‘Everyone is breaking the law right now’: GDPR compliance is falling short

https://digiday.com/media/everyone-breaking-law-right-now-gdpr-compliance-efforts-falling-short/

by ilamont • 8 years ago

217 216 8 years ago

davidhyde• 8 years ago

Part of the issue, experts say, is the vague regulation has been interpreted in wildly different ways. GDPR consent-request messages vary wildly across sites

What experts? I found the law to be pretty clear and there are plenty of summarized versions out there. What some companies find confusing is that the law has made their core business model illegal and no consent form can save them. You cannot get your users to opt out via a consent form, how many times do people have to repeat this? This is nothing like the cookie law.

The only vague part of the law is the fining system which was done on purpose. If you have explicit fines then companies will have to make more money from your private data to cover the explicitly priced fine leading to a worse situation.

AndrewStephens• 8 years ago

What some companies find confusing is that the law has made their core business model illegal and no consent form can save them.

Exactly this. Even the big reputable publishers (who wouldn't <em>dream</em> of breaking the law, oh no) accept money from companies directly targeted by the GDPR, who collect copious amounts of data on visitors across multiple sites.

Do users on site A consent to company B collecting data through ads, even if they tick a box? Probably not.

https://sheep.horse/2018/6/the_eu_general_data_protection_re...

existencebox• 8 years ago

I can't honestly agree. (re: ambiguity of interpretation, and cost being limited only to privacy-violating business models) Two reasons.

1. HN discussions themselves. Literally EVERY TIME this comes up, you see a massive back and forth from various crowds of GDPR; some of whom swear that it's perfectly comprehensible even as significant portions of the conversation are interpreting the same points in a variety of ways. (Are IPs PII? What exceptions can be allowed? What falls under "security requirement"? What forms of data are associated PII? What sort of deanonymization is sufficient? IS it sufficient? are some common questions I saw in the past, not even getting into the wonderful world of third party data processors.) This seems like enough pragmatic evidence that a (to give the benefit of the doubt) educated and professional community hasn't reached consensus, so to say there's a variety of interpretation seems very fair.

2. I implemented GDPR for a small corner of a notable BigCo. I do not consider myself an expert, but I certainly got my marching orders from experts, (The legal teams who interpreted the document and evaluated the implementation methods) and the sheer amount of horsepower put behind finding an interpretation we believed and were confident in was staggering. Granted this is something where we _really wanted to get it right_ but if it were really trivial to interpret I question if the process would have been as intensive as it was. (To preempt the inevitable; our (my team's) business model has _literally nothing_ to do with your data, but we had many of the same confusions/questions that I saw from companies who did, so I'd be hesitant to say that the burden isn't somewhat widespread.)

JumpCrisscross11• 8 years ago

The legal teams...and the sheer amount of horsepower put behind finding an interpretation we believed and were confident in was staggering

You shouldn't be getting down voted. I just went through a GDPR compliance review. We have a service model which is incredibly serious about customer confidentiality. We don't sell ads and, to my recollection, have never even bought them. Still required an army of lawyers. Two top London law firms ended up agreeing to disagree on major points, ultimately concluding the Polish data regulator would probably rule one way and the French the other.

Complying with the spirit of a law doesn't mean complying with the statue of it. With GDPR, it's the latter that's a pain in the ass.

dijit2• 8 years ago

You've had sizeable replies and I've yet to read them, so forgive if I'm reiterating something here.

But as for 1): IPs are distinctly /not/ PII (AKA: PD). They're identified /by name/ in the regulation, unless you sell that info. Anyone who brings this up as a topic has not actually read the regulations.. or they have and are trying to create uncertainty for some objective.

It sounds like you've done enough of reading the regulation to actually know this, it's part of your job and you've spoken to legal experts (as I have).

neffy2• 8 years ago

Here it is:

https://www.eugdpr.org/the-regulation.html

Hands up. Who has actually read all of it?

Speaking as somebody who actually has - was teaching computer security last term - I found it relatively easy to read (as legal documents go) - but it still took a weekend. I will guarantee you, that not all of the high powered lawyers whose job it is to read it, have done that.

True story: back in the days when libraries still stamped your book with the date it was due back, I took out a copy of Keynes General Theory from the main library where I lived. It's not that thick of a book, and according to the date stamps it had been borrowed at least 20 or so times. About half way through the pages hadn't been cut.

It was a few years before the significance of that finally dawned on me. As in many things in life, HN discussions on the GDPR are a wonderful example of nobody actually reading it, and everybody having an opinion of it.

rcheu2• 8 years ago

Yeah, I’m willing to bet the people that think this is easy and clear are not trying to implement it. I have not met anyone working at a large internet company (these companies have high likelyhood of being sued so it’s very important the law is followed as accurately as possible) that thinks the law is clear.

krageon• 8 years ago

99% of the people screaming here that it's incomprehensible either very clearly haven't read the source material or just don't understand how the law works in the EU (I guess they are from somewhere else and didn't bother to look anything up before forming an opinion).

