Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR Feels Useless

medium.com

Post reply on HN
Print view View original

11–20 of 35 posts

Re: GDPR Feels Useless

#11

Post by pas »

guitarbill wrote: post #4

Don't read this. There's so much misunderstanding in this article, I'd be surprised if any good discussion came from it. And refuting it would take ages. For example: > And apparently typing your name, age and other information is not consent. How is this supposed to work by the way? I give you my name but I don’t consent to you using it or remember it? The way it's phrased is misleading. If you need the data and are…

The better response to "typing is consent" is that, okay, you gave our address, now we're creating adverts with your house, making it look like you're selling it, soliciting offers in your name, and so on. Even though you just ordered a bumper sticker from us.

So, consent is given for a purpose, and you can't really do that with just an input box. Hence the fancy opt-in modal dialog wizard thingies, and the checkboxes at registration/payment time, and so on.

Re: GDPR Feels Useless

#12

Post by legitster »

Here's an issue we ran into when implementing GDPR: marketing software keeps a database of people who have opted out, so even if that email address shows up again, we don't risk spamming them. But if they opt out now, under GDPR we have to delete them completely, even from the opt-out list. So we can't remember not to email or track you.

The author also points out the double set of cookies, which is how most sites deal with tracking. One set of cookies that do not collect PII, that just tell the other set of cookies to turn on or off.

I respect that the writers of GDPR did not confer with the industry insiders beforehand. However, with how poorly some of it understands the technology (implementation of cookies is a great example), I wish they would have had a bit more understanding and drafted a better bill.

Re: GDPR Feels Useless

#13

Post by ziddoap »

youeseh wrote: post #9
pas wrote: post #8

Earlier quoted context omitted.

maybe ... just a thought .. but, don't agree to them? it should be just as easy to agree as to decline. if not, then they are likely not adhering to the regulation, and eventually someone will/could alert them or whatever authority.

Do you mean that if I declined I should still be able to see the content?

Correct, to a certain degree.

Specific things that require data and/or cookies to function (e.g. providing a shipping address so that your package can arrive) are exempted, obviously. But everything else is supposed to work, regardless of consent or not.

This is due to Art. 7, Paragraph 4[0,1] regarding "Freely given consent". If your only option is to consent, or not use the website, your consent is not freely given.

[0]"When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract."

[1]https://gdpr-info.eu/art-7-gdpr/

Re: GDPR Feels Useless

#14

Post by turbohz »

legitster wrote: post #12

Here's an issue we ran into when implementing GDPR: marketing software keeps a database of people who have opted out, so even if that email address shows up again, we don't risk spamming them. But if they opt out now, under GDPR we have to delete them completely, even from the opt-out list. So we can't remember not to email or track you. The author also points out the double set of cookies, which is how most sites de…

Uh? Couldn't a hash be used for that?

Re: GDPR Feels Useless

#15

Post by legitster »

turbohz wrote: post #14
legitster wrote: post #12

Here's an issue we ran into when implementing GDPR: marketing software keeps a database of people who have opted out, so even if that email address shows up again, we don't risk spamming them. But if they opt out now, under GDPR we have to delete them completely, even from the opt-out list. So we can't remember not to email or track you. The author also points out the double set of cookies, which is how most sites de…

Uh? Couldn't a hash be used for that?

According to our council, even encrypted or hashed data was still counted as PII as those are security measures, not privacy measures.

Re: GDPR Feels Useless

#16

Post by marcinzm »

Mirioron wrote: post #5

I don't view GDPR to be quite as useless as the author does, but the point about the user having to protect their data themselves is spot on. GDPR only protects you against good actors that are under EU jurisdiction. Everyone else could very well be doing whatever they want with the data you leak. The EU can't fine a Chinese company if the Chinese company has no presence in the EU. Another thing the author doesn't me…

That's the general issue with regulation, it protects the existing large players in a space by adding a higher barrier to entry for competitors. So now instead of hosting your own forum or website you'll use Squarespace or Discord or Disqus instead.

