UK to depart from GDPR

https://www.lawgazette.co.uk/news/uk-to-depart-from-gdpr/5107685.article

by bencollier49 • 5 years ago

452 623 5 years ago

lawgazette.co.uk

Hamuko• 5 years ago

new information commissioner to focus not just on privacy but on the use of data for ‘economic and social goals’.

Congratulations Britons, your data's back on sale.

8fingerlouie• 5 years ago

I wonder if we will now see a situation where British companies will be forced to move their cloud out of GB, to i.e. Ireland if they want to do business with the rest of Europe ?

The thing is, even though the GB decides to ditch GDPR, they're still bound by it if they want to do business with the rest of Europe, just like the US is bound by it.

nicbou3• 5 years ago

It's already happening. I work with a few affiliate platforms, amd many of them sent an email requesting me to update my invoices. They moved to Germany or some other EU country.

dageshi2• 5 years ago

Sure, but the large number of businesses who are UK only won't have to deal with it.

Instead of frontloading compliance for any new venture, they can build for the UK first then work on compliance if and when they go for EU business.

Freak_NL2• 5 years ago

With the difference that companies can now move Britons into the cohort of users whose data you can sell and do things with you probably didn't quite consent to in any meaningful way. And as Europeans we will probably get a couple more websites that will just tell us to sod off (in proper British English parlance now) because of our data protection laws. You know, the kind of message that already pops up when you search for some recipe and end up on an American website with good SEO or some topic featured on a local news outlet in the US.

mmrezaie• 5 years ago

We are counting on this. Actually investments in Sweden for data centers has rissen more than 20-40 percent at the normal rate.

I know that some purchases of cloud services are halted for now to be sure about this. Data movement is going to be increasingly an important matter. It should have been from the begining but here we are.

Jonnax2• 5 years ago

So with a quick search online, I found this site:

https://incountry.com/blog/data-residency-laws-by-country-ov...

Organisations which receive and hold any of regulated data types to follow the GDPR requirements. According to GDPR, companies have to keep the data secure inside the EU and if the data is to be transferred outside of the UE, then it can only be transferred to countries or organisations that have signed up to equivalent privacy protection."

So the EU has all the power here to say that the UK doesn't meet their standards and require businesses to transfer their data.

However, I would guess that most international organisations would have already moved their EU customer data out of the UK.

There were years of uncertainty with the Brexit negotiations, keeping data in the UK would have too much risk.

Plus many other countries have data residency laws, so it's not like a foreign concept to international businesses.

alphadevx• 5 years ago

100% this. Already happening (I moved all of mine from London to Frankfurt last year, fully expecting this to happen). DCs in the UK will suffer.

hnlmorg8• 5 years ago

It's not surprising considering this is the same government who used such data to create targeted campaigns to win the referendum in the first place.

edit: wow that's a lot of downvotes in a short space of time. Maybe I should back my point up with some evidence to prove I'm not talking out of my arse (though it was widely reported at the time so I'm surprised anyone would disagree with me): https://www.bbc.co.uk/news/uk-politics-44966969

kwhitefoot2• 5 years ago

Is anyone surprised?

rich_sasha3• 5 years ago

I have mixed feelings about this.

On the one hand, I think GDPR is a great step towards stopping companies hoarding your data and holding you hostage to it. On the other, main GDPR change is those awful 'hand over data / pretend you're not' dialogue boxes. When I'm feeling strong, I look for the 'reject / object / blah' box, but often I don't find it in me to resist anymore.

So maybe it's not awful they're reshaping GDPR.

beforeolives• 5 years ago

This won't be a change aiming to improve your web browsing user experience. It will likely be a change to reduce your rights and legal protections.

martin_a2• 5 years ago

The GDPR sets a pretty straight border for this.

No active (this does NOT include "by using this site you accept...") approval = no permission to collect data and give it to third parties.

That's the law. But we'll still need some hard work and hefty fines to make everyone obey it.

rich_sasha3• 5 years ago

Right - the law sounds good. But it's not the practice I see on the t'Internet.

ahartmetz• 5 years ago

Yeah. For now it's more of a latent danger than a law that is enforced according to its spirit or even letter - the letter of the law is fairly clear. I hope and assume that it will be enforced as soon as someone in the right position takes an interest in it.

bawolff• 5 years ago

The cookie boxes are silly and hardly represent informed consent. It should be the browsers job to do this.

I remember it used to be a thing in the netscape navigator days until everyone got sick of it.

krageon3• 5 years ago

often I don't find it in me to resist anymore.

All you need to do is not say yes. The easiest way to do this is filter cookiebars/walls/whatever in as many places as you can. Without an answer, the answer is no.

melomal• 5 years ago

I can honestly say that I think it made little to no difference, across the board. The requirements etc have not been fulfilled by most companies, why bother.

james-bcn• 5 years ago

If you work in enterprise it absolutely has made a big difference.

killtimeatwork3• 5 years ago

I work in an large euroepan enterprise and our GDPR compliance is... absymal. And we're not even investing that much into becoming more compliant. My impression is that the board is in a state of denial, as doing GDPR properly would probably cost us billions.

andy_ppp10• 5 years ago

I helped build a GDPR compliant system for container shipping crew personnel details that included passport photos and other sensitive details. GDPR was actually helpful in that it asks you to treat personal data as if it’s as important as credit card data. We did this and consequently if you had a a database dump or backup you’d be really hard pushed to extract any crew information from it and getting at passport copies was even more difficult. I think it’s a very well thought through spec and eventually those companies ignoring it will get burned one way or another.

Edit: removed needlessly aggressive "That is a lie" opening gambit.

Daho0n6• 5 years ago

If you deleted those first four words your comment would read much better and likely not be downvoted :)

throwaway36992• 5 years ago

You should've been at FAANG when GDPR hit like a ton of bricks. Compliance probably cost those companies hundreds of millions each, pretty much everything was affected.

teh_klev• 5 years ago

have not been fulfilled by most companies

I think you need to back that up with credible numbers.

GDPR was and has been a massive kick in the backside for companies large and small in the UK. I certainly know from talking to my past client base and current network, which is from a fairly broad spectrum of organisations, they treated GDPR compliance pretty seriously. Hell even my local village pub made sure they were in compliance, despite just having a manual paper based guest register.

distances• 5 years ago

Absolutely was a big topic. Company I worked for at the time of the change took it very seriously, and all parts I saw were adapted accordingly.

dash28• 5 years ago

YIPPEE.

Does this mean no more of those stupid little popups every time I see a site? HOORAY.

Does it mean less absurd bureaucracy and non-jobs? GREAT.

As for data privacy... does anyone seriously think that Facebook was stopped from collecting data due to GDPR?

estaseuropano• 5 years ago

Facebook and google takeout only exist because of gdpr.

Right to delete (not just deactivate) your account only exists due to gdpr.

Right to opt out at all only exists because of gdpr, and many companies do actually stick to it.

That many don't follow the spirit of the regulation is not really the fault of the regulation. Thing is its not been tested much in the courts yet, but the cases have really started last year so hopefully more enforcement incoming.

throwaway36992• 5 years ago

Google Takeout existed for many years before GDPR was even a thing: https://en.m.wikipedia.org/wiki/Google_Data_Liberation_Front

perryizgr8• 5 years ago

google takeout only exist because of gdpr.

I doubt that since takeout precedes gdpr by several years.

monkey_monkey4• 5 years ago

I guess Facebook can use the additional profit they'll make on UK citizens to pay for fines they incur in the EU

https://www.decisionmarketing.co.uk/news/facebook-sets-aside...

shrew3• 5 years ago

Ah this is the best bit! Because many companies cater for a global audience, us Brits will STILL have to endure the stupid little popups AND we'll have no protection or recourse from privacy invasion! Can't wait! /s

carmen_sandiego10• 5 years ago

I don't think you're right at all. The US is the dominant online market. China is second. Neither have the stupid popups, so why wouldn't the UK just get added to the list of 'places we don't need to show it'?

