But I'd argue that the roots of Germany's focus on privacy are not only rooted in protection against the state. Yes, constitutional fundamental rights are protections against the state (Abwehrrechte), but the legal interpretation established by the supreme court also draws on an ideal-typical perception of citizens as informed, rational and responsible people (mündige Bürger), who - through education, intelligence, moral values, dedication and pro-social behavior - create and sustain society.

Such self-determined citizens cannot exist in the face of overbearing, and especially invisible or intractable (!) external coercion. That's also the root of informed consent, of course. So in this sense, privacy protections are a safeguard against dumbing down citizens, and I think the general intent is indeed valid.

That's excellent, it's these type of arguments that get too little attention when digital "privacy" gets discussed today.

This is a foundational assumption of post-Hobbesian democracy, which asserts that power originates from the people and is delegated to the government (contrast to other political philosophies such as divine right of rule etc).

so the consequence of 'dumbing down citizens' is a destruction of the legitimacy of the government. Just as if the king rules by divine right, he would be silly to promote atheism.

I live here. Privacy awareness is very high, compared to everywhere else I've personally been. Nobody likes having their picture taken, nobody likes being filmed, nobody likes answering questions for strangers. And they'll tell it to your face too.

Go onto Google street maps for Germany and see how far you get.

And yet, people are amazingly complacent în other aspects ("War halt immer so"). For example, your apartment's doorbell has to have your last name on it: someone with an unusual name could conceivably be tracked down just by postal code. For another example, when I was blogging, I had to display my full name and address in an Impressum on the website - dox myself, so to speak.

And, of course, the Berlin government forces people to register their address, and allows everyone to query it, because why wouldn't they:

https://service.berlin.de/dienstleistung/120732/

Meldepflicht is in all of Germany, it's not a Berlin thing.

> and allows everyone to query it, because why wouldn't they:

This is highly controversial, for exactly the reasons you might think.

However, this is an "Einzelauskunft", so you get one address per query, and you are not allowed to trade in those addresses or use them for advertising. Also, if you want more detailed info, you have to provide a valid reason for wanting them.

Same principle as with password hashes were you might prefer a slow hashing function with a work factor.

I don't necessarily agree with the streetview restriction, but also don't really mind not letting Google make pictures.

You actually don't need to put your name on your doorbell, but that at least has very practical advantages for yourself.

Berlin is a failure of government since time immemorial but I am not familiar with this law.

ephemerality. If you think your neighbor is violating your privacy you can take it up with them, you think you can take on Google? There is no incoherence here. If you live in a neighborhood, there are of course certain natural limits to your privacy given that you're part of a community.

But digital privacy laws first and foremost protect citizens from entities well beyond their control, they protect them from automated processing, storage of their data beyond their own borders, and privacy erosion in ways they cannot control and at a scale that creates entirely new problems. Of course nobody has absolute privacy, everyone can overhear a conversation, but this does not end with a surveillance state or control society. Corporate entities or governments processing billions of messages in real time does.

Uh...whose last name would you put on that doorbell? Someone else's who doesn't live there?

I've never heard of a delivery person say they wouldn't delivery an item because there was no name on the bell or that the bell name wasn't consistent with the recipient, and those guys are experts at excuses for why they can't/won't make a delivery!

That's exactly what our post will do to you. (And not just because they don't know what doorbell to use if there's no name on it.)

People constantly complain about the greedy tech companies collecting data where ever they can and proceed to complain about the strict privacy regulations in the EU in their next sentence. Forcing private individuals to put their full name and address into the imprint of their personal website, which often enough isn’t even run for profit, seems absolutely absurd and very publishing hostile.

To me it’s more and more starting to seem like people don’t actually care about their privacy, they just want to be against something.

Wait...so people can decide which facts about their life they want to remain private and which they're fine with you knowing? I thought that was the whole idea of self-determination. Where's the catch?

Your building's facade is whatever you decide it to be. It doesn't matter what other people think, it's not up to them. So, likewise, you're not the one to say that someone's building's facade is not private. A major part of respect for other people's privacy is letting them decide what they're private about. I mean, sure, lots of impolite things you may be doing are still legal. Laws don't define courtesy.

In my case it is actually the other way around. I had no problem with street view but would never list my number in the public phone book.

I selectively decide what to attribute to my name as long as I am able to. So that I for example decided that I am OK with the need to have an imprint on my website and my full name and address being tied to what I write there.

I understand that this isn't for everybody, but I decided that I was okay with attaching my name to my writing.

But I am not okay with random businesses being allowed to spam me via online generated profiles without me knowing or consenting.

I know there are a lot of things that still should be massively better in Germany. But knowing how easy it is to comply with the GDPR and relevant other regulations I actually like them.

That courts are ruling against this, in whatever way, is still a good sign.

When you get to the point where judges and lawmakers have, more likely than not, personal experience of threatening emails containing private information, there's a lot of incentive to reduce the amount of data collection - and correspondingly, a lot of popular support for the idea.

Even if that is the case, it would still not be an argument against such regulations.

