Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I told them forced consent was unlawful. 5 years later it cost Elkjop €1.8M

thatprivacyguy.com

Post reply on HN
Print view View original

271–280 of 308 posts

Re: I told them forced consent was unlawful. 5 years later it cost Elkjop €1.8M

#271

Post by trinsic2 »

cheese_van wrote: post #102
engeljohnb wrote: post #17

I'm glad it all worked out for this individual. I hope more people live their lives like this as the dystopia progresses. Unfortunately, especially in the US, exercising your rights, or even just reading every paper you're expected to put your name to, not only constantly pisses people off for some reason, but also puts you at a significant disadvantage compared to the people that never push back in the interest of n…

Went to a new doctor. As part of the check-in process, I was asked to "sign" a little digital pad, so, as I was told, they could properly use my insurance. I asked to see the hard copy of what I was signing and they couldn't find one. Then, for some reason, they were unable to print one. I gave up and scribbled my sig with my finger and then was seen by a doctor. It's maddening.

What's interesting about those documents you asked to sign, at least at hospitals, it's not a requirement even though it may appear that way by the interaction. I suspect it's the same for other medical professions as well.

Re: I told them forced consent was unlawful. 5 years later it cost Elkjop €1.8M

#272

Post by miyoji »

soco wrote: post #266
filoeleven wrote: post #264

Earlier quoted context omitted.

> And the police your name and emergency contacts. Hell no. The fuzz ain't getting my info without reasonable, articulable suspicion that I have committed, am committing, or am about to commit a crime, or if I'm pressing charges and need to ID for that process.

The parent comment was about an accident where you're unable to give any details yourself. Maybe when you're under a truck you'd like your folks to know what happened to you, right? But again, such are implementation details. First let's have that zero trust device, then we can be negotiate who gets to see what and when.

The problem is that it creates a vector for illicit access to the information, and if that vector exists, it will be abused.

I'd rather have society deal with the problems that come with not knowing who's under the truck than the problems that come with state surveillance.

Re: I told them forced consent was unlawful. 5 years later it cost Elkjop €1.8M

#273

Post by aand16 »

trhway wrote: post #60
solid_fuel wrote: post #22

Earlier quoted context omitted.

> Unfortunately, especially in the US, exercising your rights, or even just reading every paper you're expected to put your name to, not only constantly pisses people off for some reason Yup. It's particularly sad seeing other people in this very thread talking about how they would "ban this customer for life" just for knowing their rights. I think it's pathetic that this has become the culture amongst large swathes…

>I think it's pathetic that this has become the culture amongst large swathes of Americans - especially ones who consider themselves patriotic. This country was founded in rebellion and the assertion of our rights, and somehow the exact opposite is now the ideal of many citizens now. DHS is putting on the domestic terrorists watch list those people who took parts in the protests. Or at minimum threatens to put. And i…

Pretty sure nobody is worried about peaceful protests.

Re: I told them forced consent was unlawful. 5 years later it cost Elkjop €1.8M

#274

Post by buzer »

AlexanderHanff wrote: post #216
buzer wrote: post #194

Earlier quoted context omitted.

Official EU website, generally speaking, are not bound by GDPR or ePD. Rather EU bodies are bound by EUDPR. I'm not well-versed on that specific thing, but EDPS and courts have previously found that EC has infringed EUDPR so it wouldn't be weird if their cookie banner was breaking the law as well.

They actually are bound by the ePrivacy Directive due to jurisprudence (EU bodies must comply with CJEU rulings). I actually wrote to the EDPB on 25th May 2018 (the day GDPR came into effect) and forced them to make their own website compliant with the ePrivacy Directive (I still have the email thread, it was quite an interesting discussion). I also filed a complaint against the Court of Justice on October 1st 2019 w…

I would like to see that thread if possible just out of curiosity.

I looked a bit into EUDPR and the earlier 45/2001 regulation (EUDPR came in effect in December 2018 so a bit later than GDPR). EUDPR explicitly imports Article 5(3) of ePD (via Article 37) and thus whatever case law there is around it. The earlier regulation seems to do this more indirectly (references in recitals), but EDPS view from 2016 is that it effectively does import Article 5(3) as well.

Personally I haven't dealt with EU institutions so far. On general public sector side I did recently seek some clarifications from Finland's Ministry of Justice regarding one of their websites and their responses weren't exactly reassuring.

I asked for the GDPR Article 15(1) information regarding single visit (i.e. information about processing, not actual copies of data) and it took them almost 3 months to give official response. Even after that time they, for example, failed to identify if they are actually the controller or not for some of the processing (Cloudflare challenge). And their stance is that analytics (Matomo) does not need Article 6 legal basis at all, i.e. they seem to think that anonymization step itself is not processing.

