Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dutch DPA fines Uber €290M because of transfers of drivers’ data to the US

autoriteitpersoonsgegevens.nl

Post reply on HN
Print view View original

151–160 of 414 posts

Re: Dutch DPA fines Uber €290M because of transfers of drivers’ data to the US

#151

Post by TeMPOraL »

jeltz wrote: post #103
wyager wrote: post #99

We are fortunate to have lived through a brief period where the internet was truly a global network. A person in the Netherlands or Nigeria [1] could access the best technology services the world had to offer. People could more or less interact freely across borders. Obviously this is coming to an end. Every fiefdom wants their cut and their say, to the point where the internet being a global network is obviously bec…

And this freedom was ended by companies like Google and Facebook who abused this freedom forcing governments to act. Internet was at its worst right before GDPR. I don't think we will ever get back to the old free Internet and instead we will have this power balance between big corps and governments.

Like with any new frontier. There's age of exploration, then the age of exploitation, and in the latter. Even if the former is usually funded by commercial interests, it's in the latter that they finally suck out everything that's nice and fair and fun about the venture. We're at this stage now with the Internet.

Re: Dutch DPA fines Uber €290M because of transfers of drivers’ data to the US

#152

Post by lossolo »

lifestyleguru wrote: post #134
lossolo wrote: post #131

Earlier quoted context omitted.

> In Poland I don't even know the names, but if you ever leave your phone number at any doctor, dentist, or blood test lab, starting from next day you'll receive tons of phone calls offering "free products", invitations to "product presentations" I don't know where you are getting your information from but that's not true.

Personal experience of mine and within circle of my acquaintances. Most of the times there is some "GDPR form" you have to sing to receive any service. The blood test results leak from time to time as well. We might be living in different Polands though.

So, it’s anecdotal to your circle. Maybe you're just using some shady providers? Because that’s not my experience or the experience of those in my circle. You should be more careful when buying stuff online; this is where these things happen, not in doctors' offices.

Re: Dutch DPA fines Uber €290M because of transfers of drivers’ data to the US

#153

Post by pembrook »

troupo wrote: post #133
pembrook wrote: post #126

Earlier quoted context omitted.

> It's all very myopic and US-centered to focus on the company's freedom to do as it pleases. The Dutch DPA is not accusing Uber of doing anything nefarious. They are mad that Uber, as an American company, can be compelled by the US government to hand over data. Ultimately, their beef is not with US companies, it’s with the US government. This is all wildly ironic because the EU is constantly trying to spy on their o…

"These cannibals keep eating people because their country's laws allow it. It's not right to blame the cannibals, the governments should figure it out."

There is no actual OR theoretical harm from the companies. Only theoretical harm in the event the US government decides to spy on an EU citizen.

The correct analogy: “There’s cannibals in both countries governments. Country A claims Uber hasn’t done enough to protect from Country B’s government cannibals.

This ignores the shifting rules around proper data transfers to the US, but you wanted a pithy logical fallacy, so there you go.

Re: Dutch DPA fines Uber €290M because of transfers of drivers’ data to the US

#154

Post by [deleted] »

TeMPOraL wrote: post #147
pembrook wrote: post #126

Earlier quoted context omitted.

> It's all very myopic and US-centered to focus on the company's freedom to do as it pleases. The Dutch DPA is not accusing Uber of doing anything nefarious. They are mad that Uber, as an American company, can be compelled by the US government to hand over data. Ultimately, their beef is not with US companies, it’s with the US government. This is all wildly ironic because the EU is constantly trying to spy on their o…

Government spying on citizens is one thing. Companies is another. GDPR applies mostly to the latter, and in practice, today , most people in Europe aren't being harmed by their governments spying on them, but they are being harmed by private business abusing personal data.

[deleted]

Re: Dutch DPA fines Uber €290M because of transfers of drivers’ data to the US

#155

Post by ndsipa_pomu »

imachine1980_ wrote: post #114
ndsipa_pomu wrote: post #102

Earlier quoted context omitted.

Well, I'm not sure that I'd equate "freedom" with companies exploiting people's personal identifying information and selling it for their own profit. Personally, I don't want my information that's protected by GDPR in my own country to be smuggled into another country where there's almost no legal protection for someone's data/privacy.

Free as in corporate freedom to extract and abuse your personal information

Quite - it reminds me of the "freedom" to own slaves, but obviously not nearly as abusive.