Regarding your point about consensus, that's fair - however this has not been my experience. Most parties that you would ask for advice on the matter have a pretty good handle on what the different terms mean.

Your second point is mostly evidence (to my mind) of large corporations trying to get away with as much malicious compliance as they can possibly manage. You really do have to put a lot of effort in that, as you cannot assume the agency checking you will see good faith (which is, as far as I understand it, one of the requirements for not being slapped with fines very quickly).

Fradow• 8 years ago

"It is difficult to get a man to understand something, when his salary depends upon his not understanding it!"

The law is pretty clear (not 100% clear, obviously, there is going to be loophole and unclear things), and it's easy to decide about unclear spots by following the spirit of the law, and by understanding that any unclear technical requirements really means "what a sane engineer would do, that you could defend against a jury of your peer".

To answer a few of your questions (obvisouly IANAL):

- are IPs PII? Yes, there are legal case about that, your lawyer should have a more detailed answer.

- what exceptions can be allowed? When you have a case you could defend that doesn't go against the spirit of the law

- what falls under "security requirements"? You should be able to defend your choices securiy-wise against a jury of your peer, using your internal documentation. If you have unsalted passwords hashs for example, you are in trouble

- what sort of deanonymization is sufficient? Best practices at the current date.

Technical details aren't going to be in the law, because the goal of a law is to not be outdated every year.

Laws are enforced by humans, not by computers. Your company should be prepared to defend its interpretation of the law (that's your lawyer job) and your technical choices (that's your job).

Edit: obviously, that's a simplified vision, and you should always consult your lawyer. The biggest your company is, the more important it is to try your best to be compliant.

scarejunba• 8 years ago

If it is easy to follow the law, then the cost of a compliance expert on this topic would be low. It is not low. Compliance is expensive, even for companies who don't make their money from data. Therefore, I don't think it's that easy.

tjoff2• 8 years ago

It becomes hard when you try to get away with something that goes against the intent of the law.

And that is exactly what sites are doing now. And there is noone on earth that will ever believe it isn't deliberate.

TeMPOraL• 8 years ago

Not necessarily. It's a seller's market due to huge demand, so prices alone may not be a good indicator of difficulty at this point.

s73v3r_2• 8 years ago

That doesn't follow. It's easy to follow the law, but because a lot of companies were doing things that were against the law, and given that a lot of companies put things off til the last minute, it took a lot of work to come into compliance.

tmikaeld• 8 years ago

What I've found to be "confusing" is that some GDPR consultants say that when a single person cannot be identified in a blob of data, then it's not personal data.

While others say the opposite, any data derived from a single individual is still considered personal data.

merb3• 8 years ago

well under the eu gdpr no data is called personal data if it is immpossible with the data to identify a person/company/person of law.

DanBC8• 8 years ago

GDPR seems clear on this: it's personal data if a natural person can be identified from it using reasonable means.

sbov2• 8 years ago

Cool. If it's so clear, then are you willing to be held liable if my company is found in violation of it due to your misreading?

I'm guessing not. People who are willing to put their reputation on the line, who are paid four figures per hour to understand this stuff, disagree with eachother on interpretations of GDPR.

JumpCrisscross11• 8 years ago

be held liable if my company is found in violation

Forget about violations. Even if you're in perfect compliance, any EU resident can complain to their data authorities if they think you're non-compliant. That then prompts a regulatory inquiry, which requires lawyers to competently respond to, which is distracting and expensive.

tomnipotent• 8 years ago

No law is clear until it's been argued a few times in court and an army of legal professionals have duked it out. This is why - at least in the US - the branch of government that writes the law is separate from the one that interprets it.

j16sdiz• 8 years ago

(Unlike US) Most of EU use civil law system. Precedent are not binding in civil law system

MarkMc• 8 years ago

Heres what the UK ICO says: "The GDPR does not define what factors to take into account when deciding if your purpose is a legitimate interest. It could be as simple as it being legitimate to start up a new business activity, or to grow your business." [1]

Isn't that a little vague? It seems to imply that if a business can show that collecting your personal information will grow their business, they do not need to provide a way for you to 'opt out'.

[1] https://ico.org.uk/for-organisations/guide-to-the-general-da...

jiveturkey3• 8 years ago

Yes, it is a little bit vague. It's intentionally vague. The abuse of LI is designed to be like porn: I'll know it when I see it.

It's totally fine for it to be vague. I very much doubt we'll see any cases where the general public disagrees with a DPA ruling of LI applicability. As a business owner, it means you need to strongly justify it and consider if a "reasonable person" would consider your use of LI to be justified. If you have doubt, you should seek consent instead.

