Arguably, that's already the case. The combined rights given in articles 15, 16 and 22 make it very difficult to legally justify a policy of banning people without explanation or appeal, especially if that process is automated. At the very least, you have the right to see any data used in that decision-making process and to have any inaccurate data corrected.
https://gdpr-info.eu/art-15-gdpr/
I'm kind of surprised that this is in the GDPR, I thought it had been part of consumer protection regulations for much longer. Maybe that was only in specific EU jurisdictions.
Sometime in the last century, this idea was implanted by big businesses in the media and therefore the thoughts of the citizenry that regulation is more than anything, just people who couldn't succeed in business bullying people who are, and that shit is so fucking dangerous that it makes me shake. Amazon, AirBNB, Google, Facebook, Apple, none of these companies give a FUCK about you any further than they are legally required to, not one iota further, and we constantly bemoan our politicians over having a "too regulated" business environment.
Unfortunately the US is very influential globally, in various ways. eg trade agreements, or just brutally implementing neo-liberal economics on weak countries they can coerce economically and/or militarily.
The US has also (having effectively no anti-trust for decades) has let many corporations based or founded there grow to unprecedented sizes and power.
Theres also other countries /areas (Jersey, Cayman Islands, etc.) that make a business of tailoring their laws to allow corporations to avoid paying taxes, pollute, hide data, censor journalists etc.
Regulation in the abstract is neither good nor bad, the particulars of the regulation are what is important.
You can be critical and suspicious of onerous government regulations while still appreciating that there are many reasonable uses for regulations.
That's fair. Should've been more specific about that, it's a very American thing.
Regulatory capture is a real thing too. Regulation isn't obviously positive just because there are reasons people trot out to justify it.
You're right, companies don't generally care about me. But neither does the Social Security Administration, the Department of Justice, my local police department, my local school board, or any post office in which I've ever found myself.
You, like most Americans tend to do, are failing to understand the democratic concept and the responsibilities it must entail.
A healthy democracy is very possible. It requires 2 basic things:
- An fair and flat electoral process with sufficient protections against financial and propagandistic inequalities.
- An engaged and educated populace, elections produce politicians who serve the electorate.
The second one is a catch-22. An educated populace requires quality education requires a healthy democracy. for that reason, when things go wrong, they are extremely hard to get right again. This is why public education and a focus on humanities has such a deep legacy in the history of building democracies. Without both, short-sighted and/or self-interested thinking like yours will doom the arrangement.
The voters.
"You're right, companies don't generally care about me. But neither does the Social Security Administration, the Department of Justice, my local police department, my local school board, or any post office in which I've ever found myself."
I've found that those agencies tend to care more about me than random companies. The rep at any of those places might not be able to help, but I can usually get them to try.
I think that last sentence could only be honestly written by someone who's lived their whole life in a society protected by strong regulatory structures. The massive benefits of regulation are taken for granted and forgotten, but the problems of implementation that still exist are magnified out of proportion.
Government bureaucracy is certainly not perfect, but lets not kid ourselves that it's worse than the alternative.
And the answer to your question is: a functioning legislature that's accountable to its constituents, and competently exercises its oversight role.
> Regulatory capture is a real thing too.
But rather than a call for less regulation, it's really a call for better oversight of the regulators.
Certain parts of the social security administration (or equivalent) also care. They want to help people, that's what it's for. It depends on where you end up, if your case fits like a cog in the bureaucracy, that's what you'll get, it's efficient. But it's a social safety net for a reason, what else do the people do, whose jobs it is to guide people around and make sure they arrive at the right part of the bureaucracy, if not care?
There could be even more care, but when I see the homeless in other countries, how many are on the streets for no other reason than mental health, I think we're doing pretty good. I always judge a society by how they treat those who are the worst off. Lifting that very lowest rung, that is the only real progress in a society.
Oh you know another funny thing, your example about post offices? You probably remember those heart-warming stories of a grand-child addressing a drawing to "granpa" and the post office somehow figuring out where it should go (and similar stories). That kinda stopped when the postal service got privatised into multiple competing businesses. The delivery guy that belongs to the now-privatised previously-government postal service still has a pretty good idea who lives in the street, whether I have new neighbours, makes a (very short) chat. The delivery people of other delivery services, that have always been private, do not.
I'm sorry but in my experience everything points that government regulated services and the like inherently allow their clerks to care more than a private business.
I just imagined what it would be like if the local neighbourhood police got privatised. Brrr.
You and people like you talk as though the various regulatory bodies simply issue an edict and every corporation is obligated to oblige that very second, and it's ridiculous.
1. The regulations themselves are often based heavily upon opinions and trusted advice from people who actively are or who formerly were in the industry being regulated, not simply dreamed up and pulled from someone's ass
2. There is an entire months long process of discussion, meeting, decisions, appeals, revisions, etc. engaged in between experts on both sides, lawyers on both sides, etc. By the time a regulation becomes required law, it's likely been attended to by a few hundred if not thousand people from both private enterprise and Government over months if not YEARS of work.
3. Once a regulation becomes law, companies often have months of forewarning to get into compliance. In the event that a business is non-compliant with something, unless it's immediately life threatening, they are given warnings, written warnings, guidance, possible solutions, etc. Regulators are not some comic book villain trying to fuck over mom and pop stores. They are attempting to ensure the safety, efficiency, and long life of everyone involved in a business. They want you to be compliant, not to file paperwork and shut you down.
> As bad as this example is, have you never heard of the nightmares people fall into dealing with government bureaucracies?
