You’re taking pains to explain why GDPR is a compromise? Why? If it’s bad law, it’s bad law.
Nothing you said invalidates the assertions I’ve made. Unless you’ve directly experienced the onerous system of regulations in places like Germany, I’d urge you to do more research before the armchair dismissal.
Presumably it's your opinion that it's a bad law. The majority of Europeans think it's a good law - possibly the best regulation the EU has ever promulgated.
Ie, onerous toward regular businesses Ie, used to greatly expand bureaucracy and overhead Ie, used by unelected bureaucrats to wage battles of personal vendetta against specific companies instead of doing what laws do, which is set unambiguous standards for all
There's no "personal vendettas" going on; can you substantiate that allegation at all? The GDPR applies to everyone equally. And unlike some laws, it's fairly easy to read; it's meant to be understood. Don't bother reading some biased summary of the Regulation; read the GDPR itself. That's the best guidance on the intent, and the best guidance on how to comply.
/me: former data protection officer at a web development outfit.
And that's just ONE sub clause of a hundred or so.
The overhead is both in the arbitrary nature of the requirements (Good Laws are objective, not subjective) and the sheer lack of consistency in the enforcement is ridiculous for any European business. Consider the adequacy clause that's taken decades to litigate and is still fucking criminal as of this writing.
Answer this simple question: "Can I, as a small business use AWS services that may or may not have a compute instance located in the EU?". You know pretty well what the answer is there, so, basically every small business in the EU is in violation right now. And it's bureaucratic assholery that keeps this deliberately inconsistent so they can choose to enforce it at any point of their choosing (read, a negative PR cycle) - Monarchy, inconsistency, arbitrary and ambiguous rulemaking that has tossed out the interests of businesses.
The vendetta against Google is well documented and it's insulting for you to even say otherwise. Look at the most recent example of the CNIL (Frances privacy enforcement body, a part of the executive) choosing arbitrary standards and refusing to even elaborate on concrete standards for recommended analytics solutions that businesses may use. They have gone full psycho with not even wanting to give Google the opportunity to come into compliance with standards that they choose not to reveal and instead openly ask industry to turn Google Analytics off. Its ridiculous and bad for their own economies.
There's a difference between the way French and Germans write laws and the way we write them in the UK; I prefer the UK style, which leaves less room for interpretation.
> basically every small business in the EU is in violation right now
Only if they're handling personal data. Most small businesses don't.
Sure, if your business is collecting personal data, then GDPR is a problem for you; in the same way as the Road Traffic Act is a problem if you're determined to drive uninsured. If you want to sail close to the wind, then it's probably wise to lawyer-up.
And, of course, you don't have to use AWS.
> And it's bureaucratic assholery that keeps this deliberately inconsistent
That's not how I read it. The way I read it, GDPR is astonishingly lenient. Before they prosecute, they'll warn you; provide advice on how to come into compliance; and give you time to do it.
> choosing arbitrary standards
If GA involves depositing personal data in US jurisdiction, then you can't use GA in a GDPR jurisdiction. That's not vague or arbitrary. It may be - um - bold; But this law was flagged up years before it came into force. It's not as if the law came out of nowhere, and suddenly everyone's in violation.
> Its ridiculous and bad for their own economies.
Others have argued that GDPR is an attempt by the EU to steal Silicon Valley's breakfast, implying that it's good for European economies.
Interesting way of saying they are bad laws. If you cannot, as a business have certainty in your prediction of the regulatory environment, you're pretty fucked. I wouldn't expect a piece of the bureaucratic establishment such as yourself to understand the struggles of setting up and running a business. What was your role as DPO again? An ornamental peace offering to the burdens imposed by regulation? Not all businesses have the luxury of throwing money at legal resources.
> Only if they're handling personal data. Most small businesses don't.Sure, if your business is collecting personal data, then GDPR is a problem for you; in the same way as the Road Traffic Act is a problem if you're determined to drive uninsured. If you want to sail close to the wind, then it's probably wise to lawyer-up.
It must take a special kind of asshole to say this. In just another one of your recent comments here you mention that even the mere presence of an IP address that ISNT EVEN STORED would put a business in violation and liable to large fines. So you pretty much agree that all small businesses are in violation if they use AWS in any reasonable way to run their business but you don't want to say it explicitly here since it makes you look bad. Gotcha.
