basically proposing that beyond majority consensus, we have no way of determining that the peeping toms or the discriminatory shopkeepers are in the wrong. In combination with the problems of majority consensus (if a majority agree to murder a minority, is that okay?), the presupposition that we are all equal, and have a right to exist as and where we are, the only reasonable conclusion is to enforce the absolute minimum of law required to maintain the peaceful coexistence that differentiates civilization. This is doubly true in a multicultural society.

Decency works for managing personal behavior on a small scale, with an ultimate check of free association. Commercial surveillance invalidates both the assumption of scale and the ability to opt out.

In general it seems like you're just asserting that value judgements should be scale free, while ignoring qualitative criticisms.

You're right, I'm basically arguing that free people don't have value judgements imposed on them.

I'm sorry to break it to you, but you're really not. Commercial surveillance is exactly this imposition of value judgements onto people without their consent.

I myself am a libertarian. A government is merely a large corporation that is impractical to opt out of. Conversely, corporations that are impractical to opt out of constitute de facto government. Data protection laws like the GDPR attempt to constrain the power of corporations so they don't rise to that level, which ultimately constrains the amount of government.

A government is much more than a large corporation that is "impractical" to opt out of. They are the sole arbiter of legitimate force, and the sole entity that can govern your behavior in places you have a right to be. Corporations are perfectly practical to opt out of, as demonstrated by the many people who do. Find me one person who doesn't pay taxes and doesn't go to jail. I know plenty of people who don't interact with FAANG at all. Corporations will never rise to the legitimate use of force. If they do, they'll be governments.

> They are the sole arbiter of legitimate force, and the sole entity that can govern your behavior in places you have a right to be

This fully depends on what you include in your definitions.

Imagine this: A company owns a vast area of land. You agree to contract with this company in order to be on their land. This contract includes things like using physical force against you if you violate other terms spelled out in the contract (just as you can contract to have violence done to you at a BDSM club). The contract defines a technical term "right", the definition of which spells out some things you're positively allowed to do, and is somewhat harder to amend but not impossible. The terms allow you to sublease a bit of their land for your exclusive use. Your sole way to terminate this contract is to completely leave the company's land and pay off any balance you owe. Call this company USG and it is indistinguishable from the United States Government.

> Find me one person who doesn't pay taxes and doesn't go to jail

Most people who have under the table income and don't report it. Same as how it's often possible to get around breach of contract when your counterparty doesn't find out. Model vs reality. And note how similar the requirements for keeping your income unreported mirror the requirements for avoiding transitive association with a given corporation.

> I know plenty of people who don't interact with FAANG at all

1. There are likely still surveillance profiles being kept on them. 2. It's hard to believe said people use the web for anything, given the prevalence of Google Tag Manager and CAPTCHAs. 3. More entrenched than FAANG are Equifax and LexisNexis, which are even harder to distance yourself from. I'd say it's easier to renounce your citizenship of most countries than it is to avoid the worst of the surveillance companies.

> Corporations will never rise to the legitimate use of force

You keep using this word legitimate, which entirely depends on perspective. I would say that it is plainly illegitimate to throw someone in a cage for smoking a plant, and so calling government inherently legitimate is a bit dubious.

> Corporations will never rise to the legitimate use of force.

Jus because that's how things are now doesn't mean it has always been that way or always will be.

The earliest Corporations originally did use force and in fact at times maintained armies and /or navies.

> Corporations will never rise to the legitimate use of force. If they do, they'll be governments.

Corporations, as creatures of law, are an apparatus of government. And they’ve participate in the legitimate use of force from the very dawn of corporations as a thing.

Erm. Are there any laws that you're okay with, then? "Murder is bad", "People should get paid for the use of copyrighted works", Freedom of Speech, private property existing, the modern concept of a fair trial... every one of those is a value judgement.

It was a matter of decency first, but we're here talking about it because to varying degrees in varying jurisdictions it most certainly is law.

