I think this would be a stronger argument if other EU laws didn't actively require the collection and long-term retention of some of the most important personal information, including identity and financial details, for other purposes such as VAT audits. Such obligations often preclude otherwise reasonable data management strategies like encrypting all personal data with a per-account key that can be easily deleted and thus render everything connected with a given account permanently inaccessible in the event of an erasure request etc.

Instead, data controllers are in principle supposed to keep track of every possible purpose for which personal data could be processed, even those originating in theoretical legal requirements that are rarely if ever used in practice, as they applied at the time each item of personal data was first collected and at all times since; to retain each individual data point for as long as any purpose for which it might be needed continues to apply; and then to delete that data promptly once its final purpose is no longer relevant.

I suggest that few if any data controllers are actually doing this. Instead I suspect almost everyone who is trying in good faith to comply with the GDPR is using sufficiently generic purposes and blanket provisions to simplify their position to a manageable level of complexity. (How many privacy policies have you read since GDPR came out that actually stated a concrete time period for retaining each category of personal data being processed, and how may have you seen that rely on abstract wording about keeping the data for as long as any stated purpose applies or something similar?) No doubt many other organisations are simply not complying with the GDPR rules about retention and deletion at all, perhaps through ignorance, or perhaps as a deliberate choice that they hope to get away with.

I see this violated so often with full-screen popups requiring you disable adblock or exit private mode. The EU really needs to fine these companies into oblivion, I should not have to create an account just to look and see if they have a disabled tracking toggle (and they usually don't, so the only way to prevent tracking is private mode/adblock).

That's not true in the slightest. One bank (ING) in The Netherlands implemented an opt-out for analyzing customers data. Quite a bit of outrage. PR spokeperson said: "all is fine, this is all good, we follow the GDPR".

Local privacy authority sent a general letter informing that such behaviour is very likely not according to the GDPR. ING quickly backtracked. Other banks said they'd obviously comply with GDPR.

No fine was given.. it was not needed. I don't particularly care if companies are fined. I do care that they take my privacy into account. The latter is what (slowly) is happening.

Sounds like teeth to me.

(1) https://www.gdprtoday.org/gdpr-in-numbers-4/ (2) https://www.reuters.com/article/us-google-privacy-france/fra... (3) https://blogs.dlapiper.com/privacymatters/

Hopefully the rate of enforcement will further increase and compliance attitudes will improve.

Indeed. Are the following two statements true or false?

1. Major data hoarders, including online giants like Facebook and Google and traditional data brokers like credit reference agencies, are still hoovering up huge amounts of personal data and processing it in ways that some or all of the data subjects don't understand and to which they can't therefore have given their informed consent (assuming they are aware of any processing and have given any consent at all).

2. Governments and organisations with ties to governments are still hoovering up huge amounts of personal data allegedly for purposes involving security with little meaningful oversight and little need to demonstrate effectiveness or proportionality.

Until statements like these are false, data protection and privacy law isn't really protecting people from the biggest threats anyway, and the main positive effect of the GDPR is just to give the regulators the ability to impose fines for things that were mostly prohibited anyway but now on a scale that is significant to large businesses. That in itself is probably no bad thing, but if that's all it achieves then it's far from clear that it's been worth the huge implementation costs and the uncertainty it has brought even to honest organisations.

The user consent parts of gdpr, are, imo, not good. Any wins though are better than nothing.

But, I feel that assuming a pseudo-contractual relationship between websites and users is euphemism. I feel the same way about user agreements. The south park parody of apple's sums it up, for me.

Not even judges read it. It can't form the basis of a consent model. I think bans on certain types of tracking would be preferable to "consent."

If we are determined to have explicit contracts, we need to be realistic and take incentives into account. If the website controls the UI of the "opt in," language of the contract and such... they have a high level of control over outcomes... and these are highly manipulated to secure convenient outcomes. UI plays a far bigger role in determining the "consent" outcomes than user preferences.

So, if we are determined to go down this route, "consent management" needs to be "open" to 3rd parties chosen by users and allow central management, user selected defaults and 3rd party recommendations/defaults.

If user consent actually reflected informed user preferences, FB's tracking pixel would be disabled for >90% of users. What possible benefit is this to users?

The overlap between people who are paranoid that FB is listening to their conversations via the phone mic and users who have "consented" to advertiser cookies on a bunch of sites tells me that this model for consent is fundamentally broken.

On the flip side if you (or someone) doesn't mind....

I can tell from the downvotes (also on similar comments) that this is an unpopular opinion. Anyone care to defend gdpr "consent" as it exists currently. I don't mean the aspirational language of the law, I mean consent in the wild under gdpr today.

Indeed, this seems to be really lacking as far as I've seen.

Compliance with article 7 section 4 in particular (provision of service must not be conditional on consent for processing of personal data not necessary for provision of that service) is blatantly ignored by many actors, with a message of "accept our tracking or we won't let you see our content". Others pretend to be in compliance by having an opt-out which never completes, or other dark patterns.

Although, in saying that, given the lack of official opt-out functionality, using the site will probably result in tracking.

I wonder: what can we (as a community) do to change this? Can we:

- make applications to the information commissioner about the most egregious breaches - create enough nuisance value that these entities need to acknowledge and address this issue

I'm sure there are enough privacy minded individuals on HN that if we all agreed on a concerted plan of action we could make an impact?

In fairness, that's because it's a legislative over-reach that the EU wants to enforce extra-territorially, but a lot of businesses outside the EU's jurisdiction have declined to undermine their entire business model because a foreign government decided they should.

It is reasonable to say that people should have a choice about things like being tracked, and that such tracking may only be used with the subject's informed consent. This protects the privacy of those who value it by default.

However, IMHO it is not reasonable to say that organisations that fundamentally rely on such data processing to be financially viable must then continue to provide service to users who choose not to participate. That's an entirely one-sided deal, and it's logically unsustainable to require businesses to operate on that basis. You'd never tell a bricks and mortar grocery store that if someone came in but didn't have any money with them then the store still had to let them take a chocolate bar and eat it, and I don't see the effects of the GDPR in this respect as any better than that.

I'm not convinced this is true. Television, billboards, and print newspapers demonstrate that advertising can still exist and support a business model without invading the privacy of users. I'm also not convinced that user-targeted advertising is significantly more effective in practise than contextual advertising.

Maybe if we were faced with some severe and immediate threat to public health and the business were a manufacturer of essential medication, there might be some overriding public interest justification for adopting that sort of position in law, but I think it would need to be a crisis of that sort of level to justify such direct intervention. I don't think the situation we're talking about here is anywhere close to justifying it on similar grounds.

Nor do I see any obvious evidence that forcing the matter through regulatory action will motivate a shift to more desirable funding models for the affected businesses. First some good alternative models would have to be identified, and if we'd done that already, we probably wouldn't be having this conversation at all.

The advertising industry has been subject to regulation for a long time, especially in European countries. There is precedent for regulating the quantity and quality of advertising, banning classes of adverts (e.g. tobacco), and the use of personal data for direct marketing (telemarketing). Ultimately they have the option of providing their services within the bounds of the law, or not providing them at all. I don't see why web advertising should be exceptionally unregulated.

The GDPR does not prohibit advertising, and as a website operator you would be within your rights to block access to adblocker users. Advertising without the use of personal data is demonstrably successful (TV; radio; cinema; magazines; sponsorship). Personal targeting of adverts may improve revenue, but so would allowing tobacco advertising, increasing the length of advert breaks on TV, or numerous other regulated practises.

So far, fines have been pretty reasonable and for clear offenses.