Oh I have, and for years and years I took them at face value but ANECDOTE IS NOT EVIDENCE. Almost every time you hear about some person who ended up on the wrong end of a regulator's pen, if you start digging you'll find a long history of shady ass behavior from that person which is conveniently omitted from their account of the events, for I'm sure totally-not-lying reasons.
> Regulation isn't obviously positive just because there are reasons people trot out to justify it.
The vast majority of regulations are written in the blood of the people who had to die to show us that storing some chemical in a break room gave every 3rd employee cancer, or every person who ate fish from a polluted river who didn't know that the chemicals in it would destroy their bodies. The fact that you personally don't understand whatever is behind a given regulation, does not make it unimportant or frivolous.
> But neither does the Social Security Administration, the Department of Justice, my local police department, my local school board, or any post office in which I've ever found myself.
Except you can affect those if you get off your dead ass and vote.
The very same interests that subvert regulations then use that subversion to say regulations, "in general" are bad, without explicitly saying what the alternative would be. No regulations, or less corruption? What, exactly, are you arguing for?
It probably happened to you because of something to do with this thread, since the dead comments start just after that: https://news.ycombinator.com/item?id=16236350
I don't think that view is natural in common citizens, but rather it's the result of effective, long-term propaganda (a.k.a. public relations [1]) campaigns by those who the regulations typically protect against (businesses and their owners, mostly) and who therefor have to comply with them.
You'd think this be common knowledge, right? But only yesterday I saw someone here arguing that Tesla is somehow an exception to this rule and really does and will care about us and the planet. I remember believing similar good things about Google in the very early 2000s (that did not last long for me).
EDIT: Downvote if you disagree.
From the article:
> ...have exercised our discretion under our Terms of Service to disable your account(s)
The language here implies that the account still exists in a suspended state, and is not deleted. If you're a european, under the GDPR they must give you all your data if you ask for it. Maybe this would include the reason they banned the account.
Otherwise, you can at least demand that they erase the data they're holding only to your disadvantage.
So complaints from user1 about user2 or customer service notes about user2 wouldn't be considered personal data of user2 and thus wouldn't fall under GDPR rules.
If this isn't the correct interpretation, I would appreciate a pointer to something in the GDPR that elaborates on this.
Why wouldn't it? If it's data about an identifiable individual then - by definition - it is personal data.
Furthermore, in the ICO's recent report into political parties' use of personal data[0], they expressed the following view:
"Our investigation found that political parties did not regard inferred data as personal information as it was not factual information. However, the ICO’s view is that as this information is based on assumptions about individuals’ interests and preferences and can be attributed to specific individuals, then it is personal information and the requirements of data protection law apply to it."
[0] https://ico.org.uk/media/action-weve-taken/2259369/democracy... p29
For example, consider a website that maintains a collection of birthdays for public figures derived from public sources (historical documents, news accounts, social media posts from the public figures themselves, etc.). In many jurisdictions the birth dates might even be available via public record searches.
Clearly the birth dates are "personal data" in the colloquial sense of the phrase, but I don't think that the data as held by the website operator would be subject to the GDPR provisions, right?
Personal data is _any_ information about an identified (or identifiable) natural person.
It absolutely, positively does require that disclosure. Article 15 states:
"The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data"
"Personal data" is defined in Article 4 as:
"any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;".
If I have any information* that can be related to you by any identifier, directly or indirectly, it is personal data within the scope of GDPR. Server logs, invoices, customer service records, CCTV footage, emails between employees that mention your name or username, the whole kit and caboodle.
The definition of "processing" given in Article 4 includes storage.
The regulations would be a farce if I could hoover up data about you from third parties or through surveillance technology, but you had no rights over that data simply because you didn't provide it to me.
Does it refer only to facts about a person, or does it include opinions and business decisions made by the company about that person? If one employee tells another by email that they dislike a particular customer and asks to have them banned, is that the customer's personal information in itself?
1. Yes, when exercising your "right of access", companies would have to send you all the personal data they have on you, except when disclosing this information would harm others (ie: notes of your manager about your performance or the example you gave) The exception does not mean that they can blankly refuse to give you any data, only the "offensive" part must be refused. By definition, that is still considered personal data however. As M2Ys4U mentioned: inferred data is also personal data.
2. there is a case where you don't have to provide all information: the right of data portability only applies to data provided by the data subject.
3. Someone is referencing article 14 below. That is not the same as giving access to data. Article 14 specifies how a data subject must be informed about processing of his data when you've received the data from someone else. For example: you've received someone's info from a recruiter and you now want to process his data to see if this person is a valid prospect. The article works together with article 13 (how to inform a data subject on what you are doing with the data he gives to you directly). Together, these articles are the reason for 50% of the privacy notices of the last couple of months :-)
Article 14 explicitly talks about data not provided by the data subject, further clarifying that it is in scope.
* are my interview notes during the hiring process "personal data" subject to GDPR provisions (disclosure, destruction, etc). * are my business meeting notes with a contractor subject to GDPR?
It might not unless the definition is really stretched. It's not data collected about you. Otherwise every email some employee sends discussing this situation would also need to be included.
It's quite obviously personal data within the definitions used in GDPR. It's information that can be related to a natural person; those two criteria are the only criteria that must be satisfied for data to be regulated under the GDPR.
https://gdpr-info.eu/art-4-gdpr/
>Otherwise every email some employee sends discussing this situation would also need to be included.
Yep. If the contents of those emails can be related to a natural living person by any identifier (name, username, email address, account number etc) then it's personal data.
Take Facebook as an example, when you request your personal data, they present what is linked in their database to you, which is of course not where anyone mentions your name. Who is to say that my name (Paul Smith) identifies me and not some other Paul?
That is what they mean with "indirect identification" in the link provided by jdietrich.