8 ms·

If the law is that simple, then why did it take 11 chapters and 99 sections to say that?

mschuster91 3y ago
Because European laws tend to be very precise and detailed, so that people can rely on them instead of a situation in the US where the effective boundaries of the law are only created in the subsequent years by the courts. It is easier to read the law and the cover text explaining the reasoning behind the regulations than to read a vague US/UK style law and then having to research court rulings, looking which of these conflict with each other or if they're even applicable (as I recently learned here, y'all's federal courts are organized in circuits and a ruling of a federal court is only binding for that circuit).
- scarface74 3y ago
  And yet small businesses in the EU are still getting caught up in it.
  - ilyt 3y ago
    Of course, because vast variety of businesses had no security whatsoever and a bunch of PII could just be accessed by anyone on file share. Vast majority of cases are "we haven't even tried in the first place" And majority of fines are in range of 4 to low 5 digit. At least from what I observed the "mistakes" are generally fined pretty low if organization can prove it took necessary steps in goodwill, but stuff like "not telling users about the breach" is treated VERY harshly
    - scarface74 3y ago
      One of the small businesses in question wanted to use Shopify and got fined.
      - ilyt 3y ago
        Then use provider that respects privacy. You guys would give up your rights for a pack of chips..
        scarface74 3y ago
        It’s funny for someone to claim that we would give up our rights when you are begging the government to limit your choices instead of using your own free will to choose based on your priorities. The EU is constantly taking away your right to choose which companies you want to use and it’s being celebrated
        SideburnsOfDoom 3y ago
        > you are begging the government to limit your choices instead of using your own free will to choose based on your priorities This is the "pro-crack-den" argument. Boring, boilerplate libertarian dogma. Not suitable for use in the real world.
        scarface74 3y ago
        So you’re not capable of choosing which websites you go to?
        SideburnsOfDoom 3y ago
        This is a non-sequitur response.
        scarface74 3y ago
        How so? Why do you need the government to tell you which products you can use? If you don’t like the policies of a particular company, don’t use their products.
        3y ago
ilyt 3y ago
If you don't store user data none of those applies. If you do want to store the data, those just specify what and how with enough detail that battalion of Facebook lawyers can't go around it. It's mostly sensible when you get around to implementing it. For example if you store data for say CCTV purpose, you have to tell people they are being monitored, for what reason, who administers the data etc. Article 6 covers filming the public spaces i.e. they don't have to give written consent because the extra security of security cameras provide considered greater good than individual. But at same time it allows processing only for those purposes. You can't just go on facebook and post some video from security camera of someone doing dumb shit. You can't just film inside toilet. You can go and monetize it in any way etc. You also need to do the rest of due diligence of making it secure, not sharing with 3rd parties unrelated to the goal etc. IIRC some company got $200k for doing exactly that, just posting basically some dumb shit people did, without even blurring out the people in all of the videos. Which triggered an audit that discovered that way more people that should had access to security footage. Similar things apply to storing and analyzing logs for security purpose. They are considered "greater good" under article 6 and you can store and use them for, say, blocking malicious users on WAF, but you can't then go and handle it to your marketing team and you would have to anonymize it if you for example wanted to give those logs to developers to debug problems.
- scarface74 3y ago
  And a small EU salesmen had to shut down because he was using Shopify…
  - SideburnsOfDoom 3y ago
    Citation needed, who is this non-existent salesman? I see sites all the time that use shopify at checkout to handle the sensitive financial data. That's literally what they do for their clients.
    - scarface74 3y ago
      https://lsww.de/shopify-illegal/ https://lsww.de/shopify-illegal/ And the HN discussion https://news.ycombinator.com/item?id=33561222 https://news.ycombinator.com/item?id=33561222

Because European laws tend to be very precise and detailed, so that people can rely on them instead of a situation in the US where the effective boundaries of the law are only created in the subsequent years by the courts. It is easier to read the law and the cover text explaining the reasoning behind the regulations than to read a vague US/UK style law and then having to research court rulings, looking which of these conflict with each other or if they're even applicable (as I recently learned here, y'all's federal courts are organized in circuits and a ruling of a federal court is only binding for that circuit).

scarface74 3y ago
And yet small businesses in the EU are still getting caught up in it.
- ilyt 3y ago
  Of course, because vast variety of businesses had no security whatsoever and a bunch of PII could just be accessed by anyone on file share. Vast majority of cases are "we haven't even tried in the first place" And majority of fines are in range of 4 to low 5 digit. At least from what I observed the "mistakes" are generally fined pretty low if organization can prove it took necessary steps in goodwill, but stuff like "not telling users about the breach" is treated VERY harshly
  - scarface74 3y ago
    One of the small businesses in question wanted to use Shopify and got fined.
    - ilyt 3y ago
      Then use provider that respects privacy. You guys would give up your rights for a pack of chips..
      - scarface74 3y ago
        It’s funny for someone to claim that we would give up our rights when you are begging the government to limit your choices instead of using your own free will to choose based on your priorities. The EU is constantly taking away your right to choose which companies you want to use and it’s being celebrated
        SideburnsOfDoom 3y ago
        > you are begging the government to limit your choices instead of using your own free will to choose based on your priorities This is the "pro-crack-den" argument. Boring, boilerplate libertarian dogma. Not suitable for use in the real world.
        scarface74 3y ago
        So you’re not capable of choosing which websites you go to?
        SideburnsOfDoom 3y ago
        This is a non-sequitur response.
        scarface74 3y ago
        How so? Why do you need the government to tell you which products you can use? If you don’t like the policies of a particular company, don’t use their products.
        3y ago

ilyt 3y ago

If you don't store user data none of those applies. If you do want to store the data, those just specify what and how with enough detail that battalion of Facebook lawyers can't go around it. It's mostly sensible when you get around to implementing it. For example if you store data for say CCTV purpose, you have to tell people they are being monitored, for what reason, who administers the data etc. Article 6 covers filming the public spaces i.e. they don't have to give written consent because the extra security of security cameras provide considered greater good than individual. But at same time it allows processing only for those purposes. You can't just go on facebook and post some video from security camera of someone doing dumb shit. You can't just film inside toilet. You can go and monetize it in any way etc. You also need to do the rest of due diligence of making it secure, not sharing with 3rd parties unrelated to the goal etc. IIRC some company got $200k for doing exactly that, just posting basically some dumb shit people did, without even blurring out the people in all of the videos. Which triggered an audit that discovered that way more people that should had access to security footage. Similar things apply to storing and analyzing logs for security purpose. They are considered "greater good" under article 6 and you can store and use them for, say, blocking malicious users on WAF, but you can't then go and handle it to your marketing team and you would have to anonymize it if you for example wanted to give those logs to developers to debug problems.

scarface74 3y ago
And a small EU salesmen had to shut down because he was using Shopify…
- SideburnsOfDoom 3y ago
  Citation needed, who is this non-existent salesman? I see sites all the time that use shopify at checkout to handle the sensitive financial data. That's literally what they do for their clients.
  - scarface74 3y ago
    https://lsww.de/shopify-illegal/ https://lsww.de/shopify-illegal/ And the HN discussion https://news.ycombinator.com/item?id=33561222 https://news.ycombinator.com/item?id=33561222