Hacker News Reader

Comment by nehalem | Hacker News Reader

While true in essence, I don’t think that the German society broadly shares the value of privacy to a level that warrants such excessive restrictions. It is important to note that Germany‘s tradition of data protection originates from a fear of government overreach through excessive data collection (the original constitutional court decision concerned the census). In my opinion data protection got out of hand when the same standards were applied to private entities while increasingly neglecting the proportionality test, or — less legalese — a risk benefit analysis. It is common in German jurisprudence to widen the scope of protection (‚everything‘ is personal data) but the proportionality test is strict (it’s okay to transfer personal data because the gains outweigh the risks as the data is only moderately private). I think that softening of the proportionally criterion has been influenced by a general fear that every datapoint might be somehow relevant even if there is little evidence.

(Disclaimer: Legal theory is slightly simplified, but true to principle)

View on HN

I agree that there is a widespread feeling that legal protections are missing reality (wirklichkeitsfremd).

But I'd argue that the roots of Germany's focus on privacy are not only rooted in protection against the state. Yes, constitutional fundamental rights are protections against the state (Abwehrrechte), but the legal interpretation established by the supreme court also draws on an ideal-typical perception of citizens as informed, rational and responsible people (mündige Bürger), who - through education, intelligence, moral values, dedication and pro-social behavior - create and sustain society.

Such self-determined citizens cannot exist in the face of overbearing, and especially invisible or intractable (!) external coercion. That's also the root of informed consent, of course. So in this sense, privacy protections are a safeguard against dumbing down citizens, and I think the general intent is indeed valid.

> perception of citizens as informed, rational and responsible people (mündige Bürger), who - through education, intelligence, moral values, dedication and pro-social behavior - create and sustain society. [...] Such self-determined citizens cannot exist in the face of overbearing, and especially invisible or intractable (!) external coercion.

That's excellent, it's these type of arguments that get too little attention when digital "privacy" gets discussed today.

In support of the ideal of citizens as informed, rational and responsible people (mündige Bürger).

This is a foundational assumption of post-Hobbesian democracy, which asserts that power originates from the people and is delegated to the government (contrast to other political philosophies such as divine right of rule etc).

so the consequence of 'dumbing down citizens' is a destruction of the legitimacy of the government. Just as if the king rules by divine right, he would be silly to promote atheism.

> I don’t think that the German society broadly shares the value of privacy to a level that warrants such excessive restrictions

I live here. Privacy awareness is very high, compared to everywhere else I've personally been. Nobody likes having their picture taken, nobody likes being filmed, nobody likes answering questions for strangers. And they'll tell it to your face too.

Go onto Google street maps for Germany and see how far you get.

To be fair, recent tech has eroded that a lot. People are still not happy about all of it, but the resistance has been dropping - usage of Facebook and Google products is now pretty widespread and people (especially young ones) seem to be far more lenient in that regard.

On the other hand, the proliferation of hacking and fraud could drive a swing to the opposite direction. It's got to the point where being hacked, blackmailed, or being the target of fraud is a regular occurrence, and a lot of that is driven by hackers having easy access to private data which lends plausibility to emails or text messages.

When you get to the point where judges and lawmakers have, more likely than not, personal experience of threatening emails containing private information, there's a lot of incentive to reduce the amount of data collection - and correspondingly, a lot of popular support for the idea.

Unfortunately true. The steady, slow and, in everyday live, invisible erosion of privacy is what might ultimately bring an end to online privacy. Especially once certain politicians see the benefit of outsourcing surveillance to third parties. Despite privacy being generally held up a lot in Europe, there are definitely a lot of people in power all over the place that would love to have access to the kind of data ad-companies have.

That courts are ruling against this, in whatever way, is still a good sign.

I think this is less due to a genuine change of heart and more because the lack of enforcement by the government in regards to big tech has left people without much choice.

You always have a choice. But you can't deny that the services offered by these companies are really good and, not to mention, completely free. It's easy to give up long term drawbacks for short term benefits.

The germans' attitude to privacy is... incoherent, to put it mildly. People get up in arms about the weirdest things, such as the Google Street View you mention. Thousands of people see an apartment building's facade every day, so what does blurring it on Google Maps give the residents, privacy-wise?

And yet, people are amazingly complacent în other aspects ("War halt immer so"). For example, your apartment's doorbell has to have your last name on it: someone with an unusual name could conceivably be tracked down just by postal code. For another example, when I was blogging, I had to display my full name and address in an Impressum on the website - dox myself, so to speak.

And, of course, the Berlin government forces people to register their address, and allows everyone to query it, because why wouldn't they:

https://service.berlin.de/dienstleistung/120732/

I absolutely hate the attitude towards privacy here. The street view example is just perfect: people require google to blur their building facade but the same people have no problem having their full name (incl. partners name), phone number and address on a publicly searchable online phonebook.

