Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Europe's GDPR privacy law is headed for red tape bonfire within 'weeks'

politico.eu

Post reply on HN
Print view View original

91–100 of 190 posts

Re: Europe's GDPR privacy law is headed for red tape bonfire within 'weeks'

#91

Post by SOLAR_FIELDS »

diggan wrote: post #88
ivan_gammel wrote: post #82

Earlier quoted context omitted.

I think you did not understand my comment. 1. It is a problem for greenfield projects too. Not everyone has sufficient expertise to be fully compliant from the beginning. The accidental non-compliance is possible and there's usually a cost to prevent it. 2. It may work as expected from EU charter perspective, but current implementation is adding extra to an already high bureaucratic workload. My point is, it can be b…

> It is a problem for greenfield projects too. Not everyone has sufficient expertise to be fully compliant from the beginning Saying it's complicated because of missing experience or knowledge is like saying creating a CRUD application is difficult. Yes, it might be difficult if you've never done it before, but that doesn't mean the thing itself is complicated, just that you potentially lack experience. Instead, I'd…

This is mostly true with security compliance in general from my experience. SOC II, for instance, is pretty straightforward if you were already doing things in a sane way. It’s only a lot of work if you were previously sloppy with security and need to rectify that

Re: Europe's GDPR privacy law is headed for red tape bonfire within 'weeks'

#92

Post by rekabis »

tzs wrote: post #84
bad_user wrote: post #50

Earlier quoted context omitted.

The cookie banners aren't worthless. The websites presenting cookie banners either don't know the law, or are engaged in spyware shit. You don't need a cookie banner if you need it to provide a service that the user expects (e.g., saving settings, login). As an EU citizen, I'm not concerned about your need to observe my behaviour or to prevent ad-click fraud. What I care about is websites sharing my navigation histor…

> The websites presenting cookie banners either don't know the law, or are engaged in spyware shit. You don't need a cookie banner if you need it to provide a service that the user expects (e.g., saving settings, login). There's quite a lot between "engaged in spyware shit" and "service that the user expects". For example if I want to add first party analytics to my site, the data from which I will use solely interna…

> if I want to add first party analytics to my site, the data from which I will use solely internally to try to figure out what pages people like and which they do not like,

This is doable entirely on the server side, provided there is no caching or CDNs that get in the way.

What you lose with that method, however, is all the spyware-like shit that analytics tends to gravitate towards.

Re: Europe's GDPR privacy law is headed for red tape bonfire within 'weeks'

#93

Post by vkou »

cbeach wrote: post #57
Hojojo wrote: post #35

Earlier quoted context omitted.

I don't see why small organizations should get to be more careless with my personal data than anybody else. The value of my privacy doesn't change just because of the size of the company.

The cookie banners don't make companies less "careless" They just introduce a needless bit of friction in the UX. If the EU wanted to prevent digital identity triangulation or cross-domain advertising data gathering, it should have banned it outright. Rather than getting all users to click a stupid banner every time they visit a website.

You can eliminate friction in your UX by not collecting data you don't need. It's way less work to, you know, not collect that data.

I'm not sure why the government is needed to solve a problem that you've gone out of the way to inflict on yourself.

Re: Europe's GDPR privacy law is headed for red tape bonfire within 'weeks'

#94

Post by kuschku »

pabs3 wrote: post #61
terminalbraid wrote: post #4

At the minimum I'd hope they a) do away with the worthless cookie banners requirement b) cut some generous but reasonable slack to small organizations. Interesting timing with the digital sovereignty movement.

Browsers should be the things handling cookies, not websites.

The law doesn't care whether the tracking happens via cookies, localstorage, fingerprinting, or a private investigator looking through your window.

All require approval that is just as easy to deny as it is to accept.

The browser may be able to block cookies, but that's not a solution for the other options.

Re: Europe's GDPR privacy law is headed for red tape bonfire within 'weeks'

#95

Post by tmpz22 »

aleph_minus_one wrote: post #69
bambax wrote: post #54

Earlier quoted context omitted.

And in the world of bureaucracy, "simplification" doesn't mean what you'd think it should mean. "Simplification" consists in adding exceptions, which are in effect additional rules and special cases. Simplification actually means everything gets more complex.

We live in an Orwellian world: War is peace. Freedom is slavery. Ignorance is strength. Simplification is complication.

Alternatively:

Peace is a lie, there is only passion.

Through passion, I gain strength.

Through strength, I gain power.

Through power, I gain victory.