Have you ever tried browsing many US news sites? They block the entire EU from even seeing their content. That's how much they care about their in-GDPR users. The idea that people cater to a global audience by just implementing the EU rules for everyone is patently false. If the UK diverges, it's free revenue to just add it to the whitelist, basically.

lanevorockz6• 5 years ago

That is true, it’s pure naivety to believe GDPR changed anything. It enforced cookies to ask for permission and a few billions in extra bureaucracy. I don’t get why people want to live in a Kafka novel

La1n• 5 years ago

I work in the privacy field. I can tell you that after GDPR the multi national I work for has become a lot more careful/aware about data privacy. We went from collect everything and just store it, to actually having limitation of data collected and how long they are stored.

hnedeotes2• 5 years ago

From my experience, unless I'm missing something, they're annoying because they're not that well implemented, maybe even on purpose?

Sites where I have granted access keep asking me to re-grant no matter what. Sites where I have denied do the same (although here I would expect it, not that I agree, since I already clicked "no").

And actually it's cool, sometimes you go to some docs and there's 33 "essential" cookies for the well functioning of the website (for a paid product) from which 30 are trackers.

Others, like wetransfer will show them as non-essential when receiving a file, but about the same amount of trackers, and this is ok, it's well defined and they're not trying to trick me into clicking "accept essential cookies" with 30 trackers tackled on them.

Perhaps one day we can start blacklisting those who don't implement a correct consent cookie form from the internet and dns wouldn't resolve for those non-compliant domains.

dash28• 5 years ago

I think you're absolutely right. But I also think it was predictable. If we trusted the companies to do the right thing, we could have done that without GDPR. So OK, they live off advertising, they want to track, so now they just use dark patterns. What's next? Yet more regulations about exactly how to show this fundamentally annoying consent question? I just want to browse the internet!!!

Sometimes people talk about technological solutions to social problems. I think here the tech solution (like tracker blocking) kind of works, like I can use it on Firefox or Safari and it doesn't waste my time; and the legal solution is a failure.

Jonnax2• 5 years ago

"...culture secretary Oliver Dowden said he would use the appointment of a new information commissioner to focus not just on privacy but on the use of data for ‘economic and social goals’.

...Dowden said that under the regime ‘too many businesses and organisations are reluctant to use data – either because they don’t understand the rules or are afraid of inadvertently breaking them’."

However this would only be in relation to UK data. If they want to do business with EU citizens, then businesses have to comply with GDPR.

Seems pretty myopic.

dbetteridge2• 5 years ago

I somewhat miss the days when the corruption was at least somewhat veiled.

No-no of course we don't want to sell your data for profit, that would be ridiculous. Clearly it is just our corporate sponsors who will be doing it for us!

lanevorockz6• 5 years ago

Yep, never heard of corruption in Italy before. The Mafia was created just a year ago right after Brexit

user-the-name2• 5 years ago

Why are you talking about Italy?

kzrdude• 5 years ago

Money has become the main objective, and it's poisoning us. Money is a means to an end, not the end itself.

The nation (any country) needs to have human goals - not economical goals for their own sake - but a better life for us, for us all.

aloisdg• 5 years ago

That why we cry when countries are compared by GDP...

Cthulhu_2• 5 years ago

And I want to say that's fine, but it's the methods involved. Recently, a LOT of decisions have been made that (to me, armchair internet guy) seem to be aimed at short-term gain.

Like Brexit, the people benefiting most from it are already well settled, they're working on their short- to mid-term plan to earn a lot of money before retiring to their private island or estate or whatever. They live outside of the negative consequences of their decisions.

Meanwhile, the rest of the population will have to suffer through the consequences for the foreseeable.

Tl;dr, policy optimizing for short term individual gain instead of long term sustainable gain. And the long term gain would be so much more better as well.

All of the countries currently under a short term gain capitalist regime could be so much better for their inhabitants. Wealth, socialist policies, comfort, safety, stability, etc is all in reach. But instead the people at the top - who already live a very comfortable and privileged life so they don't see and never will see the problem - choose short term personal gain for them and their 1% friends.

m12k2• 5 years ago

"When a measure becomes a target, it ceases to be a good measure"

carmen_sandiego10• 5 years ago

I somewhat miss the days when the corruption was at least somewhat veiled.

Oh, nonsense. People disagree with you politically. That doesn't make it 'unveiled corruption'. What a lazy way to think.

dbetteridge2• 5 years ago

I can handle political disagreement just fine.

But there is a systemic and widely recognised issue in the UK with the government flagrantly handing out public money without due diligence or fair recourse.

Selling citizens data for profit is just another data point.

https://medium.com/shit-britain/the-bumper-uk-conservative-g...

https://thejist.co.uk/politics/a-list-of-alleged-conservativ...

https://www.thelondoneconomic.com/politics/how-the-tories-no...

https://sophieehill.shinyapps.io/my-little-crony/

athrowaway3z• 5 years ago

Corruption might be the wrong word. But 'disagree politically' suggests that what voters think matters, instead of what financial contributors desire. Every political decision has winners and losers. This one seems heavily biased towards the 0.01% of people directly financially incentivized, while the rest has to deal with the breach of privacy and the social effects of hyper targeted advertisement ( a case can be made that this includes things like the QAnon bubble )

mhh__2• 5 years ago

Our government is happily funneling millions of public money into murky contracts with companies that often barely exist. It is corruption. The tory party has no ideology.

What a lazy way to think

vmception2• 5 years ago

I honestly get giggles from how unprepared they are culturally for what becoming America-like will do to them.

Does anyone else?

American-like but with no negotiating leverage and having burned all the bridges to the other economic unions.

andy_ppp10• 5 years ago

They get to asset strip the country before anyone realises right?

lanevorockz6• 5 years ago

The EU as a political union exists a little over a decade, if anything the UK never adapted to it.

asutekku• 5 years ago

But they benefited from the EU in a way which is no more possible.

HugoDaniel• 5 years ago

Mistaking the EU, the political union as an evolved form of the Rome treaty, with Euro, the coin. All that with the tone of absolute certainty and authority.

Hacker News has reached new lows :(

arkitaip• 5 years ago

You should teach history at college.

imtringued5• 5 years ago

I hope this is a typo and you mean to write "The EUR as a monetary union".

The euro is truly an unremarkable currency and I'm not sure that the EU would be much worse without it. It's equally likely that the EU would have done much better without the euro. I can't blame the UK for avoiding the euro.

reader_mode2• 5 years ago

Yeah we saw the mighty EU negotiation leverage with COVID vaccine...

UK market is large enough to stand on it's own and EU has been grossly incompetent in public for a while now. There's going to be downsides for sure but becoming "America like" is not going to be one of them.

tomelders2• 5 years ago

You're cherry picking.

postingawayonhn• 5 years ago

Who said they're becoming America-like. More like Canada, Australia, New Zealand, Japan, etc. like.

andy_ppp10• 5 years ago

Not even - we will become a right wing basket case with a brand new nuclear weapons system and a failing economy and zero safeguards about those in power. This lot are bad but there is the possibility of something much much worse.

boomskats• 5 years ago

It's unclear whether the 'they' you refer to are the British people, or the class of ruling individuals who know exactly what they're doing and are set to profit immensely.

(I'm aware that all sounds quite America-like already)

CaptainZapp• 5 years ago

or the class of ruling individuals who know exactly what they're doing and are set to profit immensely.

I'm really not sure about that. I agree that may be the case with some of those ruling individuals. My impression is that Johnson doesn't believe in anything, except his personal interest and profit.

Others in that cabinet, however, really appear to be true believers.

sverhagen• 5 years ago

I have no doubt you're right, but I'm just not familiar with the specific details. What are some real ways they stand to "profit immensely"?

simonh2• 5 years ago

For a start the people who actually rule - the MPs in parliament - are predominantly remainers. When it comes to business leaders, they're as divided as everyone else. A lot of businesses do extensive trade with the EU and stand to lose. The finance industry particularly risks losing a lot of business, although there are some sectors of it that might gain it's mostly through trading on short term volatility. They'll cash out before they're stuck in the same boat as everyone else.