People constantly complain about the greedy tech companies collecting data where ever they can and proceed to complain about the strict privacy regulations in the EU in their next sentence. Forcing private individuals to put their full name and address into the imprint of their personal website, which often enough isn’t even run for profit, seems absolutely absurd and very publishing hostile.

To me it’s more and more starting to seem like people don’t actually care about their privacy, they just want to be against something.

> people require google to blur their building facade but the same people have no problem having their full name (incl. partners name), phone number and address on a publicly searchable online phonebook

Wait...so people can decide which facts about their life they want to remain private and which they're fine with you knowing? I thought that was the whole idea of self-determination. Where's the catch?

Please explain, what about my building facade is so incredible private? Sensitive information is blurred anyways and google won’t publish anything that is private, they are just taking pictures of public spaces, which is totally legal.

> Please explain, what about my building facade is so incredible private?

Your building's facade is whatever you decide it to be. It doesn't matter what other people think, it's not up to them. So, likewise, you're not the one to say that someone's building's facade is not private. A major part of respect for other people's privacy is letting them decide what they're private about. I mean, sure, lots of impolite things you may be doing are still legal. Laws don't define courtesy.

How do you know it is the "same people".

In my case it is actually the other way around. I had no problem with street view but would never list my number in the public phone book.

I selectively decide what to attribute to my name as long as I am able to. So that I for example decided that I am OK with the need to have an imprint on my website and my full name and address being tied to what I write there.

I understand that this isn't for everybody, but I decided that I was okay with attaching my name to my writing.

But I am not okay with random businesses being allowed to spam me via online generated profiles without me knowing or consenting.

I know there are a lot of things that still should be massively better in Germany. But knowing how easy it is to comply with the GDPR and relevant other regulations I actually like them.

> For example, your apartment's doorbell has to have your last name on it

Uh...whose last name would you put on that doorbell? Someone else's who doesn't live there?

You appear to presuppose that a name is necessary. In plenty of places it's perfectly fine to have a bell with just a number.

Well, I live in a place where doorbells are attached to people. It's not "necessary" but, just for starters, you might not even get your mail if a signature for something is required.

Maybe it's different in some places but your delivery example seems like it would rarely cause problems as deliveries are usually addressed to addresses with a house name/house number and/or flat number, so they'd ring the corresponding bell for the house/flat number and then ask for the signature connected to the named recipient.

I've never heard of a delivery person say they wouldn't delivery an item because there was no name on the bell or that the bell name wasn't consistent with the recipient, and those guys are experts at excuses for why they can't/won't make a delivery!

> I've never heard of a delivery person say they wouldn't delivery an item because there was no name on the bell or that the bell name wasn't consistent with the recipient

That's exactly what our post will do to you. (And not just because they don't know what doorbell to use if there's no name on it.)

There is no such law that requires you to put your name on your doorbell in Germany. You are free to use Santa Clause or whatever. Perhaps the post man will at some point put dog shit in your letter box but otherwise there is nothing that would compell you to use your name.

It doesn't allow "everyone" to query it. You need to be a german citizen. You also need to provide either "gender and birth date" or the "address" of the person you're looking for, along with their full name.

It also cost 5 to 30 EUR per query/person and takes several weeks.

> Thousands of people see an apartment building's facade every day, so what does blurring it on Google Maps give the residents, privacy-wise?

Same principle as with password hashes were you might prefer a slow hashing function with a work factor.

I don't necessarily agree with the streetview restriction, but also don't really mind not letting Google make pictures.

You actually don't need to put your name on your doorbell, but that at least has very practical advantages for yourself.

Berlin is a failure of government since time immemorial but I am not familiar with this law.

> And, of course, the Berlin government forces people to register their address

Meldepflicht is in all of Germany, it's not a Berlin thing.

> and allows everyone to query it, because why wouldn't they:

This is highly controversial, for exactly the reasons you might think.

However, this is an "Einzelauskunft", so you get one address per query, and you are not allowed to trade in those addresses or use them for advertising. Also, if you want more detailed info, you have to provide a valid reason for wanting them.

>so what does blurring it on Google Maps give the residents, privacy-wise?

ephemerality. If you think your neighbor is violating your privacy you can take it up with them, you think you can take on Google? There is no incoherence here. If you live in a neighborhood, there are of course certain natural limits to your privacy given that you're part of a community.

But digital privacy laws first and foremost protect citizens from entities well beyond their control, they protect them from automated processing, storage of their data beyond their own borders, and privacy erosion in ways they cannot control and at a scale that creates entirely new problems. Of course nobody has absolute privacy, everyone can overhear a conversation, but this does not end with a surveillance state or control society. Corporate entities or governments processing billions of messages in real time does.