Yes, and I'm suggesting these laws are unjust because they impose the values of some segment of people on to others. Leave people to associate as they see fit. Some groups will track you, some won't. You can choose which to patronize, on which browsers.

Literally all laws “impose the values of some segment of people on to others”, so according to your criterion all laws are unjust. I guess that’s a form of anarchism, and you’re welcome to it. For me, it’s simply not an interesting way to think about justice and how society should be ordered, because it seems to be the end of a conversation, rather than the beginning.

No, some laws and some rights merely provide a framework for peaceful coexistence. See negative vs positive rights.

...your right to swing your arm leaves off where my right not to have my nose struck begins. -John B. Finch

Are laws against theft unjust because they criminalize nonviolent forms of theft?

Laws against theft are just because violence is a legitimate form of recourse against thieves. In order to surrender this right to violence, people need an alternative recourse. This furthers my point - since what we're talking about is basically gossip at scale, would you argue that violence is a legitimate form of recourse?

Why is violence is a legitimate form of recourse against thieves? Perhaps violence is so inherently evil that it is better to part with one’s property than to protect it with force.

No, you don’t have that right. If I buy toe fungus cream at your store you absolutely may not tell other shopkeepers about that. I can’t even get my head around a mentality that considers this behavior to be moral or even normal.

> If I buy toe fungus cream at your store you absolutely may not tell other shopkeepers about that

Why exactly? Which laws would I be violating if I did?

Well now you'd be violating the GDPR.

Before we didn't have these laws because this wasn't a problem in practice - nobody was calling other businesses at scale to tell them who was buying fungus cream. If they were, we would've had a law equivalent to the GDPR to prevent that.

Actually, there was one incident in the US where a politician's video rental history was disclosed against his wishes and as a result a law was drafted to prevent this practice in the future: https://en.wikipedia.org/wiki/Video_Privacy_Protection_Act

The laws of decency, respected by all decent people. Sure, keep a ledger of what I buy from you. But do not tell anyone else anything about me. I respect this principle in non-commercial life, and so do my friends. You are not exempt from the rules governing decency just because you sell things.

But on the other hand, if you had an interaction with the shopkeeper then wouldn't the same laws of decency prevent you from telling others about that encounter?

It depends what I tell. If the shopkeeper tells me that he recommends a particular brand of toe fungus cream because it works for him, I will never reveal his condition to others. But I might mention his hours of operation, or that he runs a good store, because that’s public information.

There are plenty of deals that you make with vendors/merchants that are given in confidence; a merchant may give you 50% off if you promise not to spread it around. Other than those occasions, "shopkeepers" not only want you to spread around that you shopped there, they actually depend on it and will often pay you to do it.

As a customer, I have no interest in you advertising for me, so it's not comparable. Any information that you spread around about me is likely to give other "shopkeepers" greater leverage over me (which is why vendors don't do this in the real world unless they have some sort of financial relationship with each other.)

I agree, but it has always been tyrannical to legislate decency. What next, fines for not saying "please" and "thank you"?

There’s s difference between being impolite and being indecent. We have peeping-Tom laws because it's beyond impolite to press your face against someone’s window and peer through the gap in her drapes. Are such laws tyranny? Most think not, because they are there to protect potential victims.

If someone can stand on public property and press their face against your window, they should have the perfect right to do so, for as long as they see fit.

So you think that the nearly ubiquitous peeping-Tom laws are unjust? You see no purpose to them?

Yes? Draw your curtains before you change? Anything you can see from a public space you have the right to stare at?

Our government shouldn't be in the business of policing modesty or decency. Only administering the basic peace.

When I first became aware of these laws I thought as you do. But after a while I came to think the laws are OK, maybe even necessary. You say “draw your curtains”, but in my example the curtains are already drawn. Unless you seal them with duct tape, there are almost always tiny holes or gaps through which someone can see, if they're allowed to do things, like pressing their face against the window, that have no legitimate purpose aside from the intention to invade someone’s privacy. Our laws routinely consider the intention and purpose behind the act.

