I get the outrage at being tracked by third parties across the web, but that’s different from making it illegal for any website to track any of your activity on their site.
I get the outrage at being tracked by third parties across the web, but that’s different from making it illegal for any website to track any of your activity on their site.
The days of the Internet being the Wild West are coming to a close, and not a moment too soon.
Side note: it’s disturbing it took Mixpanel nine months to notice they were ingesting sensitive data. Turn on All The Ad Blocking.
If we have to break the web, we break the web. Digital rights supercede tech profits.
I still don't understand how they plan to enforce this law worldwide, though. The EU is powerful, sure, but if I was China I might just tell them to piss off when they come knocking.
It's not really Chinese companies doing the tracking, it's American ones.
The EU is simply too big a market for them to ignore.
(The trick depends in part on companies wanting access to EU more than EU wanting a particular company to sell to its people.)
Why you do need consent for is to gather unneeded personal data or to send personl data to 3rd party providers for processing that is not essential to your service.
You are not allowed to deny people access to your site based on lack of this kind of consent.
If you collect and process PIIs of EU citizens, the EU will do whatever it goddamn likes with you, which currently means some pretty high fines.
Here's roughly what you must comply by, if you're not blocking the whole of the EU.
https://ico.org.uk/for-organisations/guide-to-the-general-da...
> Avoid making consent to processing a precondition of a service.
Does it mean I have to ensure my users can use the service even if I'm not allowed to "process" their data? I assume this must mean "processing" data for reasons not directly connected to the actual service. (E.g. using the data to gather business intelligence or sell it to third parties)
You're wrong.
You see, the "Cookie Law" was a test. Can a gentle legal nudge make the web self-regulate into respecting its users? It turned out that no, it can't. Remember, you only have to show a cookie warning if you're doing something inherently user-hostile. That almost every site has one only shows how little anyone cares. Well, the gloves are off, GDPR is the next iteration, designed to make people care. If you're doing something shady, GDPR will make you explain, in points, how exactly are you going to fuck the user over, and make you request explicit consent for each single fuckery you want to do - and does not let you make the service conditional on the user bending over. The user is supposed to be able to tell "no" to everything and still use the service.
Whatever pains this creates for businesses on-line, frankly, it's deserved.
I don't see how the informed consent bit wont become the same mindless box-ticking exercise web users already undertake?
You can "use" the service, but it'll be positioned that it's not an option but to accept.
I feel this time around, such a construct will open the company to legal liability, and there's plenty of people (myself included) who will gladly report shady practices like that. EU seems really into making consent actually meaningful, so why I can't be sure, I'm convinced the "mindless box-ticking exercise" scenario won't play out.
IANAL, but I also think a lot of companies will be well argued on using "Legitimate interests" as a basis for processing instead for a lot of things.
Then others will argue on "Consent should not be a precondition of signing up to a service unless necessary for that service." and use "processing is necessary for the performance of a contract" as the basis (especially if there's money involved).
Obviously, the large companies will be able to handle this better and employ decent legal teams to argue for using those basis' - not because they're "good actors", just they've got the cash and knowledge to argue better. It's the smaller business owners (who as with VAT MOSS) are going to be screwed over the most.
I sincerely hope the fines will put a couple of companies out of business as a warning to the remainder.
But other small and medium websites all over the world that don’t have EU operations will mostly just ignore this, as they should. It’s going to be nearly impossible to enforce for those companies, it’s a violation of national sovereignty, and half the regulations don’t even make much sense. How exactly are you supposed to avoid storing the personal information of EU residents when personal information includes IP address and that EU resident can be anywhere in the world? Or you have to delete the info if asked, but other laws require you to keep it? Now every medical facility in the world has to have entire new compliance procedure just in case an EU resident stumbles through their door?
Yeah, color me skeptical. You can pass any law you want, but it’s only as good as your ability to enforce it. If you think the US is going to help the EU collect multiple-million-dollar fines from some small business in Oklahoma, well, you’re going to be very disappointed.
We’ll see, but I doubt that in a couple years things will have changed all that much.
Maybe, but the GDPR also has much higher fines when it comes to a data breach. So there's quite an incentive for companies to care a little more about user privacy.