The basic premise of the "it's an establishment stitch up" argument is that Britain will be weaker and poorer, but the establishment will end up with a much, much bigger slice of the smaller pie such that they gain overall. It's not clear to me how that's supposed to work though. How is this pie-grab supposed to work as the pie itself shrinks? Some people might manage to pull it off, but the whole establishment class as a group?

Anyway, this whole premise flies in the face of who we know voted overwhelmingly for Brexit - ordinary British voters, many of them up north and from working backgrounds - even as the actual political parties, majority of MPs and most business leaders were arguing against it. The evidence for an establishment stitch up rests on a few very specific data points, like the fact that Jacob Reese Mog and some of Nigel Farage's hedge fund friends have already and will continue to do quite well out of it. They're hardly "The Establishment" as a whole though. They're just some of the people I was talking about trading on volatility, and hardly representative of the financial sector as a whole that is getting screwed over by losing passporting.

jleask• 5 years ago

48% of us realized this

hnlmorg8• 5 years ago

This is the thing that pissed me off the most about the referendum. The result was touted as an overwhelming majority but in fact the percentages are well within the margin for error on a poll that wasn't very well defined from the outset (ie what "leave" meant was different for different people).

The only thing the EU referendum conclusively demonstrated was how easily manipulated people are by the media they consume.

Chris20484• 5 years ago

So, all the Brexit opposed politicians are against this?

aidos4• 5 years ago

Not that I voted for this, but what’s done is done. And now that it is, I’d personally like to take the wins where we can get them.

Hoping we see the light, and the blight that is the cookie law goes the way of the dodos.

Kim_Bruning8• 5 years ago

The cookie law is like those plaque disclosing tablets you can chew to figure out if you are brushing right.

If your teeth turn out blighted all blue/purple, you generally don't blame the tablets. ;-)

DoingIsLearning2• 5 years ago

I have many British friends who were absolutely against this, I also know a former boss who was very public about his Brexit vote and like many of those who voted for it, will be too old to have to deal with the consequences of this decision.

If anything I think it is rather unfair to hear people from other EU countries treating this process as something along the lines of 'suits them' and 'they've made their bed'. When in reality a large chunk of them have pretty much not agreed to any of this but are still set to suffer the consequences.

krageon3• 5 years ago

a large chunk of them have pretty much not agreed

Yes, but a far larger chunk has. Every country gets the leaders it deserves and the UK is no exception.

callamdelaney10• 5 years ago

I'm 24 and voted for brexit. In fact I campaigned for it and would do so again. It's really a very poor form to resort to the "dumb old racists voted for brexit hurr".

noir_lord• 5 years ago

I was strongly remain, 48% of us where, if the vote had been a year later it could quite easily have been 52/48 the other way.

One wonders if remain had one if the leave campaign would have accepted "The vote was clear, put up with it and shut up".

I completely understand why EU governments would be absolutely fed up with the UK government though.

Sadly my generation (40 and younger) are going to have to live the consequences of something we didn't vote for (49 and younger voted remain getting more strongly remain as you go younger) - it's absolutely frustrating.

Viliam12342• 5 years ago

If anything I think it is rather unfair to hear people from other EU countries treating this process as something along the lines of 'suits them' and 'they've made their bed'.

From my perspective, it's more like "it was inevitable". The people pushing for Brexit would never give up. So the choice was either leave now, or keep talking for the following years/decades/centuries about how the evil EU oppresses the UK, and how everything in UK would be perfect if only...

In some way, it reminds me of dissolution of Czechoslovakia. I was not happy about that either, but realistically, the choice was either do it now, or keep forever listening to voices on both sides about how all problems are caused by the other half and everything would be perfect (though probably disastrous for the other half) if only...

Once you have a major fraction of your population -- and it doesn't make a difference whether it's 48% or 52% -- believing they are being oppressed, it becomes unfalsifiable. Every time something bad happens, you have an explanation ready, and it doesn't matter whether it makes sense or not, believing that it is all someone else's fault is always popular.

If the lesson from Czechoslovakia applies here, at the end none of the prophecies of heaven or hell came true, both sides continue living their boring lives. The only change is that now when something bad happens, this one excuse is no longer available.

So, my guess is that after Brexit, the life in EU will more or less remain the same, and the life in UK will more or less remain the same, with the exception that "everything would be perfect if only EU stopped interfering with our perfect country" will disappear from political speech.

callamdelaney10• 5 years ago

In terms of economy why not? The USA is equal in GDP to the entire EU, and it seems much more efficient to deal with them, an actual country, than 27 odd countries whom all have their own agenda and are masquerading as one country.

Of course it's very fashionable on the internet to shit on brexit. "haha brits be dumb cus independent" - I can only imagine what sort of insecurity you're dealing with about your own country that you have to resort to this.

spiderfarmer• 5 years ago

Yes, "In terms of economy" why not.

Just ignore every other benefit of the EU to make your case.

bb1238• 5 years ago

I agree. I didn't vote for Brexit but it is hard to see how the pro-Brexit crowd haven't been vindicated with the vaccine roll out.

KingOfCoders• 5 years ago

GDP - the most gamed and politicized metric on earth. Battling it out at the top of gamed metrics with unemployment rate.

We'll see if this is still the economic "gold standard" to compare countries when China overturns the US in GDP.

tubularhells6• 5 years ago

GDP doesn't matter for export/import. You don't know anything about these things, so why comment?

bb1238• 5 years ago

Why is it inevitable that the UK will become like America? There are plenty of independent Algo-States that are nothing like it. Australia, New Zealand, Canada for example.

This comment seems to be borne out spite more than any kind of logic.

carmen_sandiego10• 5 years ago

I have no idea why but the EU/Brexit is one subject where HN comment quality falls apart. I would have assumed most people here are Americans, so not really emotionally invested in their 'side'. But this comment section is full of Twitter hot take type stuff.

tubularhells6• 5 years ago

Australia is very much like the US, and worse in many regards. You just have no idea about any of it.

vmception2• 5 years ago

Mostly due to shock.

The shock of their financial sector leaving.

The shock of getting pitiful trade negotiating.

Being unprepared with anything to offer for negotiating leverage.

The domestic identity further polarizing and inability to form consensus.

pydry9• 5 years ago

#1 The UK has habitually towed the line on most American endeavors in a deferent way. The invasion of Iraq was one extremely clear example. The phrase "special relationship" which is bandied about a lot embodies this deference.

#2 The UK has departed from the trading bloc it does 60% of its trade with. It desperately needs new trade deals outside of it. Since America is the biggest economic bloc outside of Europe and because they're big and we are small they have the leverage and that means we start abiding by their rules.

#3 There were plans leaked on how this would be done with the NHS (e.g. deliberately hamstringing the NHS's ability to negotiate drug prices). They kept them secret from the public.

To be frank, your comment seems borne out of a kind of appeal to moderation rather than particular knowledge of UK domestic politics.

pm• 5 years ago

Australia is fast adopting some of what I consider some of the less useful aspects of American culture, not to mention our political class revelling in their overt corruption and willingly opening the back-door for the rest of 5-EYES.

selfhoster11• 5 years ago

It's not inevitable, but the current government appears to move in that direction intentionally.

- The EU exit was, among other things, accused of being a way to relax regulation and legislation to degrade product standards to a US-like level. Chlorinated chicken was a big item on everyone's discussion agenda a while back. This is now evidently happening.

- The government is severely underfunding the NHS, despite paying it lip service. Some accuse the government of doing this as a form of sabotage, so that the service quality degrades and the private sector can swoop in as the saviour. This is controversial because:

a) Brits are very proud of the NHS as a nation (or at least that's the dominant narrative in my news bubble)

b) The privatisation of British rail has been a disaster - ticket prices have skyrocketed, and service quality took a nosedive in some areas.

medium_burrito• 5 years ago

In fairness to the UK, they probably aren't going to become 80% foreign real-estate scams, 20% resource extraction. Well not the latter, at least.

adflux2• 5 years ago

We'll see.

Seems like not being part of a larger "union" has allowed them to start vaccinating at 3 times the pace of its European neighbours. Historically, power removed further from the people does not benefit the people. There are very few "economies of scale" in politics. As the system grows larger, accountability becomes more difficult and decision making is harder and harder.

