Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dutch DPA fines Uber €290M because of transfers of drivers’ data to the US

autoriteitpersoonsgegevens.nl

Post reply on HN
Print view View original

71–80 of 414 posts

Re: Dutch DPA fines Uber €290M because of transfers of drivers’ data to the US

#71

Post by shinycode »

concordDance wrote: post #21
shinycode wrote: post #11

Earlier quoted context omitted.

I don’t think this kind of « threat thinking » is true. « We find ways to steal from you and it’s still good for you because otherwise you will be left behind without us ». It’s kinda feels like bullying to me

This is an unconventional usage of "theft" in the "you wouldn't steal a car?" way. Could you explain how the Uber drivers are worse off due to their data being in the USA?

If what they do with data is not "theft" then why this there US laws and contracts to regulate and authorize the use of datas every time I use a new US based service, app, game ? As we see from LLMs, data has value, sometimes probably more than a car. And if it’s worthless, why Uber took the risk in the first place ?

It’s not from us to explain why would drivers be worse. It’s from the one who took the datas to explain why would drivers be better. Because if they would have been better I guess Uber would have done a marketing campaign around it to talk about the benefits instead of doing it this way without anyone noticing.

Re: Dutch DPA fines Uber €290M because of transfers of drivers’ data to the US

#72

Post by WitCanStain »

Mistletoe wrote: post #43
mettamage wrote: post #19

Earlier quoted context omitted.

Instances like this really make me feel that capitalism is devoid of any morality. If there's no law guarding it, a company will abuse its power in order to make more money. It could be a morally good thing, a morally bad thing, it doesn't matter: more money is more money. It feels heartless. I wish there was a better system.

Capitalism only works with proper regulation to protect the little people. We’ve forgotten that part for quite some time now.

Capitalism is a system that inevitably destroys its own guardrails.

Re: Dutch DPA fines Uber €290M because of transfers of drivers’ data to the US

#73

Post by hasanhaja »

mettamage wrote: post #65
allendoerfer wrote: post #30

Earlier quoted context omitted.

We have tried systems based on some seemingly absolute moral codex. Some parts of the world are still doing it. Unfortunately it always comes with brutal ways to kill arbitrary groups of people.

I'd agree, hence that's why I said I wish there was a better system. I don't know it either. Although it might be an uncomfortable truth for me, capitalism isn't great either, but I do think it's the best system we have.

I'm currently reading a book called "Technofeudalism" by Yanis Varoufakis that investigates things along the lines you've said. My main takeaway so far is "Capitalism" hasn't always been one thing and it has evolved over the years. Capitalism of today isn't the same as the capitalism we had before the oligopolies and cloud giants, and that makes me thing differently about the statement "capitalism isn't great either, but I do think it's the best system we have."

I would highly recommend the book!

Re: Dutch DPA fines Uber €290M because of transfers of drivers’ data to the US

#74

Post by AlanYx »

di4na wrote: post #64
AlanYx wrote: post #42

Can anyone explain how this relates to the EU-US Data Privacy Framework (also sometimes called the Trans-Atlantic Data Privacy Framework)? I thought that that framework was supposed to allow this (as a replacement for the EU–US Privacy Shield framework)? Presumably this wouldn't have been a problem under Privacy Shield (i.e., pre-2020), or am I getting that wrong?

You are getting this wrong. Basically the framework, like the Shield before, is the Commission trying to show "look, we fixed it". Sadly, for the previous two times, the ECJ pointed out after the fact that no framework can fix the lack of data privacy law in the US, and that as such, the Shield, just like its predecessor, was not allowing what it claimed to do. The Framework has not been tested in the ECJ so far, but…

Thanks. So basically the new framework hasn't accomplished anything that can be relied upon when architecting a system to reduce the risk of GDPR compliance issues?

Re: Dutch DPA fines Uber €290M because of transfers of drivers’ data to the US

#75

Post by jorams »

AlanYx wrote: post #42

Can anyone explain how this relates to the EU-US Data Privacy Framework (also sometimes called the Trans-Atlantic Data Privacy Framework)? I thought that that framework was supposed to allow this (as a replacement for the EU–US Privacy Shield framework)? Presumably this wouldn't have been a problem under Privacy Shield (i.e., pre-2020), or am I getting that wrong?

This article[1] by the Dutch DPA has some details about it: The Privacy Shield was invalidated in 2020, leaving only the Standard Contractual Clauses as a valid transfer tool. Uber stopped using Standard Contractual Clauses in August of 2021, before adopting the new Privacy Framework in 2023. For a period of two years they were transmitting extremely sensitive information without a valid way to do so.

[1]: https://www.autoriteitpersoonsgegevens.nl/en/current/dutch-d...

