Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why are law documents (GDPR) so difficult to understand?

news.ycombinator.com

Post reply on HN
Print view View original

61–70 of 85 posts

Re: Ask HN: Why are law documents (GDPR) so difficult to understand?

#61

Post by ryanobjc »

dc2 wrote: post #41
eldavido wrote: post #23

This might sound a little mean, and I don't mean it to be this way, but this is a really naive viewpoint. Look at any profession -- accounting for instance -- and they have all sorts of stuff like this. As an example, there's a concept in accounting of "materiality" - basically, something that's big enough to matter. Materiality is what lets fortune 500 companies present their financial statements rounded to the near…

I do understand this. I am just wondering what happens when there is a vested interest in attacking or suppressing the company involved. For example, if a company becomes unpopular on social media and by "public opinion" (such as Facebook right now), a court can feel pressured into a slanted decision. Given that so much is now based on opinion, what defense does the company have? It seems that if someone had the inte…

Perhaps you could describe how you would pressure a judge successfully?

I often see comments like this, abstract what ifs without any details on what.

So, try to illustrate what might happen. Also, describe what protections the judges might have against this. It’s a useful mental exercise and you might realize that it’s a fair bit harder than posting on 4chan or Twitter.

Re: Ask HN: Why are law documents (GDPR) so difficult to understand?

#62

Post by ryanobjc »

wonton2 wrote: post #29
Tomte wrote: post #3

You don‘t really expect a law to specify which hash algorithm you‘re supposed to use, do you? The answer is simple: the law will stand for a long time, and legislators know their limits. Unlike many engineers, unfortunately. Having courts interpret laws, with help from experts, is not a bug, but a feature!

I really like this explanation. I think code could be thought of as extremely formal requirements interpreted by the computer extremely rigidly (called instructions). And the process of making software is a translation from high level requirements specified in all sorts of ways (like this law text) to gradually lower levels of abstraction. We meet somewhere in the middle by using apis/sdks. And I think programming la…

I disagree with “code can be thought of as formal requirements” - perhaps if you twist the meaning of the word requirement, yes.

This analogy puts us into a place where we mix intent and implementation and make them the same. It doesn’t allow for bugs in a sense.

This is why I dislike analogous thinking!

Re: Ask HN: Why are law documents (GDPR) so difficult to understand?

#63

Post by jakeogh »

billconan wrote: post #56
jakeogh wrote: post #39

Earlier quoted context omitted.

What a wonderful feature for the professional astroturfing companies. Are public comments really "personal data"? This is part of the war on general purpose computing, it's an attack on memory.

no, email addresses are. I think GDPR considers emails addresses and perhaps cookies personal information, as a person can be identified by them.

And IP's. Comments are easily used to writeprint (ID) commentators even if they don't contain "personal information".

Re: Ask HN: Why are law documents (GDPR) so difficult to understand?

#64

Post by zanny »

matthewmacleod wrote: post #45
evervevdww221 wrote: post #14

Earlier quoted context omitted.

What if this law will be abused as a tactic to attack business competitions? Why would that happen? > For example, Business A has a competitor startup B who has less resources to hire security consultant. Business A hence hired person C to register the service provided by B with a weak password and hire D to breach C's account. C claims that he has been hacked, so he brings startup B to court. B goes bankrupt because…

B goes bankrupt because it runs out of money to hire lawyers. Right, that's like any other malicious lawsuit – i.e. this is totally irrelevant. I'm self learned, garage based entrepreneur with $1000 in my bank to either buy food or hire a consultant, is that required experience? Yes. If you don't have the knowledge or resources to correctly comply with appropriate regulation, then you should not be operating in a spa…

So just set the bar of compliance to start any company at several hundred thousand dollars (which is pretty much where it is) and you get the lovely contemporary effect of 40 year lows in new business creation[1][2].

There are active, observable, and semi-quantifiable costs to society when lawmakers create arcane, incomprehensible laws meant to prevent entry into markets by making the barrier of compliance too high for most people to afford to compete.

[1] http://money.cnn.com/2016/09/08/news/economy/us-startups-nea...

[2] https://www.washingtonpost.com/news/on-small-business/wp/201...

Re: Ask HN: Why are law documents (GDPR) so difficult to understand?

#65

Post by Sir_Substance »

eldavido wrote: post #23

This might sound a little mean, and I don't mean it to be this way, but this is a really naive viewpoint. Look at any profession -- accounting for instance -- and they have all sorts of stuff like this. As an example, there's a concept in accounting of "materiality" - basically, something that's big enough to matter. Materiality is what lets fortune 500 companies present their financial statements rounded to the near…

>For really complicated stuff, implementation is often delegated to an agency, such as the FCC, to create specific guidelines like you want.