Nice example is Iceland. after the 2008 crash. https://www.bloomberg.com/news/features/2016-03-31/welcome-t...

kawsper• 5 years ago

If the UK was not leaving the EU, the country may have chosen to follow this “common strategy” and move at the same pace as other members. However, it is not a legal requirement.

https://fullfact.org/health/coronavirus-vaccine-brexit/

seanhandley• 5 years ago

I live in the UK and, like 49% of the turnout, I did not vote for this. Trade blocs rely on geographical proximity to be most effective but this whole thing is an ideologically motivated change, rather than one rooted in pragmatism.

Giggle count: zero.

klingon782• 5 years ago

The US has a similar privacy law in California they must support, and many companies have presence globally, so they are having to deal with this in the following ways, like many others.

GDPR has given a 50M EUR handslap to Google and similar to some other large companies[1] while seriously hurting smaller companies with existing custom web applications for whom they may not even have someone on staff to modify those to be GDPR-compliant.

Small businesses like others must determine what PII is, how to anonymize it, and how to remove it when users request their PII to be removed. PII could be in their server logs or other locations that are inaccessible to most employees of the business. Backups might be excluded from PII scrubbing, but so much is unclear.

Let’s also talk about what it doesn’t protect. PCI, not GDPR, attempts to provide protection for cardholder data. GDPR doesn’t protect against PII that was previously shared. Nor does it protect from data being stolen, unless the user had their data removed prior.

[1] https://dataprivacymanager.net/5-biggest-gdpr-fines-so-far-2...

Kim_Bruning8• 5 years ago

It's actually fairly easy to be GDPR compliant almost by default, TBQH. It either takes a lot of effort or a lot of laziness to somehow end up non-compliant.

Blikkentrekker2• 5 years ago

Was it not already?

I find that many of the quintessential problems of the U.S.A. were inherited from the British Empire and seem pervasive throughout the Anglo-Saxon world. England too has a district based system, leading to close to a two-party state, and a common law legal system where the judge and juror are often more powerful than the letter of the law.

If anything, the U.S.A. remedied some of the unusual quirks of common law legal systems. — I was recently acquainted with knowledge that in both the U.K. and Australia, a criminal defence attorney would, when his client confess to the crime to him, almost certainly recommend that he be released, and that latter seek new counsel, and that the new counsel be kept in the dark, as apparently the system is designed such that a criminal defence attorney is completely handicapped in defending his client, know he of the latter's guilt. — this is less so the case in the U.S.A., which is rather unique for jury trials, and in most civil law jurisdictions there is no reason not to confess to one's attorney.

lanevorockz6• 5 years ago

Nice how uneducated people are over here, it's mostly a bunch of californians thinking that they understand what Europe is.

Barrin92• 5 years ago

It's more like an 'Asianization' than an Americanization, hence the whole 'Singapore on the Thames' idea. It's adopting the business practices and regulations of the US and a very paternalistic, centralized state.

The US for all the lack of controls that citizens have over business at the very least has a very federalised (in the Euro sense of the term), distribution of power, whereas Britain is pretty much governed from London.

machinelabo• 5 years ago

I am appalled at the level of discussion here. Nationalism, both from EU, US and UK side is tiring, this flame war needs to be shut down. This not what HN is for folks.

physicsguy• 5 years ago

GDPR only came in two or so years ago, it’s hardly out of living memory that we had standards more like the US

Aengeuad• 5 years ago

The GDPR wasn't written from scratch, we previously had the Data Protection Act which offered many of the same rights as the GDPR like the protection of personal information and prevention of disclosure to third parties, the right to access data a company holds on you (both of which date back to 1984), the right to opt-out of direct marketing, the right to removal of data that may cause distress, etc, which while a little dated is still far ahead of what most of the US has today.

The trouble with the DPA was fines capped out at £500k and international enforcement was limited so large international companies like Google and Facebook could treat the law as an optional slap on the wrist while smaller international businesses effectively flew under the radar, the GDPR largely rectified both of these issues while modernising the laws in response to issues that generally didn't exist prior to the mid 2000s.

heywherelogingo• 5 years ago

GDPR is three years old.

fundatus• 5 years ago

This feels like one of those things where Post-Brexit-Britain simply HAS to do something different. Just for the sake of it. Sovereignty and all that. The fact that many online businesses will probably still cater to EU citizens and will therefore still follow GDPR rules doesn't matter. Those companies will end up with two slightly different sets of rules and it will just be annoying.

mytailorisrich6• 5 years ago

The problem becomes one of enforcement.

If you're an online business established outside of the EU with no presence in the EU then as long as you abide by the data protection laws of your own country I don't see how an EU country's data protection authority could do anything to you.

This is a general issue online where sites and potentially services can be reached and used globally whilst each country basically cannot do anything outside of its own borders.

The part of the GDPR that says that the regs apply worldwide as long as the individual is in the EU is not really realistic in many actual situations.

andy_ppp10• 5 years ago

I mean this of course means EU data won’t be able to be stored on British servers as I understand it. More barriers to trade, it’s like this government is trying to destroy the economy...

that_guy_iain• 5 years ago

As far as I understand it, it currently can't be hosted in the UK anyways. As the requirement is to store the data within the EU.

Blikkentrekker2• 5 years ago

I thought the data could be exported to any country whose laws offer the same level of protection.

andy_ppp10• 5 years ago

If we were able to agree to those rules I'm sure we could strike a deal with the EU. This has always been the name of the game right - if you play by each set of rules and align the EU probably sees that as a net benefit and lets countries align, for eaxample Switzerland can still host EU personal data, from the article:

"Fortunately, Switzerland, along with 12 other non-EEA countries, has received an "adequacy decision" from the European Commission. An adequacy decision is a recognition of the strength of Switzerland's data protection law."

https://www.termsfeed.com/blog/gdpr-switzerland/

02thoeva3• 5 years ago

Not quite, the EU and UK have a draft adequacy agreement in place. Should be signed by the time the transition period ends.

andy_ppp10• 5 years ago

Can you supply a link - the UK would need something like GDPR in law (which we currently have rolled over) for the EU to recognise our laws... it seems like it would be difficult and pointless to change to something that slightly differs from the GDPR only to have to implement all of it's concerns for EU data anyway...

ArkanExplorer• 5 years ago

To 99% of internet users, GDPR has meant nothing except extra popups, blocked access to some websites, and an additional regulatory burden.

In some cases bad actors exploited GDPR for fraudulent purposes - eg. requesting a full account deletion in the event of a ban. They can then recreate the same account with the same data.

ClumsyPilot• 5 years ago

That like claiming "For 99% of consumers food safety regulations means nothing but annoying 'use by date'!"

Just because the effects are not obvious to a layman, doesnt they aren't there

nicoburns• 5 years ago

I don't think that's true. I've watched a complete about face by companies when faced by the GDPR. Previously the attitude was to collect and store as much data as possible "just in case" it was later useful. With GDPR, management is suddenly aware of the legal liability of storing this data, and it's generally only stored if it's actually needed.

anilakar• 5 years ago

I can play that courtroom drama game, too!

Right to restriction of processing is not right to restriction of storage. Trying to re-register with your banned e-mail address is consent to processing and subsequent refusal to serve the person.

piokoch• 5 years ago

For me the biggest flaw of GDPR that it does not distinguish between something done as a business to make money and something done non-profit, as a hobby project, etc. GDPR killed forums, etc. everything moved to Facebook groups, where people agree to whatever Facebook wants.

Who will create forum for a community if one has to deal with all the bureaucracy, "right to be forgotten", data accuracy checks, data export request, gathering consents, being responsible for bugs in some forum software if there will be data leak and risk huge fines if something is not done correctly.

Another issue is vagueness of the regulation. What exactly is data processing/controlling? If kids leave they clothes in kindergarten or school, can clothes be signed with kid first and last name (so it is easier to find lost items)? Is school a processor or controller of kids' PII in that case? Probably not, but who knows what will happen if someones signed hat will be stolen?

nicbou3• 5 years ago

I'm not sure why it should do that. Data is data.

