Comment by dsnr | Hacker News Reader

Comment by dsnr | Hacker News Reader

Parent Full thread

> Given how much of EU innovation is bogged down by regulatory capture, I am extremely skeptical of this (note, I know EU/UK are separated, but nevertheless, lobbying is lobbying, universally)

That‘s probably how the concept of „legitimate interest“ made its way into the GDPR law, make it practically worthless, with the single upside of making people more aware of cross-site tracking.

Another example of half-assed EU law: EU data roaming. Given that EU is all about the free mobility of people, the data roaming „fair use policy“ makes no sense. If we‘re pretending to be in a single market, why don‘t we have a single market for telecommunication services? I can order stuff from amazon.fr and have it delivered, yet I can‘t have a mobile phone contract from say... a Spanish company.

The EU aspires to a single market for telecommunications services but is taking a long time to get there. I found an entire master's thesis on the remaining obstacles: https://www.researchgate.net/publication/278390832_Title_A_s...

> That‘s probably how the concept of „legitimate interest“ made its way into the GDPR law, make it practically worthless

Does it though? Is there case law supporting this?

From what I can see the big problem with the GDPR is a near-total failure to actually enforce it, so such questions barely even matter.

It's mostly the Irish DPC dragging feet, from experience my own local DPC has been excellent and in one case a complaint of mine resulted in a fine. They just can't do anything about companies registered in Ireland.

Which is also where all the major offenders are, because of tax trickery. This is starting to be really annoying.

The solution would be a small amendment of the GDPR that local DPCs can take matters in their own hands if 1-2 years pass without the other DPC doing anything about a violation. (This would still be different from the other DPC finding there to be no violation).

As predicted only few small players were fined and the giants continue as they please. EU can tick the box and claim PR points for "solving" the problem, when in reality you got more points of data breach and people are trained to click boxes without reading.

Reply on news.ycombinator.com