Re: I told them forced consent was unlawful. 5 years later it cost Elkjop €1.8M

#275

Post by sandworm101 »

oarsinsync wrote: post #261
sandworm101 wrote: post #121

Earlier quoted context omitted.

Becauae "spirit of the law" doesnt exist. It is a saying used by people when they want to do something that isnt in the law. You dont see lawyers, judges or law makers use the phrase.

> Becauae "spirit of the law" doesnt exist. It is a saying used by people when they want to do something that isnt in the law. You dont see lawyers, judges or law makers use the phrase. This is dependent on jurisdiction. Some countries (e.g. the USA) do not consider spirit/intent (anymore), as the judiciary has repeatedly ruled that the letter of the law, as written, is what matters, regardless of whether it meets th…

Intent is expressed through drafter's notes or explanations. "Spirit" is somerhing else, something made up later by people who had nothing to do with th3 creation of the law.

Re: I told them forced consent was unlawful. 5 years later it cost Elkjop €1.8M

#277

Post by FireBeyond »

ihodes wrote: post #119
socalgal2 wrote: post #112

Earlier quoted context omitted.

I'm sure someone smarter than me has a solution. Those papers you're required to sign are generally the result of regulation. Some law got passed that say "you can't share info unless you get signed permission". The person dreaming up the law thought that would be enough to stop getting them to share info. But, even if they cared about privacy, they don't want to increase all their expenses and run their own IT depar…

Regarding information sharing, not quite. Covered entities (term of art in HIPAA), which include providers (and also payers!) including both the lab and your doctor, do not need your permission to share information between them for the purposes of treatment, payment, or operations (commonly, "TPO"). A BAA between a covered entity and a vendor (like an EHR or PACS [viewer for your imaging]) also does not require any p…

> do not need your permission to share information between them for the purposes of treatment, payment, or operations (commonly, "TPO")

In fact, for the purposes of treatment, providers can share that information, even if you explicitly refuse, as needed.

Re: I told them forced consent was unlawful. 5 years later it cost Elkjop €1.8M

#278

Post by FireBeyond »

trinsic2 wrote: post #271
cheese_van wrote: post #102

Earlier quoted context omitted.

Went to a new doctor. As part of the check-in process, I was asked to "sign" a little digital pad, so, as I was told, they could properly use my insurance. I asked to see the hard copy of what I was signing and they couldn't find one. Then, for some reason, they were unable to print one. I gave up and scribbled my sig with my finger and then was seen by a doctor. It's maddening.

What's interesting about those documents you asked to sign, at least at hospitals, it's not a requirement even though it may appear that way by the interaction. I suspect it's the same for other medical professions as well.

Many of them are just "CYA" for the facility/provider. HIPAA allows, for example, providers to share your medical information, for the purposes of treatment, regardless of your consent.

Re: I told them forced consent was unlawful. 5 years later it cost Elkjop €1.8M

#279

Post by lII1lIlI11ll »

throw9394494 wrote: post #26

I wonder if anyone who are cheering this fine, actually read and tried to implement GDPR. It is a nightmare to be fully compliant for small companies. It is mostly just a theater (like endless cookie consent dialogs in anonymous browsing), to employ more experts and bureaucrats. EU is now pushing privacy laws that severely undermine privacy.

That is likely by design. From the article footer:

"Work with Alexander

Thirty years in privacy. Helped shape the GDPR. Advisor to the EDPB, the European Parliament and the European Commission. If you need this kind of analysis applied to your own systems:

    Website and App Compliance (£500/mo+)
    GDPR Compliance Audits (£3,500+)
    DPO-as-a-Service (£1,500/mo+)
    Privacy by Design Implementation
Book a free consultation See all services"

Re: I told them forced consent was unlawful. 5 years later it cost Elkjop €1.8M

#280

Post by FireBeyond »

engeljohnb wrote: post #110
deepsun wrote: post #28

Earlier quoted context omitted.

Once I rented an apartment in US, and the documents said that they can make videos, pictures and audio recordings of me and my family, and use it for their own purposes including commercial. I objected, but their position was that no one is going to involve legal department for me, and I am free to go away.

Rentals are exactly what I was talking about. Supposedly you can always go to someone else, but we all know in practice we can't just go without housing and if everyone decides you're "difficult," you're SOL. Earlier this week a potential landlord offered me a lease saying I had already inspected the property and found no issues with it. I asked for a chance to actually inspect before signing, and even said I would s…

For separate but similar reasons, Washington was forced to add to tenant law the proviso that tenants could not waive certain tenant rights, even if consideration was given.

"There's a clause in here that gives some more time for certain repairs, because we're short-staffed, so we will take $50 off of your rent". Nope.

"There's a clause in here that says that your monthly payment will first be applied to late payments, fees, fines, and then your lease payment in that order." Nope.

Post reply on HN