Hacker News Reader

Comment by corty | Hacker News Reader

Main problem with GDPR criticism and press reporting about GDPR is that virtually all of it is based on second-hand knowledge and hearsay. I would really suggest to get the official PDF and read it. It is readable (for a legal text) and immediately clears up lots of common misconceptions like e.g. the collection/use confusion.

Pick your favourite language https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A...

View on HN

I had to study up on GDPR for a past job, and after reading the full thing several times over combined with reading various people's interpretations of it, I came away feeling like it was a generally sane piece of legislation that was overall reasonable about the trade-offs and requirements it imposed.

Since then I've heard many people complaining about the effort required to deal with or work around GDPR constraints, including in one case a data scientist complaining about needing to get consent to use certain data sources for something that wasn't the product being sold to the user. Frankly, I was happy about it, because that's privacy working as expected.

I feel like there's a kinda silly trend towards the idea that regulation should never be burdensome, that something's wrong if compliance efforts are more onerous than annual training and automated enforcement. It comes from a good place - we do need to be cautious of regulatory capture through creating so many burdens that small companies can't afford to comply. But the loudest complaints always seem to be along the lines of "it's unfair that it's harder to do these things GDPR is trying to discourage".

This has been exactly my experience. As a data scientist (not a lawyer!) I had to ensure that some of our existing data processing pipelines complied with GDPR (and make sure we could comply with its reporting requirements.)

I found the Articles well-structured, easily understandable, and overall plainly reasonable. In my experience, those who complained about the 'bureaucratic overhead' of making their pipeline compliant were those who were in charge of processes that clearly violated the spirit of the law, trying to press them into the letter of the law somehow.

As an American expat who has had to implement GDPR policies while working in Europe I know how it works I've read the damn thing. I'm back in the US and the amount of Americans who try to tell me about it, never having read the damn thing, drives me up the wall.

This is because people in the US are used to dealing with legislation that means almost nothing until it gets interpreted by the courts, and no one wants to be that first test case so their lawyers take the worst-case approach. Just like many years of effort have been expended on just one paragraph from Sarbanes Oxley.

Second is that there is an opinion some have (based on some recent cases) that European courts hate American companies and will throw the most extreme penalty at them that they can get away with.

Third, from an end-user's standpoint, who here isn't sick and tired of having to click on the "Accept cookies" link all the time? Personally, if I have issues with specific cookies, I'd rather handle that automatically via client-side techniques.

Personally I prefer this website instead of a PDF: https://gdpr-info.eu

I agree that the text is very readable and pretty sane. A left-hand nav with hyperlinks was really about all it took for me to wrap my head around it.

If you choose the HTML version on EUR-Lex you'll have a sidebar nav.

Turns out if you enable JavaScript, then a nav gets added to the page after load. Thanks for the tip!

The UK's ICO also has a reasonable plain-English guide for anyone interested in collecting or processing data - https://ico.org.uk/for-organisations/guide-to-data-protectio...

Reply on news.ycombinator.com