Do keep in mind, that growing your business by using PD for marketing purposes is explicitly excepted from LI.

tzs• 8 years ago

I found the law to be pretty clear and there are plenty of summarized versions out there. What some companies find confusing is that the law has made their core business model illegal and no consent form can save them.

What about Article 27? It's unclear, and you don't have to have a shady business model in order to have no idea how you are supposed to deal with it. All it takes is that your business is not established in the Union.

This is the article that requires companies who are not in the Union but are subject to GDPR due to Article 3(2) to appoint a representative in the Union. The representative serves as a contact point that regulators and persons can communicate with instead of the company on all GDPR matters concerning the company. The representative is also required to keep a bunch of metadata about the company's data processing, according t Article 30.

According to the recital for this article, "The designated representative should be subject to enforcement proceedings in the event of non-compliance by the controller or processor".

What does that mean?

Some people claim it means that your representative in the Union will be liable for any fines you incur from EU regulators or any damages a plaintiff wins in a private lawsuit over GDPR if the regulator or plaintiff is not able to force you to pay up.

Others think it just means that if regulators or plaintiffs serve notice on the representative, that legally counts as if you were served, meaning that if you do not show up at the hearing or trial and lose by default, you cannot try to weasel out by claiming you had no notice of the hearing or trial. In other words, these people think that the representative is very similar to the "registered agent" that many jurisdictions require foreign businesses to have in order to do business in that jurisdiction.

Personally, I was leaning toward the latter, as the idea of making the representative liable seemed pretty absurd...but it has been pointed out that in earlier drafts of Article 27 and the recitals, it did in fact actually clearly do so. That language was taken out before the final draft, but was that change because they wanted to remove that aspect, or because they decided "subject to enforcement proceedings" already implied it and they were just tightening the language?

This is important because if representatives are actually liable for fines and damages, it is going to be a lot more expensive to hire people to be representatives than it will be if all they have to do is be a contact point and a repository of metadata.

For small businesses outside the Union this could be a major expense if they must have a representative, perhaps a big enough expense that it will be worthwhile to just stop doing business in the EU.

So we must ask, "Who needs a representative?". The answer, it turns out, involves still more vagueness.

Basically, you are excused from needing a representative if you meet three conditions. Two of them most small businesses easily meet as long as they are not doing high volumes of certain particularly sensitive data, and their processing does not result in a risk to "the rights and freedoms of natural persons" (more vagueness!).

The third condition is that your processing "is occasional". What is "occasional"? No one seems to know.

Aengeuad4• 8 years ago

Some people claim it means that your representative in the Union will be liable for any fines you incur from EU regulators or any damages a plaintiff wins in a private lawsuit over GDPR if the regulator or plaintiff is not able to force you to pay up.

I very much doubt this for a few reasons, the first being that it would be completely out of scope for the GDPR to have any say on what happens or who should be sued in a private lawsuit. The recital itself would also be contradictory, immediately before it says that the representative 'should be subject to enforcement proceedings' it says,

Recital 80(4), The designation of such a representative does not affect the responsibility or liability of the controller or of the processor under this Regulation.

Additionally,

Article 27(5), The designation of a representative by the controller or processor shall be without prejudice to legal actions which could be initiated against the controller or the processor themselves.

The wording of these two alone make it clear, to me, that the responsibility or liability lies solely on the controller/processor. The term prejudice also has a very specific meaning in Civil Law, and while it may have different meanings in Common Law (UK) I'm sure the more specific Civil Law version is intended and relevant. The wording of recital 80(6) as well as (5) '[the representative should cooperate] with the competent supervisory authorities with regard to any action taken to ensure compliance with this Regulation.' also tie in with other areas of the GDPR, particularly article 31 and 58(1)(a) which essentially state that supervisory authorities have the power to order the controller/processor as well as the representative to provide information that is required for the authority to perform its tasks. I think recital 80(6) with this context is basically just confirming that representatives need to to be present when supervisory authorities undergo enforcement of legislation.

If it were such a legal headache for representatives, it is concerning that no law firm has put forward an analysis of the situation. As far as I can tell from a brief search it is only amateurs interpreting the GDPR that have come to the conclusion that representatives may be liable for fines. With DPOs, who have many more responsibilities and requirements, there was much analysis by the legal community on what those responsibilities would include and whether DPOs could share liability. The WP29 even put out guidelines for DPOs[0] stating plainly that DPOs are not responsible for non-complaince, only the controllers/processors are responsible for non-complaince. It just seems odd to me that representatives who receive almost no mention in the legislation may be responsible for non-complaince where DPOs aren't responsible.

[0] http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_... [very bottom of page 24]

shados2• 8 years ago

There are so many ambiguities and confusing situations. Eg: legitimate business use and free accounts. What do you define as the free account user to still be a customer? What if you nuke their account after some inactivity and then they come back? They're going to be pissed.

