Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Study: Google is the biggest beneficiary of the GDPR

cliqz.com

Post reply on HN
Print view View original

131–140 of 140 posts

Re: Study: Google is the biggest beneficiary of the GDPR

#131

Post by dogma1138 »

Terretta wrote: post #126
dogma1138 wrote: post #99

Earlier quoted context omitted.

I also don't think consent is the right basis to use all the time (however it's important to note that no lawful basis takes precedence over any other) and good vetted vital interests and a contractual agreement is preferable, however consent is the easy way out. "This is what we do do you agree: yes/no" is much easier than to develop a valid vital 1st and 3rd party interest for each case and most online services don…

Your position will certainly be argued for in a court at some point. So will the counter position that sending reader info to countless third parties isn't actually necessary to monetize, as plenty segmentation value comes from the readers' selection of the site itself. It will be argued the marginal value of each additional exposure of the reader's private data does not outweigh the individual's right to privacy. In…

It doesn't need to be argued it's a perfectly valid reason (and has been reaffirmed by different DPAs), the GDPR does not define what a valid or a non valid legitimate interest is, it just has to be well defined and transparent.

I suggest you read the "legitimate Interests" part of the document you provided.

>It will be argued the marginal value of each additional exposure of the reader's private data does not outweigh the individual's right to privacy.

There is nothing in the GDPR that puts on legitimate interest over another including your so called right to privacy.

Re: Study: Google is the biggest beneficiary of the GDPR

#132

Post by ucaetano »

kerng wrote: post #128
ucaetano wrote: post #123

Earlier quoted context omitted.

> Google may be hurt the least, but I doubt they're a "beneficiary" in economic terms. Quite the opposite, if you pass a 20% tax on every company, except for Google, who gets a 10% tax, it is a beneficiary. Everything is relative.

Yeah, beneficiaries are the end users and their privacy being worth something now. Which is something that wasn't the case before.

Probably not, having a few large companies benefiting from it compared to the rest of the market reduces competition, resulting in a loss to consumers.

Re: Study: Google is the biggest beneficiary of the GDPR

#133

Post by Krasnol »

Krasnol wrote: post #117
pmiller2 wrote: post #108

Earlier quoted context omitted.

Here you go: https://www.theguardian.com/technology/2018/may/24/sites-blo... First hit from a google search for “GDPR shut down”.

> Unroll.me, an inbox management firm, announced it was completely withdrawing services for EU companies due to an inability to offer its product – which is monetised by selling insights gleaned from reading users’ emails Dodged a bullet here. - history.com forwards to their german page history.de as it always did - Ragnarok Online is working: https://www.ragnarokeurope.com/?lang=de - Klout sounds just as dirty as un…

The discussion culture here is disgusting.

I get downvotes for FACTS? Seriously people?

Re: Study: Google is the biggest beneficiary of the GDPR

#134

Post by kruczek »

dogma1138 wrote: post #95
detaro wrote: post #93

Earlier quoted context omitted.

The parent was responding to a claim that consent works as a base of processing, and only talking about that base. That other bases can work is true (I'm personally really curious how this is going to play out for ad-financed services), but just because they didn't mention it they aren't "confused" about anything.

The parent is not correct however you can use consent as your lawful basis and deny services to users who do not consent under any business justification as long as you have one. If targeted ads give you more revenue and you choose to use solely targeted ads because thats your business model GDPR does not forced you to provide a free service or a service that generate less revenue. So no #2 doesn’t have to be as #1 t…

Please see GDPR Article 7, §4:

"When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract."

And then Recital 43:

"Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance."

If:

1. You ask users for consent

2. The consent is not strictly necessary to provide the service

3. You deny the service to users who decline to give consent

Then the consent isn't freely given and therefore invalid.

> GDPR does not forced you to provide a free service or a service that generate less revenue.

True, but then consent isn't the right basis for processing of data. As you mentioned, business justification, or "legitimate interests" as GDPR puts it, is what you should be using.

Re: Study: Google is the biggest beneficiary of the GDPR

#135

Post by kruczek »

dogma1138 wrote: post #131
Terretta wrote: post #126

Earlier quoted context omitted.

Your position will certainly be argued for in a court at some point. So will the counter position that sending reader info to countless third parties isn't actually necessary to monetize, as plenty segmentation value comes from the readers' selection of the site itself. It will be argued the marginal value of each additional exposure of the reader's private data does not outweigh the individual's right to privacy. In…

It doesn't need to be argued it's a perfectly valid reason (and has been reaffirmed by different DPAs), the GDPR does not define what a valid or a non valid legitimate interest is, it just has to be well defined and transparent. I suggest you read the "legitimate Interests" part of the document you provided. >It will be argued the marginal value of each additional exposure of the reader's private data does not outwei…

> There is nothing in the GDPR that puts on legitimate interest over another including your so called right to privacy.

