zlacker

Going on a bit of a tangent here, I am becoming concerned with how we discuss these things. You're completely either for or against it. And if you're against one way you are automatically for the other. If you think one thing is bad, obviously you need to be corrected that other thing is bad too. And then you'll get extreme examples showing it. Call it whataboutism, appeal to emotion, whatever.

Every time these GDPR discussions come up, someone is always quick to say the US is worse, US is getting a taste of its own medicine, that dissenters must want surreptitious data collection, and on and on. Oddly enough, bringing it full circle, the tendencies for humans to argue in these directions instead of stay focused on the issue at hand make me glad to have more strict boundaries that are less subject to the whims of idle thought. Obviously this can't be absolute, so we should craft our rules to limit their scope at least from the outset. It's not about one country/continent vs another, it's about the goals and how they are achieved. Some believe and/or have experienced difficulties conforming to all sorts of government rules, it is a human thing not a location one. IMO, we need to stop deflecting and we need to stop being so absolute. People that are feeling pain of impending laws are not hysterical and laws are not magically OK because other forms/interpretations have downsides.

>>kodabl+(OP)
I think your tangent is merited and unfortunately there seems to be a lot of polarizing comments (I might have done a couple, but there are some that really go over the top in either direction, like "hiring a lawyer to be your DPO is trivial" or people spreading FUD and saying how they will have to shut access from the EU to their personal site, etc.)

But in essence people are missing the bigger context.

>>kodabl+(OP)
I think this is a situation where it's easy to see the mote in someone else's eye. I tried to provide a summary using the standard terms for both approaches (in practice, making it clear I preferred a principles-based approach); you jumped up to rebut (in practice, by trying to find the most derogatory synonym for "principles-based regulation" and accusing opponents of "frothing at the mouth"). And then both of us are astonished by the level of partisanship in this argument ;)

It's true, I do think that a more principles-based approach is usually preferable. (And I will happily marshal anecdata to that end!)

But it's naive to think that any approach comes without a cost. Even the PayPal example I mentioned above could be coloured the other way: A company makes a major investment in a foreign market, only to find the rules changed underneath them by a capricious government agency! (Someone brought up IR35 down-thread, and that's an excellent example too.) Is that an acceptable cost for the outcome? I'd look at the overall state of (eg) consumer financial protections in the US vs the UK and say "yes"; but I'm open to evidence-based disagreement.

>>meredy+D6
Meh, I'm less concerned with disagreement (or the words used) than I am with deflection. To be clear, and brief, I am not saying one approach to law is better than another (though I too have my preferences and of course corruption anecdata abound). In this case, I think neither legal approach is preferable with such a large statute. But if we are resigned to this option, one could argue that the size/scope of the legislation can only happen with vagueness and trust. In general I think we could arrive at a GDPR-level statutes (at a global level no less) after working up to it. And I don't believe the regulatory bodies' failures themselves justify doubling down on those same failure-causers. I could talk about my suggestions for days, but in general a good set of first steps would be simple transparency requirements for specific uses and tangible enforcement.

>>kodabl+8a
> I could talk about my suggestions for days

This sounds like it would make an interesting blog post!

>>meredy+D6
Thank you for bringing this up. I never knew PB law was a thing. I thought it was just poorly written. Being a yank, I just assumed they forgot the corner cases. I am anti authoritarian by nature so I tend to view authorities as Djinn that must be tightly constrained by wording lest they find a way to misbehave. I would have thought PB would have a higher risk of regulatory capture and corruption of regulators than RB. What is a small business owner's recourse if a regulation is being selectively enforced to favor a competitor? To they need to find funds to retain legal representation? What if the competitor is much larger?

Edit: I realized this might sound passive aggressive. I like the idea of human judgement in regulation, but I really want to know what checks are commonly used to account for all actors involved potentially being malicious.