Server log retention, message queues, etc and ip addresses (which may or may not be problematic depending on how they're stored and with what). Not fun.

Third party vendors. Omg third party vendors. Many of them have no idea wtf they're doing. Ive seen some vendors swear up and down they didn't store any PII, just to realize eventually that they did and they didn't even know. Hope those DPAs are signed and in order! Hope you have good lawyers!

It's insanely hard for any non-trivial systems. It gets even worse when american laws and GDPR conflict (eg: finance data retention laws. The definition of legitimate business need gets REAAAAALY fuzzy...)

Aengeuad4• 8 years ago

There are so many ambiguities and confusing situations. Eg: legitimate business use and free accounts. What do you define as the free account user to still be a customer? What if you nuke their account after some inactivity and then they come back? They're going to be pissed.

Processing of data is legitimate so long as you still have a reason to process that data, as well as if you have a contractual obligation with the subject to process that data. If that contract involves keeping an account registered indefinitely, until deletion is requested, then so be it. State it clearly and plainly when the user registers an account, and if you're that concerned about the ambiguity of the situation then the solution seems a simple one, no? Allow the user to choose to have their account deleted after a certain period of inactivity, or email users that their accounts will be deleted after lengthy periods of inactivity. It should be noted that 'inactivity' is industry specific, for something like free services online it could be industry standard to keep accounts for years, it's hard to imagine that a user would be upset about having an account they haven't used in 4 years be deleted, and really, do you need to keep that account after 1 year of inactivity? 3 Years? 5 Years?

I realise the law is purposely ambiguous here especially when applied to things like user accounts, but it helps to understand that storage limitations and retention plans apply less to things like accounts and more to things like metadata that you may be collecting. It's perfectly reasonable to keep user accounts registered for years even after inactivity for example, it's less reasonable to collect data for marketing campaigns and keep that data for years. Retention limits are also far more relevant to processors of data rather than for controllers of data, if you're a third party service you shouldn't need to keep data for longer than your contract with the controller specifies, however controllers have far more of a legitimate need to process data for longer. The push to have retention limits may as well be seen as a push to anonymise data that no longer needs to be tied to an identified person rather than a need to delete everything that hasn't been touched in 90 days.

Server log retention, message queues, etc and ip addresses (which may or may not be problematic depending on how they're stored and with what). Not fun.

IP addresses become problematic when you can tie them to an identified person, i.e., you're linking user accounts and IP addresses. As far as generic logs go, if the only personal information you're collecting is IP addresses then you shouldn't need to worry too much, treat the logs with some care as they still do contain personal information but don't sweat it too much. Make sure that if your logs are leaked that you inform users (i.e., through a blog post) that logs were leaked and the only personal information contained is IP addresses. IP addresses are one of the easiest things to justify needing to keep as a legitimate interest as well as needing keeping indefinitely, and if only IP addresses are leaked it's not really a big deal. If you have other personal information in your logs, especially if it's linked with more information, i.e., 'ip address 1.2.3.4 who has username asdf searched for jkl; [etc]', you should take steps to justify why you need to keep that extra information and maybe look at implementing a retention limit, or better yet, anonymise some of the extra data after you are finished processing it. If the metadata you're collecting is kept to a minimum and/or anonymised as much as possible, the need for a retention limit drops almost entirely, not that retention limits are entirely needed.

Third party vendors. Omg third party vendors. Many of them have no idea wtf they're doing. Ive seen some vendors swear up and down they didn't store any PII, just to realize eventually that they did and they didn't even know. Hope those DPAs are signed and in order! Hope you have good lawyers!

In every other industry you are responsible for when you choose a shoddy third party vendor who makes a mistake, I fail to see why the tech industry should be any different. I realise there is going to be a lot of teething issues on this particular issue, but part of the reason GDPR has as much scope as it does is because of these clueless third party vendors who misuse and abuse data. Maybe look into using European third party vendors in the future, as they would be just as culpable for their mistakes as you would be and they would be liable for fines too. :-)

It's insanely hard for any non-trivial systems. It gets even worse when american laws and GDPR conflict (eg: finance data retention laws. The definition of legitimate business need gets REAAAAALY fuzzy...)

For what it's worth, the GDPR makes explicit exemptions allowing for processing data where you have a legal obligation to do so. There is absolutely no conflict between financial laws and the GDPR in this respect.

Moru3• 8 years ago

If you listen to the experts that are economically invested in the complexity of the law, you risk having more work.

sfifs4• 8 years ago

If you don't and some regulator fancies making an example of you, then your shareholders will fire and sue you.

red75prime2• 8 years ago

Can I request to remove my face from a stored security camera footage? If not, why?

synotna2• 8 years ago

Read about legitimate interest, it's only a few sentences

CaptainZapp• 8 years ago

Security camera footage is overwritten and recycled on a regular basis.

