I can guarantee you, from conversations I have had with senior executives at these companies, that they fully believe they’ve got the regulators in their back pockets. Until we throw people like Nick Clegg in prison for their revolving door betrayal of their citizens, you’ll have some suspiciously incompetent and sympathetic politicians handling these issues. The whole Federal Reserve stock trading scandal should show you that these “public servants” will bend their morals for depressingly small amounts of money.

Should we be more surprised that they’re selling us out, or more angry that it’s for so little?

It costs about £150k to become an unelected member of the UK permanent legislature, and bribe your way into an office of state: https://www.dailyrecord.co.uk/news/politics/arise-lord-offor...

Those are the donations that were declared, to maintain a pretense of propriety. What sits in Panama, you'll probably never know. 150k is too low a price for that seat, particularly since the cash-for-peerages practice is now so old that the competition must be significant. Either there is more undeclared or this guy knows where the bodies are buried.

A certain amount of regulation runs the risk of leaving us in a situation where a competitive moat is established between companies large enough to handle the regulatory burden and everyone else for whom it represents an unsurpassable barrier between them and the EU market. It wouldn’t surprise me at all to find that large tech companies are encouraging “just so” regulation of this sort.

[I do not speak for my employer.]

I think they've realized that privacy centrism creates an industry in which the EU can compete well, independently from the US and China. Or at least I hope so.

Here's the issue. Google can use private data in the US to design a model such as say a personal voice assistant. It then deploys this model in the EU and then uses no EU private data either for training or running it live. Google can then use non-private data to adjust the model to the EU market.

A company in the EU has to design the whole model with no private data which means they will have more difficulty competing with Google rather than less.

That would only work for the percentage of the European population who uses English as their primary language. It'd be damned near useless.

I already noted that and plenty of languages are spoken outside the EU aside from just English.

>Google can then use non-private data to adjust the model to the EU market.

Google can do everything a EU-only company can do. They can also do things a EU-only company cannot do. The reverse is not true. So at worst they'll be roughly as good and at best much better.

And why is the company EU-only? What X-only company is trying to compete with Google anyways?

No they won't.

There are regional differences between the same language that can be pretty severe, all the way down to the pronoun level.

So, no they can't.

I don't think you understand the point. Google can get all the same data as an EU company. They literally can do the same job an an EU company by simply not leveraging US data. The fact they have US data doesn't mean they are forbidden of getting EU compliant data like any other company.

They can also get US data that doesn't follow EU privacy requirements. So Google has two source of data they can combine into a better product.

The same goes for the US. but there are always regional differences, the bigger point is that people are not just a simple lookup table, they can adapt to a personal assistant that only understands an imperfect understanding by changing they way they speak to the device. People will do this without even being conscious of it.

Nope.

In the US the dialects are very similar and usually separated mostly by accent.

When dealing with different countries, entire groups of words do not mean the same thing because either (a) the language has changed, or (b) those things literally did not exist at the time the split occurred. Training an AI on Parisian French will result in an utterly broken experience for Haitian French and Cajun French.

My point is, that if you trained an AI on Parisian French, people in Quebec would be annoyed but could adapt to the differences if they wanted to use the system. People in southern Germany may be annoyed they have to speak high German, but they know it. There are very few people, if any, who only understand Cajun French and the issue.

Also, the biggest difference would be the pronunciation differences vs words being different. The word differences are easily modeled after any ASR, if the developer understands the differences and plans for it in their NLU models.

Poverty wages, child labor, ignoring emissions regulations, evading taxes, etc are all ways a company could improve margins and charge lower prices. That doesn't mean you want to legalize all of that just to compete in the global market.

It's ultimately going to be a race to the bottom if you allow companies who engage in those practices all over the world into your market on even terms. That's honestly what tariffs are for. Tax your citizens for engaging in commerce with companies that gain efficiencies through operating in ways that disagree with local values.

Couldn’t you use the same line of argument for tariffs on a vast number of imports? (Electronics, software, services, etc.)

