Ask HN: Could EU residents comment on how the GDPR has improved their privacy?

> [those that] don't prompt to ask if they can hoard your data [don't have their IT in correct order]

It's kind of the opposite: if they need to ask for your consent, that means they're doing something that is not part of the standard exceptions.

For example, if they only use your data to do what you asked them to do, they don't need consent. If I ask Contoso to ship me a horse, they don't need my consent to process my address.

Every time you see a cookie banner, the message is: we want to invade your privacy.

If you want to find those that don't have their data protection in order, look for sites without privacy policy, or policies that were updated prior to ~2016 (that's when the GDPR text was finalized, i.e. the earliest time they could have updated it to be compliant with new requirements). A cookie wall is a signal that it's bad, not that it's good.

> I barely receive any out of the blue marketing calls or texts anymore

That's strange, as anti-spam legislation is completely separate from GDPR and has been in place for much longer. The only connection I see is that data brokers got a harder time selling your data to these third parties that would call or text you, but what those third parties were doing was already illegal and still is for the same reason (so not because of GDPR).

In the Netherlands it hasn't been legal to cold call someone that opted out of cold calls (using a national register of phone numbers that don't want to be called) since 2009. Any marketing call you do receive has to offer enrolling you on this list to prevent future calls.

For email, again speaking of Dutch laws, companies are not allowed to send you unsolicited, promotional messages. Not sure as of which year this is, but it has been the case for as long as I remember.

I assume most EU countries have similar constructions (I'm not sure if our laws are based on a EU directive).

I find it interesting how Google still does this on sites like blogger. I ignore the banner covering 80% of my mobile screen and read the article but agree to nothing. They'll probably still process my data despite me not agreeing to it, and when the day comes, someone will sue them, an investigation will be held, and a large fine will be collected.

What I find strange is that google's army of lawyers doesn't seem worried about this.

We're not a SaaS - but we noticed GDPR appearing as a requirement in RFx's

Our software does contain customer information, but isn't the focus. As somebody actually designed it properly, compliance wasn't particularly arduous. Huge sections simply didn't apply, and where it did we could just link each requirements to the relevant details, API, logs etc.

As you mention, I think the main benefit is just formalizing something that should already have been designed.

Another benefit is that it's driven 'bottom up' - Customer doesn't have to pay every vendor to provide them a new feature for say "scrubbing a customer". All their providers supply "here's how you scrub in my product" and customer just needs to stitch these mechanisms together to give their customers the ability to be scrubbed.

Having used the ICO to try and stop a company illegally collecting biometric information for access to a gym I am not confident it is very effective. Not only did the gym not stop but the ICO all but rubber-stamped what they were doing. Just like the data protection act before it on a daily basis on the web you see companies openly breaking the law with the wrong defaults and reports just disappear into a pit with the ICO.

The law exists but it isn't enforced by the regulator and the way the GDPR law is set up there is no way to bring private prosecutions to enforce fines and get the law applied. So since the regulator isn't doing it the law is effectively useless. Some companies are complying but the bad ones are seeing no consequences and the compliant ones are bound to notice soon that they can safely ignore it completely soon enough. It has no enforcement currently, there is no rush to ensure your company complies.