It's not tyrannical in the dictionary sense of the word. You simply don't like it, that's what your arguments boil down to in this subthread so far.

Depending on your jurisdiction, privacy laws designed to prevent exactly what you are doing.

GDPR immediately, unless you have a consent from John to share his personal details. GDPR does not pertain to digital format solely.

> Isn't that information yours, to do with as you please?

I could equally ask "Isn't that information John's, to do with as he pleases?".

Property is a legal fiction, and "intellectual property" doubly so; but it seems perfectly reasonable that society should decide that information about a human person should be controlled by them, rather than by the artificial person of a corporation.

If John asks you to make his drink preference available to every competitor of yours, and you for some reason agree to provide that service to him, then of course John can get the benefit of that information sharing, but this should only happen if he specifically opts in to it.

(In reality you wouldn't provide this service helping your competitors, and the information sharing could be managed by another service, which John would probably have to pay for, and service providers would compete based on the security, speed, ease of use, and accuracy of their service).

"information" itself is a fiction. The only question is to what degree can someone else control what you do or say? The "information" is "mine" in the sense that I should be able to use my brain and mouth as I see fit. Anything else is awfully invasive don't you think?

If you work for a corporation, you already are prevented from using your brain and mouth as you see fit (or at least, what you "see fit" is being heavily influenced by your desire to stay employed by them).

Consumer privacy regulations don't control your brain and mouth, they control the incentives of companies, who are not humans, and do not have mouths or brains. Those companies then control the incentives of their employees who can choose whether or not to work for them.

I'm not prevented by anyone. No one will impose a fine on me for speaking my mind at work. They may just terminate me, which is of course their prerogative. They can terminate me anyways. Small businesses with individual owners are also burdened by this legislation.

> The only question is to what degree can someone else control what you do or say?

Someone else can't control what you do or say, but they can establish consequence for what you do or say. Nobody can control whether you assault people or not, but they can certainly put you in jail for it.

> Anything else is awfully invasive don't you think?

I don't think so. Information that you got for the specific purpose of providing a service shouldn't be yours to spread as you see fit. In fact, there have been strict legal procedures in place for a long time for certain professions (e.g. medical sector) to enforce this.

Just like I don't expect my doctor to spread information about my hemmorhoids, I don't expect my bartender to spread information about my drinking habits.

Establishing legal consequences is our only mechanism of legitimate control. If you can be threatened with fines, and with arrest for non-compliance with the fines, then you are being controlled. Tyranny of the majority is a thing. This is why laws are an extremely blunt instrument. If people were truly interested privacy, they would simply boycott businesses that violate it. If they don't, there clearly isn't enough interest to possibly justify the use of force.

Wow, I think your example is what's mental. In no way what so ever is it ok for someone to share that with someone else.

So I actually like your analogy, it shows how insane the ad businesses and tracking is.

(Except for the part where you say the other business owner does it to give great service. Ads aren't used to help people, no one likes them)

Since always? If someone asks you a question you have a right to answer as you see fit, don't you? Shouldn't you? Even if you've entered into an agreement to keep a secret, it's only a legal contract that you'd be violating (which you have a perfect right to do) not a law.

You seem to be using “right” to mean something like the state of affairs where there is no criminal penalty. Am I mistaken? I don’t think most people understand the term in that way. So my answers would be no, you don’t have a right to answer as you see fit; no, you should not; and no, you don’t have a right to violate a contract.

Yes, I mean "right" as in action that may be taken with no criminal consequences. What do you mean by the term?

With this definition, you do in fact have a right to breach any contract as there are no criminal penalties for doing so. That's why most contracts specify what happens if they are breached under various conditions. There's a major distinction between civil and criminal law.

I mean something that it is wrong for you to do. You indeed do not have the “right” to violate a contract; that’s precisely why doing so exposes you to civil remedies.

A lot of tech regulation exists specifically because of the scale of the collection/automation that is now possible. For example surveillance cameras, license plate readers, facial recognition can all be replicated by positing a dozen cops on every intersection in the country, but many jurisdictions still have laws against them.

