Hacker News Reader

The GDPR is broader than you make it look here. It doesn’t only have provisions for ”providing consumers recourse after their data has been collected”, it also provides ”individuals the right to control what data will be collected”.

It even goes further than your request for an opt-out. All data collection must be opt-in, and opt-in requests must be written in such a way that your users can understand them.

Opt-out in combination with not ”providing consumers recourse after their data has been collected” is especially dangerous. Extreme example: application X installs a keylogger, and sends all your keystrokes to evilEmpire.com. Would you consider that to be OK, as long as there is an opt-out button? Would you be OK if evilEmpire.com kept the keystrokes it collected before you opted out?

Would these be applied specifically to data collected not for the primary purpose of the product? If such a regulation applied to all the data collected by a device / service, I'm not sure the classes you propose would be a good basis for a consumer to decide on which products to use. Let's take a product that stores data on the company's servers as part of the core offering.

Under a GDPR-like system where the purposes of data collection were specified as only fulfilling that core offering, you'd get a pretty good guarantee that it wouldn't be used for personalised marketing etc. Yet on my reading of this system, it'd be a class D since this data could potentially be used for targeted marketing.

Admittedly this is the first time I've written this idea down and it needs a bit more work.

But I stand by the general sentiment of empowering users to decide and telling them in plain language the reasons why their data is being collected.

But I stand by the general sentiment of empowering users to decide and telling them in plain language the reasons why their data is being collected.

That's exactly what the GDPR does. You can use the data for other purposes (e.g. marketing) as long as you request for that specific permission in "clear and plain language".

Citing the text:

"The principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used."

I don't mean to say it's a bad idea by any means, just wanted to provide some constructive criticism. I'd say that GDPR's rules around providing purposes for data collection and not bricking services un-necessarily for refusing such are pretty good; and a labelling scheme similar to that you've proposed to highlight what is being collected outside the core requirements of the service might complement it nicely.

How the data is used is at least as important as what data is collected.

I'm fine with a smart speaker securely storing my voice data in the cloud to provide me with personalised speech recognition. I'm not OK with that data being sold to a fraudster who wants to phone my bank and impersonate me. If you classify based on data collection alone, then both these scenarios would result in a "class D" rating.

Yes, It would need to distinguish in each class between technical capacity and reserved legal rights, with stiff penalties for breach of either one. One might use your targeted voice data only to improve your service, but also reserve the right to aggregate it for marketing purposes.

I think an important point that the GDPR gets right is to recognize that you often need to give data to services in order for them to be useful, but you currently have almost no recourse if you stop using it and don't want that data 'out there' any more. Even just the data limited data that services can 'reasonably' need will still paint a very detailed picture of you in aggregate. Forcing companies to allow users to recall consent and actually get their data deleted is the only way to prevent that picture from becoming very detailed over time.

Yes, this, and a second part: GDPR recognizes that data moves between services, and people should have rights about their data that can be enforced on recipients after data is transferred. Currently, agreeing to transfer is a ratchet, where the secondhand party has basically no responsibility to you.

Is there a way to flag yourself as a consumer who always requires personal data deleted when you cancel a service, or is it opt-in on a case by case basis only?

That’s neither opt-in nor opt-out, but stronger. Companies only may have data they need for doing their business. If you cancel a service, accounting and similar laws may dictate a company has to keep your address and payment info for a couple of years, but that’s about it (this actually is covered by the implementation of the “data protection directive”, the precursor to the GDPR, which has been in effect since at least 1-1-1999. See https://en.m.wikipedia.org/wiki/Data_Protection_Directive#Le...)

Student clubs (yes, the GDPR applies to them, too, even if they are 100% volunteer run) that want to keep address info of past members for communicating with alumni, for example, have to make that opt-in.

“necessary for running the business” has some gray areas. For example, an athletics club will want to keep a list of club records, photos of past victories, etc. That’s something that is allowed as “necessary for being a sports club”. I don’t know whether there’s any case history on this)

Essentially the GDPR does this. Barring some explicit opt-in to the contrary, or other laws that take precedence (such as book-keeping).

This would likely have to be paired with a tiered pricing model for said good or service - i.e.

Class A = 100% of retail cost

Class B = 75% of retail cost

Class C = 50% of retail cost

Class D = free

I'm convinced that the vast majority of those outraged by today's data collection practices will conveniently direct their ire to some other cause when faced with the possibility of actually having to pay for the services they've gotten used to having for free.