Through victory, my chains are broken.

The Force shall free me.

Re: Europe's GDPR privacy law is headed for red tape bonfire within 'weeks'

#96

Post by youngtaff »

pabs3 wrote: post #61
terminalbraid wrote: post #4

At the minimum I'd hope they a) do away with the worthless cookie banners requirement b) cut some generous but reasonable slack to small organizations. Interesting timing with the digital sovereignty movement.

Browsers should be the things handling cookies, not websites.

Not so sure they can be trusted to have the users interests at heart e.g Chrome and 3rd parties cookies, Topics/Fledge

Re: Europe's GDPR privacy law is headed for red tape bonfire within 'weeks'

#97

Post by kuschku »

superkuh wrote: post #90
johnnyanmac wrote: post #79

Earlier quoted context omitted.

It's also easy if you simply stop trying to track users and only store the most necessary data. Like, no one ever seem to consider this. Meanwhile, this same community a few days back were discussing the idea of trying to abolish advertisement. That's truly bluesky thinking if we're still justifying user tracking in 2025.

I only "store" my webserver's logs and user submitted comments. But someone can still put the legal pressure on me, a random person, to force me to do work to turn over those logs/etc. It's wild. Like having a security camera, hosting a BBQ for the neighborhood, and having a neighbor demand access to the recorded video with legal threats. This whole thing really only makes sense in the context of for-profit incorpora…

You have up to 30 days to respond to access/edit/delete requests.

It's accepted practice to only keep logs for e.g. 48 hours and respond to any request with 2 days delay "we've got no logs from that timeframe anymore".

Re: Europe's GDPR privacy law is headed for red tape bonfire within 'weeks'

#98

Post by remus »

sega_sai wrote: post #12

I think the title is clickbait'y. The EU proposes to simplify the law rather than abolish it, which makes sense to me.

Indeed. Relevant quote from the article:

"The Commission said previously that the simplification plan will focus on reporting requirements for organizations with less than 500 people, but will not touch the “underlying core objective of [the] GDPR regime.”

Adjustments could include limiting requirements to keep records of data processing activities, or reforming how businesses provide data protection impact statements — two rules seen as overly cumbersome to smaller firms."

Sounds pretty sensible to me.

Re: Europe's GDPR privacy law is headed for red tape bonfire within 'weeks'

#99

Post by wongarsu »

diggan wrote: post #21
cbmask wrote: post #5

The politicians cite competitiveness as the motivator for relaxing the GDPR. The real reason for the EU lagging behind the US in "big tech" is of course the lack of venture capital and the red tape in registering corporations. The GDPR does not prevent US big tech from operating in the EU. As it stands, this is just another attack on EU citizens' rights. It is also the least of the EU's current problems. De-industria…

> The GDPR does not prevent US big tech from operating in the EU. Of course it doesn't, that'd be stupid. But it does require them to be compliant, otherwise they'll face fines and eventually they'll chose to either be compliant, or exit the market. As a EU citizen with rights, I love this, exactly what I want from my inter-continent union of countries.

And complying with the GDPR isn't that difficult as a startup. You can build your systems from the ground up to be able to accommodate GDPR requirements. There is some documenting paperwork you are supposed to have internally, but enforcement is quite lenient if you show good-faith efforts to comply.

Re: Europe's GDPR privacy law is headed for red tape bonfire within 'weeks'

#100

Post by AndrewStephens »

superkuh wrote: post #90
johnnyanmac wrote: post #79

Earlier quoted context omitted.

It's also easy if you simply stop trying to track users and only store the most necessary data. Like, no one ever seem to consider this. Meanwhile, this same community a few days back were discussing the idea of trying to abolish advertisement. That's truly bluesky thinking if we're still justifying user tracking in 2025.

I only "store" my webserver's logs and user submitted comments. But someone can still put the legal pressure on me, a random person, to force me to do work to turn over those logs/etc. It's wild. Like having a security camera, hosting a BBQ for the neighborhood, and having a neighbor demand access to the recorded video with legal threats. This whole thing really only makes sense in the context of for-profit incorpora…

Why do you store your webserver's logs? My reading of the GDPR (I am not a lawyer) is that it strongly encourages site owners to store the very minimum amount of data about visitors - something that I wholeheartedly agree with.

Server logs are useful for debugging the site but also contain potentially identifying information (IP addresses) so I have my site delete them after 48 hours.

User submitted comments are obviously required for the usage of your site, so you are in the clear there.

Post reply on HN