To answer your specific scenario, it would be pretty creepy (and possibly illegal) if shopkeepers in different towns were calling each other and discussing my specific purchasing preferences.

That's not how it works in the real world though. Why would a restaurant answer someone random calling them and asking what one of their regulars is typically ordering? I see no possible benefit in answering that question.

How would they even know which restaurant to call?

This only works in the online advertising world because whenever John enters a shop, restaurant or other establishment his photo is taken and sent to a central authority. That central authority can then sell space in some of those shops to push a product or service to him based on the history of shops he's entered.

You casually say this like it's obviously OK, and like it ever happens in the real world. If I'm doing business with you, and you investigate me to discover other people that I've done similar business with in order to ask them what I like, you're officially a creepy business.

The reason this is a matter of creepiness and not law IRL is because no business with more than a couple of customers could manage to regularly do this. The internet is what provides the dragnets, and the ability to be creepy at scale.

I hope you are playing devil's advocate and don't mean this seriously.

1. When you enter it into a computer, everything changes. The scale with which data can be stored, distributed and aggregated is just staggeringly more huge.

2. People don't like ads, except for a few weirdos. Ads are not a service in the interest of the consumer.

3. Knowing someone personally is fine, but passing on that knowledge without their consent, or at least knowing for certain that it is in their interest, is a no-no.

And that's only the three most egregious things you get wrong.

A computer is just an augmentation of a mind. It does the same things, just more perfectly. Shouldn't we all be able to augment our minds as we see fit? Should our freedoms change in the process?

People who attract new customers with ads must like them. People who were informed of a product that meets their previously-unserved needs must also, right?

3. is just plain old gossip, which is also what I'm describing. It has always been in poor taste, and should never be illegal or regulated at all. Only religions do that.

Some forms of "gossip" (such as slander) are actually harmful, and thus probably should have legal consequences (and usually does).

Maybe John traveled to another city so that the things he does there are not linked to what he does at home. If John wants that I share his preferences, he should let me know and the other business owner should ask him whom to contact in order to spare him the inconvenience of listing all his preferences himself.

Edit: grammar

And if that shopkeeper starts following you around everywhere you go, noting what you do, what you buy, what you read, with whom, and then shares this with whomever they want, for profit, isn't that stalking, isn't that person basically a creep? And if they did it with all of their customers? And since it's physically impossible for a single person to do that then they will build an army of robots that will do that for them, is that still OK? Because that's already a reality we live in.

I mean, yeah if it's their shop of course they can follow you around with a clipboard and sell copies to whomever wants one. That's why it's their shop. If you don't like it, you can leave. If they follow you home, yeah they're stalking you, but that's not what we're talking about is it?

Bad example. You are not memorizing one customer but millions, you don't note one favorite purchase but all, you don't tell one other store owner but thousands. One locust is harmless thousands are a plague.

The question to ask yourself is always 'if I prefix this with 'at scale' does that change the equation?'. And if the answer to that is a 'yes' then your online/offline analogy doesn't hold water.

The more you move from "your brain" to "database", the bigger the risk of abuse.

If you keep it in your head, it's not going to be stolen or abused. If you put it in a notebook, the risk increases, but you at least aren't going to be doing this at a large scale, simply due to physical limitations.

Various laws have different thresholds, but usually it's something like a "systematic collection of data" or "automated processing" (I think it's the latter for GDPR), which seems like a reasonable compromise to avoid hampering the low-risk small scale use cases.

Edit, looked it up, this is the definition GDPR uses:

This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.

So if you keep your database in a notebook, you're probably still fine, because the structure makes it impossible to do nasty things at scale. Once you switch to alphabetically sorted index cards, you've crossed the threshold.

This is exactly what seems crazy to me. Why does augmenting my capabilities with technology arbitrarily subject me to additional regulation? I should either have a right to do something, or not have that right. That's what "inalienable" means. In this case an inalienable right to free expression.