As a matter of fact: If you operate secutrity cameras in a public -, or semi public place you need a written procedure why something is captured, what is captured, how long it's kept, who can see the footage and under which conditions the footage is retained.

"If not, why?"

Because this is not a reasonable request if the footage is anyway deleted after, say, 72 hours.

Aengeuad4• 8 years ago

You cannot, part of the reasoning will be that the footage may need to be used in court therefore the integrity of the information needs to be maintained, another reason will be that it would be incredibly impractical and a burden for businesses to erase the faces of everyone that requests it. You cannot request that a business deletes CCTV footage of you either, probably for similar reasons. You can request a copy or to view that footage though.

In another comment you posted:

I'm still not sure that recording everyone who walks past your store 24/7 is legitimate interest.

Stores and businesses need to display signs for when they are recording in the areas they're recording, inside a store it may be obvious that the store is recording, so a sign may only be needed on a door. Outside of a store you may need more prominent signs. If it's not obvious that the area area is being recorded then even more signs need to be posted still. The degree to which stores and businesses can record outside of their businesses will vary by country, but for the UK the ICO provides information for consumers [0], and businesses [1].

[0] https://ico.org.uk/your-data-matters/cctv/

[1] https://ico.org.uk/for-organisations/police-justice/

downandout2• 8 years ago

I found the law to be pretty clear

If you think this, you've misinterpreted it. I don't think even the biggest GDPR advocates would claim that it is "pretty clear".

Sargos• 8 years ago

If everyone is breaking the law then no one is.

JeremyBanks2• 8 years ago

I'm sympathetic to the dangerous of discretionary enforcement, but if you're making a dramatic change like this, it's pretty hard to avoid an awkward period while people get compliant or get shut down.

dfxm12• 8 years ago

Like the period between April 2016 and May 2018?

adrianratnapala• 8 years ago

... dangerous of discretionary enforcement, but if you're making a dramatic change like this, it's pretty hard to avoid ...

So what does that tell you about dramatic changes?

RightMillennial• 8 years ago

More like if everyone is breaking the law, you have your pick of who to go after with selective enforcement.

JumpCrisscross11• 8 years ago

If everyone is breaking the law then no one is

In the EU, if everyone is breaking the law then the foreign tech companies are.

hotdog97• 8 years ago

Feel free to point out actual instances, or even better, trends backing up that statement.

Jacqued• 8 years ago

To be fair that’s pretty much the doj enforcement strategy too. Except you don’t even have to serve American customers to be targeted there.

dmitrygr• 8 years ago

That was entirely the intent! If everyone is breaking the law, you can pick and choose whom to enforce against, for a variety of reasons, including political convenience, shakedowns, etc

frockington• 8 years ago

I believe it was largely a way to try and unify the EU to combat recent turmoil. By taking a stand against the evil American tech innovators, the EU can look to its populace and say they accomplished something that a single nation could not have

oblio2• 8 years ago

Because God forbid that us Europeans would actually want a law like this, it’s just the Bruxelles bureaucrats that are pushing an anti-US agenda.

I’m being ironic, a decent chunk of Europeans want this (I’d say a majority but I don’t have hard numbers).

synotna2• 8 years ago

Was the original law 20 years ago also a conspiracy against America?

trumped2• 8 years ago

just another reason why mass surveillance is not a good thing; there is too many laws and no one can know them all... even attorneys have to pick a specific field. I know that dangs love it but still...

chronial2• 8 years ago

Are you actually claiming that the GDPR leads to mass surveillance? Please elaborate.

alkonaut2• 8 years ago

Hopefully things will stabilize once a few big players with dark patterns are taken to court, establishing some precedents.

For example, switches opting in by default or popups saying “by using the site you agree to x”.

merinowool• 8 years ago

Not every country in the EU has precedent based law, also what could be considered bad in one EU country not necessarily could be considered bad in another given how vague GDPR is.

chronial2• 8 years ago

Precedents matter everywhere. In countries where precedents are not law, decisions from higher-level courts are still guiding the decisions of lower-level courts – so the effect is somewhat similar.

curun1r• 8 years ago

It's possible that the poster above isn't talking about legal precedents and instead talking about practical precedents. After spending about a month building a GDPR consent tool and now seeing many other "compliance" efforts on various sits around the web, it's become clear to me that most businesses are taking a wait-and-see approach.

They're doing the minimum necessary to claim they tried to comply while changing absolutely nothing about the way they do business. They're waiting to see how serious enforcement of the law is before making changes that negatively impact their business. It's not about whether they'd lose in court or have a regulatory judgment against them, it's about the likelihood that non-compliance will get them in trouble.

