Hacker News Reader

Comment by nforgerit | Hacker News Reader

Gosh. Only about 10 years ago I used to be a convinced European from Germany. The last couple of years I started having my doubts that the EU will ever find its own legit style of handling tech concerns. Everything is crumbling and we still see deeply arrogant leadership seemingly trying to bs their way through the current turmoil. And what do they do? Regulate ChatGPT, try to introduce mass-surveillance through #chatcontrol and secretly apply Palantir tech in police depts.

I don't want an incompetent patronizing government. I want competent leadership in politics and business that is able to set up a culture of innovation.

View on HN

But this is a domestic regulator, making a domestic finding.

This isn't an EU level decision. Countries in the EU have a lot of control over their own affairs, as they should.

Conflating EU and Domestic policies is a bad thing (this was done a lot in the UK)

Conflating EU and Domestic policies probably happens in every EU country. It's also a German thing to fingerpoint at Brussels. This whole ping-pong is disastrous for our democracies.

In this certain case, I see already other nation's leaders and eventually the EU commission feeling inspired by this "bold" way Italy deals with ChatGPT. And #chatcontrol is an issue that directly comes from the EU commission (again the German "home secretary" is pointing at Brussels while officially hilariously stating "no we won't install client-side scanning everywhere").

> It's also a German thing to fingerpoint at Brussels

I wonder where Belgians point to. Schuman?

Strasbourg when the whole European Parliament is moving there for 4 days 12 times a year.

It was done massively in the UK, there were many cases of prominent criticism of "EU regulations" that we'd either actively championed, or were optional and chosen to adopt, or that we had actually oped out of anyway.

As an example, Boris Johnson infamously claimed in the runup to brexit that "Prawn Cocktail" flavour crisps were being banned by the EU. It turned out that the UK had simply forgotten to submit this flavour to the list of flavourings when it was being compiled. This error was quietly corrected (by the UK).[1]

[1] From the FT but here's a non-paywalled link https://archive.is/p4H9X

Why the hell is there a list of crisp flavors at the EU? What if I want to make and sell my own original one?

Are you seriously confused why governments regulate what can be put in food and sold to the public?

Here's a classic for you, one of the early incidents which lead to this kind of regulation: https://en.wikipedia.org/wiki/1858_Bradford_sweets_poisoning

Here's some more contemporary links:

https://food.ec.europa.eu/safety/food-improvement-agents/add...

https://food.ec.europa.eu/safety/food-improvement-agents/fla...

Which includes an answer to your question: "The procedure for authorisation of a flavouring substance is common to the one established for food additives and enzymes under Regulation (EC) No 1331/2008."

The fact that something called "flavouring substance" is a thing makes me shake my head.

>Are you seriously confused why governments regulate what can be put in food and sold to the public?

Are these the same regulators that allowed Olestra to be used? sidebar--just to check the spelling of Olestra, I used the Mac's force click dictionary access: "Origin 1980s: from (p)ol(y)est(e)r + the suffix -a." WTF? Seriously? We dropped some letters from polyester and called it food ingredient?

Yeah, sounds like some "regulations will save us" doesn't work as expected.

As I can't find when olestra products were sold in the EU, the answer seems to be “no”. Don't hesitate to prove me wrong though.

Sure, the EU definitely seems to be better about what it considers food. The United States of Greed definitely needs to do better. I'm constantly flabbergasted at what is considered edible and passes as food in the US. The fact that being required to put on the package the words "anal leakage" doesn't immediately stop someone from using it as an ingredient just shows how little corp food cares about what it puts into the "food products" it manufactures/sales.

>Here's a classic for you, one of the early incidents which lead to this kind of regulation: https://en.wikipedia.org/wiki/1858_Bradford_sweets_poisoning

I don't see how said regulation would have helped in this case, the shop owner simply mistook fake sugar for arsenic, it's not like he decided to sell arsenic-flavored candies.

Correct. He was selling candies filled with (what he thought was) gypsum. Yum.

(He didn't mix up the sugar with arsenic. He mixed up the gypsum.)

>What if I want to make and sell my own original one?

Then you're free to do so if you aren't putting artificial sweeteners in them.

https://en.wikipedia.org/wiki/Commission_Directive_91/71/EEC

I'd say that there's two different styles of legislation here. AFAIK in the US (and maybe UK too) a producer can put whatever they want into their products but can be sued to death in case sth goes wrong. Most EU countries have a different flavor such that they try to tightly control products and their ingredients upfront. Imho both styles have their pros and cons.

Food in Europe > USA. Even the fast food.

Depends on where you go. You can eat better in NYC than in Vienna, and better in Barcelona than Pittsburgh.

Then there's Boris as London Mayor in 2014 decrying the UK government obstructing EU legislation to make lorries safer. Then 2018 Boris decrying the UK supposedly being held up waiting for EU regulations on lorry safety. All the while despite the fact there was nothing to stop the UK implementing rules on the same issues, which a later London Mayor ended up doing anyway.

I only skimmed the article but we (UK) have our own nearly identical GDPR.