> And, of course, you don't have to use AWS.
And of course, the European people elected you their lord and savior to tell businesses which tech stacks they pick and choose because of your interpretation of arbitrary laws. See the problem here yet?
> That's not how I read it. The way I read it, GDPR is astonishingly lenient.
Is it? So why did other member states of the EU take offense at the decision of the Irish DPA ? The one stop provision clearly stipulates that the onus of enforcement falls to the one stop shop and instead, the arbitrary nature of the law as it stands, other member states and bureaucrats in Brussels seem to deem it necessary to impose their will and personal vendettas against the perceived soft touch approach of an entity fully within their rights to do so.
> If GA involves depositing personal data in US jurisdiction, then you can't use GA in a GDPR jurisdiction
Has there been any warnings against AliCloud for instance? Or all the analytics bundles shipped in Huawei phones?
I can't seem to recall any press release or webpage dedicated to a single company like the CNIL and now Italian authorities have adopted towards Google Analytics?
Is there any oversight to these agencies allowed where these decisions are up to public scrutiny such as the FOIA act in the US to assure the public that these highly paid public officials are not wasting all their time and money chasing personal vendettas as seems to be the case here? Of course fucking not.
Is Google Analytics perfect? Maybe not. But this is the crucial point . . THE LEGISLATURE CANNOT DISCRIMINATE AGAINST A SINGLE ENTITY THIS WAY. While turning a blind eye to practices by Huawei and other companies, it is simply against the rule of law.
> Others have argued that GDPR is an attempt by the EU to steal Silicon Valley's breakfast, implying that it's good for European economies.
A weasel through and through. What else did i expect from someone in your position?
So, illegal abuse of power by Government to target a company is fine by you, Mr. DPO ?
Good Lord, presumptions much?
I said I was DPO in my last job. I was also the main sysadmin, and as my main role a website developer. This was a company of 10 people including the bosses. Someone had to take on the role.
> It must take a special kind of asshole to say this.
It must take a special kind of asshole to say that, to someone you haven't met and know nothing about.
> but you don't want to say it explicitly here since it makes you look bad. Gotcha.
Not really; I've never evaluated AWS for compliance. The reason I didn't say that is because it's not something I know about. We didn't use AWS; I've used it, but in someone else's coding shop, where AWS compliance wasn't my concern.
May I suggest that you're a bit hasty with words like "clown", "asshole", "weasel" and "gotcha"?
> And of course, the European people elected you their lord and savior to tell businesses which tech stacks they pick and choose because of your interpretation of arbitrary laws. See the problem here yet?
How are things over there in Conclusions, where you seem to have jumped? I have never told anyone what tech stack they should use.
> THE LEGISLATURE CANNOT DISCRIMINATE AGAINST A SINGLE ENTITY THIS WAY.
Where in the GDPR is GA mentioned? Or AWS, for that matter?
For the sake of clarity, no legislature had anything to do with the GDPR; it was promulgated by the European Commission, an important part of the EU bureaucracy, and I have never worked for any part of the EU bureaucracy. In fact, I no longer even live in the EU.
> A weasel through and through. What else did i expect from someone in your position?
And what position is it, that you think I occupy? FTR, I'm a retired software developer. The position I occupy is sitting in an armchair.
> So, illegal abuse of power by Government to target a company is fine by you, Mr. DPO ?
Nope. In fact I'm also against legal abuse of power, whether by government or anyone else.
You seem to be very angry; perhaps social media is not for you.
ie, that any small or big business inadvertently sending even an IP address that isn’t even stored to touch a US based resource in something as innocuous as AWS.
Seeing your other recent comment here, it seems you’re just a moron with a nationalistic tendency to support your countrymen (and women). Oh well, objectivity dies and future generations on your continent suffer. Who cares, right? You’re retired.
If an IP address is sent to the USA, then whether it's stored or not ceases to be a matter that European courts can oversee. Since US courts and European courts are not in accord on these matters, Europeans are faced with either banning the export of IP addresses to the USA, or giving up on legislating privacy at all. We chose the former.
