41–50 of 98 posts
Earlier quoted context omitted.
OK. Then throw it away after that.
That is what they just announced.
Earlier quoted context omitted.
In my case, I don't use an ad blocker, but I do use Privacy Badger, which is only supposed to block tracking, and should only block ads if they can't have their tracking disabled. It looks like Privacy Badger decided "pagead2.googlesyndication.com" should now be blocked as a tracking domain. Perhaps Google should split off their nonpersonalized ads service into a different domain so such services can easily distingui…
Actually, this is something that should be fixed in Privacy Badger. They can detect the URL parameter that flips ads from personalized to non-personalized (npa=1) and block accordingly. https://github.com/EFForg/privacybadger/issues/2046
Allowing tracking cookies just because a certain parameter is present is asking for abuse.
If you are serious about not tracking people, don't use tracking cookies.
I feel like this whole thing with the GDPR is people fighting each other for the wrong reasons. The people for it argue that gets large companies to behave better. The people against it argue that it's unnecessarily complicated, poorly drafted and burdensome to small businesses. But it's both at the same time . The issue is that it doesn't have to be. It's possible to get the desired effect without using such a compl…
"cost of producing the data" seems really hard to strictly define. What's stopping a company from implementing extremely tedious procedures and billing $100 an hour to discourage people from requesting it? In addition, GPDR says that getting access to data on you is a right and it seems contradictory to have to pay for something that is your right to have.
Government agencies have been known to do this when they don't want to release FIOA information. Then they get sued over it by the ACLU or similar.
> In addition, GPDR says that getting access to data on you is a right and it seems contradictory to have to pay for something that is your right to have.
That is how all the other rights work. Freedom of the press isn't a right to use someone else's printing press without compensating them.
I feel like this whole thing with the GDPR is people fighting each other for the wrong reasons. The people for it argue that gets large companies to behave better. The people against it argue that it's unnecessarily complicated, poorly drafted and burdensome to small businesses. But it's both at the same time . The issue is that it doesn't have to be. It's possible to get the desired effect without using such a compl…
I'm not so sure - how do you make sure the cost isn't so high that it deters people with legitimate reasons to request their data, but also high enough to actually cover the cost of obtaining it? I would expect that those are two very different amounts.
If the cost of doing something legitimately exceeds the value of doing it to the person asking for it to be done, isn't not doing it then the rational outcome?
Earlier quoted context omitted.
In my case, I don't use an ad blocker, but I do use Privacy Badger, which is only supposed to block tracking, and should only block ads if they can't have their tracking disabled. It looks like Privacy Badger decided "pagead2.googlesyndication.com" should now be blocked as a tracking domain. Perhaps Google should split off their nonpersonalized ads service into a different domain so such services can easily distingui…
Actually, this is something that should be fixed in Privacy Badger. They can detect the URL parameter that flips ads from personalized to non-personalized (npa=1) and block accordingly. https://github.com/EFForg/privacybadger/issues/2046
Earlier quoted context omitted.
Your proposed solution gives companies zero incentive to minimize data collected, and even incentivizes them to make fulfilling such a request as convoluted and expensive as possible. What people online love to call "common sense solutions" are usually not solutions a all.
> Your proposed solution gives companies zero incentive to minimize data collected The expense of producing the data isn't supposed to be an incentive to minimize data collected, that is what the other sections are for. For large companies it wouldn't be regardless because they could automate the process. > and even incentivizes them to make fulfilling such a request as convoluted and expensive as possible. A company…
The cost of complying with the GDPR nightmare letter, for the average large company that's not designed around the ability to comply with it, is likely to involve multiple engineers for several months digging out the data - if not a large internal redesign to make it even possible to dig out the data. It is not outrageous that the cost of doing that work is objectively going to be hundreds of thousands of dollars. And end users aren't going to pay for that.
So the question is whether we think that it's worth it to society to cause companies to figure it out anyway, or not. If we don't, we don't need a law at all; we just let companies carry on as they are now. If we do, then we should give incentives to design your company right from the start, to minimize data collected, etc.
Earlier quoted context omitted.
I'm not so sure - how do you make sure the cost isn't so high that it deters people with legitimate reasons to request their data, but also high enough to actually cover the cost of obtaining it? I would expect that those are two very different amounts.