If EU regulators show a willingness to do the legwork to fine smaller companies, you'll start to see a lot of these site become much more compliant. But those companies are not going to spend all that time and money proactively only to see that the EU doesn't have the teeth to enforce the rules, so they need practical precedents of companies being hit with huge non-compliance fines to scare them into making the necessary changes.

jiveturkey3• 8 years ago

Your example won't help at all. That type of thing would clearly be in violation (by letter of the regulation, no expert legal evaluation needed).

alkonaut2• 8 years ago

I know. Yet this is a very common pattern. So obviously people are either uninformed, or they believe there will be no actions against violators. Taking action solves that problem.

gist3• 8 years ago

Was a big media workup (like y2k) leading up to it and now it has faded from memory. It's like everything else that is the issue of the day and then ceases to matter at least in any way as much as whatever you read seem to make it before hand 'sky is falling comply comply' so typical. After you have been through similar things you know the way this type of thing is overhyped (I mean by what will actually happen and who it will happen to way overblow ie 'shut down my shitty little website for fear' mode.)

NeoBasilisk• 8 years ago

The Y2K issue did actually require a significant amount of patching for some systems, and they absolutely would have failed if not for that patching.

Complying with government regulation is not really in the same class of issues.

ghaff• 8 years ago

It seems that "Y2K was much ado about nothing" is becoming an increasingly popular school of thought. There was certainly lots of hype at the time. But a huge amount of money and time went into mitigating problems. I don't know if there would have been widespread power grid, etc. collapses or not if everyone had taken the attitude of "Eh, we'll fix things if they break" but I'm pretty convinced people would have been missing paychecks, bank account statements would be wrong, and that sort of thing at least.

Moru3• 8 years ago

People keep saying "Look, the sky didn't fall, what was all the hubub about?!".

A job well done!

gist3• 8 years ago

The Y2K issue did actually require a significant amount of patching

I am referring mainly to the media hype and how it becomes the issue de jure and then ceases to matter. The media jumps on it and amplifies anyone who chimes or confirms the fear. Why? So they can run a 'if it bleeds it leads' type headline. While there could have been stories after the fact of problems for unpatched systems I don't remember any of those stories. And it is not because everyone patched their systems either.

I mean there were posts online about GDPR where some small insignificant company just folded up for fear of what would happen as if the EU was really going to go after that type of target. Anyone who has been in business for a long time knows that is not what is ever done.

To your point you are right because this isn't even (for US companies) a US regulation and if they have no customers in the EU then it is a stretch to be concerned about it (at least relative which is my point to the attention given to it by the media).

lnanek2• 8 years ago

There were definitely publishers who had to block EU traffic while working on compliance. Additionally, people at companies like mine had to rush out features to allow users to view all of their saved data retained by us and optionally save or delete it. Additionally there are lawsuits out already for non-compliance, which cost money to deal with even if you win. So it had a big impact to companies' bottom lines and was worth the press in my opinion. Definitely penalizes startups who couldn't throw a couple engineers at GDPR compliance for a couple months as well like we did.

Moru3• 8 years ago

They would not need to block access. They needed to set up a time-plan on how they would get compliant to show in case they get a complaint. This is not US law, it's EU :)

Seriously, that is my impression of all conversations here, US companies trying to understand a law written in EU. I imagine this to be very hard.

DanBC8• 8 years ago

Please can you link to the "lawsuits"?

Theodores• 8 years ago

The whole thing was a shambles, there was no reference design that you could just implement for your ecommerce store/blog/software service or anything else that required it.

Instead we had people running around like headless chickens rushing to put in place some extra tick-box on their website.

The funny thing was how people sent out those emails to their newsletter subscribers and I do wonder how decimated those lists became. People got GDPR fatigue and could not be bothered with the emails after a while. This particularly affected smaller businesses who had legitimate reasons to email customers.

Does anyone here have any anecdotal data on how badly some of these email lists were purged?

dingo_bat• 8 years ago

Irony is that I never got that email from Facebook and Google. Only small websites bothered to try and obtain an agreement.

throwawayqdhd• 8 years ago

As I mentioned in another thread, the biggest winners from this entire GDPR saga are Google and Facebook.

Email is control. You get someone's email once, you get to control how often you contact them. You can send them hundreds of messages for next to no cost - as long as they don't hit 'unsubscribe'

But if you can't rely on email, what do you turn to? Ads, of course!

I get that there are some nasty actors that abuse your privacy. But as a consumer, I've never felt that spam was that big an issue to begin with, at least not big enough to warrant small businesses ceding control and having to rely on Google and Facebook to reach their audiences.

robryan2• 8 years ago

As I understand it, people had to only gain consent for email lists if they had never gained consent previously.

DanBC8• 8 years ago

The funny thing was how people sent out those emails to their newsletter subscribers and I do wonder how decimated those lists became. People got GDPR fatigue and could not be bothered with the emails after a while. This particularly affected smaller businesses who had legitimate reasons to email customers.

