News for hackers. Stuff that matters.
Re:StreetLend.com shuts down, citing GDPR regulations by Silhouette on Monday April 30, 2018 @10:59AM (#16959077)
See, I disagree with this very premise. Why is it true? It's _not_ my data; it's data about me.

Why do we protect any rights by law? Usually it's because some harm is likely if the right is not protected and the potential victim cannot effectively protect themselves due to some imbalance of power.

Reasonable people can debate how far privacy rights should be protected and where the balance lies between protecting the data subject and allowing data processors to do useful things. Maybe the GDPR doesn't strike the ideal balance here and favours one side too much at the expense of the other.

However, it makes no more sense to argue that someone can't have any legal control over how personal data concerning them is processed than to argue that, for example, someone can't have any legal control over whether their physical property remains in their possession. Many social conventions have proven to be useful, and we codify them in laws so that everyone can see what is considered acceptable behaviour and so that people who try to undermine those norms for their own benefit at the expense of others can be dealt with.

Re:StreetLend.com shuts down, citing GDPR regulations by jimktrains2 on Monday April 30, 2018 @11:21AM (#16959331)
> However, it makes no more sense to argue that someone can't have any legal control over how personal data concerning them is processed than to argue that, for example, someone can't have any legal control over whether their physical property remains in their possession.

No, it's more like making it a crime to break or lose something lent to you. At most it's a civil matter handling damages, not an extension of control over the item lent (baring any contractual agreement).

Re:StreetLend.com shuts down, citing GDPR regulations by Silhouette on Monday April 30, 2018 @11:57AM (#16959670)
I don't see why the criminal vs. civil distinction matters here. The point is that you can have legal control over something without necessarily having physical control over it.

Put another way, how is protection of privacy by restricting what someone may lawfully do with personal data any different to protection of physical property by restricting when someone may lawfully use or remove it? Typically you can't physically stop someone from sending your email address to someone else once they have that information, but then typically you also can't physically stop someone from stealing your TV while you're out once they have a big sledgehammer and access to your front window.

I think most of us would still say that we have legal control over our possessions, and most of us would still say that theft is unacceptable behaviour and should be punished. In Europe, where perhaps we tend to have stronger feelings about privacy than in some parts of the world, a lot of people similarly feel that they should have the ability to restrict how data about them is being used and shared, and that some things that some organisations have been doing until now are unacceptable behaviour and should be punished if they continue to do them.

Re:StreetLend.com shuts down, citing GDPR regulations by victorNicollet on Monday April 30, 2018 @12:37PM (#16960054)
The purpose of the law is one thing, the means through which the law is enforced is another. One can agree with the purpose of the law (people should have control over X) but not with the means (civil damages or criminal penalties).

"To have legal control over your PII" and "To have legal control over your possessions" are similar in nature. The fact that such purposes are implemented in different ways, for mostly technical reasons, does not diminish the argument.

The main technical reason is that, right now, loss of control over PII is widespread, and individually processing each claim would likely overload the judicial system of EU countries which usually don't have class action lawsuits. GDPR simulates a class action lawsuit using regulatory bodies, to be triggered by refusal to comply with a significant number GDPR requests.