Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Two years in, GDPR defined by mixed signals, unbalanced enforcement

complianceweek.com

Post reply on HN
Print view View original

21–30 of 216 posts

Re: Two years in, GDPR defined by mixed signals, unbalanced enforcement

#21

Post by luckylion »

HissingMachine wrote: post #14

This has been a constant headache, not the rules or how to apply it, but our customers still act like there isn't such a thing like GDPR, and actively demand, DEMAND that we put in place functionality that is in clear violation of GDPR, and when you try to inform and explain to them who things work they get mad at me and threaten that they will get a more professional shop to do things for them shrugs

Given that enforcement would have to be stepped up considerably to even be called selective, compliance means your competition has a large advantage.

Re: Two years in, GDPR defined by mixed signals, unbalanced enforcement

#22

Post by umvi »

Nextgrid wrote: post #15
MattGaiser wrote: post #10

Has anyone beyond big tech actually figured out what the rules are yet?

The rules are very clear once you look past the fear-mongering. Don't stalk people, and if you want to stalk them you need to ask them nicely and allow them to decline. Don't be careless with user data so you minimize the likelihood of a breach, and if you do get breached then report it to the regulator and cooperate with them. In fact, "big tech" has figured out how to get around the rules by exploiting the lack of…

> Don't stalk people, and if you want to stalk them you need to ask them nicely and allow them to decline

Ok, that's nice in a fantasy world, but in the real world a lot of people/sites rely on ad revenue, and ad revenue for the most part, requires tracking built in. So now if you legally force me to allow users to decline "stalking" you are basically allowing users to decline my monetization model and use my website/product for free. And why should I allow that?

Why can't I say: "accept that my site is ad-supported or don't use my site?"

Re: Two years in, GDPR defined by mixed signals, unbalanced enforcement

#23

Post by SpicyLemonZest »

Nextgrid wrote: post #9
barking wrote: post #2

We care about your privacy notices have become the bane of my life.

The majority of these aren't actually compliant. Tracking should be opt- in and consent should be freely given . If your notice is annoying enough that most people click accept (or if clicking decline is harder) then you are already in breach. A lot of websites also consider analytics cookies as essential and don't provide a way to decline those which isn't compliant either. These websites can be detected very easily…

I've seen a lot of people say this, but I'm just not convinced it's actually the law. It's not obvious to me that analytics cookies categorically can't be essential or that "freely given" implies strict UI neutrality between accepting and declining.

Re: Two years in, GDPR defined by mixed signals, unbalanced enforcement

#25

Post by legitster »

Nextgrid wrote: post #15
MattGaiser wrote: post #10

Has anyone beyond big tech actually figured out what the rules are yet?

The rules are very clear once you look past the fear-mongering. Don't stalk people, and if you want to stalk them you need to ask them nicely and allow them to decline. Don't be careless with user data so you minimize the likelihood of a breach, and if you do get breached then report it to the regulator and cooperate with them. In fact, "big tech" has figured out how to get around the rules by exploiting the lack of…

>Don't stalk people

The problem is there is no consistent definition of stalking in this context. Which could be the difference between a store manager watching how people move around a store vs following you home and going through your trash.

Re: Two years in, GDPR defined by mixed signals, unbalanced enforcement

#26

Post by shadowgovt »

Nextgrid wrote: post #9
barking wrote: post #2

We care about your privacy notices have become the bane of my life.

The majority of these aren't actually compliant. Tracking should be opt- in and consent should be freely given . If your notice is annoying enough that most people click accept (or if clicking decline is harder) then you are already in breach. A lot of websites also consider analytics cookies as essential and don't provide a way to decline those which isn't compliant either. These websites can be detected very easily…

> A lot of websites also consider analytics cookies as essential

For a lot of websites, they are.

Re: Two years in, GDPR defined by mixed signals, unbalanced enforcement

#27

Post by microcolonel »

tjoff wrote: post #17
microcolonel wrote: post #16

Earlier quoted context omitted.

Setting aside GDPR for a moment, the cookie thing just means that if I want to use these websites, I have to enable cookies so that I can dismiss the cookie dialog.

Again, only because of incompetent and/or immoral developers.

How else can you even store a consent for cookies/localStorage? You can go around calling people immoral and incompetent, but what is the actual way to ask for permission to store data?

If your contention is that it is immoral or incompetent to store any data except through some specific user interaction related to those data, sure that's an opinion.

But if your job is literally "tell me which other pages users go to after this one", it's not really that crazy of an ask.

The law seems to call upon you to make it conspicuous, but when you make it conspicuous it is annoying, the law then calls upon you to make it not annoying.

The better solution, in my mind, is just making cookie control features more visible in browsers. They work great, and it's the right place for this form of consent.

Malicious actors abuse the current circumstance, because it relies on there being a responsible party with collateral to complain against. This is one of those times where the engineered solution is better than the social one.

Re: Two years in, GDPR defined by mixed signals, unbalanced enforcement

#28

Post by ThePhysicist »

moksly wrote: post #6

I work as a developer in the European public sector, we already took privacy and security rather serious because the laws governing it had always been and are still tougher than the GDPR. I actually like that the EU is doing something, and I guess this is the best you get from a bureaucracy, but what it’s changed is that we document everything. Whenever I build anything that moves privacy data, even if it’s just hook…

Not sure why this is getting downvoted, seems to be a perfectly reasonable point?

Re: Two years in, GDPR defined by mixed signals, unbalanced enforcement

#29

Post by rocmcd »

umvi wrote: post #22
Nextgrid wrote: post #15

Earlier quoted context omitted.

The rules are very clear once you look past the fear-mongering. Don't stalk people, and if you want to stalk them you need to ask them nicely and allow them to decline. Don't be careless with user data so you minimize the likelihood of a breach, and if you do get breached then report it to the regulator and cooperate with them. In fact, "big tech" has figured out how to get around the rules by exploiting the lack of…

> Don't stalk people, and if you want to stalk them you need to ask them nicely and allow them to decline Ok, that's nice in a fantasy world, but in the real world a lot of people/sites rely on ad revenue, and ad revenue for the most part, requires tracking built in. So now if you legally force me to allow users to decline "stalking" you are basically allowing users to decline my monetization model and use my website…

You can? If the user doesn’t opt-in to advertising then you could simply not allow them to use the site...

Note, I’m not in any way an expert on the legality of it, but this seems like a silly argument to make. If anything, being more up-front with the model may open alternative methods of monetization (subscription-based, etc).

Re: Two years in, GDPR defined by mixed signals, unbalanced enforcement

#30

Post by shadowgovt »

tjoff wrote: post #17
microcolonel wrote: post #16

Earlier quoted context omitted.

Setting aside GDPR for a moment, the cookie thing just means that if I want to use these websites, I have to enable cookies so that I can dismiss the cookie dialog.

Again, only because of incompetent and/or immoral developers.

How, exactly, is a developer supposed to change state in a stateless protocol to denote that you've dismissed the cookie dialog if the user has disabled the feature that allows the developer to add state to the stateless protocol?
Post reply on HN