> it seems you’re just a moron with a nationalistic tendency
Oh, more name-calling, and more conclusions jumped to. If you can't make an argument, make a personal insult, and decorate it with insulting epithets based on nothing at all.
> future generations on your continent suffer
Ah, you're not from these parts! I thought not. But in the light of that fact, it's our concern, not yours, right? So why do you get SO angry about European law? If you want to trade in Europe, you have to comply with European regulations. Same wherever you want to trade.
I don't approve of the US trade environment. For example, about half the world is under US trade sanctions; but you don't get me marching around accusing USAians of being morons, weazels, assholes, and clowns.
Perhaps the truth is that it is you that is the nationalist?
You expect a business that's invested in the AWS stack to up and move overnight because some illiterate morons in Brussels decided that?
It has been my view for a long time that entrusting your infrastructure to the tender mercies of a firm like Amazon is reckless. Here we have a situation where the legal environment has changed; AWS hasn't changed to match; so those companies that chose to rely on a 3rd-party infrastructure provider appear to have made a mistake.
If I had been advising one of those companies, I would have advised them to bring critical infrastructure in-house. But there might have been other options, like using Europe-based infrastructure providers.
I've never been involved with budgets and so on. It's not my concern how much different solutions cost. I just think the principals of companies have a responsibility to avoid third-party risk - which is what you have, if you rely on a third-party for critical company infrastructure.
That's why I was able to persuade my employers to bring their email service in-house. It worked, and the bosses were pleased with the improved service and reliability. We also constructed our own in-house build and deployment train; that worked very nicely too.
Maybe the cost-benefits vary according to the type and size of business. I'm not a researcher, and I only know about the things I've looked into. But my guess is that AWS works well for companies that are after a quick buck (e.g. an IPO).
> unelected bureaucrats
Does the American elect the IRS or the FTC bureaucrat?
I have officials in the EU on the record that IP addresses are deemed personal information and if your business uses AWS and unintentionally passed IP addresses over to any resource in the US, you are technically in violation.
Will you be hanged for this today? Probably not. But all it takes is one negative press cycle for the idiots there to interpret and enforce this as they have shown the willingness to do in the past.
The point about unelected bureaucrats isn’t the unelected part. It’s the lack of oversight or consequence or clear demarcation of legislative power from the executive.
The bureaucrats have taken it upon themselves to issue multiple specific rules that go over and beyond the text of any law. See the case of the CNIL in France. They had a court ruling around their rules for cookies on Google go against them and they continued to insist that they would enforce said law. They issued an “FAQ” on their website that indicated threatening language against businesses that flouted their previous comments that were now deemed incorrect by a court of law and had the audacity to press on.
Like I said, the EU is an abusive monarchy
Of course, everybody knows that. You have to have good reasons to store people’s IP addresses (ie security logs, which must be disconnected from the tracking/telemetry system).
> Will you be hanged for this today? Probably not. But all it takes is one negative press cycle for the idiots there to interpret and enforce this as they have shown the willingness to do in the past.
If the regulator finds out that your analytics or recommendation system (which again is not the system where you store logs) is collecting and processing IP addresses without users’ consent, they will ask you to stop. If you don’t they will eventually fine you.
> The point about unelected bureaucrats isn’t the unelected part. It’s the lack of oversight or consequence or clear demarcation of legislative power from the executive.
GDPR has been made/negotiated by the European Parliament (which is elected directly), by the Council of the EU, which is composed by ministers of member states, and by the Commission (whose members are elected by the Parliament and the Council). These are the legislative and executive branches of the EU, not a bunch of unelected bureaucrats.
If you were referring to the regulator, well, all regulator bodies are made of “unelected bureaucrats” by design (that’s why they are referred to as “independent agencies”).
> The bureaucrats have taken it upon themselves to issue multiple specific rules that go over and beyond the text of any law. See the case of the CNIL in France. They had a court ruling around their rules for cookies on Google go against them and they continued to insist that they would enforce said law.
It seems that you are very agitated because the CNIL (some unelected bureaucrats) imposed a blanket ban on cookie walls and then the Council of State (some other unelected bureaucrats) held that such blanket ban could not be imposed. An honest observer would acknowledge that these things happen everyday (the Council of State wouldn’t otherwise exist), the matter is quite complex and that the gist of the matter hasn’t changed: “in order for consent to be freely given, access to services and functionalities must not be made conditional on the consent of a user to the storing of information, or gaining of access to information”. So one may still be fined for a cookie wall.
