Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why are law documents (GDPR) so difficult to understand?

news.ycombinator.com

Post reply on HN
Print view View original

11–20 of 85 posts

Re: Ask HN: Why are law documents (GDPR) so difficult to understand?

#11

Post by nannePOPI »

Most laws of this kind are made so that they can exclude small players from the market.

If something goes wrong, Facebook can easily hire an army of lawyers and "prove" that they "processed [data] in a manner that ensures appropriate security".

But a small player can't do that. This has the follow advantages for big corps and governments:

1. Big companies can use the laws to destroy small companies (they just need to push the enforcers of regulations in the right direction, maybe with a little gift or something wink wink) 2. People don't even try to create a small company, because it's too risky, so big companies don't have to face any competition at all 3. Governments and other institutions can use the laws to stop people who spread informations or products that go against their interest. In fact the main reason for GDPR is stopping the spreading of true informations about the current political situation in Europe (what they techinically call "fake news"). It's much easier to control the web if you only have Facebook, Youtube and other channel you can easily manipulate. Good luck instead controlling hundreds of thousands of small blogs, mailing lists, chat rooms, etc

Re: Ask HN: Why are law documents (GDPR) so difficult to understand?

#12

Post by Chaebixi »

aurizon wrote: post #2

Lawyers wished to create a 'walled garden' for their knowledge and methods. Doctors do the same and the churches also did it. These people charge fees for access to this knowledge and do not want easy access to the general public. recent advances in AI endanger many jobs at law firms and medical practices and may result in fewer jobs - at law firms at least. I expect the medical and legal lobbyists will bribe our ele…

> Lawyers wished to create a 'walled garden' for their knowledge and methods. Doctors do the same and the churches also did it. These people charge fees for access to this knowledge and do not want easy access to the general public.

And programmers do the same thing, using a secret language called "code" to make their work incomprehensible to mere mortals. /s

More seriously, I've heard it stated that there are actually a lot of similarities between legalese and software code, as they're both constrained languages to meant to make certain kinds of statements more precise.

Re: Ask HN: Why are law documents (GDPR) so difficult to understand?

#14

Post by evervevdww221 »

matthewmacleod wrote: post #9

I found this regulation put too much burden on small businesses. It's not. You are wrong. What if this law will be abused as a tactic to attack business competitions? Why would that happen? How do you understand this "security appropriateness" of the above text? How can you be sure your understanding is correct? You use your knowledge or regulation to read and make decisions. If you don't have the required experience…

What if this law will be abused as a tactic to attack business competitions? Why would that happen?

> For example, Business A has a competitor startup B who has less resources to hire security consultant. Business A hence hired person C to register the service provided by B with a weak password and hire D to breach C's account. C claims that he has been hacked, so he brings startup B to court. B goes bankrupt because it runs out of money to hire lawyers.

You use your knowledge or regulation to read and make decisions. If you don't have the required experience,

> How do I know I have required experience (what experience is required is not said in the regulation text)? I know md5 is insecure and you need salting on password. I'm self learned, garage based entrepreneur with $1000 in my bank to either buy food or hire a consultant, is that required experience?

Re: Ask HN: Why are law documents (GDPR) so difficult to understand?

#15

Post by codingdave »

I did one semester of law school before deciding I didn't really want to go that route, and while I'm not going to comment on how to read this law, I can tell you my most effective technique for really breaking down the language of legal documents:

Treat every paragraph like a great big chain of boolean logic. The confusing parts of law are normally due to long paragraphs of 'and' and 'or', all mingled together. Parsing those in legal documents isn't any different than parsing them in code. But we normally don't have to think that way when reading, so it feels more confusing than it really is.

Try re-reading it specifically looking for the ands/ors, and envision how they really operate on the words of the paragraph, and legal reading will suddenly become far more clear.

Re: Ask HN: Why are law documents (GDPR) so difficult to understand?

#16

Post by spydum »

kuschku wrote: post #7

EU law is written so it can apply for many decades – when the precursor of the GDPR was written (1995), MD5 was considered secure. So, you should expect the "appropriate" part to mean the current state of the art to keep something secure. An "appropriate" hashing algorithm today would be bcrypt, scrypt, or potentially still a salted SHA512 with many rounds. An "appropriate" protection against unauthorised access woul…

I agree with your points. I think mostly the problem is there is no one specific place to find the list of "appropriate" methods to achieve the objective. Someone working in the infosec field could probably spit them out, but a dev may not be so up to date on such nuances.

Re: Ask HN: Why are law documents (GDPR) so difficult to understand?

#17

Post by [deleted] »

matthewmacleod wrote: post #9

I found this regulation put too much burden on small businesses. It's not. You are wrong. What if this law will be abused as a tactic to attack business competitions? Why would that happen? How do you understand this "security appropriateness" of the above text? How can you be sure your understanding is correct? You use your knowledge or regulation to read and make decisions. If you don't have the required experience…

[deleted]
Post reply on HN