cccbbbaaa

CNIL disagrees and says you can need them to secure your service. Legitimate interest (art. 6(1)f) is applicable (recital 49). You can also be required by law to keep them for some time, so legal requirement is applicable (art. 6(1)c). Other uses may require consent.

Cf: https://www.cnil.fr/sites/default/files/atoms/files/recomman... (in French, though)

See also Articles 7 and 8 of the Charter of Fundamental Rights of the European Union (https://www.europarl.europa.eu/charter/pdf/text_en.pdf). (side note, the ECHR is why European countries have strong privacy laws since the '70s.)

The EDPS recently said that under the Charter, the infamous “Chat Control” would always be illegal in the EU: https://www.euractiv.com/section/law-enforcement/news/eu-wat....

The reason for this slow movement is because EU made a new agreement (Privacy Shield) that did not address the issues of the first one, and was invalidated in 2020 by Schrems II.

I worded my previous message poorly, but I would say that keeping a product out of a market, for what I assume are legal reasons, is the opposite of following the law. Anyway, sorry for this–I should stop arguing about semantics.

The internet was already ruined by scummy companies overloading their websites with trackers. The EU just forced them to be transparent.

If they did follow EU laws, Bard would be available there…

More like GDPR violation thanks to Schrems II.

Plenty of people already argued that LLMs don't actually learn like a human. However, you should keep in mind the reason why clean-room reverse engineering exists: humans learn from source material. FLOSS RE projects (e.g. nouveau) typically don't like leaks, because some contributors might be exposed to copyrighted material. Sometimes, the opposite happens: people working on proprietary software are not allowed to see the source of a FLOSS alternative.

I don't know about other laws, but GDPR does not say “immediately”, but “without undue delay”. In practice, it is within one month, extensible by up to two months (cf. art 12).

It replaced Python for everything longer than a couple hundred of lines long for me. Fast language, fast compile times, clean(-ish) syntax, strong typing system, good ecosystem, and now multicore support? Yes please!

I must be more nuanced, though: existing libraries in opam are generally very, very good (I really like cmdliner), but many things may be missing. There is no alternative to Django, for instance. No serious IDE, except emacs. The standard library was so lacking that there is at least an alternative. The situation improved, but there's still missing stuff compared to Python.

I get that. I'm saying that what you think is missing in existing privacy laws, actually already exists.

> GDPR requires you to request consent for any cookies the “could” be used to identify you, which makes them personal information.

> So if you want to use cookies to link a user’s sessions on your own website together (without actually identifying them) so every request doesn’t look like a totally anonymous, opaque request, then you must show a cookie banner.

Wrong. The ePrivacy directive has an exception for strictly necessary cookies (Article 5.3), which is applicable for user sessions.

The ePrivacy directive: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL... Search for “strictly necessary”. More details in this opinion from WP29, see section 3.2: https://ec.europa.eu/justice/article-29/documentation/opinio...

> You could (presumably) do this through browser fingerprinting and not require consent (since you don’t actually enrich/link the browser fingerprint to be become user data) but you need a cookie banner if you do it with a cookie.

Are you able to identify someone from the fingerprint of their browser? Then the fingerprint is PII. Consent (or any other legal basis from GDPR Article 6) is therefore required if the exemption from the ePrivacy directive is not applicable.

GDPR Article 6: https://www.privacy-regulation.eu/en/6.htm

Data retention limitations are absolutely a thing in GDPR and previous European laws (ie. Informatique et Libertés).

Because DNT barely existed when ePrivacy was last amended, back in 2009.

It depends on the product range. G0s and G4s seems to be available on mouser.

I'm pretty sure Arduino already sold better boards based on Atmel SAMD for years (the Zero and various Nanos). Also, Arduino is not the only game in town. I recently bought two Nucleo G431KBs; it costed me less than a single Uno R3, they are more powerful than this R4, and they are supported by their IDE.

DNT barely existed when ePrivacy was last amended, back in 2009.

Not sure why we should want to make companies less responsible in the first place. Anyway, as I said earlier, GDPR does not imposes burdens specifically on websites, but on any kind of PII processing. It is not the place to add provisions specifically for web browsers. I understand that the next ePrivacy regulation wants to make it more user friendly, but negotiations for this bill have stalled for years.

The DNT header already exists. Go figure out why it is ignored (is it too user friendly?) And since the GDPR has a large reach (it covers PII in all form, not only stored digitally), it is not the place to mandate it.

And GDPR forbids holding the data for longer than necessary, except in some very restricted cases (cf. art. 5(1)e.)

Which is to be expected: GDPR basically is a harmonisation of the various privacy laws that existed in various member states before.

As I can't find when olestra products were sold in the EU, the answer seems to be “no”. Don't hesitate to prove me wrong though.

I'm afraid you are wrong for the global disallow button, as informed and specific consent is necessary to allow the processing of personal information, not to forbid it. See the definition in article 4(11), and the definition of the basis in article 6(1)a.

I know that cookie banners exist since ePrivacy. That's why I mentioned it. But ePrivacy does _not_ mandate them. The adtech industry could have respected the DNT header.

Because similar laws already existed in member states, sometimes for literal decades, before GDPR came along.

Neither ePrivacy nor GDPR require cookie consent popups, instead they basically say that tracking requires consent. GDPR only mentions cookies once, in its recitals. It's the adtech industry that decided to ignore DNT.

Thankfully, there is still 38 pages left after that quote. You will have a hard time finding a flowchart in a law though…

Anyway, my point was that the fines dispensed nowadays are sensible. As for the future, DPAs know very well that the instant they go rogue, ie. distribute disproportionate fines or misinterpret the law, their decisions will be reversed by an appeal court. It already happened, in fact.

edit: I just read this on the website of my govt:

> The court that sentences the offender is free to set the amount of the fine, but not to exceed the maximum amount set for that offence.

Turns out judges here have even more leeway than my DPA! The finepocalypse should come any day from now. And don't get me started on courts of assizes.

> The fine is arbitrarily decided. There isnt anything solid governing the amount if the fine is not % of revenue

This is wrong. See GDPR article 83, and https://edpb.europa.eu/system/files/2022-05/edpb_guidelines_...

Per your link, proportionality seems to be working. Big fines are directed towards big companies (cf. Fines Statistics). For individuals (“private person” or “private individual”), it seems they mostly are fined 3-digits amounts, with some in the 4-digits, and 3 at 10-11k.