If what is upsetting you is instead a court case, the only one I could find is the recent 150mln€ fine that Google appealed on jurisdictions grounds and that was upheld, again, by the Council of State.
Either way, I wouldn’t get too agitated about complex court cases in foreign countries thousands of kilometres from my home and whose language I don’t speak.
> Like I said, the EU is an abusive monarchy
I will point to Proposition 7 of Wittgenstein’s Tractatus and I won’t indulge you further on this.
Lol. Thank you for agreeing. You're completely wrong about the fines part, it is discretionary. ie, if tomorrow, there is a negative press cycle, you will certainly be hit with any punishment of their choosing. The incremental warning and fines approach has no practical or legal basis.
If it does, get it in writing from __ANY__ entity entrusted with enforcing the GDPR, you will be laughed out of the room. Europe is a clown show. Ambiguity rules.
> These are the legislative and executive branches of the EU, not a bunch of unelected bureaucrats.
Oh really? Read my comment again. These assholes in the executive are directly changing the letter of the law. ie LEGISLATING.
They are further doing so with the stated objective of harming a single company. I can point you to the statements of a hundred or so elected officials, not least of all the president of the European Comission who said so in no uncertain terms when she was in the US for SXSW.
> It seems that you are very agitated because
I didn't ask you to diagnose anything, Dr. Phil. Sit the fuck down and read the comment again. The Council of State in France is who the CNIL reports to. They are the administrative justice Supreme Court.
When an agency goes fucking rogue against their oversight body while trying to kill a company, what else is it other than abuse of power? The very fact that you choose not to call this out makes me question your motives and judgement.
We have laws for a fucking reason. Not to print them out and hang them on the walls like ornaments but so there is discipline in the exercise of power entrusted in people with the power of Government. We can't have personal vendettas run through governmental office.
> I will point to Proposition 7 of Wittgenstein’s Tractatus and I won’t indulge you further on this.
Fancy. Should i be impressed? Does that disqualify all the abuse of power in your eyes?
Not any punishment of their choosing, but according to Art. 83, that defines the maximum fine and the criteria to determine it.
This is not different from what the FDA or the SEC do in the USA. Or do you think they define exact fines for all possible misbehaviours up to the second decimal point regardless of mitigating factors or negligence?
> The incremental warning and fines approach has no practical or legal basis.
The legal basis is GDPR, which is a regulation of the EU. Do you mean that it goes against some EU treaties or rulings of the CJEU? Or the problem is that this notion upsets you somehow and you are telling me because you think I should do something about it?
> If it does, get it in writing from __ANY__ entity entrusted with enforcing the GDPR, you will be laughed out of the room. Europe is a clown show. Ambiguity rules.
I don’t understand what I should get in writing. Art. 83 of GDPR?
> Oh really? Read my comment again. These assholes in the executive are directly changing the letter of the law. ie LEGISLATING.
The Commission has the right of initiative, that is they propose laws that are approved by the Parliament. I’m not sure I understand what is upsetting you here.
Who are “these assholes in the executive” you are referring to? Are they the Commission or CNIL or both or none? I don’t live in France, but I’m sure the CNIL is not making new laws. If it worries you, I can ask around.
> We have laws for a fucking reason. Not to print them out and hang them on the walls like ornaments but so there is discipline in the exercise of power entrusted in people with the power of Government. We can't have personal vendettas run through governmental office.
Which is why the Council of State blocked the CNIL and also why you should not get so upset.
> Fancy. Should i be impressed? Does that disqualify all the abuse of power in your eyes?
I won’t indulge you further on this.
To sum it up, you don’t seem aware of how the EU makes laws but yet you know enough to be very agitated. You are especially upset with French bureaucrats, because some of them made some mistake and other French bureaucrats corrected them. For avoidance of doubt we’ll certify that you are very upset with both groups and that you think something should be done about it.
We’ve established that there is presently different outcomes for the same actions under European law. Ie, if you send IP addresses today to AWS, you could be deemed to be doing something illegal overnight subject to 4% of global revenue or 20 million euro fines.