A recognition that they're not going to be realistically able to stop the small business owner keeping customer preferences in a notebook and the cost/benefit of chasing after them is low should not preclude taking action when it gets scaled up to monitoring way more people in a way more pervasive fashion.

Augmented capabilities are different capabilities. Your inalienable right to free expression only exists for certain definitions of expression. It does not extend to incitement to crime, revealing classified information, deceptive commercial speech, misleading investors in a public corporation, etc. You have (in my opinion!) an inalienable right to have a pistol, but not to have a hydrogen bomb.

How would you derive exactly where the line should be between a pistol and a hydrogen bomb? If you can build one, you should be able to have one no?

No, you should not. We draw the lines wherever we think we want them. If you think the line is in the wrong place, you bribe a legislator to move it, or vote, or something like that.

> I should either have a right to do something, or not have that right.

Should you have the right to watch which direction I'm going when I pass by at an intersection?

How about at the next intersection?

And the one after that, and the one after that, and the one by my home, and all the ones that I happen to go by when I next leave and go somewhere?

There's no single point at which passive observation turns into stalking but we still have laws against stalking and it's still perfectly ok and legal for you to watch where I'm going. If you understand why it's ok to look around you (and perhaps even take notes or draw what you see, snap a photo) but not OK to do that systematically around someone, you should also understand why we might want to restrict automated unwarranted and consentless data collection, even if taking some notes is OK.

The other thing is scale. Laws against seemingly minor things are enacted when that thing becomes widespread enough to upset many people. You probably don't upset people too much by taking some notes in a shop. If every shop had a fleet of staff dedicated to the same thing, that probably would upset people and lead us to a similar discussion.

> Why does augmenting my capabilities with technology arbitrarily subject me to additional regulation?

Augmented capability lets you cause more, newer and larger problems.

We didn't have speed limits on the roads until humans acquired the technological capability to go faster, causing more fatalities.

We've had laws governing public spaces and common rights of way for millennia. Governing what and to whom people can communicate, and what they are allowed to remember or record, that's the new thing I'm objecting to.

GDPR doesn't care if its in a database or in your notebook, you are still subject to the same laws and as such the data in this case is the property of John. You need his permission to record it.

For the same reason why you are allowed to fish with a single fishing rod in some places, but can't just drop a giant net or trawl the whole river: Scale matters, and regulating the tools is often an easier and more effective solution than trying to regulate scale directly.

In particular with data, the processing method makes a qualitative difference, between individual disconnected people each knowing one small snippet of your life, and a megacorp having an overview over whatever you're doing at every moment. By de facto limiting it to "one brain", the panopticon is prevented.

Your rights end where they start impacting other people's rights, and drawing those lines is what we have governments for. Even if you were to use just your memory, if you were tracking what someone is doing in such detail as ad companies do, you'd likely a) not be able to do that to more than a few people b) receive restraining orders for stalking.

>Now say John travels to another town, and the proprietor of a similar establishment in that town, wanting to provide John with the best level of service, calls you to ask "Hey, what does John like?", and you tell them.

That's unacceptable to start with.

>What has changed exactly?

You've automatized something unacceptable ?

>Don't you have a right to record who transacts with you?

Within a certain context, you do. The data that is untrusted to you is done so based on the assumption that you're acting in good faith and won't trade that information without consent.

>Isn't that information yours, to do with as you please?

Absolutely not, at least not in the legal systems we have in Europe.

>Can "John" command us to forget we ever saw him?

Yes, he can ! At least in my opinion and virtually every other European's he does. The right to be forgotten is an active subject of discussion[0]. The stance in the US is that it runs contrary to freedom of expression. The stance in Europe is that personal freedom implies being sovereign over one's own data. In technical areas, the right to be forgotten is interpreted as the right to erasure[1], which happens to be part of the GDPR. I've myself used that right several times. And I end up being very mindful of my usage of data in software I write.

>How is any of this reasonable?

Your ease of business doesn't trump someone's rights over themselves, the data they generate being a extension of it. End of story.

