News for hackers. Stuff that matters.
Re:Statement on 4 Years of GDPR by Ygg2 on Wednesday May 25, 2022 @05:48AM (#31502340)
Honestly, never saw the point of GDPR. You add additional expenses for something big abusers will just bypass, ignore or even worse just retract from the market.
Re:Statement on 4 Years of GDPR by Nextgrid on Wednesday May 25, 2022 @06:08AM (#31502452)
Well the idea is that with proper enforcement the big abusers shouldn't be able to bypass it. The legislation itself is sane, it's just that enforcement is lacking.

> even worse just retract from the market

I disagree that this is worse - if privacy-violating monopolies retract from the market then it opens the doors for privacy-respecting competition to take its place.

Re:Statement on 4 Years of GDPR by Ygg2 on Wednesday May 25, 2022 @06:45AM (#31502652)
> The legislation itself is sane

On paper yes, great intentions[1], in practice no. E.g. Right to be forgotten.

Implement RTBF in context of IPFS.

[1] Second order effects like prevent rats/snakes by awarding award for rat/snake heads, lead to rat/snake farms.

> if privacy-violating monopolies retract from the market

You get Splinternet. Several independent Internets, walled from each other.

Re:Statement on 4 Years of GDPR by Nextgrid on Wednesday May 25, 2022 @07:21AM (#31502937)
I find the right to be forgotten very valuable in a world where everything is permanent, searchable and every little mistake will be used against you in the future.

> Implement RTBF in context of IPFS.

How does IPFS deal with CSAM being published on it? Not saying it should detect CSAM, but once it is found, how does one go about having it removed? You use the same system to handle RTBF, and if you can't, then maybe a platform where it's literally impossible to delete something isn't a good idea (partly because undesirable content will ultimately outnumber legitimate content)?

> You get Splinternet. Several independent Internets, walled from each other.

If there's an internet where Facebook and Google can't spy on me, sign me up!

Re:Statement on 4 Years of GDPR by dleslie on Wednesday May 25, 2022 @11:45AM (#31506181)
> You use the same system to handle RTBF, and if you can't, then maybe a platform where it's literally impossible to delete something isn't a good idea (partly because undesirable content will ultimately outnumber legitimate content)?

The impossibility of the assured annihilation of data is true of all protocols for data retrieval so long as client nodes are free and able to copy the data retrieved.

It's why removal of illegal content from the internet has been an abysmal failure.

Re:Statement on 4 Years of GDPR by Ygg2 on Wednesday May 25, 2022 @09:42AM (#31504387)
> I find the right to be forgotten very valuable in a world

So do people with skeletons in the closet. Not saying you do, but right to be forgotten can infringe on other people's right to be well informed.

This is not a hypothetical. It has already happened.

> How does IPFS deal with CSAM being published on it?

Using CSAM to justify a law, is not a winning strategy.

It would be tedious but probably destroying all nodes. Which means IPFS is not compatible with RTBF.

> If there's an internet where Facebook and Google can't spy on me, sign me up!

That does leave state actors though.

Re:Statement on 4 Years of GDPR by solarkraft on Wednesday May 25, 2022 @07:23AM (#31502954)
IPFS already has to deal with other kinds of forbidden content.

Could you elaborate on the second order effects?

Re:Statement on 4 Years of GDPR by piva00 on Wednesday May 25, 2022 @06:17AM (#31502492)
> even worse just retract from the market

This is like saying that regulating damage to the environment is bad because would make businesses that can't exist without doing said damage would retract from the market. Good riddance, if a business can't or isn't willing to protect EU's citizens data they should go away, like many polluting industries that had to adapt or die.

Re:Statement on 4 Years of GDPR by Ygg2 on Wednesday May 25, 2022 @06:50AM (#31502687)
> This is like saying that regulating damage to the environment is bad because

Sure if a global problem is only taken by a small subset of states. It's not solving a problem just essentially grandstanding. See climate change.

But GDPR and related laws have been a mixed bag and a combination of neat and "why the hell do you think that will work?".

Re:Statement on 4 Years of GDPR by maccard on Wednesday May 25, 2022 @06:24AM (#31502525)
Can you give any examples of abusers that have retracted from the market that actually provided a useful product?
Re:Statement on 4 Years of GDPR by PartiallyTyped on Wednesday May 25, 2022 @06:11AM (#31502474)
GDPR prevents companies like "safe"graph [1] from selling mined data:

>The GDPR (European Law)

> As of May 25, 2018, a new data privacy law known as the EU General Data Protection Regulation (or the "GDPR") went into effect through the EEA countries. SafeGraph does not offer products or services involving the collection or sale of “personal data” in EEA countries. We likewise seek not to collect such personal data from our data providers. Should any of the foregoing change, we will update this section of our Privacy Policy.

If this is not a net win, I don't know what is.