This isn’t about cents or decimals, jackass. You know very well this is about coverage.
Under the FDA or any US agency, you have an option to appeal to an independent branch of government whose decisions are binding. Here, we see the opposite take place in France. Lawlessness. Monarchy. Being run through the bureaucracy. You can’t even bring yourself to admit that the CNIL arrogantly brushed off effectively the SUPREME COURT OF ADMINISTRATIVE JUSTICE. You say it’s a “mistake”?? Are you fucking kidding me? Deliberately doing to opposite of what your oversight agency rules is abuse of power.
Can a European citizen simply ever say “yeah, fuck the GDPR, I know that’s a law, but I won’t follow it, doesn’t apply to me?” Of course not. So what gives the CNIL the power to ignore their responsibilities under French and European law?
Even after being blocked by the Council of state, they chose to target an individual company with the exact thing that they were instructed is legal and they should not be interfering with. Respect laws only when you like them?
Clear abuse of power, horrible precedent for democracies and rule of law everywhere and most European assholes connected to politics i speak to behave the way you do, try to brush it under the carpet? Anyone with half a brain will be aghast at what is happening is the EU and if you clowns think discourse that defends assholery from the bureaucracy wins you any favors or makes Europeans lives any better, you more stupid than I’m giving you credit for here.
If you are breaking the law, if a regulator finds out, you may be deemed to be doing something illegal overnight. Yes, that’s how everything works everywhere. What is worrying you now? The sound of a GDPR breach in a forest where nobody can hear it?
> Under the FDA or any US agency, you have an option to appeal to an independent branch of government whose decisions are binding.
Of course you can file an appeal, just use Google, you’ll find plenty, some successful and some not.
> Here, we see the opposite take place in France. Lawlessness. Monarchy. Being run through the bureaucracy. You can’t even bring yourself to admit that the CNIL arrogantly brushed off effectively the SUPREME COURT OF ADMINISTRATIVE JUSTICE. You say it’s a “mistake”?? Are you fucking kidding me? Deliberately doing to opposite of what your oversight agency rules is abuse of power.
You are getting fixated on a very minor case of French administrative law, that you didn’t even care to understand. The ICO made a minor mistake in considering all cookie walls illegal. The Council of State said that they can’t make a blanket ban, but that they should evaluate all cookie walls individually. No fine has been annulled and the ICO can still deem your cookie wall illegal. So still no monarchy for you.
> Anyone with half a brain will be aghast at what is happening is the EU
Anyone with a half brain will at least spend some time understanding the issue at hand before getting excessively agitated.
By admitting data flows to us resources are illegal, you’ve just said that what you’re doing right now can be construed as illegal activity on the part of the website you’re on. HN is indeed hosted on us resources. You touch Microsoft excel and guess what? Us resources get your personal data.
So you’ve just basically admitted that under GDPR, all regular internet activity is illegal if it touches a US server. Hence “coverage”. Hence, everyone living under really, the discretion of the monarchs.
Thanks for playing. Dumbass.
> guess what? Us resources get your personal data.
From posting to HN? AFAIAA, HN only gets your IP address. GA gets your search history, which is a bit different.
It doesn't matter post that statement what your conclusions are. You have opened up every business to a liability of 4% global earnings or 20 million Euros WHICHEVER IS GREATER. . .at the sheer discretion of some illiterate fucks like yourself in Brussels.
You don't seem to know what a monarch is. You're ranting about a French regulator; you don't seem to be aware that the French got rid of their monarchy before the American colonies did.
> if you clowns think discourse that defends assholery from the bureaucracy wins you any favors or makes Europeans lives any better, you more stupid than I’m giving you credit for here.
The value of your "credit" diminishes with each post you make. Apparently your view is that "Anyone with half a brain will be aghast at what is happening is the EU"; well, either Europeans are, in fact, aghast, or you're really referring to your own "countrymen", which I suspect is a rather small clique of USAian tech bros.
Have a chill-pill, dude. GDPR is European law, for Europeans. You don't have to come to Europe, and you don't have to trade here. If you stick to jurisdictions that don't, in your view, involve assholery, then everything's copacetic for everyone, right?
I have a strong sense that you want to trade in Europe, without having to comply with European law. That's not going to work.