> I don’t think that the German society broadly shares the value of privacy to a level that warrants such excessive restrictions.

Even if that is the case, it would still not be an argument against such regulations.

If someone else is okay with the data transfer, he can opt-in if he wants to. I should not carry the burden of having to opt-out of it.

> While true in essence, I don’t think that the German society broadly shares the value of privacy to a level that warrants such excessive restrictions.

You are wrong. I have been living in Germany for almost a decade and it absolutely does. In fact, it is one of the things that I appreciate the most about German culture.

Maybe privacy preferences are a bit incoherent sometimes, but nothing is perfect, and I much prefer that we err on the side of protecting privacy too much than too little. Especially in this brave new world we live in, were culture is being slowly but surly manipulated by powerful interests to erode the right to privacy more and more.

10 year old survey, but it seems the data disagrees with your perception. I'd imagine since then awareness has risen massively, so if anything people would likely be more concerned today.

https://joinup.ec.europa.eu/sites/default/files/document/201...

See page 55 for per country chart.

> I'd imagine since then awareness has risen massively, so if anything people would likely be more concerned today.

It's sadly the opposite; It's so normalized that a whole generation was born into it and don't even see anything wrong about it.

All a lot of them see is how Google is giving them "free services" and how Facebook allows them to make "free friends", and then they declare; That's the web, and that's how the web has always been and how it should be.

And who can blame them; They never knew any other web than the glorified digital mall [0] it has mostly become.

[0] https://staltz.com/the-web-began-dying-in-2014-heres-how.htm...

I understand your argument and I agree that all of this is excessive and maybe spiraling out of control. However the core of the case is "I'm German, that web site is Danish, my personal data have no reason to be in the reach of the US government." By the way, Germany and Denmark share a land border. I think it's difficult to argue that even with the cloud it's not easy to explain why to access a Danish university from Germany one couldn't use an EU only set of technology providers. Of course using Akamai (a well known company) is easier than researching, assessing and using some relatively unknown European solution. I'm European, I'd have to Google (ironically) for one.

The case is about a German public university, owned by and located in the state of Hessia, that uses a Danish service provider to manage cookies on their website, which in turn uses Akamai. That by the way is the reason this whole thing is tried at the administrative court - the defendant is the state itself.

The university is German, their website is therefore "German". They just use a "cookie consent tool" by a Danish company, which in turn processes data using Akamai's infrastructure.

I find it problematic that the university requires any cookie consent whatsoever in the first place. They are a public institution (Körperschaft des öffentlichen Rechts), not even a "company" but state-owned, and they run basically a static website and shouldn't have a need for cookies. Any "member" area (students and faculty) would require an account anyway, where you can and have to ask for all kinds of consent during signup anyway.

I get the Danish company doesn't want to run a CDN (with DDoS mitigations and all that) on their own, and it's a real problem that the EU economy snoozed when it came to creating competitors to Akamai, Cloudflare, AWS/GCP/Azure. There is a sliver of hope that court decisions like this will create a "demand" for such platforms within the EU, and that finally some companies with some "investment" money to spare (we still have plenty "rich" companies) will fund that. Or maybe at least the US providers will find way to create EU "subsidiaries" which are actually legally shielded from US (and other non-EU) law.

> I find it problematic that the university requires any cookie consent whatsoever in the first place.

Totally right, and also

> If someone else is okay with the data transfer, he can opt-in if he wants to. I should not carry the burden of having to opt-out of it.

so much this. If something is spiraling out of hands it is the cookie usage, which is 99% AD tracking.

The current law is badly implemented, or lead to bad implementation. Now almost every site asking your for their necessary or "helping" cookies, most often using dark patterns to trick you into just accepting all - and because you get this stupid cookie prompt on every page now, everybody just wants to click it away as fast as possible, which misses the target totally, too :(

Still, its not data protection spiraling out of hand, but that basically every site, even ones where I don't login to or want to drop off any other data, but just fetch a small information, wants to set cookies is ridiculous. We all should have never accepted that, but too late?

I disagree. Aside from the possiblity of collected data landing in the hands of government fairly easily, this isn't the only reason for privacy protection. I would also dispite that it got out of hand in some cases, although it is often just applied wrongly. It isn't as popular anymore since the normal user is just annoyed by the cookie popups and in his mind data protection instead of the site owner tracking people like there is no tomorrow.

As Google Maps Street View showed back then [0], the public at large cares exactly as much about privacy as the media tells them to care about.

