Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The GDPR blog post

medium.com

Post reply on HN
Print view View original

41–50 of 144 posts

Re: The GDPR blog post

#41

Post by dmortin »

y0ghur7_xxx wrote: post #39
dmortin wrote: post #36

Earlier quoted context omitted.

> AND you can NOT deny me reading an article without giving consent They can't, but they can, for example, ask for a fee to read the article. They don't deny you reading it, but they don't have to give it to you for free either. Either you share your data, so they can make money to operate the site, or you don't, but then the content is not free. I expect some sites will choose this route.

> They can't, but they can, for example, ask for a fee to read the article. They don't deny you reading it, but they don't have to give it to you for free either. Of course they can charge a fee. They should. > Either you share your data, so they can make money to operate the site, or you don't, but then the content is not free. No. My data is not a commodity exchange. The GDPR makes that VERY clear. I can not pay wi…

You can pay with your data if you consent to it. It's your data, your choice. But if you don't consent then prepare your credit card for payment.

Most people then will choose the free version.

Re: The GDPR blog post

#42

Post by dullgiulio »

kbsletten wrote: post #37

So, I'm really not trying to start a fight, please read this with curious intent. I personally don't really feel like keeping my email is a violation of my privacy. If they're not "processing" it (that feels like code for "data mining") is this really required? I mean my email address is literally a public means of contacting me. It's kind of fun that they decided to use a one-way hash, but this story doesn't make me…

Keeping your email without a use case is a violation of your privacy.

How would you feel if you had to give your home address to the baker to buy a pastry?

Re: The GDPR blog post

#43

Post by chopin »

TeMPOraL wrote: post #34
dpwm wrote: post #31

Earlier quoted context omitted.

I think it's more likely that "to make Medium make money," they engage in tracking for advertising purposes. Medium works perfectly well for my purposes without that banner being displayed. I can open up developer tools and delete that node. If I don't click agree, does that mean that this information isn't collected? Because tracking cookies are still placed. Now what is interesting is that I don't remember being as…

> Now what is interesting is that I don't remember being asked for consent for them to place a cookie to log the number of articles I read in a month as part of their sign-up funnel. They could probably make this compliant by storing the counter in your local storage and never sending it anywhere - just having a piece of JS that essentially does: if(Storage.getItem("visits") > 6) { displaySignnupPopup(); }

I block JS wherever I can, though.

Re: The GDPR blog post

#44

Post by chopin »

Vinnl wrote: post #38
TeMPOraL wrote: post #3

A popup (probably what used to be cookie warning) on Medium says: > Medium uses browser cookies to give you the best possible experience. To make Medium work, we log user data and share it with processors. To use Medium, you must agree to our Privacy Policy. I must agree to logging user data and sharing it with processors? EDIT: come to think of it, it might be a new, GDPR-specific, dark pattern. I can use the site w…

"Processors" need theoretically not be advertising/tracking networks, but could also e.g. be payment processors. That is something that I could imagine classifies as necessary.

Consent must be given for a specific purpose. It is debatable whether a generic "we need to share your data with our processors" is sufficient. I doubt it.

Re: The GDPR blog post

#45

Post by JackC »

kbsletten wrote: post #37

So, I'm really not trying to start a fight, please read this with curious intent. I personally don't really feel like keeping my email is a violation of my privacy. If they're not "processing" it (that feels like code for "data mining") is this really required? I mean my email address is literally a public means of contacting me. It's kind of fun that they decided to use a one-way hash, but this story doesn't make me…

No idea if deleting the email is required under GDPR, but for a taste of why it might be, imagine scaling up a bit. If they keep one email in this scenario, they're keeping one personal fact: email A is affiliated with email B. Suppose that process runs at scale for a while, and ends up with a database of 10 million email addresses averaging 100 connections. That becomes a digital map of society, with lots of private facts hidden in it -- a valuable/dangerous pile of surveillance to leave lying around for no reason, even if they're not actively using it.

There's a big difference between one fact and a billion, of course. But that's what keeps happening on the internet -- what feels like one small harmless thing turns out not to be harmless at scale, with no real warning that you're crossing from one regime to the other.

Re: The GDPR blog post

#46

Post by Aaargh20318 »

kbsletten wrote: post #37

So, I'm really not trying to start a fight, please read this with curious intent. I personally don't really feel like keeping my email is a violation of my privacy. If they're not "processing" it (that feels like code for "data mining") is this really required? I mean my email address is literally a public means of contacting me. It's kind of fun that they decided to use a one-way hash, but this story doesn't make me…

> If they're not "processing" it (that feels like code for "data mining") is this really required? I mean my email address is literally a public means of contacting me.

It's also a means of identifying you. It's not just the piece of data, even if it's only your mail address that is stored it can be sensitive information due to context. Say, due to a data breach a list of all members of a company's mailing list is leaked. You might not mind too much if your publicly known mail address shows up on Amazon's mailing list, but you might care if it shows up on the leaked mailinglist of transexual-midget-porn.com

Re: The GDPR blog post

#47

Post by zerostar07 »

MitjaBezensek wrote: post #24
zerostar07 wrote: post #18

Earlier quoted context omitted.

Warning though: that site is not gdpr-compliant

Why? Is there a company behind this webpage?

doesnt have to be a company. it processes data and it's not a strictly personal site, it's all over the internet in fact.

Re: The GDPR blog post

#49

Post by merinowool »

So far I have received over 300 GDPR emails. When I am supposed to read all this? How do I track it? How can I track what each company stores about me? Do I feel this in any way improved safety of my data? I don't think so.

Re: The GDPR blog post

#50

Post by pferde »

krageon wrote: post #8
TeMPOraL wrote: post #3

A popup (probably what used to be cookie warning) on Medium says: > Medium uses browser cookies to give you the best possible experience. To make Medium work, we log user data and share it with processors. To use Medium, you must agree to our Privacy Policy. I must agree to logging user data and sharing it with processors? EDIT: come to think of it, it might be a new, GDPR-specific, dark pattern. I can use the site w…

The most hilarious part of that is that you really don't need to. I've added a blacklist for everything (first party JS, styling, images) on medium.com and everything continues to work just fine. I don't remember specifically why I did that, but it's probably a dark pattern (such as a modal that pops up after one paragraph of reading) that annoyed me in the past.

Hm, they must have changed how the site works. A while ago, I decided to simply skip any medium.com link posted to HN, because a) it was a crap experience reading on mobile, b) it was a crap experience reading with javascript disabled and c) with javascript enabled, the site was too annoying
Post reply on HN