But those EU companies that are clued in as a whole are taking this pretty seriously.
Bad laws are bad laws because they have unintended consequences outside of the spirit of the law, so far I have not seen any or even a credible suggestion of such a bad consequence. Let us give it some time before we start declaring the law dead on arrival.
Elizabeth Denham, UK's information commissioner in charge of data protection enforcement, had this to say:
"Having larger fines is useful but I think fundamentally what I'm saying is it's scaremongering to suggest that we're going to be making early examples of organisations that breach the law or that fining a top whack is going to become the norm. Our office will be more lenient on companies that have shown awareness of the GDPR and tried to implement it, when compared to those that haven't made any effort."
Now, whether you trust large bureaucratic institutions to use elastic, broadly defined, excessive powers granted to them wisely, applying self-restraint for the general good, is a function of your general political leaning and life experience more than legal nuance, I suppose.
But you keep just falling back on what they’re trying to do, which matters less than what they’re going to end up doing.
What they’re actually going to end up doing is fail to really curb much abuse, introduce lots of costs and uncertainty, drive businesses out of the EU, worsen the UX of the internet, entrench the largest players who can afford to be mostly compliant and defend themselves legally, and further erode the concepts of national sovereignty and the ideals of the web.
How about this: if EU citizens want more privacy protections than those provided by laws of my country, stop sending HTTP requests to my server in America and asking me to send information back to them. Why the hell is it on me to figure out where those requests are coming from and what bizarre set of laws that person’s country thinks I should have to care about with regard to what I do with the content that their citizen voluntarily sent me?
That's got to be the mother of all strawmen. FB will not be destroyed by the GDPR, but - ideally - the GDPR will cut back some of the worst excesses such as tracking users who are not even members of FB through embedded JS on other people's properties.
> It's a bad law, because it's so overly broad and vague that it's going to be impossible to be fully compliant.
It's actually a pretty good law compared to the predecessor.
If you feel that it is impossible to be fully compliant then maybe you need someone to interpret the law for you - such as a lawyer or a judge -, there are some fields of tension but on the whole it is not at all impossible to be compliant at least with the spirit of the law. Acting in good faith is a good first step.
> For example, an EU resident hits your server while they're on vacation in Australia. You've stored analytics, IP addresses, etc. Congrats, you're now in violation.
Contrived example, do not pass go.
> That's the tip of the iceberg. The law also broadly contradicts loads of other laws about how data must be retained for legal and compliance purposes.
And makes special mention of that and has exceptions for those cases.
> So now that everyone is breaking this law, regulators are free to just decide who they want to punish and how much. That's incredibly damaging to the fundamental idea of the rule of law.
Except that's not how it works, which makes this another strawman.
> 2. It sets a really bad precedent regarding jurisdiction and the internet.
How so? If you want to argue something is bad then you need to show how it is bad because of negative consequences, what 'any jurisdiction in the world' declares is their business, but the EU has stepped up for the rights of its citizens, and as one of those citizens, I'm pretty happy about it.
> So now any jurisdiction in the world can declare that if you do something they don't like that even remotely affects them, you owe them whatever they want.
This has nothing to do with the GDPR.
> What if some oppressive regime passes a law that if your website is shown to one of their citizens and doesn't have a message praising their leader, you owe them 100% of your global revenue in perpetuity.
Yet another strawman.
> Why not?
Well, why not? Indeed, except, it hasn't happened.
> You've violated their laws regarding behavior towards their citizens!
Yes, and you're free to ignore them, except in those cases where you wish to have a business presence in the country of said oppressive regime.
> 3. As item #2 gets at, countries can pass whatever laws they want, but they're limited by their ability to enforce those laws.
Exactly. But the EU can and does enforce its laws.
> If the EU gets overly broad and punitive here (as I'd argue they have), then companies will either just leave, or shift their digital operations to jurisdictions where courts can't enforce those laws.
That's fine, at least we have proven malicious intent on their part then. Complying with this law isn't all that hard. But it is hard if you are coming at the whole concept of privacy as a party that does not care about it.
> Ultimately, I think that the realistic path here is that Google and Facebook will fundamentally change almost nothing.
We'll see. My guess is that they like the money too much to do 'nothing'.
> The user experience will just get worse, because we'll have to constantly be agreeing to a long list of terms about how our data will be used, etc, etc. And people will just agree and move on.
So what are you worried about then?
> Regardless, the idea that we're suddenly going to live in a new golden age of digital privacy because the GDPR has good intentions is laughable.
Nobody claimed that, could you please lay off the strawmen, you can do much better than that.