[0] a huge amount of misinformation going on, making people think there would be live cameras showing them on street view. At least to me, it felt like manufactured outrage by people who didn't understand what was going on (neither the instigators, nor the outraged).

edit: It was mainstream enough that there were articles about it: "Webforscher Humer glaubt, die deutsche Skepsis basiere auf falschen Vorstellungen zu Street View. Viele Menschen würden davon ausgehen, dass Google Live-Bilder übertragen wolle" - https://www.onlinekosten.de/news/webexperte-deutsche-versteh...

I remember more from the local press back then. But it's hard to find sources about it now.

> making people think there would be live cameras showing them on street view

that was in no way a mainstream "idea" about it.

Oh yes it was! Did you talk to „normal people“ in Germany back then? It’s not like that was the way it was reported by the media, but that’s what people understood.

Yes, and I never encountered that sentiment from actual people.

I really never understood why Germans don't like to expose the outside of their public facing houses to Street View. It would be very frustrating not to be able to see in advance where I'll be going to the next day and prepare accordingly. Examples: Is that shop really at that address? Is there some parking in front of that house? I've been using Street View like that for ages.

What is more important, your convenience or the resident's right to privacy?

The residents should decide because they are, welll, residents. My partner's parents had their house photographed with the garage door open showing a rock & roll poster with the f-word on the inside of the door. A French guy was photographed while taking a leak in the bushes in front fo his house, that he was trimming. He sued Google and won.

Their right, of course, but I wonder what happened in Germany that didn't happen at that scale in any other part of the world AFAIK.

or "I want to break into the house, which windows are hardest for the neighbors to monitor"

so it kind of depends on what you mean by "I'll be going to the next day and prepare accordingly."

The linked article says people thought Street View was a live feed of their houses. This is pure conjecture coming from a single person, and sounds like a massive straw-man.

I know several people who have blocked their houses on Google and absolutely none of them had this assumption. Anecdotal, I know, but in the article there is zero data backing that assertion.

As I said, can't find more now. But I remember even reading about fears of it being live in the local newspaper in Flensburg.

I was working in online media back then. They loved these crazy ideas and promoted them because of massive outrage. Outrage generates clicks and clicks === €.

And then they wrote pieces about what kinds of idiots didn't want to have their houses filmed. And about people who had their shop front blurred, because people in the 5th floor didn't want the house to be in the clear on street view.

It was outrage porn at it's best.

And one of the things that made me decide that I maybe should do something else with my life.

Yeah, agreed. As a teen I did an internship in journalism, way before becoming a coder, and crazy stories like those were the bread and butter of newsrooms. :(

I disagree with both (longer) replies — but sure appreciate the style of debate.

The reason to allow data transfer to the US for (arguably) trivial data is that a private entity might choose Akamai as their subjectively best option. Restricting data flow for (arguably) no good reason puts restrictions on other who can invoke their own fundamental rights. Leaving aside that it’s also not great to force the technologically inferior solution for (arguably) moot policy reasons.

As to the argument of informed consent, I think that’s another severe misconception. In my opinion, consent is only one option to legalise data processing. The fact that GDPR (and older German legislation) lists legitimate interest is important. We should — in my opinion — not fall for the fallacy that data is a whole different universe that can be split off from everything else. For most of our lives, data just flows with contracts, relationships, torts and whatnot.

I do acknowledge that in the case, the university is Public and does not have (relevant) fundamental rights. Also that web analytics is likely one of the consent only scenarios. But we’re drifting into theory anyway.

>"The reason to allow data transfer to the US for (arguably) trivial data is that a private entity might choose Akamai as their subjectively best option"

And what if it's China/Russia, and its 'best' because it pays for private data? Does the argument still hold?

At the end of the day, this is simple: is it my data, or not? If it's my property, why should someone elae have freedom over it?

Or, for a not-far-fetched example, say the data goes to a country where 1) you have relatives, and 2) homosexuality is a capital offense,

and your search results may be use to implicate you of homosexuality, or by extension your relatives in that country, and the country's police are monitoring search histories.

Actually that is an excellent point, this is a real possibility for immigrants from the middle east and some other places

Your argument hinges on the fact that you consider data privacy rights as "moot", "trivial" etc.. That ignores the fact that many people and the lawmakers disagree. In Germany for instance there is the fundamental right for "informelle Selbstbestimmung", the right to have governance over the information related to ones self.

Now you could certainly argue that this right is irrelevant/not needed, but you didn't bring forth arguments to this extend. Without this your argument is largely about businesses being inconvenienced (many European countries don't give businesses fundamental rights like they do for people)

Also, the reasons these laws exist in the first place is because not too long ago, privacy was massively eroded in the eastern half of europe and intensively used for suppression.

Reply on news.ycombinator.com