We've had data protection laws for 20 years. Those companies were already breaking the law if they didn't have permission to send email, and if they had a legitimate need to send email they don't need consent under GDPR.

evancox100• 8 years ago

Speaking of opting out... as a non-EU citizen, is there any way I can opt out of the EU's internet regulation? Like some flag my browser can send so I don't have to deal with the meaningless cookie/privacy popups?

wst_• 8 years ago

For some reason people can't get into agreement to use one library that provides consistent way of dealing with this consent. Then you could just automatically close it with some extension, or not even load it at all.

andrewmackrodt• 8 years ago

I'm an EU citizen and I've hoped for something similar since the cookie "law". Maybe a callback that gets fired when the consent popup appears and then a browser extension could hook into that and automatically accept.

Edit: replied to an out of date tab, another poster commented the same idea.

navs• 8 years ago

Maybe if there was a browser feature providing an API for marketing consent.

marcrosoft• 8 years ago

A lot of people are _not_ breaking their locals laws and "Confusion will continue to reign" because there is a disproportionate amount of people that think that EU laws apply to the entire world.

keithnz• 8 years ago

I'm curious about this aspect. If you run and operate a website outside of Europe, if a European then uses that site, you aren't breaking local laws.

What does the GDPR mean for these people? The europeans will still believe you have broken their laws and try to use whatever international agreements they have to go after you? Or if you enter europe they will hold you to account?

Google / Facebook have operations in Europe, so I can understand why they are concerned, but what does it mean if you don't operate in Europe but have Europeans using your site?

mgkimsal3• 8 years ago

but what does it mean if you don't operate in Europe but have Europeans using your site?

My limited understanding is that generally, it doesn't mean much. However, if you are actively targeting/marketing to Europeans, then you might fall afoul of this, but probably won't be affected legally without hitting some sort of moderate commercial size.

chii• 8 years ago

If your site is intended for Europeans, then you need to comply. It's not clear what test is used to determine this. My guess is, if you include translations, or region drop-down in a signup form, or is selling goods/services that only apply to Europe, then you'd have to comply.

jonhendry18• 8 years ago

And what counts as "operations in Europe"? Would a magazine's Paris correspondent count?

AmericanChopper• 8 years ago

there is a disproportionate amount of people that think that EU laws apply to the entire world

I think one of the problems is that too many of those people are MEPs.

eulers__number• 8 years ago

Any kind of regulation will harm small businesses and create monopolies of large companies who have teams of lawyers to del with this kind of situation

programmarchy• 8 years ago

Counterexample: Anti-trust regulation

megous2• 8 years ago

I'm quite happay, my phone number and addresses slowly disappeared from the google/bing/duckduckgo/... searchable internet over the past month. Often times without my involvement.

Searches for my real name now vs prior to GDPR enforcement are like day/night. Prior, it was all topped by aggressive (SEO wise) companies who clone public registries and republish them en-masse without adding any value whatsoever. They just use this as a trick to drive people searching for various people's names to their online magazines and whatever. They basically parasite on other people's names to prop up their revenue at those people's expense.

Now the searches are actually starting to return relevant things near the top, like my past OSS contributions, etc.

For me, this side of GDPR compliance is working fine, and almost all comapnies are pretty good at responding to requests. That is a law working pretty well from the side of the data subject.

baxtr• 8 years ago

Now the searches are actually starting to return relevant things near the top

How were the prior top search results not relevant before? Either google and others are lousy or relevance means something different to you than most other people when searching for your name.

inetknght• 8 years ago

What's relevant to someone can change over time, even at different parts of the day.

I know of no search engine which has always shown what I'm trying to find.

megous2• 8 years ago

Top 10 or so results just contained the same info repeated over and over on different websites. Half of the time outdated (old addresses, etc.). Yes, google is lousy sometimes.

It was the result of name squatting, as I described earlier.

mgkimsal3• 8 years ago

I was onsite at a client's retail location and got chatting to a customer. They learned I was in IT and said "I hope you're all set for GDPR!" and I said "it doesn't affect us". "Oh yes it does! There's a lot of people living in this area (in the US) who are European citizens - this affects you right here!" I tried to argue back politely that it didn't affect us, and she started getting a bit... agitated, and the voice started to raise a bit. I tried to de-escalate - other customers in the store would have started paying attention once the raised voice went on. But... man on man... my comeback question I was ready to put back - then stopped short - was "Do you think a 20 person brick and mortar in the middle of Spain is required to abide by US laws? They're not, even when serving customers who happen to be US citizens." I would have hoped it would have made it clear, but... stopped short of getting in to a shouting match with my client's customers. :)

cletus• 8 years ago

I hate to be the one to break it to you but just being in another country and being small doesn't automatically exempt you from other countries' laws. Some examples:

- Australia has laws that about child sex tourism aimed at those that go to Asian countries with lax laws or enforcement. These crimes are committed in other countries [1]

- Foreign financial institutions are subject to FATCA when serving US customers, an issue that has made it difficult for US expats to even open bank accounts in some jurisdictions [2]

- Australia has some pretty strict insider trading laws such that two foreigners who trade in inside information about an ASX listed company while they're on foreign soil (may) have commited a crime in Australia

- Sanctions on the likes of Iran and North Korea prevent US companies or persons from trading with entities from sanctioned states even if such transactions take place entirely on foreign soil.