It could even extend to most consumer product. e.g. Some obscure chemical compound for plastics is much more costly to produce in an environmentally friendly way, therefore it’s nearly all produced in the least regulated jurisdictions, therefore the compound and all derivative products have to be tariffed from those jurisdictions?

Why do you put words in my mouth that we should legalize something when I said nothing of the kind? If this is how you react when someone points out flaws with a legislative approach then good luck ever getting one that isn't flawed.

It just pours cement on industry~wide invention and replaces it with bureaucratic innovation.

Alternately, it may counter incentives towards digital monopolies.

I’m not convinced that large amounts of personal data is required for search to work well, at the very least I’m not convinced the personal data must leave an individuals control.

We don’t see a lot of innovation in this direction as hyper personalized search seems to work reasonably well and the startup costs to compete are massive.

I’d love it if Duck Duck Go would let me assign priority to websites. Prefer Wikipedia, GitHub, StackOverflow over spammy copy cats. Maybe the ability to flag results as spammy copy cats would also be nice.

I'd love it if DDG didn't pointlessly ignore operands.

> may counter incentives towards digital monopolies.

Doesn't the cost of compliance inherently favor larger companies with better lawyers and deep experience in passing audits?

Which invention/innovation couldn't have come out with better privacy laws? I guess Palantir? Do you have another example? Theranos?

Theranos is largely agnostic to privacy laws; it came about due to shoddy medical regulation (specifically, while medicines and medical devices deployed to hospitals and homes are heavily regulated in the US, medical labs are not).

Also, arguably, shoddy financial regulation. In many countries, large private companies have to submit audited accounts to the regulators, and that would likely have raised alarms about the other problems with the business earlier.

Theranos happened because the founders chose to lie. Plenty of laws were violated there. Medical regulation is not to blame. Investor hubris is.

Oh, sure! But the primary purpose of regulatory enforcement is to catch people lying, and Holmes was pretty effective at exploiting the weak points in the regulatory regime to avoid that detection.

What? Holmes (allegedly) misled people that were willing accomplices in being misled. There wasn't a regulatory failure, just investors that did not do their homework.

So beyond the investors, Theranos injured quite a lot of real people. They were actually doing blood tests, which largely did not work. With different regulation, some of this might have been averted (in particular, if the FDA was responsible for diagnostic labs, that might have helped).

Frankly, dodgy companies screw over the people unwise enough to invest in them every day. Theranos was unusual in that it also directly screwed over members of the public.

> while medicines and medical devices deployed to hospitals and homes are heavily regulated in the US, medical labs are not

Relatively speaking, this is as it should be. There are ways to cope with arbitrarily-convincingly fake lab reports (most generically, do multiple tests and compare them), whereas there's not a procedural fix for your X-ray machines occasionally going THERAC. Those measures generally aren't actually in place, but they should be anyway to cope with eg human error.

But the regulations actually in place on both patient-proximate and lab-based equipment are insufficiently stringent. (Annoyingly, they're also gratuitously burdensome.)

Medical labs are heavily regulated. Theranos mislead inspectors by not showing them their entire lab.

Well, depends on how you define ‘heavily’. Theranos did hide a lab, but even beyond that they were depending on rules that allowed novel tests with very minimal oversight, provided they were done in a lab rather than in the field.

(Also, the regulator was presumably aware that Theranos made proprietary medical devices; it said so on their website. So, when they were shown a lab full of Siemens stuff, they should probably have asked about that. The problem here was really hiding in plain sight, and a competent, sufficiently empowered regulator would have caught it)

It's not about what you can and can't do, it's the friction and cost associated with achieving compliance. I'm not against privacy protections, but having released digital products in Europe I can say that the cost of achieving GDPR compliance could very well make the difference between whether some companies can succeed or not.