Re: GDPR Feels Useless

#17

Post by pas »

Mirioron wrote: post #5

I don't view GDPR to be quite as useless as the author does, but the point about the user having to protect their data themselves is spot on. GDPR only protects you against good actors that are under EU jurisdiction. Everyone else could very well be doing whatever they want with the data you leak. The EU can't fine a Chinese company if the Chinese company has no presence in the EU. Another thing the author doesn't me…

First of all, GDPR does not apply to personal sites. ( https://law.stackexchange.com/a/28086 - see current "in force" version of the directive: https://eur-lex.europa.eu/eli/reg/2016/679/oj see recital 18)

> [...] GDPR sets a minimum amount of cost/effort to run a website [...]

This is simply false. If you want to post something on the 'net, nothing changes. You want to count page downloads? (You know those old school CGI counters.) Nothing changes. You want to know how many individual visits you got? Well, you need to try to distinguish between new and returning visitors, hence you might put a cookie on the visitor's browser/client/useragent, now you need to ask nicely, because it's eerily easy to use that cookie for a lot of other purposes. (Similarly if you would try to use something else, like IP address, and/or browser fingerprinting.)

And so on. Yes, I like pretty graphs about visitors (browser screen size distribution, fancy geoip charts, etc), but so do the people that live off the not so innocent usage of this kind of data.

And yes, if you collect personal data, then you should be able to protect it. This was always the case, GDPR simply states this and tries to create a mechanism that forces data holders to act accordingly (via the mandatory data breach reporting). Again, similarly, if you handle a lot of data you should be able to accurately take a stock of what kind of data you have about whom, hence the requirement to respond to these inquiries.

> I think it disproportionately impacts smaller sites.

Agreed. But small sites were always at the mercy of random script kiddies. They always lacked resources to properly handle updates/upgrades, security, data, end-of-life termination, etc.

GDPR at least makes WordPress, discourse, and random blog and forum engines able to deal with the reality of how much value their databases represent nowadays.

Re: GDPR Feels Useless

#18

Post by Orangeair »

This is just a weird article.

> But do you know what data I have access to when you come on my website ? Well only your IP and some information about your computer and browser. That’s all.

It's pretty well known by now that that's often more than enough to identify a specific user. "That's all" really undersells it.

> It’s true I can create an ID and save it on your browser (I can do much more but we will stay focus). Your browser, not your computer.

That's effectively the same thing -- the vast vast majority of users don't use more than one browser per device, and I'd be willing to be that the few who do use more than one mostly use them for different websites.

> So the very first thing you need to understand about data privacy is that YOU protect your own data by not giving it away without thinking.

And here it is. This article is basically just victim blaming. "You didn't want this website to identify you based on the unique combination of user agent, viewport, and feature detection? Then you shouldn't have visited this website with that user agent, screen size, and set of features enabled in your browser."

Re: GDPR Feels Useless

#19

Post by pas »

marcinzm wrote: post #16
Mirioron wrote: post #5

I don't view GDPR to be quite as useless as the author does, but the point about the user having to protect their data themselves is spot on. GDPR only protects you against good actors that are under EU jurisdiction. Everyone else could very well be doing whatever they want with the data you leak. The EU can't fine a Chinese company if the Chinese company has no presence in the EU. Another thing the author doesn't me…

That's the general issue with regulation, it protects the existing large players in a space by adding a higher barrier to entry for competitors. So now instead of hosting your own forum or website you'll use Squarespace or Discord or Disqus instead.

You can host your own forum. And if you do it as purely personal activity, then GDPR does not apply.

Re: GDPR Feels Useless

#20

Post by pas »

youeseh wrote: post #9
pas wrote: post #8

Earlier quoted context omitted.

maybe ... just a thought .. but, don't agree to them? it should be just as easy to agree as to decline. if not, then they are likely not adhering to the regulation, and eventually someone will/could alert them or whatever authority.

Do you mean that if I declined I should still be able to see the content?

Yes.

And the whole practice of huge scary obtrusive modal-like dialogs (that tint the background so you can't even read it normally) are the cheap tricks used by sites to incentivize you to consent to tracking. So, it's almost certain that those are not compliant. They replace the fundamental function and purpose of the site with a fake choice.

Post reply on HN