If someone else is okay with the data transfer, he can opt-in if he wants to. I should not carry the burden of having to opt-out of it.

You are wrong. I have been living in Germany for almost a decade and it absolutely does. In fact, it is one of the things that I appreciate the most about German culture.

Maybe privacy preferences are a bit incoherent sometimes, but nothing is perfect, and I much prefer that we err on the side of protecting privacy too much than too little. Especially in this brave new world we live in, were culture is being slowly but surly manipulated by powerful interests to erode the right to privacy more and more.

https://joinup.ec.europa.eu/sites/default/files/document/201...

See page 55 for per country chart.

It's sadly the opposite; It's so normalized that a whole generation was born into it and don't even see anything wrong about it.

All a lot of them see is how Google is giving them "free services" and how Facebook allows them to make "free friends", and then they declare; That's the web, and that's how the web has always been and how it should be.

And who can blame them; They never knew any other web than the glorified digital mall [0] it has mostly become.

[0] https://staltz.com/the-web-began-dying-in-2014-heres-how.htm...

I find it problematic that the university requires any cookie consent whatsoever in the first place. They are a public institution (Körperschaft des öffentlichen Rechts), not even a "company" but state-owned, and they run basically a static website and shouldn't have a need for cookies. Any "member" area (students and faculty) would require an account anyway, where you can and have to ask for all kinds of consent during signup anyway.

I get the Danish company doesn't want to run a CDN (with DDoS mitigations and all that) on their own, and it's a real problem that the EU economy snoozed when it came to creating competitors to Akamai, Cloudflare, AWS/GCP/Azure. There is a sliver of hope that court decisions like this will create a "demand" for such platforms within the EU, and that finally some companies with some "investment" money to spare (we still have plenty "rich" companies) will fund that. Or maybe at least the US providers will find way to create EU "subsidiaries" which are actually legally shielded from US (and other non-EU) law.

Totally right, and also

> If someone else is okay with the data transfer, he can opt-in if he wants to. I should not carry the burden of having to opt-out of it.

so much this. If something is spiraling out of hands it is the cookie usage, which is 99% AD tracking.

The current law is badly implemented, or lead to bad implementation. Now almost every site asking your for their necessary or "helping" cookies, most often using dark patterns to trick you into just accepting all - and because you get this stupid cookie prompt on every page now, everybody just wants to click it away as fast as possible, which misses the target totally, too :(

Still, its not data protection spiraling out of hand, but that basically every site, even ones where I don't login to or want to drop off any other data, but just fetch a small information, wants to set cookies is ridiculous. We all should have never accepted that, but too late?

[0] a huge amount of misinformation going on, making people think there would be live cameras showing them on street view. At least to me, it felt like manufactured outrage by people who didn't understand what was going on (neither the instigators, nor the outraged).

edit: It was mainstream enough that there were articles about it: "Webforscher Humer glaubt, die deutsche Skepsis basiere auf falschen Vorstellungen zu Street View. Viele Menschen würden davon ausgehen, dass Google Live-Bilder übertragen wolle" - https://www.onlinekosten.de/news/webexperte-deutsche-versteh...

I remember more from the local press back then. But it's hard to find sources about it now.

so it kind of depends on what you mean by "I'll be going to the next day and prepare accordingly."

I know several people who have blocked their houses on Google and absolutely none of them had this assumption. Anecdotal, I know, but in the article there is zero data backing that assertion.

And then they wrote pieces about what kinds of idiots didn't want to have their houses filmed. And about people who had their shop front blurred, because people in the 5th floor didn't want the house to be in the clear on street view.

It was outrage porn at it's best.

And one of the things that made me decide that I maybe should do something else with my life.

that was in no way a mainstream "idea" about it.

The reason to allow data transfer to the US for (arguably) trivial data is that a private entity might choose Akamai as their subjectively best option. Restricting data flow for (arguably) no good reason puts restrictions on other who can invoke their own fundamental rights. Leaving aside that it’s also not great to force the technologically inferior solution for (arguably) moot policy reasons.

As to the argument of informed consent, I think that’s another severe misconception. In my opinion, consent is only one option to legalise data processing. The fact that GDPR (and older German legislation) lists legitimate interest is important. We should — in my opinion — not fall for the fallacy that data is a whole different universe that can be split off from everything else. For most of our lives, data just flows with contracts, relationships, torts and whatnot.

I do acknowledge that in the case, the university is Public and does not have (relevant) fundamental rights. Also that web analytics is likely one of the consent only scenarios. But we’re drifting into theory anyway.

Now you could certainly argue that this right is irrelevant/not needed, but you didn't bring forth arguments to this extend. Without this your argument is largely about businesses being inconvenienced (many European countries don't give businesses fundamental rights like they do for people)

And what if it's China/Russia, and its 'best' because it pays for private data? Does the argument still hold?

At the end of the day, this is simple: is it my data, or not? If it's my property, why should someone elae have freedom over it?

and your search results may be use to implicate you of homosexuality, or by extension your relatives in that country, and the country's police are monitoring search histories.