[1] https://www.safegraph.com/privacy-policy

Re:Statement on 4 Years of GDPR by kreeben on Wednesday May 25, 2022 @06:05AM (#31502439)
The point of GDPR is to smack companies that fail to meet it hard on the nose, so hard, in fact, that it might break. The maximum penalty is 2% of yearly turnover. That's hurtful even to megacorps. No one, not even them, needs a broken nose.
Re:Statement on 4 Years of GDPR by retSava on Wednesday May 25, 2022 @06:12AM (#31502475)
In theory yes, but so far they haven't brought the hammer onto anyone of formidable size.
Re:Statement on 4 Years of GDPR by mhitza on Wednesday May 25, 2022 @07:16AM (#31502886)

    Amazon Europe Core S.à.r.l. Industry and Commerce LUXEMBOURG 746,000,000 euro Non-compliance with general data processing principles 16 Jul 2021

    WhatsApp Ireland Ltd. Media, Telecoms and Broadcasting IRELAND 225,000,000 euro Insufficient fulfilment of information obligations 02 Sep 2021
https://www.enforcementtracker.com/?insights
Re:Statement on 4 Years of GDPR by retSava on Tuesday May 31, 2022 @03:55AM (#31567078)

     In 2021, Amazon EU S.à r.l. had a revenue of over 51 billion euros
Can't find numbers on profit, but companies such as amz are experts on creativity, as indicated by eg this quote:

    Amazon paid zero corporation tax in Luxembourg last year, despite seeing a record sales income of €44 billion.

    As first reported by The Guardian, accounts for Amazon EU Sarl published online showed that despite making billions of dollars in sales, the company's Luxembourg unit, which oversees retail in countries across Europe, made a €1.2 billion loss and therefore paid zero tax.

    Not only did the company not have to pay corporate tax, but it was also handed €56 million in tax credits to offset future tax bills in the event that it does turn a profit. That also comes on top of €2.7 billion in losses that have been carried forward and can be used to offset future tax bills.
Ie, not a sledge hammer.
Re:Statement on 4 Years of GDPR by Nextgrid on Wednesday May 25, 2022 @07:39AM (#31503099)
This link gets posted all the time but if you compare the total amount fined across all companies and all countries it's laughable compared to the profits a single big offender (see Google, Facebook, etc) makes in just a year.
Re:Statement on 4 Years of GDPR by betaby on Wednesday May 25, 2022 @08:38AM (#31503671)
Are those fines given or fines collected? I remember reading that fines collected are really tiny portion of those given.
Re:Statement on 4 Years of GDPR by mhitza on Wednesday May 25, 2022 @02:11PM (#31508321)
Fines given. Wasn't even aware there were mechanics for third-parties to track fines collected (aside from say yearly reported aggregates).
Re:Statement on 4 Years of GDPR by arky527 on Wednesday May 25, 2022 @06:08AM (#31502454)
GDPR also opened the door for the eprivacy directive that brought us cookie law
Re:Statement on 4 Years of GDPR by diffeomorphism on Wednesday May 25, 2022 @06:47AM (#31502663)
Different order. That is also why the gdpr addresses some of the abuse of the cookie law.
Re:Statement on 4 Years of GDPR by Nextgrid on Wednesday May 25, 2022 @06:09AM (#31502464)
ePrivacy was there way before the GDPR.
Re:Statement on 4 Years of GDPR by varispeed on Wednesday May 25, 2022 @06:01AM (#31502412)
The purpose of GDPR is to help abusers legitimise the data they collect. Before GDPR it was a grey area, because users didn't explicitly consent to anything - GDPR fixes that. Ubiquitous pop ups where you agree for your data to be collected and processed, trained users to consent to anything that comes their way and corporations now have legal basis to use, process and sell that data.

It was quite clever - make people believe the legislation is for their benefit, whereas in reality it has been created to help with data abuse and make money off of it.

Re:Statement on 4 Years of GDPR by withinboredom on Wednesday May 25, 2022 @06:08AM (#31502453)
> trained users to consent to anything that comes their way and corporations now have legal basis to use, process and sell that data.

Sorta? I don't consent to much when I get the pop-up. You can revoke consent at any time as well and you're entitled to the data the company has on you.

Re:Statement on 4 Years of GDPR by varispeed on Wednesday May 25, 2022 @08:56AM (#31503858)
Average person don't understand what they click on and they just want the pop up the get out of their way.

You have a bias for being a tech person who understand this, but vast majority of people have no idea what it is about and they just consent because they don't care or know the impact of their decision.

Re:Statement on 4 Years of GDPR by withinboredom on Wednesday May 25, 2022 @09:30AM (#31504271)
Most people I know are not tech savvy and from shoulder surfing, they click no to consent. One couple I know won’t even install an app if it asks for their location.
Re:Statement on 4 Years of GDPR by SiempreViernes on Wednesday May 25, 2022 @10:28AM (#31505034)
> vast majority of people have no idea what it is about and they just consent

Do you have a link to the study that shows this?

Re:Statement on 4 Years of GDPR by Nextgrid on Wednesday May 25, 2022 @06:09AM (#31502460)
The GDPR has strict regulations on what counts as valid data processing consent. 90% of the consent popups you see out there do not fit that criteria and any "consent" obtained via them doesn't count.
Re:Statement on 4 Years of GDPR by MattPalmer1086 on Wednesday May 25, 2022 @06:07AM (#31502445)
That's an unduly cynical take in my opinion. GDPR isn't about web sites and cookie preferences, although that is the most visible effect to users.

I'd happily replace that whole cookie mess.