Hacker News Reader

cccbbbaaaon EU opens Microsoft antitrust investigation into Teams bundling

Yeah, once again, disregarding the actual charges. I don't want to say you're wrong, just that looking at the fines is, in my opinion, not a good measure and doesn't give a good picture.

cccbbbaaaon EU opens Microsoft antitrust investigation into Teams bundling

I don't think starting with a conclusion, only looking at the fines instead of the charges, ignoring factors that could influence the outcome (eg. EU companies being more familiar with EU regulations and regulators, for better or worse), and cherry-picking will give you a good opinion on how the EU works.

cccbbbaaaon EU opens Microsoft antitrust investigation into Teams bundling

Help yourself: https://competition-cases.ec.europa.eu/search?sortField=case...

cccbbbaaaon U.S. Senate bill crafted with DEA targets end-to-end encryption

You're right, but we see a lot of people saying EU wants to ban encryption with the CSAR proposal, using it to argue that they don't care about privacy.

I wanted to bring nuance in the discussion, by posting sources to EU bodies (EDPS, EDPB, many associations, and probably the ECJ if it came to that) and members (Germany, Estonia, Finland per your own link) that disagrees with the proposal, or are outright denouncing it as illegal.

EU, as HN, is not uniform, and while it is not the privacy heaven some claim it is (I don't -- I think GDPR is not strong enough and not correctly applied; the ePR proposal seems to be nightmarish thanks to my own country), nor “they don't care”.

cccbbbaaaon Ubisoft account -including games- can be permanently deleted for inactivity

Legitimate interest is the most fragile basis in GDPR and should not be relied upon, apart for server logs as suggested by recital 49. Contract (art. 6(1)b) may be better here, but keep in mind that art. 5(1)e still applies.

cccbbbaaaon U.S. Senate bill crafted with DEA targets end-to-end encryption

The situation in EU is more nuanced than what HN wants you to believe:

https://www.euractiv.com/section/law-enforcement/news/eu-wat...

> Wiewiórowski said this type of indiscriminate scanning of private communications “will always be illegal under the Charter of Fundamental Rights (and probably under several national constitutional laws as well),”

https://edps.europa.eu/system/files/2022-07/22-07-28_edpb-ed...

https://www.patrick-breyer.de/en/summary-of-statement-by-the...

https://www.patrick-breyer.de/en/leaked-eu-council-legal-ana...

See also the repeated ECJ decisions against IP retention.

cccbbbaaaon No cyber resilience without open source sustainability

> the overwhelming majority on HN is aware of GDPR, knows at least tangentially how poorly written EU directives are

No. Most GDPR threads on this website are full of speculation or beliefs that are backed by nothing. Most comment authors would not be able to provide a source to their claims, either with a citation from the legal text, interpretations (eg. From the EDPB, a DPA, or even the GDPRHub stuff), or actual cases. They don’t even make the effort to understand its principles (data minimization, transparency). And I don’t see how you can say that EU directives and regulations are poorly written when you don’t even take the time to read the one that may have an impact on your work. I know developpers here are not lawyers, but neither am I-but I still read the thing (and ePrivacy) so I actually know my rights, and can ask somewhat relevant questions wrt. data protection in my work.

cccbbbaaaon Big Tech can transfer Europeans’ data to US in win for Facebook and Google

https://www.euractiv.com/section/law-enforcement/news/eu-wat...

cccbbbaaaon EU signs off on data transfers deal with US

Yes, for two or three years.

cccbbbaaaon EU signs off on data transfers deal with US

noyb is ready to challenge this https://noyb.eu/en/european-commission-gives-eu-us-data-tran...

cccbbbaaaon Wayland on OpenBSD

If you use the DRI2/3 extensions, or Xft fonts, and chances are you are, you don't benefit from X11's network transparency. Anyway, you can do forwarding with waypipe under wayland.

cccbbbaaaon Red flags in the Threads privacy policy

GDPR require equivalent protections, not to store data in the EU.

cccbbbaaaon French Assembly to allow remote police surveillance via phone cameras and mics

Under GDPR, if you process personal data, you are required to have a clear scope: which data, why, for how long is it retained, under which legal basis (articles 5 and 6), etc. Selling data later would be a misappropriation of legal basis.

More info here: https://commission.europa.eu/law/law-topic/data-protection/r...

cccbbbaaaon Illegal Life Pro Tip: Want to ruin your competitor's business?

https://noyb.eu/en/telesign-profiles-half-worlds-phone-users

I did not gave my data to TeleSign but apparently they have it. And my operator did not tell me.

cccbbbaaaon Illegal Life Pro Tip: Want to ruin your competitor's business?