[0]: https://en.wikipedia.org/wiki/Right_to_be_forgotten

[1]: https://gdpr-info.eu/art-17-gdpr/

> That's unacceptable to start with.

On what grounds exactly? When interacting with people they are able to observe you and record their observations. From where do you derive a "right" to control their behavior in this regard?

How could you classify an observation about yourself made by someone else as "yours"? How would you enforce this "right to be forgotten" when people carry around storage mediums made from meat? Or are you simply suggesting that you should be forced to go through all your letters, diaries, notebooks and ledgers on the whim of someone's demands?

Technology is making this easy to scale up, there will always be people who want to abuse this, and the abuse potential grows with scale.

What was once 'I'm particularly fond of a certain shops version of a food item' can then become every shop selling that category of item automatically guiding you to the same type of item. Besides the part where everyone knows your name and a quick dossier like you're a celebrity but without any of the perks, life would be so drab if it was "The usual today John?" at literally every place everywhere always.

I'm more or less in agreement. What we need is a change of mentality/awareness, i.e. that everything you do online is being tracked and shared with other parties. Because it mostly is.

These is no difference offline vs online in this context.

You almost certainly had a legitimate interest in remembering your guest’s preferences, but retaining only the necessary amount of personal information is key, and sharing it with other firms is more restricted- an example of where this could be legal is in sharing warning of violent guests.

The problem is the scale at which this is done. Technology allows to not only collect much more of this data but puts that data at risk of being stolen much more than a single physical notebook.

If you employed an army of people to be able to take photographs and remember or write down what every customer looks like, what time they come in, what they typically wear, how long they spend looking at each product, etc... most people will find that creepy and will take offense at that.

They may find it creepy, but why should it be illegal or regulated by the government in any way? If you don't like the creepy establishments, go elsewhere?

What if everyone does it and so you literally don't have anywhere else to go?

What if the data collection was done in such a way that most non-technical people aren't even aware what data is being collected and how it is used? In my hypothetical example about a business employing an army of workers to follow, photograph & take notes about every customer the behavior would at least be visible by the customers (and so they could choose to go elsewhere), which is not the case with modern technology - data is being collected silently in the background.

> why should it be illegal or regulated by the government in any way

There are plenty of other unlawful things you could apply this question to. Society enacts laws to dissuade & punish behaviors that the majority finds reprehensible.

That assumes that the customer is aware that it's happening and that there are other stores that don't do it. Since at least one of those things is vanishingly unlikely, we have legislation.

> They may find it creepy, but why should it be illegal or regulated by the government in any way?

Because that society has decided that it wants no creepy restaurants at all. Same with unclean ones, discriminatory ones, etc.

Has it though? I don't remember being asked.

And yet I see every single supermarket offer their own membership card "to get discounts" and everybody is happy with it. The only purpose of that card is precisely to track your purchases.

It seems to me that some people in society decided that websites aren't allowed to sell ads based on what you view, but all the other tracking in our society is just a-okay. I've not seen a single campaign or push against predatory membership cards or credit card info being sold.

> Has it though? I don't remember being asked.

Depends if you're in the EU but I guess you could've lobbied against the GDPR when it was being drafted. You could also lobby against restaurant food safety regulations, or discrimination laws. The reason these laws are there and stick around is because a majority decided that these behaviors were noxious and should be outlawed and the current majority appears to be happy enough with the current situation to not demand laws to be changed.

> every single supermarket offer their own membership card "to get discounts" and everybody is happy with it

It is opt-in (you can decide to not swipe it when buying the aforementioned fungus cream if you don't want it associated with you), the data collection is relatively common knowledge and is disclosed when you sign up for the card (and if it isn't then that's a breach of the GDPR and should be rectified).

In comparison, online data collection is at best opt-out and at worst mandatory and often invisible (and even if you could see what data is collected from your browser, you have no visibility on what further processing is done on it or to whom it gets transferred or sold).

> but all the other tracking in our society is just a-okay

Source?

> I've not seen a single campaign or push against predatory membership cards

Those are opt-in.