Re: Dutch DPA fines Uber €290M because of transfers of drivers’ data to the US

#156

Post by pembrook »

akie wrote: post #144
pembrook wrote: post #126

Earlier quoted context omitted.

> It's all very myopic and US-centered to focus on the company's freedom to do as it pleases. The Dutch DPA is not accusing Uber of doing anything nefarious. They are mad that Uber, as an American company, can be compelled by the US government to hand over data. Ultimately, their beef is not with US companies, it’s with the US government. This is all wildly ironic because the EU is constantly trying to spy on their o…

That's a nonsensical load of hyperbole, pardon my French. It's not particularly difficult to be careful with personal data, it's just inconvenient and prevents all kinds of uses that can make you money - which is why US corporations would prefer to not implement it. But if you want to do business in the EU, you need to play by their rules. Simple.

I have soberly explained the actual situation to you. I know it’s impossible to have a rational conversation about privacy on HN and my comments go against the narrative everyone has stuck in their heads here, but I urge you to look further into this issue.

This is an ongoing geopolitical spat and compliance in good faith is currently impossible.

I have spoken to many lawyers about this. Any US company operating in the EU is at risk of constant fines no matter what you do, due to this geopolitical issue.

Re: Dutch DPA fines Uber €290M because of transfers of drivers’ data to the US

#157

Post by ndsipa_pomu »

pylua wrote: post #146

Funny thing is, us data is almost always maintained by people outside of the US, at least for banking. The servers may live in the us, but the people accessing it are probably located in Europe or India. This also means that the data lives their temporarily while it is being accessed. The US definitely needs stronger laws here.

It shouldn't be a problem for Europeans to access/process U.S. data that belongs to U.S. citizens - GDPR doesn't cover that AFAIK, so it's fine for it to cross borders. The issue is with GDPR protected data of EU citizens, as the law does not permit that data to cross non-EU borders unless it's for specific exemptions such as law enforcement.

Re: Dutch DPA fines Uber €290M because of transfers of drivers’ data to the US

#158

Post by [deleted] »

jeltz wrote: post #91
janandonly wrote: post #2

[flagged]

> If compliance or braking a law is simply some S3 buckets with a different latency and “zone” then breaking the law becomes trivially easy to do. And devilishly hard to check. If it is a genuine mistake the fine would be tiny if there would be a fine at all. At least that is how it has been in other cases. A this big fine indicates that the DPA found serious negligence or willfulness.

[deleted]

Re: Dutch DPA fines Uber €290M because of transfers of drivers’ data to the US

#159

Post by ndsipa_pomu »

oneplane wrote: post #149
dtquad wrote: post #127

Does anyone know good best practices and software/DB patterns to model localized GDPR-compliance into global software systems? I know ASP.NET Core comes with some GDPR-related helpers but it's more interesting to know general best practices and patterns not related to a specific framework.

It's pretty much part of your normal data management that you'd be doing anyway, except it now has an additional lifetime (on top of any you might have had). Since when ingesting the data you knew where it came from and on what timestamp, you also know when to next check for deletion. And since you also know where it came from (the owner), deleting/sending it on request (when applicable - not all data is always requi…

> You only keep what you need for the time that you need it

Just to add that it's stricter than that - you can only keep the data that is required for the purpose that you detailed to the customer. e.g. If you ask for their email address for password validation, then you're not allowed to use that email for other communication unless you explicitly asked for that as well.

Re: Dutch DPA fines Uber €290M because of transfers of drivers’ data to the US

#160

Post by allendoerfer »

epgui wrote: post #116
allendoerfer wrote: post #89

Earlier quoted context omitted.

You are carefully trying to stay vague and are avoiding to name even a single counter-example. You are just claiming that my examples are wrong. This is the definition of a "No true Scotsman" fallacy. Name one non-capitalistic system more moral than the currently existing ones. All rankings trying to quantify morality and order societies by it, are consistently topped by social market economies, a form of capitalism.…

> With the edits to your post, its nature became more and more apologetic to dictatorships. What are you talking about?(!)

It looked more and more like you wanted to say that morals are not an "all or nothing" thing from where it is easy to leap to being apologetic to just a little bit of (systematic) wrongdoing. But judging from your reaction, this is not what you were trying to set up.
Post reply on HN