> I'm not so sure - how do you make sure the cost isn't so high that it deters people with legitimate reasons to request their data, but also high enough to actually cover the cost of obtaining it? I would expect that those are two very different amounts. If the cost of doing something legitimately exceeds the value of doing it to the person asking for it to be done, isn't not doing it then the rational outcome?
Imagine if a city with no roads, with just human-width sidewalks between skyscrapers. The cost of moving all the skyscrapers to fit even a single road is enormous; no single driver would be willing to pay it for the incremental benefit of being able to drive. Would you say that this means that rationally the society should never build roads?
I feel like this whole thing with the GDPR is people fighting each other for the wrong reasons. The people for it argue that gets large companies to behave better. The people against it argue that it's unnecessarily complicated, poorly drafted and burdensome to small businesses. But it's both at the same time . The issue is that it doesn't have to be. It's possible to get the desired effect without using such a compl…
If you can't cheaply and quickly respond to a subject access request, then you're probably breaching several other parts of GDPR. How would you respond to a deletion request under Article 17, a restriction of processing request under Article 18, a portability request under Article 20 or an objection under Article 21?
Compliance with all of those requirements necessitates clear documentation of how you're processing personal data. If you don't have that documentation, how can you comply with the stewardship and security requirements of Articles 24, 25 and 32? How will you comply with the record-keeping requirements of Article 30 and the impact assessment requirements of Article 35? If you have a data breach, how will you be able to properly fulfil your notification requirements under Articles 33 and 34? How can you be confident that you're abiding by the general principles laid out in Chapter 2?
Processing personal data is a serious responsibility with potentially grave risks. If you have been taking that responsibility seriously (and been in compliance with the 1995 Data Protection Directive), then complying with the GDPR is relatively straightforward. If you just copy-pasted a privacy policy and gave no real thought to data protection while hoovering up tons of potentially sensitive personal data, then compliance will be a painful and expensive process.
Being a small business doesn't give you the right to be negligent. Not under the GDPR and not under any of the other laws governing businesses. If you don't have the expertise to comply with data protection law, you need to delegate those tasks to someone who is suitably qualified. If the scale and complexity of your processing activities makes compliance impossible, then the EU would very much prefer that you find a different business model or stop doing business with their citizens.
I feel like this whole thing with the GDPR is people fighting each other for the wrong reasons. The people for it argue that gets large companies to behave better. The people against it argue that it's unnecessarily complicated, poorly drafted and burdensome to small businesses. But it's both at the same time . The issue is that it doesn't have to be. It's possible to get the desired effect without using such a compl…
But you're wrong :)
You're actually on the same side as most of the anti-GDPR arguments I see.
Rather than speak for everyone, I'll just state my case: I like the intent of the law, and I don't like my privacy or anyone else's being violated. I'm fine with reasonable regulation to prevent that.
But the GDPR is legitimately terrible regulation. It's overly broad, vague, has the potential for huge penalties, is anti-small business, tries to establish the entire globe as being within its jurisdiction because someone from the EU might stumble across your website, and expects us to just trust that regulators from 28 countries will forever be gracious and helpful instead of capriciously punitive.
If the GDPR was restricted to company with an actual presence in the EU and above a certain size, I'd be fully in favor of it. I'm not sure I'd think it's smart, but the EU should do what it thinks is right for its citizens. But instead the GDPR claims that my side project on a server in Alabama (hypothetical) is a violation of their residents' human rights worth a fine up to millions of Euros depending on the whims of 28 different regulatory agencies (yes, I know they almost certainly won't fine me millions, but this law leaves it up to them to decide).
But the reason the other side disagrees is because: a) they trust the regulators, and b) they see any collection of anything remotely resembling "private data" as a fundamental violation of their human rights.
Under that set of assumptions, why would you let small businesses off the hook so they can be free to violate anyone's human rights as they see fit?
Earlier quoted context omitted.
That is what they just announced.
True. To be honest I don't know how their stuff works in detail. My main point was that most of the officially stated needs for data collection can be met with much less data if you really think about it. Until now most incentives were for collecting as much as possible.