I wonder if these kinds of discussions can be easier to have if concerns and critiques brought up were framed, from the start with an understanding that the cost to achieve and maintain compliance with the standard is a cost that gets paid either in money or work-hours (like for example SOC2 or PCI), that it can very tangibly halt non-compliance workloads and rollouts; instead of starting from a footing of assuming complaints are the cloaked dressing for being against user privacy.

Understanding full well each standard solves different problems, for some of us in tech achieving compliance is a non-trivial amount of critical work and maintaining it similarly isn’t always something you easily drop everything and make happen in a day or two.

I think that’s 100% relevant and shouldn’t be immediately responded to as others have by assuming the relevance comes from a position of opposing the regulation or standing against user privacy

> instead of starting from a footing of assuming complaints are the cloaked dressing for being against user privacy.

The problem with this is twofold:

a: 'Most' (by loudness or other perception) of the complaints are known to be bad faith because they're coming from malicious actors like Facebook or Google which we know are against user privacy (since that's their business model).

b: You have to go out of your way to build a site that interferes with actual user privacy, for example by actively adding Google Analytics scripts or faux-CAPTCHAs, or actively demanding a real name and actively doing something about it if the user lies to you. (Technically you get IP addresses by default, but much like mailing addresses, obscuring these pretty much has to be the user's responsibility, since how else would you respond to them.)

So if you want a assumption of good faith, you need to be clear that you're complaining about the bureaucratic compliance overhead (eg having a particular data processing officer or whatever GDPR calls it), rather than about having to change your object-level service to eliminate spyware that you went out of your way to incorporate in the first place.

>> the cost of achieving GDPR compliance could very well make the difference between whether some companies can succeed or not.

Is this a bad thing? If we take privacy seriously then it shouldn’t be. We don’t see too many people fighting food or drug regulations intended to keep us safe because it might be costly for companies to comply. Maybe if a company cannot afford to comply with privacy regulation they should not be handling our personal information. I guess the reason it seems heavy handed in the tech/web world is that the barrier to entry started at next to zero and so much of what we put on the web is not monetised that any cost/compliance seems like a massive burden.

It is a trade-off which is not always acknowledged. It is not something that has 0 potentially negative consequences. And the competition and innovation that is stifled is often invisible (hard to see what could have been).

If you had less intervention with respect to privacy would there be more dynamic market-driven initiatives to fill the gaps? Would there be more incentive to develop technology that would be effective for privacy? I don't know.

Regulation is just hard because reality is complex and dynamic and regulation is often complex but not very dynamic.

> If you had less intervention with respect to privacy would there be more dynamic market-driven initiatives to fill the gaps?

This is hilarious. Because we had that, and it was lacking, to put it mildly. And some people still have that, in a way that's easy to compare (e.g. EU vs US, CA vs other states). For me, the results are in and obvious. Privacy regulations are the only thing that reflects the privacy externalities they might impose on society back onto them (and the shareholders).

I don't think it's necessarily a bad thing. Like you say, some regulations are needed, and we wouldn't want to allow unsafe cars on the road just because crash-tests are a barrier to entry for startups.

However it does serve as a moat for players with more capital, and that's something we should also be mindful of. For instance, maybe we could have some of the requirements scale and only kick in when a product meets certain thresholds in terms of numbers of users.

I shrunk down the interactive (with server-side or external functionality, like third-party comment-boxes) features my sites a lot because of being worried about GDPR, basically killing a small community and having a direct negative effect on users. The overhead/worry is real, even if as a consumer I'm a big fan of it. The toolchain/conventions may eventually catch up so that things are GDPR-compliant by default, but the downsides are still very palpable.

[ And even with all of those cutbacks, I'm still not really compliant on all my sites... (legacy software/not knowing what exactly my data server is logging/etc.) ]

But, as a direct answer to your question: I don't think many things in principle are impossible with the current privacy laws. But that doesn't mean it's not having a chilling effect.

Although I understand your worry about not being compliant, from my understanding it’s unwarranted. The intent of any enforcement action is not punitive but to enforce compliance. In other words small companies will be told “please comply” and given a chance to comply. It’s only if they refuse that action such as fines is taken. Maybe this has changed but at least when I was studying this a few years ago this seemed to be the case.