So Italy's concerns might also apply to us, and every EU nation with EU GDPR.

BUT let's not kid ourselves there is huge pressure to stop OpenAI from techphobes to pearl-clutching techphiles and of course ruthless rivals who want a breather to catchup.

>> and of course ruthless rivals who want a breather to catchup

This was the bit i wondered about, there’s at least an incentive for this kind of jiggery pokery lobbying but little transparency.

>But this is a domestic regulator, making a domestic finding.

It's a decision by a domestic DPA based on the GDPR. In practice, it will have an impact across the EU, because any company intending to operate uniformly across the EU has to, in practice, comply with the most onerous GDPR interpretation taken by any domestic DPA.

This ratcheting effect is a practical reality given how the GDPR operates. It's also why orgs like Schrems' NOYB celebrate individual victories with the most activist DPAs. They ultimately do have an impact across the EU.

Convinced European and Italian here. While I feel zero respect for our new corrupt government, this could be a bold, yet necessary, move, provided it is really temporary and motivated by concern about personal data misuse. New developments in AI can offer bad players the most incredibly powerful communication weapon ever created, and although I'd be strongly against any kind of blockage, I can agree that things in that field are progressing too fast and we (as society) need time to fully understand the implications and dangers should it (read: when it will) be used to take advantage of people, and grow the necessary antibodies.

edit: minor additions/corrections

>> I want competent leadership in politics and business that is able to set up a culture of innovation.

I don't really want my government 'innovating' much at all. I want them to provide for defense of the people and freedoms.

How many competent government leaders have you seen?

Would you be OK with an AI government that caters to those objectives?

I think a more helpfully formulated question would be "why would I be OK with an AI government that caters to these objectives?"

the AI can prove that it catered to those objectives, isn't that the problem you stated?

The AI is unaccountable. If the leaders get good ideas from the AI, then cool, let them present them and take responsibility.

accountability does not guarantee future improvement, while an AI can be continuously retrained

AI does not guarantee future improvement either. Humans can also be continuously retrained. I don't understand your point.

>Only about 10 years ago I used to be a convinced European from Germany.

Hear, hear.

How many "accept all cookies" button did you have to press today?

Far too many.

Not, however, on Hacker News, because Hacker News isn't using data for more than actual functionality, and you don't need to ask permission in that case.

Please show me which part of GDPR mandates that banner.

As additional homework, you can also lookup malicious compliance etc. Or even the sibling discussion on how Facebook wants you to apply for a permission to opt out of their tracking: https://news.ycombinator.com/item?id=35383925

The banners proliferated after GDPR was instituted.

Privacy should have been promoted through technological means, e.g the EU could have funded development of fingerprintless browser technologies, zero-knowledge proof based identity verification, etc, instead of through bureaucratic regimentation of private interaction.

Same to you: Please show me which part of GDPR mandates that banner. Also, where the GDPR talks about browsers or cookies or gingerprints.

Ironically they seem to be ok with the CCP controlling their telecommunications.

What is the issue with the GDPR? If OpenAI is violating the GDPR, why should European governments ignore it?

In the beginning of GDPR I remember me sitting in annoying meetings with lawyers who essentially became Product Owners and designers while I still thought the GDPR-Framework makes sense in itself and might help in practice.

But boy was I wrong. The people criticizing GDPR were right: Tech giants were able to cope better with the regulations while smaller domestic companies were put under an additional burden of excessive bureaucracy. And from what I perceive, there's now cookie banners everywhere while my personal data is still going into opaque silos.

> And from what I perceive, there's now cookie banners everywhere while my personal data is still going into opaque silos.

Those cookie banners are either non-compliant with the regulations or meaningless. Why people add them is anyones guess.

Yeah. Mozilla with their ad-network visualization and browser extensions did more to privacy in practice than any GDPR regulation in which exchanging business cards became some kind of mexican standoff.

No that's not true, though it does get spouted very often in online comments.

It's true that a cookie banner (notification only) does not equal "the site can now do whatever it wants and is GDPR compliant thanks to the banner".

However, cookie notification banners are nothing to do with GDPR! They are to comply with an earlier (but still active after GDPR) bit of legislation, the 2002 'ePrivacy Directive' (sometimes known as the "cookies law").

If you don't go near personal data, but still want to use cookies for website functionality, then GDPR doesn't apply but you need to notify users of your use of cookies. If you are doing stuff that's covered under GDPR, then you obviously need to do more than just a cookie notification, and in most cases doing that 'more' will cover the non-personal cookies too so no need for a separate cookie notification on top.

https://en.wikipedia.org/wiki/Privacy_and_Electronic_Communi...

edit to be more specific: section (25) includes "Where such devices, for instance cookies, are intended for a legitimate purpose, such as to facilitate the provision of information society services, their use should be allowed on condition that users are provided with clear and precise information in accordance with Directive 95/46/EC about the purposes of cookies or similar devices so as to ensure that users are made aware of information being placed on the terminal equipment they are using." and "Access to specific website content may still be made conditional on the well-informed acceptance of a cookie or similar device, if it is used for a legitimate purpose." (meaning that unlike with GDPR, it's easier to say "these cookies are necessary, accept them or don't use this website")

Full text of that 2002 directive: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...