Re: Dutch DPA fines Uber €290M because of transfers of drivers’ data to the US

#76

Post by AlanYx »

jorams wrote: post #75
AlanYx wrote: post #42

Can anyone explain how this relates to the EU-US Data Privacy Framework (also sometimes called the Trans-Atlantic Data Privacy Framework)? I thought that that framework was supposed to allow this (as a replacement for the EU–US Privacy Shield framework)? Presumably this wouldn't have been a problem under Privacy Shield (i.e., pre-2020), or am I getting that wrong?

This article[1] by the Dutch DPA has some details about it: The Privacy Shield was invalidated in 2020, leaving only the Standard Contractual Clauses as a valid transfer tool. Uber stopped using Standard Contractual Clauses in August of 2021, before adopting the new Privacy Framework in 2023. For a period of two years they were transmitting extremely sensitive information without a valid way to do so. [1]: https://ww…

Thanks. That gives a lot more information. With respect to the new framework, the article you linked to just says "Since the end of last year, Uber uses the successor to the Privacy Shield." Do you know if the Dutch DPA endorsed the new framework, or did they leave it ambiguous/unresolved as to whether post-2023 transfers are GDPR compliant?

Re: Dutch DPA fines Uber €290M because of transfers of drivers’ data to the US

#77

Post by WesolyKubeczek »

lifestyleguru wrote: post #66
ghusto wrote: post #22

Earlier quoted context omitted.

GDPR was never annoying banners, that's just malicious compliance.

Since GDPR every interaction with public administration, healthcare, and employer within EU results with additional form or two "oh that's just a GDPR form, you have to sign it". I imply they are all malicious as well?

In fact, yes. It’s malicious in the vast majority of cases, with behavior patterns quite akin to cons where you are made into signing something under time pressure and are actively discouraged from asking questions.

I had maybe one occasion where upon asking questions about how long they store my information and who exactly they give it to, I actually got answers and learned something. It was a dentist office, and by that time I had been visiting them so often that we were practically friends.

The rest of the time (mostly in hotels), they didn’t like it very much that I took time to read through their GDPR forms and actively withdraw my consent from optional things, of which there was like 85%, and some dealt with sharing my data with undisclosed marketing partners. Some of this, especially the undisclosed bit, I think, is a no-no under GDPR, although a lawyer may promise you a way to weasel out of trouble.

Note that when you deal with public administration, depending on the country, they may have you sign something to the effect that if they fine you and you don’t pay, your data will go to a debt collection firm, at which point you may assume it goes to all of them, because they trade debts between themselves, too. And of course, those share data with further companies according to agreements between themselves to which you are not a party, so I’m wondering if there is/should be a way to curb them…

Re: Dutch DPA fines Uber €290M because of transfers of drivers’ data to the US

#78

Post by nraynaud »

allendoerfer wrote: post #30
mettamage wrote: post #19

Earlier quoted context omitted.

Instances like this really make me feel that capitalism is devoid of any morality. If there's no law guarding it, a company will abuse its power in order to make more money. It could be a morally good thing, a morally bad thing, it doesn't matter: more money is more money. It feels heartless. I wish there was a better system.

We have tried systems based on some seemingly absolute moral codex. Some parts of the world are still doing it. Unfortunately it always comes with brutal ways to kill arbitrary groups of people.

Isn’t Warren Buffett’s son using his father’s fortune to hunt and murder Latinos at the southern border?

Re: Dutch DPA fines Uber €290M because of transfers of drivers’ data to the US

#79

Post by croes »

koollman wrote: post #55
croes wrote: post #28

I'm confused. Thanks to the CloudAct there is not protection of EU user data no matter the location of the servers.

That would be incorrect. IANAL, but cloud act purpose is to allow the usa government to ask data from USA-based or USA-related services providers, for offsense/crimes. It does not allow service providers to do anything else with that data.

But what could Uber do with customer data on US servers what they couldn't do with the data on EU servers?

Re: Dutch DPA fines Uber €290M because of transfers of drivers’ data to the US

#80

Post by epgui »

allendoerfer wrote: post #60
epgui wrote: post #50

Earlier quoted context omitted.

You seem to be missing an ethics class. Morality doesn’t have to be like that at all.

So you would say these systems are no true scotsmen ?

No. If you go looking, you will find plenty of counter-examples in History. You just made a statement that the top handful of catastrophic examples were representative of the bunch.

You have massive selection bias in your sample. “Morally-based decision ends well” is not exactly something that makes headlines or that is seized upon by historians to explain memorable cataclysmic events.

You don’t need to be an ethics expert to see a difference between moral principles that lead to suffering, and moral principles that don’t.

Waving away all morality in moral nihilism is teenage-level ethical sophistication.

Post reply on HN