skysight-inc/HackerNews huggingface dataset:
> GDPR doesn't apply to individuals

>> Agreed

Not a lawyer too, but I'm interested what makes you (and jbfoo) believe that it doesn't apply to individuals. It's a EU regulation it should apply to natural and legal persons.

Ok, it has an exception for the processing of data by natural persons in the course of a purely personal or household activity but that doesn't mean it doesn't apply to individuals in general.
> It includes liability for any and all data handed off or handled by 3rd parties.

Good. Outsourcing violations, ethical or legal, shouldn't get you off the hook for them.

Besides which, what are you doing handing off stuff that's important to your business without knowing what's being done with it? Not a recipe for success. And if it's not important, then...
Agreed, but do you think that a language that reduces lines of code considerably (lets say clojure vs java) is bike shedding or is part of using "good design" ?
No: the law wants you to not have to do this. The law wants you to stop collecting data for things that are not core to your business. The issue is that companies are trying to maintain the status quo as much as possible, and annoying users with these does that.
> "I certainly agree that that's the kind of thing a tool should help with rather than complain about and make you fix.
"

It's also the type of thing you should be getting your IDE to worry about. And not leave it till it's time to commit/push.
Companies don't force people to come and work for them. People make that choice. As of earthquake protection in SF, unfortunately most of the owners don't have earthquake insurances because the premiums are ridiculous. In other words, companies might have earthquake protections in SF if they own their office buildings. Otherwise, not sure it's their responsibilities.
I wish the whole web looked like that!
No, it's not the same. The lack of proportionality is precisely why the UK/EU is such a hard place to conduct business.

These rules don't stop anything about ads, they just make them less targeted. Not a big deal, but it will increase the costs of serving users and thus decrease the total amount of commercial projects started.
But the lawsuit in question seems to be that the guy doesn't like facebook using his data for any type of analysis which is different than disclosing what they are doing with it. I am all for more details of what they do with it but again from what I read the guy wants to use FB and other services without allowing them to use his data for anything.

As far as what FB is going to do to use it against me I am not sure what exactly they can do that will actually be a detriment to my life. Can they throw me in jail for a mean comment? No. As long as there is proper due process for government's access to my data (which GDRP to my knowledge doesn't address and is a whole 'nother legal issue imo) I'm not terribly concerned.
"Replace "Telsa" with "Audi/VW/Toyota/Holden/Ford/GM using adaptive cruise control", and this doesn't make front page news."

Or maybe it doesn't happen because people have suitably realistic expectations of Audi/VW/Toyota/Holden/Ford/GM products.
No, most of them aren't required.
Might depend on what you mean by progress. Culturally we are very far from even where we were in the age of my parents. In terms more like that from the sciences or academic philosophers I can't say, though I'd guess they'd argue "Yes!".
Wait, I don't understand, this is blocking traffic from EU continent. I thought GDPR was applicable for all EU citizens regardless of where they physically are. And I may be wrong, but I thought it did not apply to non-EU citizens surfing the web from the EU (although I may be wrong about that).

A more effective way might be to ask on page load if the user is an EU citizen. You know, like some financial website asking you if you are a US citizen on page load [0] (i remember marshall wace's old website doing it, it looks like they do not anymore).

And EU traffic being the "most malicious" ? Is this satire, irony, or something else ? Seriously, if I go on website W and they go through all the dark patterns possible to collect and share my data without me knowing about it and I'm the malicious one ? Better read that than being blind...

[0] https://www.quora.com/All-of-a-sudden-Bank-of-America-is-ask...
> it sets a bad framework as precedent

Not really, this is how pilot programs generally always work. You limit the scope of the program for two reasons:

1. It keeps the program manageable, and it keeps the data more consistent. If the number of operators or scooters are constantly changing it makes it hard to actually draw any conclusions from the program.

2. The pilot program is being run because the SFMTA hasn't yet made the decision to allow this going forward (or they haven't finalized the rules governing it). Not having any restrictions on the program is basically the same thing as simply approving it, but the pilot program exists to determine if it should be approved and what rules it should be governed by.