In fact there is one exception which thankfully limits legitimate interests of data controllers:

"processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child."

It remains to be seen in practice how much data controllers' interests can be overridden by "interests or fundamental rights and freedoms of the data subject".

Re: Study: Google is the biggest beneficiary of the GDPR

#136

Post by dogma1138 »

kruczek wrote: post #134
dogma1138 wrote: post #95

Earlier quoted context omitted.

The parent is not correct however you can use consent as your lawful basis and deny services to users who do not consent under any business justification as long as you have one. If targeted ads give you more revenue and you choose to use solely targeted ads because thats your business model GDPR does not forced you to provide a free service or a service that generate less revenue. So no #2 doesn’t have to be as #1 t…

Please see GDPR Article 7, §4: "When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract." And then Recital 43: "Consent is presumed not to be freely given if it does not allow separate…

Article 7 does not violate what i said this is a single purpose clause.

Meaning i can't force you to sign up to my mailing list or refuse to sell you items on my store, the current interpretation of most DPA is that it doesn't apply to single purpose processing.

Also again as stated below people confuse the "I agree" button to a GDPR consent, the fact that there is ok/opt-out UI for GDPR does not mean that they are seeking consent as their lawful bases but they still need to inform the user and allow them to opt-out (even if opt-out means that they opt-out of the service).

Only about half the GDPR popups I've seen were actually worded solely for seeking consent even tho they had the agree/opt-out buttons below the text itself stated the legitimate interests of both them and their partners in why they need the data for most things with maybe a handful of purposes relying on consent alone.

Re: Study: Google is the biggest beneficiary of the GDPR

#137

Post by dsumenkovic »

nwellnhof wrote: post #60
brennebeck wrote: post #26

Earlier quoted context omitted.

Somewhat tangential: have you seen GitLab’s notice? And what’s your opinion of that style, as far as informing/consent?

GitLab seems to use the Cookiebot solution. I like that "Marketing" cookies are disabled by default, although they should be labeled as "Advertising". Also, even if you bother to read the purposes of all the 80 advertising cookies, the descriptions are incomplete and dishonest. For example: Doubleclick cookie notice: "Used by Google DoubleClick to register and report the website user's actions after viewing or clicki…

At GitLab we really care about transparency and it's one of our core values. Here you can find out more about Cookies policy https://docs.gitlab.com/cookies-policy/

Re: Study: Google is the biggest beneficiary of the GDPR

#138

Post by rdlecler1 »

_nosaj wrote: post #65
anoncake wrote: post #49

Earlier quoted context omitted.

We, the people of the EU, have democratically decided that we don't want them.

How did that democracy work with articles 11 and 13? The European Union is the antithesis of democracy. If it wasn't, those directives would never have passed.

And the power to use proxies and non personal emails.

Re: Study: Google is the biggest beneficiary of the GDPR

#139

Post by edwhitesell »

rbinv wrote: post #96
tpush wrote: post #55

Yeah, I wouldn't trust this source on anything privacy related. They present themselves as user privacy champions but primarily make money via, you guessed it, advertisements. They are owned by Burda, a large German media organization who, again, make money by advertisement and processing of their user's data. "We’re breaking new grounds when it comes to developing our business model. Bringing together targeting and…

This is also the company that acquired Ghostery.

That explains why the latest Ghostery update on Android was so terrible. It lost all of my tabs and had 3 different places to disable some form of tracking.

Re: Study: Google is the biggest beneficiary of the GDPR

#140

Post by brennebeck »

nwellnhof wrote: post #60
brennebeck wrote: post #26

Earlier quoted context omitted.

Somewhat tangential: have you seen GitLab’s notice? And what’s your opinion of that style, as far as informing/consent?

GitLab seems to use the Cookiebot solution. I like that "Marketing" cookies are disabled by default, although they should be labeled as "Advertising". Also, even if you bother to read the purposes of all the 80 advertising cookies, the descriptions are incomplete and dishonest. For example: Doubleclick cookie notice: "Used by Google DoubleClick to register and report the website user's actions after viewing or clicki…

I agree with what you’re saying; you’re proposing some ideal changes. But I think given where we were as a community or what has become the norm in tracking/social, this is a great step and is a big improvement over the past. It looks like someone from GitLab replied in a sibling to my comment, so maybe giving this extra feedback will bring about further changes.

Edit: and yes, I just checked and it looks like Cookiebot.

Post reply on HN