In the end though, you don't have to go crazy about it, because there is zero chance of enforcement over small pebbles.

gampleman• 5 years ago

A school most certainly already is a data controller as it has way more PII than just your kids name.

ThePhysicist• 5 years ago

The GDPR only regulates automated data processing and manual data processing where a "filing system" is used, so you kindergarten doesn't "process" children's data just because they write the children's names on their coats... In general I think you're exaggerating a lot of the problems, many forums are still alive and kicking and most forum software has been updated to accommodate the requirements of the GDPR (which aren't very difficult to implement in any case).

The centralization of the web on very few commercial platform has many reasons, data protection is probably the least important and might even be a counter-force in my experience.

bornelsewhere• 5 years ago

If you do not have resources to take care of PI then perhaps do not gather and store it in the first place?

Forums do not necessarily require personal information to exist.

j-pb2• 5 years ago

Except that a commonly used user name is already "personal information". And your eMail address you've used to register to the forum. And the IP address that you use to access the forum.

AND EVEN THE RANDOM UUID THAT YOU ASIGN TO USERS ON YOUR FORUM BECAUSE YOU'VE GIVEN UP AND ONLY IDENTIFY USERS BY THAT AND THEIR PASSWORD.

In effect everything where a user has to input something instead of being just a recipient, or where the user is connected to any persistent identifier contains PI according to GDPR.

Say bye bye to most kinds of technical server logs used to debug stuff, to your database, and storing stuff in general.

The only way to be truly GDPR compliant if you followed the law to the letter would be to just provide TV and Teletext service via radio waves.

iamacyborg• 5 years ago

Forums died a decade ago. Everyone moved to Facebook, Reddit, Discord, etc. This is not a GDPR problem.

coding_unit_1• 5 years ago

The guidelines are pretty clear on what processing is, what data it covers and who controllers are in those circumstances. The biggest flaw I see is people don't read them and assume any data in any context is bound by it and it becomes a stick to beat everything with when it's not required.

I'm afraid your example is a prime case of that - leaving a hat at school that happens to have your name on it clearly doesn't fall within the remit of data processing under GDPR, it's a strawman (straw boater?) argument

I also don't agree it's a bad thing to make no distinction on size of company, doing so would leave a grey area of when a thing becomes "big enough" to transition from outside to inside scope and therefore gaps in the enforcement.

If you want to build a hobby forum, you're free to do it without requiring my personal data. If you want to collect my data for analysis or marketing then I absolutely want you to abide by the rules and look after it even if you're a lone programmer in his basement.

lm28469• 5 years ago

What kind of personal data do you need to store for a forum ? For what purpose ?

Who will create forum for a community if one has to deal with all the bureaucracy, "right to be forgotten"

Most forums are created with softwares handling everything, virtually nobody creates a forum from scratch with his own tech stack.

If kids leave they clothes in kindergarten or school, can clothes be signed with kid first and last name (so it is easier to find lost items)? Is school a processor or controller of kids' PII in that case?

People asking these kind of questions are either trolling or making their life much harder than necessary.... The text is pretty simple if you read it in good faith and don't act like a 6th grader who doesn't want to do his homework and pretend he doesn't understand the question...

Do you think GDPR is aimed at facebook &co storing millions of users data without the immediate business need nor the consent for it ? or at kindergarten kids who have their name written on their clothes ?

j-pb2• 5 years ago

Most forums are created with softwares handling everything, virtually nobody creates a forum from scratch with his own tech stack.

If you don't host the forum yourself you need a data processing agreement with the hoster to be GDPR compliant. If you want to load the user image from Gravatar, you need a DPA with Tumblr. Good luck with that.

Reading contracts and laws in good faith is a pretty bad idea if you don't like being sued and loosing. Always read laws in a way as if someone was going to use it just to ruin your day.

CryptoPunk3• 5 years ago

I hope the UK follows through with its 'Singapore-on-Thames' plan, which requiring losing regulatory harmonization with the EU:

https://en.wikipedia.org/wiki/Singapore-on-Thames

lanevorockz6• 5 years ago

Let’s be honest, it’s not up to the UK alone. The EU still has strong world influence and they will try to stop it at any cost.

viraptor2• 5 years ago

Why do you think so? What do you think EU has to gain from UK doing badly? And I mean in practice, economically - we're way past the time "told you so" is relevant.

pydry9• 5 years ago

I was pretty disappointed after living three years in Singapore and witnessing the uglier underbelly of the country that the UK decided that's what it wanted to become almost as soon as I got home.

Moreover, they don't want to copy any of the successes - e.g. their public housing system or strict "you WILL go to prison if you overcharge" price controls on medical care.

They just want the tax haven, deregulation, an under the thumb easily exploited workforce working themselves half to death and handouts to their friends.

dageshi2• 5 years ago

Healthcare is paid via taxes, so how does one overcharge it?

CryptoPunk3• 5 years ago

On the balance, Singapore is much more free in the economical sphere than the UK, so if the UK did copy ALL of its policies, it would become more much economically competitive and see more rapid economic development.

As for exploitation of workers, Singapore has seen massively more wage growth than the UK over the last 50 years, so I don't equate a free labor market with exploitation.

I will add that there are important ways in which the UK is more conducive in the long run to a free market and free society than Singapore, but at least in the short run, Singapore's simulation of a free market economy has been offering more practical liberty and working better at raising living standards.

Ideally, the UK would maintain its pluralistic and democratic core, while adopting Singapore's economic policies.

kmlx2• 5 years ago

They just want the tax haven, deregulation,

no matter how much I like this idea, this will never happen in a European country unfortunately. there's just too much baggage of big state and other nonsense.

mhh__2• 5 years ago

So we throw away our relationship with a trading bloc that is 0km away to do things we already do but spun to make Brexit look palatable before the people who voted for it are already dead?

dtf2• 5 years ago

Well say goodbye to EU data adequacy. Although to be honest it probably wouldn’t have survived the first court case given the UK state’s addiction to snooping.

remus2• 5 years ago

It'll be interesting to see what changes they actually propose. Id assume they would want to avoid threatening the EU adequacy decision so would go with some changes that would score them some points with businesses but without materially affecting contents of the current legislation.

jjcon• 5 years ago

UK state’s addiction to snooping

GDPR has nothing to say on state snooping and if you think Germany or plenty other members aren’t.... I’ve got some bad news for you

dtf2• 5 years ago

Undoubtedly so. What UK is doing wasn't a problem until it was no longer a member.

ur-whale• 5 years ago

UK to depart from GDPR

Good for them.

Looks like in the UK there will be a lot less time wasting clicking on useless "Accept all cookies or else" disclaimers pop-ups.

Nextgrid10• 5 years ago

These useless pop-ups are only there because the GDPR wasn't enforced properly. The majority of tracking consent popups you see are not compliant with the regulation. A compliant pop-up should make the opt-out option as easy to use as the opt-in option.

Nemo157• 5 years ago

Just block them in your ad blocker, because they must be opt-in, by not interacting with them you are asserting your right to not be tracked.

renewiltord• 5 years ago

Hmm, this would be good for business if it had never been an issue. It looks like the plan is for this to just be a divergent set of regulations which is not particularly of any general utility.

Maybe if they harmonize along CCPA or something it would be of value.

jpxw2• 5 years ago

Good riddance. GDPR is an insane, Byzantine mess of legalese, which maps poorly onto reality.

M2Ys4U5• 5 years ago

Good riddance. GDPR is an insane, Byzantine mess of legalese, which maps poorly onto reality.

Have you even read it? The GDPR is a quite straightforward piece of legislation.

jpxw2• 5 years ago

Yes, I have read it.

A pdf copy of it runs to 156 pages. Not particularly straightforward.

