Proposed Jail Time for Tech Companies Who Steal Data

I think there is a good argument that this is often not just. The iconic image of many events may have the victims preferring not to be that iconic representation years later. They may want their life to be known for them, not a moment long past. For the most obvious example, the famous image of a child running during the Vietnam war[1]. She's famous for being terrified of a napalm attack against civilians and allied forces. The photographer gets to decide if it may be reused, and he will, where it's proved to be his meal ticket. There's many less significant examples of where resting with the photographer is inappropriate.

Rights resting with every subject would raise its own, different problems. I'm not sure how to improve the balance without unreasonably restricting the freedom to take perfectly reasonable snaps.

> if I meet someone on the street .. right to demand that I not record that information

They should, unequivocally. I can walk past a person with clip board taking a survey. I prefer unannounced recordings to be left to authorities and journalists.

> Does my perspective or interpretation of that information give me some ownership to that data?

Nope. If it's about me, I care not what you are trying to interpret from my eye colour, location and my presence in a shop. Just whether I have agreed to your monitoring of me, or whether you are one of a limited number of exceptions. Which seems to be the sensible starting point of GDPR.

> What if I use that information for commercial gain

See above. Makes no difference, other than hugely reducing my sympathy for its collection. I don't care if it concerns 10 or 10m if it's without informed consent (no dark patterns etc).

[1] https://en.wikipedia.org/wiki/Phan_Thi_Kim_Phuc

However the real kicker here is, if they hold private companies to this then how do they excuse the government from similar actions and how does a law assigning this level of protection and declaration of personal property not affect law enforcement? In particular in that your phone/email account/etc has no rights even though your data is there.

If this does get somewhere, what if companies choose to encrypt it all and when stolen it is just encrypted. does the government demand the keys at all times?

You could argue a single 0-day should not result in a breach (security is best as a layered defense), but that’s probably far less likely to find.

https://en.wikipedia.org/wiki/Prudent_man_rule

Funny enough, the thing you object to is usually the one thing explicitly spelled out in ToS that they are allowed to do with your information

Moreover, startups seeking capital must convince potential investors that the chance of being wiped out by a GDPR complaint is low -- on top of convincing those investors that their business model is viable, that they are entering the market at the right time, etc. Plenty of startups with great ideas never get off the ground because they cannot get the initial capital they need, or they fail to get enough capital to survive a rare negative event.

There is not much doubt that regulations raise the cost of entry to a market. The real question is whether or not it is worth it for society -- if we are willing to sacrifice a few small companies for the sake of the regulatory goal. User privacy is a fine goal, but the EU is losing the leadership it once had in the tech industry to the US and China. Where is the European answer to Google, Facebook, Tencent, or Alibaba? Where is the Europe in the AI race? It is not just GDPR; the right to be forgotten, the draconian copyright rules, and so forth have all contributed to a stifling regulatory environment in Europe and a stagnant tech industry.