Take it far enough and it will force new innovations in the fields of p2p and distributed networks, homomorphic encryption, etc.

It’s still profitable enough with data silos that this is not happening yet

because that strategy has worked well so far?

If you wanted to ensure that only companies with the resources of FAAMG could operate in your jurisdiction, you could hardly do better than the EU has done.

The thing I noticed most is that in Denmark, Danish sites follow both the letter and thespirit of GDPR. I was looking at trying to pay my electricity bill the other night and got told that because my version of FF sent the Do Not Track header, they'd automatically "objected" to all cookies and branding beyond necessary ones and I didn't need to do anything else. Those big banners have a simple "yes to only necessary" or "yes to all" button at the bottom.

American sites on the other hand tell me either "tough, take our spyware if you want to see this site, or to to a restricted list of five pages" (which I'm pretty sure isn't legal under GDPR); throw up the gauntlet of 1000 tick-boxes, infinitely nested, or say "you're from the EU and we can't serve you page".

The problem is cultural. I've de-googled myself as much as possible, but I don't like the fact that all of my real mobile device choices are written in California and made in china.

Almost every site has the "Yes to necessary" or "yes to all" now, it's not in the banner but generally IME if I click the "select" option it automatically has all the "optional" cookies turned off. Just two clicks instead of one. I think since the majority of people are too lazy for two clicks they see "select which ones", say whatever and just accept all so hiding the fact you don't actually have to select works in the site's favor.

Samsung is neither Chinese nor Californian. Their phones are designed in south korea and manufactured in South korea, indonesia and brazil.

The GP’s point was that Android/G-Suite/Firmware, the software on Samsung phones, is substantially “written in California”. That seems true enough in spirit.

I think you are spot on, but maybe for a different reason. The EU has looked at the practices of large tech companies in the USA and decided that the way that these companies are collecting personal information and selling it for profit is something that should be progressively phased out. So not being able to create a company that harvests personal data seems like a win for the GDPR. The next step would be to reign in the large companies that have been able to use their resources to continue the practices that the GDPR has set out to limit.

As a side point, I work in a tech startup in the EU that was founded post GDPR. We have no issues being competitive and also complying with the GDPR, however we do not make our revenue by selling personal data.

I still see plenty of small companies operating online in the country I live in. GDPR isn't particularly hard or expensive to follow if you are small and barely have any data, especially if you build your system to be GDPR compliant from the start. The expensive part comes when you are already large and have to make that large system GDPR compliant after it is already built.

For larger companies i can tell you that the red tape and additional overhead from GDPR is horribly expensive to implement.

Not to mention the reduced happiness from working with GDPR.

If Google could help remove GDPR and the Cookie law i would welcome it.

I am really happy that EU forces you to properly track what and where you store data about users. Sloppily just storing data everywhere and not properly deleting it is a huge security/privacy hazard, making such reckless behaviour illegal is a great thing.

>For larger companies i can tell you that the red tape and additional overhead from GDPR is horribly expensive to implement.

My company had about a week of design of our data handling infographic and policy page and that was it for GDPR. The transition was incredibly simple, as we just didn't keep such data in the first place.

Because we did collect voluntarily submitted items from users which might contain such protected data, we simply explained our retention process to users and documented in full the data's life-cycle once it hit our servers. I think we had to add a few extra S3 regions for uploads also, but that was just a few clicks.

GDPR is anything but a headache unless you're trying to do the things the GDPR doesn't want you to be doing; then yeah, it's probably quite a headache.

>Not to mention the reduced happiness from working with GDPR.

I'm of the opinion it should be even more onerous to deal with people's data than it currently is. GPDR doesn't go far enough.

As a consumer, all I got for GDPR is a lipservice in the form of cookie banners and annoyance everywhere on the web.

