Comment by constantcrying | Hacker News Reader

Comment by constantcrying | Hacker News Reader

Parent Full thread

But this is a failure on the part of the EU law makers. They did not understand how their laws would look in practice.

Obviously some websites need to collect certain data and the EU provided a pathway for them to do that, user consent. It was essentially obvious that every site which wanted to collect data for some reason also could just ask for consent. If this wasn't intended by the EU it was obviously foreseeable.

>The mistake the EU made was to not foresee the madness used to make these decisions.

Exactly. Because the EU law makers are incompetent and they lack technical understanding and the ability to write laws which clearly define what is and what isn't okay.

What makes all these EU laws so insufferable isn't that they make certain things illegal, it is that they force everyone to adopt specific compliance processes, which often do exactly nothing to achieve the intended goal.

User consent was the compliance path to be able to gather more user data. Not foreseeing that sites would just ask that consent was a failure of stupid bureaucrats.

Of course they did not intend that sites would just show pop ups, but the law they created made this the most straightforward path for compliance.

Tracking users isn’t actually needed, though. Websites that store data only for the functionality they offer don’t need to seek consent.

The actual problem is weak enforcement. If the maximum fines allowed by the law had been levied, several companies would’ve been effectively ended or excluded from the EU. That would’ve been good incentive for non-malicious compliance.

That possibly cannot be the common notion to frame this.

I agree with some parts it but also see two significant issues:

1. It is even statistically implausible that everyone working at the EU is tech-illiterate and stupid and everybody at HN is a body of enlightenment on two legs. This is a tech-heavy forum, but I would guess most here are bloody amateurs regarding theory and science of law and you need at least two disciplines at work here, probably more.

This is drifting too quickly into a territory of critique by platitudes for the sake of criticism.

2. The EU made an error of commission, not omission, and I think that that is a good thing. They need to make errors in order to learn from them and get better. Critique by using platitudes is not going to help the case. It is actually working against it. The next person initiating a EU procedure to correct the current error with the popups will have the burden of doing everything perfectly right, all at once, thought through front to back, or face the wrath of the all-knowing internet. So, how should that work out? Exactly like this: we will be stuck for half an eternity and no one will correct anything because if you don’t do anything you can’t do any wrong! We as a society mostly record the things that someone did wrong but almost never record something somebody should have done but didn’t. That’s an error of omission, and is usually magnitudes more significant than an error of commission. What is needed is an alternative way of handling and judging errors. Otherwise, the path of learning by error will be blocked by populism.

——- In my mind, the main issue is not that the EU made a mistake. The main issue is that it is not getting corrected in time and we will probably have to suffer another ten years or so until the error gets removed. The EU as a system needs to be accelerated by a margin so that it gets to an iterative approach if an error was made. I would argue with a cybernetic feedback loop approach here, but as we are on HN, this would translate to: move fast and break things.

On point 1. Tech illiteracy is something that affects an organization, it is independent of whether some individuals in that organization understand the issues involved. I am not arguing that nobody at the EU understands technology, but that key people pushing forward certain pieces of legislation have a severe lack of technical background.

On point 2. My argument is that the EU is fundamentally legislating wrong. The laws they create are extremely complex and very hard to decipher, even by large corporate law teams. The EU does not create laws which clearly outlaw certain behaviors, they create corridors of compliance, which legislate how corporations have to set up processes to allow for certain ends. This makes adhering to these laws extremely difficult, as you can not figure out if something you are trying to do is illegal. Instead you have to work backwards, start by what you want to do, then follow the law backwards and decipher the way bureaucrats want you to accomplish that thing.

I do not particularly care about cookie banners. They are just an annoying thing. But they clearly demonstrate how the EU is thinking about legislation, not as strict rules, but as creating corridors. In the case of cookie banners the EU bureaucrats themselves did not understand that the corridor they created allowed basically anyone to still collect user data, if they got the user to click "accept".

The EU creates corridors of compliance. These corridors often map very poorly onto the actual processes and often do little to solve the actual issues. The EU needs to stop seeing themselves as innovators, who create broad highly detailed regulations. They need to radically reform themselves and need to provide, clear and concise laws which guarantee basic adherence to the desired standards. Only then will their laws find social acceptance and will not be viewed as bureaucratic overreach.

> Exactly. Because the EU law makers are incompetent and they lack technical understanding and the ability to write laws which clearly define what is and what isn't okay.

I am sorry but I too agree with OP's statement. The EU is full of technocrats who have no idea about tech and they get easily swayed by lobbies selling them on a dream that is completely untethered to the reality we live in.

> The next person initiating a EU procedure to correct the current error with the popups will have the burden of doing everything perfectly right, all at once, thought through front to back, or face the wrath of the all-knowing internet.

You are talking as if someone is actually looking at the problem. is that so? Because if there was such a feedback loop that you seem to think exists in order to correct this issue, then where is it?

> In my mind, the main issue is not that the EU made a mistake. The main issue is that it is not getting corrected in time and we will probably have to suffer another ten years or so until the error gets removed.

So we should not hold people accountable when they make mistakes and waste everyone's time then?

There is plenty of evidence to show that the EU as a whole is incompetent when it comes to tech.

Case and point the Chat control law that is being pushed despite every single expert warning of the dire consequences in terms of privacy, and setting a dangerous precedent. Yet, they keep pushing it because it is seen as a political win.

If the EU knew something about tech they would know that placing back-doors in all communication applications is non starter.

> You are talking as if someone is actually looking at the problem. is that so? Because if there was such a feedback loop that you seem to think exists in order to correct this issue, then where is it?

Yes, the problem is known and actually worked on. There are several approaches, some being initiated on country level (probably because EU is too slow) some within the institution, as this one:

https://www.edps.europa.eu/data-protection/our-work/subjects...

No, I don’t think that institutionalised feedback loops exist there, but I do not know. I can only infer from observation that they are probably not in place, as this would, I would think, show up as “move fast and break things”.

> So we should not hold people accountable when they make mistakes and waste everyone's time then?

I have not made any direct remark to accountability, but I’ll play along: what happens by handling mistakes that way is accountability through fear. What is, in my opinion, needed is calculated risk taking and responsibility on a base of trust and not punishment. Otherwise, eventually, you will be left with no one taking over the job or people taking over the job who will conserve the status quo. This is the opposite of pushing things through at high speed. There needs to be an environment in place which can absorb this variety before you can do that(see also: Peter Senge’s “Learning Organisation”).

On a final note, I agree that the whole lobbying got out of hand. I also agree on the back-door issue and I would probably agree on a dozen other things. I am not in the seat of generally approving what the European Administration is doing. One of my initial points, however, was that the EU is not “the evil, dumb-as-brick-creator” of the cookie-popup-mess. Instead, this is probably one of the biggest cases of malicious compliance in history. And still, the EU gets the full, 100% blame, almost unanimously (and no comment as to what the initial goal was). That is quite a shift in accountability you just were interested in not to loose.

Reply on news.ycombinator.com