And usual disclaimer, this is not legal advice, if you're doing anything affected by either the ePrivacy Directive or GDPR you'd do well to do one or both of getting specific advice from a lawyer with specific expertise in this area, and that if it's a personal site (or a company without the money for legal advice), better safe than sorry and better to give users more power (in terms of requiring their consent to use even cookies that might not need explicit opt-in to be legal, etc) than required rather than less. Both better in terms of liability, and in terms of ethics!

> However, cookie notification banners are nothing to do with GDPR! They are to comply with an earlier (but still active after GDPR) bit of legislation, the 2002 'ePrivacy Directive' (sometimes known as the "cookies law").

The cookie banners people are now complaining about are literally companies skirting or otherwise breaking GDPR. Because they now have to ask for your consent before the siphon your data and sell it wholesale to the highest bidder.

Sorry if I wasn't clear, there's confusion between banners put up because of GDPR and actual 'cookie banners'.

There are certainly plenty of examples of poorly implemented banners attempting to comply with GDPR while not actually being compliant, where consent is required, but I wouldn't call those 'cookie banners' since they generally talk about privacy and personal data, not just about cookies/local storage.

My point was that there are plenty of websites that don't need to comply with GDPR (because nothing they do falls under its scope), but they still need to comply with the ePrivacy Directive and therefore there are plenty of cookie banners used for that purposes that are a perfectly acceptable way of complying with that law - though because people are more familiar with GDPR than with the ePrivacy Directive, they see those banners and think it's a non-compliant attempt at dealing with GDPR.

I wish they's update the ePrivacy directive :)

---

I think, but don't quote me in that, that with ePrivacy you don't really need a banner, but an explanation that you use cookies. But that is a minor issue

I think there is an update being discussed? Away from my desk but will look in a bit

I saw this discussed in my Twitter feed today, so second-third-hand account is that the update has been in the works for almost a decade, being fought tooth and nail by the same companies that fight any other privacy initiative.

Hearsay and rumors, so don't take this seriously

Ah yeah, this is what I came across earlier when looking for the full 2002 text: "Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL concerning the respect for private life and the protection of personal data in electronic communications and repealing Directive 2002/58/EC (Regulation on Privacy and Electronic Communications)"

But it's from 2017... https://eur-lex.europa.eu/legal-content/EN/TXT/?darkschemeov...

(If the twitter discussion was interesting, any suggested accounts to follow for this sort of topic?)

It was a couple of acquaintances discussing GDPR :)

I guess you'd want follow

- Felix Reda https://twitter.com/Senficon (former European MP for the Purate Party)

- NOYB EU https://twitter.com/NOYBeu (fighting the GDPR fight)

- Max Schrems https://twitter.com/maxschrems (https://en.wikipedia.org/wiki/Max_Schrems)

These are more or less the usual suspects you'd follow :)

Cheers :)

I've been observing this space and a lot of those smaller companies didn't bother to ensure personal data is safe, so it's not like they're the victims here.

There was already one large crackdown on non-compliant cookie banners, and even large entities had to stop fooling around and implement them properly.

The leftovers need to be picked up one by one, but that necessarily takes time.

The people on this site who criticize the GDPR don't even know what the GDPR does, including you. Cookie banners aren't from the GDPR, they're from the ePrivacy Directive as amended in 2009. I don't understand how you people even mix this up, the cookie banners appeared several years before the GDPR existed. It's like this site is a big pity party of surveillance capitalists whining into an echo chamber, remixing and repeating each other's confusions without any feedback from reality.

Maybe (I'm too lazy to check this out). But from what I remember only after GDPR those banners went viral in clumsy, annoying, not useful and frequently unnecessary implementations. Maybe it's because of hefty fines introduced in the context of GDPR.

My point is: Did it help fighting privacy issues? I don't think so. Did it harm? I do think so. Will it ever be somehow measured for its effectiveness and be taken back/changed to be more effective? I don't think so. So better get rid of it.

I seem to recall that before the GDPR, cookie banners were basically a single "OK" button, annoying but at least usually floating near the bottom of the page. After GDPR. they became dark-patterned modal nests of unfathomable checkboxes and submenus.

I don't think it has made of jot of difference for privacy, but it sure has degraded the user experience of using the web.

> GDPR those banners went viral in clumsy, annoying, not useful and frequently unnecessary implementations. Maybe it's because of hefty fines introduced in the context of GDPR.

The problem is that not enough fines have been meted out. Had they been, we'd see less of the unuseful, annoying, unnecessary banners. Because they are this way on purpose: to make you "consent" to wholesale collection and trading of your data.

I was complaining about the cookies banners in 2009, but ok people tend to conflate the two but it is not fair to lash out to people saying they don't like X with a simple rebuff that the thing is actually called Y. China makes the hardware, America writes the software and the EU makes the regulation, is a very common critique of technical people in the tech sector who lack political and economical power compared to the value they create.

Reply on news.ycombinator.com