Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Two years in, GDPR defined by mixed signals, unbalanced enforcement

complianceweek.com

Post reply on HN
Print view View original

51–60 of 216 posts

Re: Two years in, GDPR defined by mixed signals, unbalanced enforcement

#51

Post by Nextgrid »

legitster wrote: post #25
Nextgrid wrote: post #15

Earlier quoted context omitted.

The rules are very clear once you look past the fear-mongering. Don't stalk people, and if you want to stalk them you need to ask them nicely and allow them to decline. Don't be careless with user data so you minimize the likelihood of a breach, and if you do get breached then report it to the regulator and cooperate with them. In fact, "big tech" has figured out how to get around the rules by exploiting the lack of…

>Don't stalk people The problem is there is no consistent definition of stalking in this context. Which could be the difference between a store manager watching how people move around a store vs following you home and going through your trash.

Stalking is collecting any information, that either by itself or combined with other information can be used to identify someone with reasonable probability. IP addresses, browser/device details (fingerprinting, etc), usage patterns can fall into this category.

Re: Two years in, GDPR defined by mixed signals, unbalanced enforcement

#52

Post by flemhans »

volak wrote: post #24

I would pay a subscription to a news site if they spent all their time evaluating 2-5 year old events and determining which side was right. 2 years ago comments of "this will only benefit the lawyers" would be -50 points. Turns out... actually yeah.

I thought that’s what everyone thought back then. At least all my friends were like, the lawyers will have a good time and be the only ones benefiting from this

Re: Two years in, GDPR defined by mixed signals, unbalanced enforcement

#53

Post by Nextgrid »

joering2 wrote: post #35
Nextgrid wrote: post #13

Earlier quoted context omitted.

At the moment, lawyers and all the scummy industry around the GDPR (whether it's advice/consulting or "consent management") are indeed the only ones making the money. There is very little enforcement and flawed solutions from the aforementioned industry are allowed to proliferate despite not actually being compliant (the majority of "consent management" solutions are in breach, so they are making money while not even…

Another good page with stats [1] including this: $63 million in fines issued $57 million of that issued to Google [1] https://www.varonis.com/blog/gdpr-effect-review/

> Google was hit with a fee of $57 million for not making it clear to users how they were harvesting data from the Google search engine, YouTube and Google Maps for personalized ads. This fine only amounts to .04% of Google’s yearly revenue.

Not only does this not cover Google's main offense (tracking of users and non-users with Google Analytics even on non-Google properties) but the fine is so minimal that it's basically the cost of doing business.

I wish people would stop bringing this one up.

Re: Two years in, GDPR defined by mixed signals, unbalanced enforcement

#54

Post by ApolloFortyNine »

rocmcd wrote: post #29
umvi wrote: post #22

Earlier quoted context omitted.

> Don't stalk people, and if you want to stalk them you need to ask them nicely and allow them to decline Ok, that's nice in a fantasy world, but in the real world a lot of people/sites rely on ad revenue, and ad revenue for the most part, requires tracking built in. So now if you legally force me to allow users to decline "stalking" you are basically allowing users to decline my monetization model and use my website…

You can? If the user doesn’t opt-in to advertising then you could simply not allow them to use the site... Note, I’m not in any way an expert on the legality of it, but this seems like a silly argument to make. If anything, being more up-front with the model may open alternative methods of monetization (subscription-based, etc).

You can not [1] (though this is definitely the clause that at least in the US, I'm confident would be beaten down in court).

And this is why I have such a problem with the rule. Without some dramatic changes, any video streaming site almost surely wouldn't be able to handle the substantially lower ad revenue and still make a profit if everyone actually opted out. Sites like Facebook would probably turn a profit, but there's a large portion of the internet that would not survive when faced with 90% less revenue (untargeted ads payout drastically less).

>“Freely given” consent essentially means you have not cornered the data subject into agreeing to you using their data. For one thing, that means you cannot require consent to data processing as a condition of using the service. They need to be able to say no. According to Recital 42, “Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.” [1]

[1] https://gdpr.eu/gdpr-consent-requirements/

EDIT: Come on can we not down vote just because you disagree here? It's just going to be come a circle jerk like most of Reddit if you guys keep this up... I linked a source even proving this OP wrong... from the official GDPR resource...

Re: Two years in, GDPR defined by mixed signals, unbalanced enforcement

#55

Post by Fargren »

rocmcd wrote: post #29
umvi wrote: post #22

Earlier quoted context omitted.