Can you sum what the legislation does up in a couple of paragraphs?

danmur• 5 years ago

Any time 'adequate' is the bar it's not great

matthewmacleod2• 5 years ago

One of the most obvious political impacts of Brexit is that the government will feel obliged to demonstrate some kind of benefit. Since real benefits are difficult—verging on impossible—to find, it seems likely the government is going to head in the direction of fabricating benefits. So - slash some regulation, present it as “freeing up business”, and ignoring the wider impact.

tomelders2• 5 years ago

GDPR should have been implemented as a standard that browser vendors should implement. e.g.

``` window.getPersonalDataPreferences() ```

It should only prompt the user to submit their preferences if no preferences were detected, or a specific permission is required to allow certain features.

People may argue that everyone will just turn everything off everywhere and forget about it, and I would argue "so what?".

The burden of GDPR has been dumped on the wrong people and has become so tedious to administer it's basically useless and a massive waste of time and energy.

Nextgrid10• 5 years ago

We had that in the form a "Do Not Track" header and not only did nobody obey it, but malicious actors actually used it as an extra fingerprinting vector to track you even more.

M2Ys4U5• 5 years ago

The GDPR is not a cookie law. It's not even an internet law.

The GDPR applies when any processing of any data is done regardless of context.

oytis3• 5 years ago

Well, we'll see. The pandemic has shown that tracking can be a huge economic advantage - and it's likely not the last pandemic we encounter. OTOH targeting adtech can redirect resources to some more potentially useful areas.

DangerousPie• 5 years ago

I don't think GDPR applies to governments anyway, does it?

oytis3• 5 years ago

But you don't necessarily want tracking infrastructure being built by governments completely, that would be pretty inefficient. As far as I understand the China case at least (I'm not an expert here though, and have never been to China), it's largely started with a commercial app (WeChat).

Not to say that the necessary technology (big data, ML etc.) is to a great extent driven by commercial applications - and businesses should have economic incentives to develop them further.

krageon3• 5 years ago

It does not and it never has.

ewidar• 5 years ago

It depends on what you mean:

GDPR does not prevent EU government from handling their citizens personal data for bureaucracy.

However a good example of GDPR applying to the government is the COVID tracking app built by (for?) the French government, which still has to provide ways to opt out from tracking + clean your personal data.

I think that's what the GP was talking about.

sseneca• 5 years ago

Huh. I guess this'll be what pushes me to finally figure out a proper backup system for my server, so I can trust it with all my photos etc, and remove them from "The Cloud"

m12k2• 5 years ago

‘too many businesses and organisations are reluctant to use data – either because they don’t understand the rules or are afraid of inadvertently breaking them’

TBH I'm glad companies stay away from my data if they don't know how to get consent, store data securely, or even what those things mean.

tobyhinloopen• 5 years ago

Yes this sounds like a great thing

lanevorockz6• 5 years ago

This is an illusion, only thing that happened is that you only get access to websites if you give away your GDPR consent. I love the ignorance of people over here thinking that GDPR is nothing more than just that accept button that people click in order to get access to the websites.

switch007• 5 years ago

I have never observed a non-techie do anything other than blindly click the call to action (i.e. agree to everything). The entire scheme seems sneakily designed to actually encourage users to give more and explicit consent, avoiding the situation where consent was a grey area. It seems to have been spun to a great extent.

dundarious• 5 years ago

That is a huge and often unacknowledged factor. However, there are small (smaller than many think) victories even in having those click barriers -- a few percent more people can choose not to click. And unrelated to the GP's point and your response, but the ability to ask for all your data is a huge benefit.

rlpb• 5 years ago

...you only get access to websites if you give away your GDPR consent.

If a model box only has "I consent" and "Learn more" buttons, then I don't consider clicking on "I consent" to mean freely given GDPR consent. Since it's the only reasonable way of viewing the website, and the GDPR doesn't permit a consent-wall, it's non-consent, and any use of my personal data following that event remains illegal.

It's not a problem with the GDPR; it's a problem with the ICO failing to put a stop to this.

Nursie25• 5 years ago

only thing that happened is that you only get access to websites if you give away your GDPR consent

Well that seems untrue, as someone that regularly either outright declines, or goes through and chooses "functional only".

I do occasionally see websites that say "we no longer serve the european market". That's a shame but it's up to them.

bajsejohannes• 5 years ago

You are conflating GDPR and the annoying cookie dialogs.

GDPR regulates, among other things, how information is stored and deleted on servers. I have worked at multiple companies in both Europe and the US who take this very seriously and has definitely altered their practices based on this.

For example, pre-GDPR, we would "mark as deleted" but not delete. Now we delete.

harperlee2• 5 years ago

The website accept button is not in the GDPR. [EDIT: it's a different law]

GDPR covers way more requirements regarding data management. You need complete control over the lifecycle of sensitive data, exhaustive documentation of data transformations, you have concrete obligations regarding disclosure of incidents, data removal, limitations of for what data is used, user consent management, and the obligation to have people personally liable (which is big, just look at AML regulations to see the effect when not only the fuzzy concept of "the company" is liable).

Lapoino• 5 years ago

At least in SAP (german softwarecompany 100.000 employees) we have to follow gdrp very stricktly and we do.

I don't know if that was the case before gdrp but we have to centraly clarify if and when we store user data, what we do with it and we have to show that we can delete user data if requested.

Not sure how far small companies go through this thow.

kalleboo2• 5 years ago

thinking that GDPR is nothing more than just that accept button that people click in order to get access to the websites

I know of small companies that before GDPR didn't really consider the implications of private data at all. They'd just let their SQL databases grow forever (mark as delete and have "script to actually delete the data" as a TODO that never happened), had random backups lying around on dev machines.

GDPR forced them to actual define policy, start deleting old data that was no longer relevant, strip private data from developer test sets.

It was a bit more work, and adds a small bit of friction, but these are still important things!

Forcing cooks in restaurants to wash their hands after using the bathroom also adds friction to the process but is similarly important.

dkersten7• 5 years ago

Most of these companies wouldn't know how to make much use of the data anyway. My experience working with companies and analytics (even did an analytics startup some years back) is that they haven't a clue about how to actually use it and just heard that more data is somehow better.

That to me sounds like they're most likely to sell the data, since they don't know how to use it themselves. Better these companies have less data, not more.

sharperguy• 5 years ago

In practice though with the GDPR, sites either just 403 everyone in the EU to avoid complying, or just shower you in javascript cookie notifications, making your browsing experience more bloated, slow and insecure.

quest88• 5 years ago

Companies still need some basic data for whatever problem they're solving, right?

As an example, let's say I want to launch a blogging platform. You need some basic tables (data) like User, Posts, Tags, etc. I'd consider this data the business needs for core business. Does there need to be some GDPR compliance thing?

Anecdotally a dumb app I built I was worried about EU visitors and just wanted to block them instead of figure it out (yea yea maybe that's not the right approach but I'm sure the sentiment is common).

justapassenger• 5 years ago

Did you read the law and then work on complying with it?

Spirit of the law is great. Implementation and end result is a typical bureaucracy mess, with not much benefit for end user, that functions mostly as a way for government to have a leverage over companies for non-compliance, whenever they want to put pressure on them.

throwaway2102223• 5 years ago

"that functions mostly as a way for government to have a leverage over companies"

Which is why you NEVER comply: you get exemptions.

hrktb• 5 years ago

While there are byzantine parts, I think it has been a net positive for the user.

People focus mostly on the cookie popups, but forcing companies to delete data after the user stopped using the service for too long, or even giving a legal stand on users requesting their data to be deleted wouldn’t have happened any other way I think.

In a lot of european countries GDPR came on top of other existing customer protection, but it helped make companies think about compliance as needed for continued business, instead of something akin to properly filing random local paperwork.

downandout• 5 years ago

TBH I'm glad companies stay away from my data if they don't know how to get consent, store data securely, or even what those things mean.