Is such tiered pricing allowed under the GDPR?

Because that would provide an easy way out of the whole sitation. Just make the price ridiculously high, and all users will choose the free, your-data-belongs-to-us version.

Sadly this is illegal in EU. You have to offer both Free+ClassD and Free+ClassA versions otherwise its forced consent.

I have written more about this here https://news.ycombinator.com/item?id=16351892

Does this essentially force companies to charge for services in the EU then? The only reason FB, Google, etc even offer "free" services is because they make money on the backend utilizing the data they collect. If everyone can say "don't collect my data but also keep my service free", I'm not sure how a business can remain viable in the EU without charging some type of subscription or micro-transaction fee.

Maybe this is how the whole web-based fee structure should have been setup in the first place but it's not the current deal we have in place. How difficult will it be to shift an entire industry (and consumer mindset) to a vastly different fee structure?

They can still show ads, and they can still be relevant to whatever page the user is currently viewing.

Since they do such a terrible job of it anyway I can't imagine it being less profitable.

And then again, maybe actually paying for something like facebook is the right way to go.

Yeah, that's a good point. If the whole advertising landscape forcibly moves away from direct targeting, presumably the same players retain the same position in the marketplace they have now (with the possible exception of ad dollars moving to other media if web is seen as less effective in general without direct targeting).

Why wouldn't advertising still work without pervasive tracking? If targeting ads based just on content works for TV, radio and print media, why wouldn't it work for online advertising?

Well, I think that is the best part. There is no need nor usefulness of greedy parasitic companies.

Why "sadly"?

Would I as a business owner be allowed to kick people off my service for not allowing class D? Because in some cases it really is necessary and why should I host a customer who is only costing money?

Might I suggest an alternative? If the customer is not comfortable with Class D, don't kick them off, require a monthly subscription fee. If they don't like it they will kick themselves off.

The subscription fee should be equivalent to the loss to the business from no longer collecting the data on the user.

It could actually be an eye-opener for many people. Most middle-class tech people would probably happily pay $10+ a month for the service Facebook provides, but if its something like $70 then Facebook is either scarily good at monetizing their information or unreasonably pricing the service.

On the flip side, you shouldn't be allowed to undercharge for the cost of a private membership. Transparency is good, let users be part of the free market for their data and make informed consent.

According to their filings, it's about $26 per user in the US and Canada per year.

I 100% agree with this approach. The problem with GDPR is the following:

- big corporations which do collect the data will lawyer up and still collect data they do

- small companies will do whatever they can do and they will bet that enforcement is going to be sparse

- the enforcement will be non-existent

So nothing will change. The GDPR will not improve privacy, not improve users knowledge who is collecting what, will give false sense of privacy for some users, etc.

I do think a few "heads on pikes" in the media will make enforcement a lot easier afterwards.

Like Volkswagen diesel emission scandal? Where is the enforcement after that? Car companies can still shop around Eu and get their emission standards certified in Malta or some other less fortunate EU country.

I know in the UK at least, big first are taking this very seriously. The potential fines are huge. But it's true that enforcement will be spotty, as the ICO and its equivalents are under-resourced. But you can bet that they will be looking for some big targets pour encourager les autres.

Doesn't your argument apply basically to any law?

The problem with tax law is the following:

- big corporations will lawyer up and still dodge taxes

- small companies will do whatever they can do and they will bet that enforcement is going to be sparse

- the enforcement will be non-existent

I don't know if you meant to do so, but you seem to be arguing governments are incapable of enforcing law against companies.

They're pretty incapable against large multinationals. The sort that hoard profits offshore for years and years, waiting for the tax holiday. CEOs can outlast multiple election cycles to get what they want.

EU fines Google record $2.7 billion in first antitrust case

https://www.reuters.com/article/us-eu-google-antitrust/eu-fi...

Microsoft fined by European Commission over web browser

http://www.bbc.co.uk/news/technology-21684329

Apple ordered to pay €13bn after EU rules Ireland broke state aid laws

https://www.theguardian.com/business/2016/aug/30/apple-pay-b...

EU fines Facebook 110 million euros over WhatsApp deal

https://www.reuters.com/article/us-eu-facebook-antitrust-idU...

$2.7 billion is just the cost of doing business to Google. They had $32 billion in revenue last quarter.

Sure, it ate into the margin however and the share price dropped significantly when the news got out.