Maybe article 22 (“automated individual decision-making, including profiling”) can be useful here, too. This will not work if the account is not nominative though.

cccbbbaaaon Ask HN: Refusing all cookies, still targeted by ads. How?

An IP alone is personal data. Recital 30 should be enough, but it has been asserted time and time again by DPAs and courts. See also: https://commission.europa.eu/law/law-topic/data-protection/r...

cccbbbaaaon Is Google reCAPTCHA GDPR Compliant?

Any piece of information that can be related to someone using supplementary information. Eg. My personnal email address contains my name, so I can be identified direclty; my phone number doesn’t, but my operator and contacts knows who is behind it, so I can be identified indirectly.

cccbbbaaaon Is Google reCAPTCHA GDPR Compliant?

So someone can be identified, directly or indirectly, with an IP address, making it personal data under GDPR, art. 4(1).

cccbbbaaaon Is Google reCAPTCHA GDPR Compliant?

Yes, this is what the Cnil suggests for people that want to use Google Analytics.

cccbbbaaaon Ask HN: Refusing all cookies, still targeted by ads. How?

Storing counts as processing under the GDPR; the definition is in article 4. It's not hard to find.

> ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...

One can use the “legitimate interest” basis (recital 49 may be relevant here) or “compliance with a legal obligation” for logging.

cccbbbaaaon Ask HN: Refusing all cookies, still targeted by ads. How?

Logs are acceptable under the “legitimate interest” basis if you need them to secure your service (GDPR recital 49 and https://www.cnil.fr/sites/default/files/atoms/files/recomman...). In some countries, you may have to retain them for some time: “legal requirement” is applicable here.

cccbbbaaaon Ask HN: Refusing all cookies, still targeted by ads. How?

If you are able to identify a unique user from its browser fingerprint, then it's personal data: GDPR applies. And for ad purposes, consent is pretty much required.

cccbbbaaaon Ask HN: Refusing all cookies, still targeted by ads. How?

This is wrong. Cookies are covered by ePrivacy, article 5(3), not GDPR. There are two regimes for cookies: strictly necessary ones, and others, requiring consent. The fact that disabling “legitimate interest” cookies does not break the service should tell you that they are not strictly necessary.

GDPR enters the picture when cookies are used to identify users. And using the “legitimate interest” basis for ad purposes is illegal, and instead will require consent. Adtech is just hoping that users won't notice and lodge a complaint.

cccbbbaaaon Ask HN: Refusing all cookies, still targeted by ads. How?

Correct; the actual “cookie law” (ePrivacy 2002/58/CE) talks about “the use of electronic communications networks to store information or to gain access to information stored in the terminal equipment of a subscriber or user”. https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...

So local storage is also covered by this law. For other fingerprinting techniques, if you can identify a user, GDPR applies. And for ad purposes, the only realistic legal basis is consent.

cccbbbaaaon EU suggests breaking up Google's ad business in preliminary antitrust ruling

Sure, but remember that:

- the so-called “cookie law” is not limited to cookies (see ePrivacy article 5(3) for more information, it's actually any technique allowing to store or retrieve information from a user's terminal);

- ePrivacy exists since 2002 (so, decades);

- any kind of tracking allowing to identify unique users will require consent, cookies or not.

cccbbbaaaon Meta fined $1.3B over data transfers to U.S.

GDPR (and the national laws it replaced) does not exist in a vacuum, but is an implementation of ECHR art. 8, and CFREU art. 7 and 8. If it is changed, odds are it will become stronger, not weaker. And it is quite foolish to think the CFR will be changed to accommodate companies like Meta.

cccbbbaaaon Meta fined $1.3B over data transfers to U.S.

That's exactly why the privacy shield was invalidated by the CJEU.

cccbbbaaaon Meta fined $1.3B over data transfers to U.S.

Privacy is a human right in the EU.

cccbbbaaaon Who wants to be tracked?

There's 6 legal basis under GDPR, but that's irrelevant for cookies (or anything that allows you to store or retrieve information on the user's device, really), because they're covered by the older ePrivacy directive. If a cookie is not “strictly necessary”, consent is required.

cccbbbaaaon Google Analytics 4 was frustrating, so we built our own analytics service

You're mostly right, but legitimate interest also require balance. Fingerprinting may be considered to be too intrusive if logs are enough.