- US citizens living in other countries are required to file taxes with the IRS even though during the tax year the citizen may never have stepped foot on US soil and any income is earned and paid entirely in foreign jurisdictions.

So I'm not saying GDPR applies or doesn't. I honestly don't know. I'm just saying not being in Europe and being small aren't the automatic defenses you seem to think they are.

[1] http://www.thejakartapost.com/news/2017/12/13/australia-intr...

[2] https://en.wikipedia.org/wiki/Foreign_Account_Tax_Compliance...

Karishma12344• 8 years ago

What can EU potentially do to you? I have no plans to comply with my website that gets only 5% traffic from EU. I would rather block access to those users based on trade off.

mgkimsal3• 8 years ago

US citizens living in other countries are required to file taxes with the IRS

that's part of being a us citizen, and complying with your own law. you can renounce citizenship if you prefer to not comply with IRS.

Australia has laws that about child sex tourism aimed at those that go to Asian countries with lax laws or enforcement. These crimes are committed in other countries

So if a US citizen violates Australian laws in Thailand, are they guilty and punishable by Australia? The example above is still against Australians, even if the crime is committed overseas. But... it's only against people who've been convicted, and it's basically just shutting down their ability to leave the country.

The customer in question was stating that simply someone being a citizen of a European country, then visiting my client's shop somehow subjected my client to European law. I don't find any examples you've cited above to be remotely comparable to this situation.

No, I take it back, your banking situation is sort of similar, except the banks in question are likely directly or indirectly connected with US banks. If they want to continue to enjoy whatever status that gives them, they're probably going to comply with those regulations. I also suspect that it's really their own government's financial regulators which have an agreement with US regulators (the wikipedia page seems to jive with that). Those FFIs are voluntarily(?) agreeing to the terms of FACTA because they enjoy some level of benefit (not being shut down by their own govt regulators, perhaps).

There are laws about heresy and apostasy in middle eastern regions - I'm probably violating their laws on a regular basis. Beyond a highly unlikely fatwa that may get issues against me, I'm not sure what they can really do (or indeed, that I would really be 'liable' in any real sense of the word)

kisstheblade• 8 years ago

Isn't the intent of the law quite easy to understand?

Do not track/store anything by default. And your site works perfectly and without questions.

If you then have a legitimate need for some data, without which your site doesnät work (eg. gps location data for a map), then you ask for it.

And if you need to use ads, then have some opt in button somewhere deep in the settings where the user can go and click "please track me aggressively" if he so chooses.

smileypete2• 8 years ago

I'd like to see some sort of browser request header that can set or deny permissions on a global basis, dealt with by an options page in the web browser.

Then sites only need to serve up the annoying dialogs if they need a permission you haven't set, otherwise clearing cookies periodically means being plagued by the dreaded things. >;-(

JaceLightning• 8 years ago

I feel like this is against the spirit of the law.

duxup3• 8 years ago

I feel like I'll have a way better idea of what is up once we see actual enforcement.

jillesvangurp• 8 years ago

Gdpr is very straightforward to comply with. Yes there are fines but you pretty much only get them at the end of an escalation process with plenty of opportunity to fix things. If your business was breaking the pre gdpr laws by doing things that were dodgy already, then, yes, this is now more likely to happen. That's a good thing.

As for legislation and jurisdiction, doing business internationally has always been complicated. Many big corporations have legal entities across the world and funneling revenue via the eu is a popular way to dodge taxes in the us. If you do business with such companies, that makes gdpr relevant for you even if you have no direct eu ties as these companies may be forced to reconsider their relationship with you otherwise. Think anything involving ad based revenue, e-commerce, and other sectors involving non trivial revenue from the EU.

Anyway, read the law text. It's surprisingly easy to find and digest and it puts all the idiots interpreting each other's interpretations a bit in perspective. Good summaries are available.

techsin101• 8 years ago

I feel US companies should have protection against badly implemented laws from forgein governments. Regardless of treaties. I'd love to see someone quantify loss of innovation, added cost of operation, and total delays cost by GDPR to companies he re

Thiez• 8 years ago

What would this protection look like, in your ideal world? How would it work?

Paianni• 8 years ago

Everytime I see the GDPR acronym I immediately think 'German Democratic Peoples Republic' and I can't think straight about it.

‘Everyone is breaking the law right now’: GDPR compliance is falling short

Related Stories