If you start at around article 43 and work your way onwards, over the next 20 or so articles the GDPR document goes on to specify that all nations should set up organizations to perform this task and that these organizations have a responsibility to create and make available such specific guidelines.

Re: Ask HN: Why are law documents (GDPR) so difficult to understand?

#66

Post by nitwit005 »

Tomte wrote: post #3

You don‘t really expect a law to specify which hash algorithm you‘re supposed to use, do you? The answer is simple: the law will stand for a long time, and legislators know their limits. Unlike many engineers, unfortunately. Having courts interpret laws, with help from experts, is not a bug, but a feature!

They're delegating creating the detailed regulations to the courts. When some court rules that something is acceptable, or unacceptable, you'll know what the "real" rule is.

Another approach some countries have taken is to have laws cite some set of government regulations, which some part of the government is supposed to update. That tends to be even messier as the courts still get involved, but at least you get faster updates.

Re: Ask HN: Why are law documents (GDPR) so difficult to understand?

#67

Post by matthewmacleod »

zanny wrote: post #64
matthewmacleod wrote: post #45

Earlier quoted context omitted.

B goes bankrupt because it runs out of money to hire lawyers. Right, that's like any other malicious lawsuit – i.e. this is totally irrelevant. I'm self learned, garage based entrepreneur with $1000 in my bank to either buy food or hire a consultant, is that required experience? Yes. If you don't have the knowledge or resources to correctly comply with appropriate regulation, then you should not be operating in a spa…

So just set the bar of compliance to start any company at several hundred thousand dollars (which is pretty much where it is) and you get the lovely contemporary effect of 40 year lows in new business creation[1][2]. There are active, observable, and semi-quantifiable costs to society when lawmakers create arcane, incomprehensible laws meant to prevent entry into markets by making the barrier of compliance too high f…

The GDPR is not arcane or incomprehensible. It’s quite simple, there are a million explanations out there about how to comply, and even in the case you don’t get it right regulators will invariably give you the benefit of the doubt.

Many things might cause low levels of business creation. I am entirely unconvinced that the cost of regulation is one of them.

Re: Ask HN: Why are law documents (GDPR) so difficult to understand?

#68

Post by oliwarner »

I won't beat about the bush. If you don't understand the laws, or don't know how to keep your stack secure, YOU SHOULD NOT COLLECT PERSONAL DATA!

Ignorance isn't an excuse.

It is a burden. It's supposed to be a burden. It's supposed to make it harder for companies to amass toxic dumps of sensitive data, that go onto get hacked. And to stop the Facebooks of the world weaponising every anecdote they can link to you.

It's a good set of measures. It's just going to be a cock to comply with some times. I get that. I'm going to have to comply with it. But I'm happy that companies I deal with will also have to deal with it, for my sake, as a consumer.

Re: Ask HN: Why are law documents (GDPR) so difficult to understand?

#69

Post by dc2 »

Tomte wrote: post #52
dc2 wrote: post #41

Earlier quoted context omitted.

I do understand this. I am just wondering what happens when there is a vested interest in attacking or suppressing the company involved. For example, if a company becomes unpopular on social media and by "public opinion" (such as Facebook right now), a court can feel pressured into a slanted decision. Given that so much is now based on opinion, what defense does the company have? It seems that if someone had the inte…

That's why we have independent judges. "Pressuring a judge" would be an impressive feat. They are generally obnoxiously aware of their untouchable status. And if society's stance really changes, we want the courts to take that into account. Again. feature, not bug.

Well I'm talking about exactly that - social pressure.

Just because popular opinion (aka the vocal social media / news / social media echo chamber) approves of something, it doesn't mean it is correct.

Governments and courts have definite pressure to legalize marijuana, for example. That pressure is based on popular public opinion. Therefore approving it gives that legal body or state acceptance / goodwill. This is an incentive that goes quite far.

It can also be popular to smash a company.

Re: Ask HN: Why are law documents (GDPR) so difficult to understand?

#70

Post by dc2 »

ryanobjc wrote: post #61
dc2 wrote: post #41

Earlier quoted context omitted.

I do understand this. I am just wondering what happens when there is a vested interest in attacking or suppressing the company involved. For example, if a company becomes unpopular on social media and by "public opinion" (such as Facebook right now), a court can feel pressured into a slanted decision. Given that so much is now based on opinion, what defense does the company have? It seems that if someone had the inte…

Perhaps you could describe how you would pressure a judge successfully? I often see comments like this, abstract what ifs without any details on what. So, try to illustrate what might happen. Also, describe what protections the judges might have against this. It’s a useful mental exercise and you might realize that it’s a fair bit harder than posting on 4chan or Twitter.

See reply to Tomte on that.
Post reply on HN