Perhaps if you were to actually highlight the issues you claim to have highlighted, it might be easier for us and our "kind" (I don't know what "kind" I belong to). You rant about the European "monarchy", and the deficiencies of European bureaucracy; what about explaining your proposals for a reformed GDPR?
But I think you are opposed to any kind of privacy legislation. GDPR steams you up because it is privacy legislation that works. Well, that's fine; there are laws that USAians make that I'm opposed to. I'm not on-board with US lawmaking and judicial processes. That's fine too; I don't have to live or trade in the USA (and I did make a choice; I once lived in the USA).
I suspect that something about the GDPR must have bitten you quite badly - would you consider sharing what it was? It would be helpful if you avoided the "asshole", "weasel", "moron", "dumbass", "illiterate" language, and focused on what happened, and what the impact was.
NOTE: there are people here that don't seem to be good at spelling, but I don't think I've ever come across a post here that I would describe as "illiterate".
1. Toss it out. All of it. In the present form, it is worthless. 2. Make privacy regulation simpler, not ten million pages and bureaucrats who are RIGHT NOW, abusing the power that all Europeans have entrusted them with. 3. Enable independent oversight. Consultations with technical committees of technology companies, Judicial reform to ensure there is no legislating from the bench, independent whistleblower handling to investigate abuses of power such as the CNIL case. 4. Separate the legislative, executive and punitive functions with very tight rules. We have assholes in Brussels so married to the idea that all tech is bad that they rebelled against the moves by the European Parliament to codify data transfer laws between the EU and US during Bidens visit. I mean, there is a limit to short sighted thinking. 5. Stop the political uncertainty with the multiple changes and the sheer amount of idiotic bureaucracy with multiple conflicting regulations where EVERY SINGLE FUCKING THING is a crime and instead, pick the most pressing issues: Cybersecurity, Data Handling, Data Sharing etc. It's ridiculous that we have 10,000 people obsessing over cookie banners while malicious hackers pilfer 100s of millions of peoples data because of a lack of political will to focus on cybersecurity.
On privacy legislation, my biggest gripe with the GDPR is it HAS DONE FUCK ALL for privacy. Apple has done more with the changes to iOS than the entire fucking EU with GDPR.
I am advocating for MORE effective legislation, not more INEFFECTIVE, burdensome, regressive regulation that enshrines the concentration of powers and makes innovation impossible.
1. Enlarge the definition of privacy legislation to cover EVERYTHING! Do you realize that EUROPEAN Intel agencies are not covered by the GDPR right now? While American Intel agencies are and Chinese Intel agencies are not even mentioned or challenged? How is that good for privacy when Huawei is essentially taking much of European market share while being run by a Govt enslaving a million Muslims in Xinjiang? 2. Make it less reliant on pure punitive measures and more an incentive+punitive set of objective measures to give companies the opportunity to innovate towards solutions. Right now, the stance by Europe has made only investing in lawyers the most appropriate choice. That or leave. No middle ground, no consultations, simply make villains of tech companies and that is the legacy of many regulators there. 3. Term limits on regulators. Limits and regulation on the people enforcing privacy legislation to ensure a balanced mind. Right now, go on Twitter and see the deranged rants of many of the people in these agencies who delight at the market share loss of Facebook or openly express glee whenever there is a bad press cycle outside of privacy for any of the companies they're supposed to be entrusted with passing judgements on. This is not a democracy. It's shameful. 4. Incentives that MINIMIZE liability for companies that meet objective standards that are reasonable. Right now, the approach is to hit them with the biggest stick you can find and hope and pray that it works out.
Many more, but along the same lines.
>I suspect that something about the GDPR must have bitten you quite badly
I've seen people simply struggle to achieve success that other parts of the world take for granted. This is TODAY . . in EUROPE of all places. You need to realize that bad political decisions are bad for everyone. I don't have skin in the game other than the feeling of watching someone drive off a cliff. So many people i speak to/interview/engage with from Europe who are young as SO very bright and talented and it's amazing to see how the very people they elected piss away time, resources and money on depleting the economy that these kids are going to grow up into for personal vendetta.
No one in their right mind will argue that the GDPR does a great job. It is very flawed legislation that will set the privacy movement back decades.