“Storing data securely” and “getting consent” are both wildly different from full compliance with the onerous requirements of GDPR. You can do both of these things in absolute good faith and still be in violation. Unless you have a team of legal scholars working for you, odds are that you are in violation of at least one provision of this massive, unwieldy legislation - no matter how respective of user privacy you are.

That is why the UK is abandoning it. GDPR, as written, is a business-killing mess.

ric2b5• 5 years ago

That is why the UK is abandoning it. GDPR, as written, is a business-killing mess.

GDPR has been in place for years, which businesses has it killed?

Do you have an example of a company that you consider was not doing anything wrong in your personal opinion but still got a GDPR fine?

closeparen2• 5 years ago

Consider lawful basis. Does your processing fall under the lawful basis you think it does? Who the hell knows. Making an educated guess as to what the regulators and courts will think is legal scholarship, one of the most expensive professional services money can buy. And even if you get billed for hundreds of hours of the most premium legal minds thinking about it they can still be wrong.

Words like “reasonable” and “legitimate” in the law are not something it is safe for a layperson to reason about. They have specific meanings depending on the nuances of case law, judicial understanding of legislative intent, ideological leanings of the judge you happen to draw, etc.

No company is competent at this, some just have enough money at stake and enough to spend on lawyers that they’re willing to risk it.

klingon774• 5 years ago

Apparently those supporting GDPR would rather have the EU fine Google than to ensure small businesses can survive and be productive with technology, even when the fine to Google is a small amount compared to how much Google makes in the EU. Makes perfect sense, no?

Nursie25• 5 years ago

That's why the first line of remedy is to help the company achieve compliance. Good faith on the part of the company goes a long way too.

The law is not like code. Thank god.

jsty• 5 years ago

And even if you get billed for hundreds of hours of the most premium legal minds thinking about it they can still be wrong.

And that's if you can get said legal minds to take a firm position in the first place, instead of the more usual five - six figure "maybe"

oliwarner• 5 years ago

But going through the process where you work out what customer data you need, reviewing how it's stored, letting your customers all this, is good.

It's very much more healthy (and lawful) than just mucking on, stuffing data into limitless digital vaults and then not having a clue when all that data gets leaked.

In the good old days, paper records had the good manners to take up physical space. It was clear when you had too many records because it was a serious inconvenience to your business.

hnick4• 5 years ago

For cases like this I think consistent enforcement is the most important thing.

In the short term it may sound great that a lot of companies are erring on the side of caution and not using the data, when perhaps they could.

But if there's no enforcement this gives a huge competitive advantage to companies who just don't care at all. They might crowd out the former set. If such companies were not erring on the side of caution, and using some data in a natural way like they used to rather than avoiding it like the plague, they may provide competitive pressure against this dishonest set.

It is a lot like paying taxes. If I am an honest small business owner who pays my taxes but my competitors in the field are known for underhanded cash schemes that dodge tax, I'm not going to last long. I need the law to go after them or I'm done unless I start playing the same game. After dabbling in a small business compliance can be a real killer and it's my honest opinion a lot of people just play it dumb except where they know it matters, and hope for the best.

fumblebee• 5 years ago

"too many businesses and organisations are reluctant to use data – either because they don’t understand the rules or are afraid of inadvertently breaking them"

This is a deeply depressing take if the conclusion is to scrap GDPR. Is this true for 'data' in the general sense, or actually only true in the murky cases where there's an opportunity to use and abuse our personal data.

In my book, that implies that GDPR is working exactly as we hoped it would.

Daho0n6• 5 years ago

I'm willing to bet that this:

The UK has the freedom to strike its own partnerships, he said, and he would announce priority countries for data adequacy agreements shortly

will be an announcement that the US has adequate data protection.

remus2• 5 years ago

This is obviously reading the tea leaves a bit, but I didn't get the impression they are looking to scrap GDPR. It seems to me that they just want to relax things a bit so that businesses don't feel so threatened by it.

Overall I think GDPR is a very positive thing, but from the government's perspective if they could keep the adequacy agreement in place with the EU while still relaxing some of the current GDPR legislation then that would be a big win for them, especially from a political point of view as it would be some much-needed validation of their brexit strategy: "Look! We have all the benefit of being in the EU [via the adequacy decision] but we get to make our own rules! Go us." I could imagine them doing something along the lines of greatly reducing the maximum fine, for example. Big fines are typically not being issued, so they likely wouldn't see it as a big loss.

MaxBarraclough• 5 years ago

Seems there's a reason reputable news outlets aren't reporting this:

The government has sent a first signal of its intention for UK data protection laws to part company with the EU’s General Data Protection Regulation. In a Financial Times article last week, culture secretary Oliver Dowden said he would use the appointment of a new information commissioner to focus not just on privacy but on the use of data for ‘economic and social goals’.

So we don't know the UK is going to depart from the GDPR, but despite that, this website is reporting that it will.

Daho0n6• 5 years ago

But we do:

The UK has the freedom to strike its own partnerships, he said, and he would announce priority countries for data adequacy agreements shortly

Either he recant that comment or announce a country (the US I bet) that doesn't have an adequacy agreement with the EU. You can't have it both ways. If he does announce a list that isn't the same as the EU's they'll have scrapped GDPR.

earnubs• 5 years ago

Link says Government sent a "first signal of its intention", title says "UK to depart".

Comments skip straight to how dumb we all are.

:shrug:

thinkingemote3• 5 years ago

It's like this for most stories and subjects to be honest. It's just that technology news has more people knowing what's actually going on.

sdfhbdf• 5 years ago

‚Meanwhile one of the architects of the GDPR, German MEP Axel Voss, last week called for the regulation to be updated to take into account developments such as blockchain technology...’

What does that have to do with personal data? Sounds like keyword stuffing

tremon• 5 years ago

Blockchain data is immutable after it's been signed. If PII ends up in blockchain data, which is not unthinkable for e.g. financial transactions, there is no way to comply with data deletion requests, which the GDPR mandates.

M2Ys4U5• 5 years ago

Axel Voss wasn't even one of the GDPR's architects. He was trying to kill it before it was born.

smartbit• 5 years ago

Documentary Democracy: Im Rausch der Daten (2015) [0] gives insight in the some of the main characters during the GDPR negotations. It films behind closed doors where the real negotiations took place. Highly recommended for anyone interested in EU politics and in particular for those with interest in privacy.

Quotes from Alex Voss in today’s Financial Times [1]

[0] https://www.imdb.com/title/tt5053042/

[1] https://archive.is/P1gqZ

KaiserPro• 5 years ago

With respect, this is not what the article means.

The UK has an equivalence agreement with the EU, which unlike a trade agreement can be rescinded quickly (something like 4 weeks). This means that we have to have equivalent provisions to continue to handle data about EU citizens.

so the UK might be "departing" from GDPR in name, it won't be in substance just by this act.

This of course assumes the the UK is acting rationally.

corobo3• 5 years ago

Now we got rid of the EU protections the Tory govt is going to stripmine the country for cash.

Imagine the desire for wealth and power at the expense of others being defined as a mental illness that needed treating instead of giving these cunts more power.

aembleton10• 5 years ago

What did the EU stop the Tory government from stripmining?

corobo3• 5 years ago

Data, did I comment on the wrong thread?

varispeed• 5 years ago

Not sure why people treat GDPR as dogmatic ultimate privacy law. This is a bit laughable. The giants violate it as they please and people are now taught to click boxes without reading its contents and agreeing to who knows what. I think the result is quite the opposite of what was intended as it also added few more vectors of attack that didn't exist before. Only advantage I can see is that some services now offer data download. I hope UK will come up with something much better.

macinjosh2• 5 years ago

At least the UK is one European country with its head screwed on straight.

kmlx2• 5 years ago

the lightest of articles based on a single quote.

we'll wait for the actual documents, but in the meantime:

1. does this mean no more cookie stuff, and no more "click here to accept" modals? if yes, then it's a huge win. years of useless clicking, and countless Mwh will be saved in the long run.

2. will this mean no more protections whatsoever? this is not so great imo, and sincerely impossible in today's world of Big Tech legislation (especially in the highly litigious Europe).

3. what about the right to forget? will they touch that part as well?

khalilravanna• 5 years ago

too many businesses and organisations are reluctant to use data – either because they don’t understand the rules or are afraid of inadvertently breaking them

