The plight of those who do not live under strict privacy laws | Hacker News Reader

The plight of those who do not live under strict privacy laws

blobfox.coffee

15 pointsRyanCaoDev6 comments

Not constantly having to see cookie banners?

Those cookie banners are a choice: websites can choose to simply not spy on you with cookies and thus not need to ask permission for spying.

And users can install plugins to always deny as much of them as possible, or delete them after closing the tab.

In my opinion, cookie banners mean that you have an active choice of whether or not you want any data to be stored in your browser and whether you want to be statefully tracked or just retain basic functionality.

Everyone has a different threat model; but it should be up to us to decide what we want rather than not having the choice.

The reality is from about 5 or 6 GDPR data requests I haven't received actual data once. However it's surprisingly effective to get big companies to do things they usually wouldn't. Like getting out of a phone contract way easier. Or have money collectors from different countries give up on you (long story, but it was just a bus ticket I didn't have).

Facebook did ignore my request and months later sent me a email to download data where I would have to login to my already deactivated account...

Yeah, a lot of companies still aren't willing to fully comply with these laws... but having them does make it a lot better.

I've had a few companies ask me for a government issued ID for proof of residence within the EEA or in California; that's just horrible behavior from every perspective.

A GDPR request can be quite a challenge for any company that doesn't have fully automated processes in place.

I guess it's often not malice, but rather "we have no clue in which SaaS we might have your personal data, don't want to drop everything for a week in order to figure it out and simply hope that you won't sue us if we don't reply".

So if you want to screw over an early stage startup:

1. Buy their product, use everything on their website where you can leave your personal data (newsletter, chatboxes, send an email,...). Document the requests that are made. 2. Request your data according to GDPR. Preferably by mail. 3. Take a lawyer and sue them if you find any inconsistencies. 4. Rinse and repeat until they've either fully automated the process or are out of business.

Reply on news.ycombinator.com