You got the ability to demand to see your data from every company and get it deleted, you didn't have that before. They could just keep whatever data they want and there is nothing you could do to discover or stop them from doing that.

If you care about privacy at all you should be very happy that is possible today. It is how we got all those articles showing what data Google and all other companies collects about you, since they asked about this referring to this EU law and the companies has to comply. So even if you don't use it yourself it greatly helps you anyway.

I can see this useful for sites that collect a lot of data (Banks, Social Media, etc.) but for buying shoes from a shopify website, I really don't give a shit. If anything, GDPR has been a nuissance to me as a consumer. Being 100% honest. Cookier banners are so ubiquitious that we've all gotten used to just accepting them and moving on.

This is the problem with EU regulation. Good intentions, bad implementations and unforeseen consequences. In fact this goes so far into the reasons why EU cannot harbor a growing startup scene or make rockets. I am not against regulations but if you lay a landmind in front of every endeavor in the form of regulations, it bears down on people that want to disrupt existing and overweight companies that can afford to abide by regulations. I've talked to many Europeans and they resonate with the same sentiments.

I own a small business and I've gone through the process GDPR compliance. It is not too bad but there is a reason why there are upteen number of GDPR compliance consulting firms and checklist makers out there.

What should have happened is a complete solution to privacy in the browser instead of playing cat and mouse games with businesses that will find loop holes.

> Cookier banners are so ubiquitious that we've all gotten used to just accepting them and moving on.

Cookie banners has nothing to do with GDPR.

> I own a small business and I've gone through the process GDPR compliance. It is not too bad but there is a reason why there are upteen number of GDPR compliance consulting firms and checklist makers out there.

The reason is that GDPR compliance gets more expensive the more technical debt you have. For big enough companies with bad engineering practices it can costs hundreds of millions of dollars. For a small business with a straightforward product they likely are all but compliant without even trying.

> What should have happened is a complete solution to privacy in the browser instead of playing cat and mouse games with businesses that will find loop holes.

GDPR has nothing to do with browsers, it has to do with forcing companies to ask for and track data they keep on you no matter where it comes from. It applies to apps, to hiring interviews, to storing transaction data when you buy groceries etc. What you are talking about is a completely different issue.

I am sorry Jensson, but everything you said is wrong and misleading.

> The proliferation of such alerts was largely triggered by two different regulations in Europe: the General Data Protection Regulation (GDPR), a sweeping data privacy law enacted in the European Union in May 2018; and the ePrivacy Directive, which was first passed in 2002 and then updated in 2009. They, and the cookie alerts that resulted, have plenty of good intentions. But they’re ineffectual.

https://www.vox.com/recode/2019/12/10/18656519/what-are-cook...

You are talking about the ePrivacy Directive, not GDPR. Cookie banners has been a thing for well over a decade.

What you probably meant is the user data banners/popups you have to click on that are new since GDPR. They are not cookie banners, they are a different thing, calling them cookie banners gives people the wrong impression.

The fact that you mix these two makes it look like you don't understand what you are talking about here. Especially since you talk as if this was the only thing GDPR changed. The cookie law is stupid, but GDPR is not.

>You got the ability to demand to see your data from every company and get it deleted, you didn't have that before.

This matters to the nerds on HN and Reddit,some clout chasers on Twitter, and no one else.

You couldn't be more wrong, so many people are afraid of stuff like their old Tinder profile leaking etc. So having a law that forces companies to delete your profile rather than keeping it around forever is really important to people. You can see leaks from another site like that embarrassing a lot of people who thought that they had deleted all data related to them, they certainly would have wanted GDPR back then.

People don't care about most data, you are right about that, but they care a ton about some data.

GDPR is just about that, make you own your own data rather than companies owning it. Companies has to ask for it rather than just taking it, and you can revoke that right at any moment and the company has to comply.

Exactly, cookie banners are an annoyance where the user ends up clicking Accept All just to make the banner go away.

I've heard this a lot on HN, any data to back it up?

For whom?