I’m sure they’ll feel much better when there’s yet another set of rules and laws they’ll have to follow. Oof.

marcorx• 5 years ago

GDPR has not much to do with cookies, and more to do with how your data is captured and used. Most of the "annoying" cookie banners and popups are related to the e-privacy regulation [1].

I am not sure this will have a significant impact, as UK will have to comply with GDPR if they want to to reach European customers.

[1] https://www.activemind.legal/gb/guides/eprivacy-regulation/

jonplackett2• 5 years ago

The idea of GDPR was good, the execution was poor. All those pop ups in your way and you end up just hitting 'ok' anyway because it takes so long to figure them out.

And big companies seem to completely ignore it anyway. Take twitter - all they have is a banner along the bottom that says:

"By using Twitter’s services you agree to our Cookies Use. We and our partners operate globally and use cookies, including for analytics, personalisation, and ads."

and a close button. How is that consent?

dkersten7• 5 years ago

The pop ups are not usually complaint though. So its not that the execution was poor, but rather that the enforcement is poor.

Also, your Twitter quote shows another issue: conflating GDPR with the Cookie directive. They are two very different laws. GDPR is concerned with personally identifiable data and data protection, the cookie laws are concerned with tracking users online. GDPR applies to all data (not just websites), the cookie laws deal with what websites can do. They are not at all the same thing. The popups you see tend to be for the cookie law, because GDPR doesn't require anything like that. Both do require consent (opt-in) though, but both also have exemptions for data and cookies required to provide the service.

jonplackett2• 5 years ago

Ok thanks for the clarification.

Twitter are specifically saying that they’re going to use cookies for a bunch of things there that are not necessary - like ads. So how is that allowed?

elorant• 5 years ago

Let the spam kings rejoice.

fmajid• 5 years ago

It's worth mentioning the UK-Japan free-trade agreement already exempted data flows to Japan from GDPR (and from there they can be laundered to the USA):

https://edri.org/our-work/uk-japan-trade-agreement-violates-...

As Boris Johnson said, "The UK won't immediately send children up the chimneys or fill beaches across the country with raw sewage". Emphasis on "immediately".

jdlyga• 5 years ago

What does the UK want to do, make some commonwealth free trade zone? That would make sense. But it seems like everyone wants to go in their own directions, including parts of the UK.

mavhc• 5 years ago

Practical outcomes of GDPR: You can't search old emails. Your website lists 100 companies you send data to. Someone will randomly waste your time asking for all information you have about them. You have to click Accept cookies on every website you visit 100s of times a day, wasting your life.

Things it didn't fix: Data leaks.

turkey99• 5 years ago

ICO pretty much said they were only going to enforce it like previous data protection laws anyway.

benbristow3• 5 years ago

Can we get a rid of the cookie notifications next? They're so annoying and usually end up conflicting with Adblockers and breaking pages because they're not fully blocked.

glsdfgkjsklfj3• 5 years ago

elitist nonsense.

They ought to be annoying. so sites that do not track you for advertising can just add your cookie when you actively sign in, without the annoying popup on first visit, and receive more traffic because they are less-annoying.

benbristow3• 5 years ago

Get real, most sites aren't going to do that when they can get away with putting a modal/banner up. It's the end-user that gets the brunt.

Most of the modals are full of dark patterns that basically force you to accept the cookies etc. unless you go through multiple different screens and checkboxes.

Nextgrid10• 5 years ago

The GDPR already forbids consent prompts that are unclear, misleading or designed to annoy the user into submission. A compliant prompt should make it as easy to agree as it is to refuse.

The problem is that the ICO is absolutely incompetent at enforcing it (I found it very funny that the article claims businesses are afraid to use data while in reality not only do they appear to use it just fine and even a bit too much for my liking, but our regulator has only ever handed out 4 fines, all for data breaches and not other abusive usage of data).

danpalmer• 5 years ago

I'm broadly in favour of any consumer protective legislation like the GDPR, but I feel that the GDPR has been misinterpreted by many, in both directions.

Those who ultimately respect user privacy and want to do the right thing are often paralysed by process and making sure that they absolutely can't be sued, rather than being able to show respect for data and best practices but still getting things done.

Those who ultimately don't respect user privacy use it as an excuse. They plaster their services with GDPR notices, and then ignore the spirit of the law and sweep up all the data they want, regardless of whether they need it or should have it, but of course this is invisible to users so nothing happens about it.

I wonder if this disconnect comes from the enforcement? I'd like to see a few high-profile cases that set out some precedents for what is and what isn't a breach of GDPR.

choeger• 5 years ago

Don't forget the people that use it as an excuse to not do what they simply don't want to do. "Sorry, we cannot contact you via email, GDPR, you understand? You have to come to us and have an awkward sales talk in order to get your trivial information."

Nextgrid10• 5 years ago

Yes, there is definitely a lack of enforcement. The annoying consent flows people complain about and blame on the GDPR are actually forbidden by it and news of any enforcement actions would quickly scare most websites into implementing an actually compliant one.

freddybobs• 5 years ago

GDPR is generally a good thing IMHO.

It seems this can only lead to

1) Rolling back to pre GDPR, where user data is largely a free for all 2) The UK having it's own 'unique' rules

Neither which seems very good for users and/or businesses.

Perhaps the point here is to make some kind dubious 'look what we can do because of brexit' argument. When the reality is that 'freedom' has a reality which is more negative than any positives it might have.

flimflamm• 5 years ago

Should we just switch to France as a main language in the EU countries? Oui.

drusepth• 5 years ago

While GDPR's intentions were good, the implementation is hilariously vague/wide and has had a chilling effect on small and large businesses worldwide since going into effect (not to mention the additional costs immediately levied on every business to develop, verify, and maintain GDPR infrastructure).

I'm sure this is a minority opinion on HN but I'm glad to see some countries pulling back, especially in light of recent calls to expand GDPR even further (!).

aerosmile2• 5 years ago

Just an observation that we seem to have two camps here: one camp correctly noting that GDPR was a net positive for the users, and the other camp correctly noting that GDPR was a net negative for startups and SMBs.

I am surprised that nobody is realizing that what's bad for startups and SMBs is also ultimately bad for the users, just on a longer timescale (with an equally long reversal period).

I remember the US Congress grilling Zuckerberg back in 2018, and him responding that he's certainly willing to make amendments, but if you tie his hands too much, someone from China will swoop in and bypass all regulations. Everyone scoffed at that, and less than 3 years later, TikTok is unstoppable despite Facebook's best efforts. While users' privacy has benefited from Facebook's downfall, their privacy has never been at more risk with the rise of TikTok (I do realize that TikTok's servers are in the US and Singapore, but let's not fool ourselves - the ByteDance leadership would be quickly replaced if they refused a data request from their government). I would consider this a net negative for the users, and particularly for the US as a country.

Just another example proving that the paradox of tolerance [0] is a real thing. If you get too tolerant too quickly, you end up with a less tolerant outcome.

[0] https://en.wikipedia.org/wiki/Paradox_of_tolerance

Nextgrid10• 5 years ago

Is there any evidence that TikTok's popularity is due to their non-compliance with regulations, and not just being a novelty and them having lots of money to bankroll such a service without annoying the users with ads like FB does?

aerosmile2• 5 years ago

On the first-order basis, it might be difficult to pinpoint why Facebook "wasn't allowed" to build this product before anyone else.

On the second-order basis, there is an interesting comparison between how well Facebook hindered Snapchat's growth with their rollout of Stories, vs how well it hindered Tiktok's growth with their rollout of Reels (not very). There are obviously a million factors to consider, but I would argue that us taking Facebook through the dirt 1) weakened its hold over its users and 2) triggered a talent exodus, both of which contributed to Facebook's Reels not being as impactful as Stories (viewed strictly through the lens of defending against the new competitor).

Mentlo• 5 years ago

Did anyone actually read the article? Most of the comments here are treating the article as if the UK will depart from GDPR (as the title says) - but the article says nothing of the kind. It will be a slight change, probably reformatted to allow for less red tape and more clarity for small businesses and early-life enterprise. And the UK still needs to keep regulatory alignment to the EU to be able to have low-tarrif access to the markets.

If I was a betting man, I wouldn't bet on this being a significant change, given the world is moving more towards privacy (yes, including US).

UK to depart from GDPR

Related Stories