Europe is probably having a more functioning government than the US.

2.7 b$ is not simply cost of doing business. 32 b$ revenue doesn't mean 32 b$ profit, once you deduct cost you are left with a lot less. Under GDPR the maximum fine grows to >4 b$ and that will hurt even more.

Lawyer up if the risk is 4% of global revenues, and the opposing party has the means to lawyer up, too? (The opposing party would not be some John Doe, but a national supervisory authority that decided to bring a case)

And ”enforcement will be nonexistent”, from a EU that has a history of taking on big companies on, say, cartel cases (http://ec.europa.eu/competition/cartels/cases/cases.html) or antitrust cases (http://ec.europa.eu/competition/antitrust/cases/)? Would you take that bet, again at percents of your global revenue?

Your proposed classes would lead to everyone just collecting class D, because it's the only one that allows for targeted collection, which is needed even for diagnostics and debugging. In order to improve algorithms, you need to be able to figure out what the user wanted, which means being able to view their session specifically, not in aggregate.

You don't need to view my session to improve my toaster. I currently have a class A television and would love to be able to buy another one in the future. I'm not sure that will be possible, but maybe having a standard label would help.

This exactly. People never believe me whenever I explain that smart refrigerators phone home about use and potentially contents. Then I show then the terms and Eula and almost universally they think it should be illegal.

So make it illegal.

Sure! Where are the politicians who have “enact a GDPR-like law in the USA” on their platform? Hell, where are the politicians who even have multiple words to say about privacy?

Not sure if you're being sarcastic, but the context is bognation's proposal for data collection tiering. Instead of tiering, just adopt a GDPR-like law.

> Hell, where are the politicians who even have multiple words to say about privacy?

In the vein of Manufacturing Consent - the elites in the US are not split on the topic so there is no discussion. Larger companies, especially in SV, run on private data.

As long as users have the right to opt into collection under class d it would be fine. Keep in mind that products were successfully developed for thousands of years without invasive data collection.

to play devil's advocate though, I think product development accelerated greatly thanks to analytics and usage tracking, and lots of mistakes were avoided. This in turn can reduce the price for consumers of those products or features.

Of course, at the expense of privacy, but I'm still wearing my devil's hat here for a moment. And I would go as far as saying people by and large don't care as much about privacy as they do about cost, or getting free stuff (e.g. Facebook).

And a lot of those innovations were just to keep users more immersed while showing them ads. There was little innovation that actually helped end user in the past decade.

It certainly has been abused. But I think it’s throwing the baby with the bath water to some extent.

People won’t be immersed in something that doesn’t bring them value. Some products would make money from users by showing them ads, others would ask those users to pay. Both would want to create immersive experience in my opinion. I would even argue that less immersive experience (getting bored or distracted) leads to ad clicks. Whereas a service that charges wants to keep users truly engaged.

Is “being immersed in the product” a real user need? That sounds like a company goal to me, not something I would want as a user.

When you watch a film, do you want to feel immersed in it? When you play your favorite sports game? I don’t think using a product is necessarily different.

But let’s replace immersed with “enjoy using” or for it to be clear and intuitive. Some product designers and UI experts don’t need usage data, but I think a lot benefit from it to create a better and more enjoyable and clear user experience.

Your point is correct for entertainment apps like video games. Last decade doesn't look like video games golden age though :(

The rest of the apps - the less screen time they get, the better they're. I don't want to be "immersed" in Spotify. I want to find music I want and be done with it.

There's little to help UI design in data. Best way is watching your users (or at least using eye-tracker) and then talking to them. Looking at cold data, you never know why somebody took that long at certain step or kept clicking around. Why did they click wrong button - is it wrong color/positioning, unclear label or they just changed their mind? It's hard to know when users are annoyed or when it's stressful for them either.

Meanwhile data is great if you want to do shoot-in-the-dark A/B testing. Which is good to optimise for "more links clicked". But not so much for relaxed user happily doing his task in quickest way possible.

In most cases product should help user to do what they want quicker and let them go. E.g. if I come to Facebook, I want to get my cat pictures fix and GTFO. Yet it tries to lure me into spending as much time as possible :/

No - I would pay for TV which is class A. Sure the TV manufacturer will need to buy data from company from class D - but they already do that.

On California buildings my isn't display a sign of they contain dangerous chemicals...

All buildings display said warning, because that way they have zero liability.