> Don't stalk people, and if you want to stalk them you need to ask them nicely and allow them to decline Ok, that's nice in a fantasy world, but in the real world a lot of people/sites rely on ad revenue, and ad revenue for the most part, requires tracking built in. So now if you legally force me to allow users to decline "stalking" you are basically allowing users to decline my monetization model and use my website…

You can? If the user doesn’t opt-in to advertising then you could simply not allow them to use the site... Note, I’m not in any way an expert on the legality of it, but this seems like a silly argument to make. If anything, being more up-front with the model may open alternative methods of monetization (subscription-based, etc).

That's actually not allowed under GDPR. You can't deny access to a website based on whether a user accepted non-essential tracking.

Re: Two years in, GDPR defined by mixed signals, unbalanced enforcement

#56

Post by kodablah »

volak wrote: post #24

I would pay a subscription to a news site if they spent all their time evaluating 2-5 year old events and determining which side was right. 2 years ago comments of "this will only benefit the lawyers" would be -50 points. Turns out... actually yeah.

There is a bit deja vu, since at that time we were pointing out similar flaws in the DPD (lack of enforcement, lack of clarity, govt inefficiencies, the inability for proponents to separate intent from reality, etc).

Sadly, there is an absolute "for or against" mentality out there. You can't make it clear that the implementation of such a law would be poor enough to not justify it being enacted in the first place lest you are told "well, should we do nothing?". We can easily start with easy-to-understand/implement transparency requirements (maybe even just as guidelines or requirements for a form of certification at first while encouraging technical solutions in the meantime). Never-realized scary fines might as well have never been brought forth.

Re: Two years in, GDPR defined by mixed signals, unbalanced enforcement

#57

Post by bonoboTP »

volak wrote: post #24

I would pay a subscription to a news site if they spent all their time evaluating 2-5 year old events and determining which side was right. 2 years ago comments of "this will only benefit the lawyers" would be -50 points. Turns out... actually yeah.

That's actually a good idea. It's really frustrating how (in other types of news) a lot of buzz can be generated and then just silence and we forget it all and move on. But it's not really something that would sell well. Not many people care about yesterday's news, people want to know what's coming next and not what came out of some magazine's prediction several years ago.

Re: Two years in, GDPR defined by mixed signals, unbalanced enforcement

#58

Post by ratww »

microcolonel wrote: post #43
legitster wrote: post #32

Earlier quoted context omitted.

You are allowed a cookie that tracks their opt in to your other cookies, so long as it is anonymous (or so our lawyer tells us). On our site, we ping whether that cookie is set before we load the rest of the cookies.

Is it acceptable to store a cookie that defaults to "false" provided it is generic? That would solve the problem of not being able to detect if cookies are enabled in the browser until you try to store them. added: person down thread indicated that there's an API for determining if cookies are enabled for the host on your page's origin called navigator.cookieEnabled which I am shocked I've not seen nor heard of even…

Even if there was no new API, storing a cookie "just to check if it works" is not against the GDPR. It's a functional cookie.

Re: Two years in, GDPR defined by mixed signals, unbalanced enforcement

#59

Post by MattGaiser »

a_imho wrote: post #42
umvi wrote: post #22

Earlier quoted context omitted.

> Don't stalk people, and if you want to stalk them you need to ask them nicely and allow them to decline Ok, that's nice in a fantasy world, but in the real world a lot of people/sites rely on ad revenue, and ad revenue for the most part, requires tracking built in. So now if you legally force me to allow users to decline "stalking" you are basically allowing users to decline my monetization model and use my website…

Because the EU says you have it backwards? Ignoring European users is perfectly fine, but if you want to monetize them, you better play by their rules, unless you are more powerful than the EU. In theory. In practice do whatever you want.

> Ignoring European users is perfectly fine,

See this: https://news.ycombinator.com/item?id=23353051

Re: Two years in, GDPR defined by mixed signals, unbalanced enforcement

#60

Post by volak »

flemhans wrote: post #52
volak wrote: post #24

I would pay a subscription to a news site if they spent all their time evaluating 2-5 year old events and determining which side was right. 2 years ago comments of "this will only benefit the lawyers" would be -50 points. Turns out... actually yeah.

I thought that’s what everyone thought back then. At least all my friends were like, the lawyers will have a good time and be the only ones benefiting from this

That's why such a news app would be so interesting.

I remember comments from back then slightly differently.

Post reply on HN