71–80 of 182 posts
Earlier quoted context omitted.
Yeah, people have always been scared of new technologies. When people are scared of a computer being able to do a task that is mundane for people (recognize someone) you can know it is just hysteria.
Damn, I didn't know people's memories could be archived and replayed.
Good. Not only does this ensure that the students enjoy privacy, monitoring children in school with surveillance systems could have come straight out of foucault's discipline and punish. Maybe we should think about how we make schools spaces of freedom for our children rather than turning them into the next panopticon.
Good. Not only does this ensure that the students enjoy privacy, monitoring children in school with surveillance systems could have come straight out of foucault's discipline and punish. Maybe we should think about how we make schools spaces of freedom for our children rather than turning them into the next panopticon.
The fact that we have kept a part of middle-age inside our modern societies keeps fascinating and frightening me.
Earlier quoted context omitted.
Recital 38: "Children merit specific protection with regard to their personal data, as they may be less aware of the risks, consequences and safeguards concerned and their rights in relation to the processing of personal data." Recital 43: "In order to ensure that consent is freely given, consent should not provide a valid legal ground for the processing of personal data in a specific case where there is a clear imba…
Thank you for surfacing this language. In the more general case, I was under the impression that informed consent was sufficient to authorize a data controller to collect/process private information and so the ruling didn't make sense to me. I'm using "informed consent" here as a short hand for all the applicable GDPR requirements on consent (reasonable language, etc). It isn't clear to me from this language in Recit…
Consent is not always necessary, nor is it always sufficient. If you rely on consent as a lawful basis for data processing, the burden of proof lies with you to demonstrate that such consent was informed and freely given. The authors of the GDPR were fully aware of the fact that coerced consent was rampant, with stuff like shrinkwrap agreements, incomprehensible terms and conditions and "by entering these premises, you consent to give us your first-born son"; as a result, consent is very tightly regulated under GDPR. As a rule of thumb, ask whether a data subject could a) refuse consent without any repercussions and b) would not be surprised by any aspect of your processing; if you aren't certain that both a & b are true, you probably can't rely on consent.
https://gdpr-info.eu/art-6-gdpr/
The school already had a means of collecting attendance data that didn't involve constant video surveillance and had a far lower risk of misuse and security breaches. They didn't need consent to take the register, because it was justified under Art. 6 (1c, d and e). They relied on consent as a lawful basis for the facial recognition scheme, even in a situation where it would be difficult for the data subjects to refuse consent and where the data subjects would be unlikely to understand the full extent of the data processing and the risks that they would be exposed to as a result. Using consent in that way is very much contrary to the spirit of the regulations.
>If parents are in an imbalanced situation regarding school attendance, then pretty much all government relationships are imbalanced.
Yes, absolutely.
The main parts of the wrong-doing: - The school had obtained consent from the pupills and each one of the pupills could opt out at any time. The Swedish Data Protection Agency (DPA) did however find that due to the power balance of a school vs a pupill, these consents are not ”freely given”, and thus are void. The school therefor have no legal basis of processing special categories of data/sensitive data, which proce…
Which is 197h per day. I find this number extremely dubious.
Earlier quoted context omitted.
That presumes all early stage startups (as made in the US) are created equal, and any regression in their success rates is bad. Given that 9/10 startups fail even without GDPR, it's not surprising that early stage cos form the Lion's share of failures, and it surely can't be good for any data that was slurped up during whatever these experiments at market fit were doing. And given that the ultimate goal of GDPR is to…
You misunderstand the point I'm making. After GDPR, investments in early stage startups dropped by almost 50% in the EU. If you cut investment in half, you're going to cause some startups to fail that otherwise would have succeeded. Startups are a "hits" enterprise. Most fail. Some are mildly successful. A few are responsible for almost all of the upside. Cutting investment by 50% means that instead of getting a Drop…
The tech economy seeing such upheaval right now could be construed as a signal demonstrating how dependent it was on fundamentally unhealthy and untenable data practices that were previously endemic to the industry.
I'm sorry that you have had to spend a tonne of money to attain GDPR compliance. I imagine most "incumbents" have had to spend a good deal as well; I can only hope that the next generation of companies have learnt from your company's mistakes and to structure their data processes from day 1 to avoid accruing such sensitive data in the first place.
At any rate - a tech sector is possible. A thriving one, that can sustain as much employment? Maybe not quite, there'd have to be some adjustments; but the people would be better off. A tech sector with the same market cap? Unlikely, but we need to get over ourselves and question if preserving the techocracy's wealth is more important here.
Good. Not only does this ensure that the students enjoy privacy, monitoring children in school with surveillance systems could have come straight out of foucault's discipline and punish. Maybe we should think about how we make schools spaces of freedom for our children rather than turning them into the next panopticon.
School is the most authoritarian experience one typically experiences in a democracy. Here is a place where a strict hierarchy is enforced, through means of parental and peer pressure, anxiety over your future. Your schedule is planned by the minute, even peeing requires an authorization. Chatting is banned except on very limited time spans. The fact that we have kept a part of middle-age inside our modern societies…
I see these things as my basic human rights. And nobody should accept having them restricted.
In the country where I live the school has the authority by law to be more restrictive and enforce their own rules. Which I see as necessary to some point. But I think we should teach kids and teenagers to make decisions on their own and take responsibility for their actions. And not just enforce arbitrary rules.
Earlier quoted context omitted.
Recital 38: "Children merit specific protection with regard to their personal data, as they may be less aware of the risks, consequences and safeguards concerned and their rights in relation to the processing of personal data." Recital 43: "In order to ensure that consent is freely given, consent should not provide a valid legal ground for the processing of personal data in a specific case where there is a clear imba…
Does Google's et all EULA cater for this as fairly sure many childrens phones track them and fall foul of this. Oyster cards in London, your journeys are tracked, consent not asked for. Let alone giving special privilege for children. Then the whole aspect of under-age (children) commiting crime and evidence. A smart lawyer could abuse the whole aspect to squash any evidence that placed them at a scene of a crime as…
I think that is a fairly well established legal principle. In many places, a contract cannot be enforced against a minor no matter whether it was freely entered. Statutory rape laws say it doesn't matter if the minor consented. And so on . . .
Earlier quoted context omitted.
This fine is precisely in line with the intentions of the European Parliament when they signed the GDPR into law. That is certainly a statement that no one could argue with. I think the argument is whether those intentions are actually good, logical, or workable. For example, the fine structure is explicitly designed so that they could take all of the assets of a small business and wipe it off the face of the map, bu…
>but only take 5% of annual revenue of a large business It's 4% global revenue and it's really a lot. Fines are issued based on the amount of data and amount of people affected. Small companies rarely need anything but contact information. Storing the data securely is no trivial task for any size of organization, though. Small companies would have significantly less data and customers to be worthy of a hefty fine. Ag…
Earlier quoted context omitted.
The GDPR doesn't specify what you can't do with personal data, it specifies what you can do. Personal data is private by default; you can only use my data if it is explicitly lawful for you to do so. If you're not absolutely sure that what you're doing is in line with the GDPR, you shouldn't do it. That's by design, not by accident. The GDPR's fundamental principles are set out in article 5. You should collect the le…
Choosing between European internet laws and having a tech sector, I'd pick having a tech sector any day. It's all totally unnecessary strangling of innovation. The entire idea that you own data pertaining to you is absurd.