> or credit card info being sold.

Every time the selling of credit card info comes up on HN people speak out against it just like they do against ad tracking, and the only reason nobody else talks about it is because they most likely don't know (would a reasonable person expect their bank to be sharing their purchase info with third-parties?).

Both of these issues are addressed by the GDPR by the way; it covers much more than just ad tracking on the web.

But GDPR bars websites from doing what the stores are doing. The website can't refuse to serve you the website if you don't agree to the tracking, but membership cards work exactly like that. You only get the membership discount if you agree to the tracking. Websites aren't allowed to do that.

The store doesn't bar you from entering & shopping without a membership card. If they did, it could very well be that the GDPR would equally apply and forbid them from mandatory data collection as a prerequisite for shopping there.

Costco bars you from entering and shopping without membership. I'd never thought about the GDPR angle of that before.

So, the card is a great example, because it's opt-in, and you get some reward for opting in. Basically the exact opposite of adtech tracking.

The opt-in of adtech is visiting the website and the reward is the content on the website. You're the one that starts the chain of events in both cases.

You can still serve ads (based on the content of the webpage for example). They just shouldn't collect nor process any personal data.

>The opt-in of adtech is visiting the website and the reward is the content on the website.

No, quite clearly I've opted-in to the site's content. No body has ever knowingly navigated to a website to enjoy its advertising and tracking. (except for maybe 3-5 individuals)

>You're the one that starts the chain of events in both cases.

This is victim blaming. I started the chain of events leading to the rendering of the website content, not the ads or tracking behavior to which I would otherwise be oblivious. This is akin to saying I asked for a computer virus by purchasing this computer.

"society has decided" all sorts of awful things in the past. I'm just pointing out that this is one of them.

High end hotels do this.

Honestly, more and more I'm starting to think GDPR is just an excuse to fleece "evil foreign tech giants". It's a set of arbitrary rules with vague and selective enforcement that seems not to be completely understood even by the legislators who wrote it, as demonstrated by legislators not knowing the answer to the simple question: Are pop-up consent forms acceptable. It's whatever the bureaucrats don't like that day really.

Guess some US company will have to go to court (and subsidize the European Legal Industry doing so) for the privilege of figuring it out.

It wouldn't be so comical if FAANG wasn't full of European devs who chose to innovate in the Valley, probably to escape this very bureaucracy.

Doesn't seem arbitrary to me. It might be cultural though. Somehow the need for privacy is just not something that is in the lived experience of eg many Americans, apparently.

Say we've learned over time that the color purple is really dangerous and needs to be regulated (work with me here for a second) .

Now try explaining "Purple Considered Harmful" to someone who is colorblind. The fact that suddenly grape juice is bad, but orange juice is good... weird. Or the fact that you'd not be allowed to mix tomato ketchup with blueberry jam. And you'd just randomly get fined for trying to sell that "dark green" sweater. Madness!

It would all seem quite arbitrary to the color blind person. Meanwhile someone with color vision would instantly see that all those things are purple, and thus clearly harmful.

The example might seem bit contrived, but something similar might be going on with the European concept of privacy.

People have been hurt due to PII issues in recent history, so one would like to keep control of PII. But try to explain that tingling spidey sense that has kept one's family alive in the last century to someone who has never encountered Nazis or Soviets before, and has instead lived a life of unfettered freedom. That might be rather difficult. Especially if you can't get the base concept across, and need to do it in terms of (very arbitrary seeming) examples.

Honestly, if you fail to comply with GDPR, you probably failed to comply with laws stretching at least back to 1995. GDPR mostly changed ability to hunt down violations, and further harmonised and clarified laws that were already in force. It's easier to comply in post-GDPR world than before it, and there's general guidance for let's call it "honest mistakes" as well as coverage on some internet-specific issues.

And Valley is pretty much there because when the long chain of capital-hungry events was building it up, we were still rebuilding from last war while funding preparation for take three thanks to Truman.

Reply on news.ycombinator.com