> Regardless, the deadweight loss from this decision is substantial.

The theoretical loss under certain assumptions, true. What if it turns out that the usage of scooters actually produces a net economic drain in the city?

The pilot program limits the potential benefit, but it also limits the potential downside too.

> Also note specifically that a big issue with the taxi medallion system was that the quotas prevented the discovery of the equilibrium # of taxis. If we do not allow a market equilibrium to be reached, it's very easy for regulators to endlessly argue over the 'right' number without ever getting close to what the market actually wants. Politics has a lot of inertia -- the medallion system perpetuated itself for generations -- so I do not think you can understate the importance of bad precedent.

It sounds to me like you don't understand what a pilot program is. The pilot program only lasts a year, so these restrictions are only in place for a year. After the pilot program ends, the SFMTA will determine the new rules to use (assuming they decide to allow the scooters to continue operating at all) and the rules that governed the pilot program won't apply anymore.

Presumably the SFMTA will continue to require companies operating in this space to obtain a permit, but they'll also likely drop the "only 5 companies can participate" rule because that rule exists to limit the scope of the pilot program and keep it manageable. As for restrictions on the total number of scooters allowed, I guess that depends on the outcome of the pilot program. However, if the outcome is "2,500 scooters is better, or at least not worse, than 1,250 scooters" then the SFMTA is unlikely to put a cap on the scooters (since, as you said, they won't know what the optimal number is at that point).
The Waterbed Theory: some complexity is necessary
Considering Facebook even actively tracks non-users, where's the "users" choice of not participating in that glorious Silicon Valley invention?

As far as I can tell, the "user" doesn't have a whole lot of choice there and Facebook isn't the only company doing that kind of aggregated data collection.
>hey will probably not be able to travel to the EU without fear of arrest, etc

This is EU, not USA, Russia or China. At most his visa will be denied (and i'm not even sure immigration services will actually care)
Assuming, and this is a big assumption, you can cookie (CDN level) or otherwise leave an indication client-side that the visitor is from the EU, then you can easily make the page GDPR compliant instead of blocking.

https://github.com/donohoe/simple-gdpr-lockdown/

This does NOT solve the problem, its just (IMHO) a better alternative to blocking.
No. Intel is still on 14 nm [1] while TSMC/Samsung/GloFo "7 nm" should be roughly equivalent to Intel 10 nm.

[1] Don't believe the hype.
Even though this post is sarcastic, people forgot that your EU resident could still access you when in vacation or business trip outside of the EU and that they certainly already have plenty of data store fom EU resident, so blocking all european IPs does nothing to help them being compliant.
Short of moving Earth out of the way, there's not a whole lot you can do in that case…
Facebook is the new AOL, so it's kind of sad to see Carmack saddled with that baggage.
Both versions are hosted on NPR.org.
I haven't found the statistic about fines levelled by the Hamburg DPA that I read recently, but just found something about the Saxony DPA:

From April 2015 to March 2017 there were 124 proceedings, with 47 leading to fines.

The aggregate sum of all those 47 fines was... 174.226 Euros.
The US government could save $1B by combining its 12,062 data centers
Personalized, targeted advertising is how many services make money. So what is meant by 'the law wants you to not have to do this'. The law wants these services to not make money to cover their expenses? Or scale back their operations?
There's also the Yuma Desalting Plant, it has been turned on twice in 26 years.

The reason the lower colorado basin statea waste so much water is to save their allocations for future growth.
We will have at least a good month of multitasking bliss ;)
GDPR for lazy people: Just use the 'Content Security Policy' meta tag
"got away with "just" a broken foot?"

She's fortunate she didn't plow into the back of a church van full of kids instead of a fire truck. The kids would probably be dead thanks to the high speed impact of a 4,900 pound car.
there is also a long history of people giving up their personal data to get some (overall) irrelevant service and then being surprised when their data is missused...
The IE/Edge users also made a choice.

Not voting is a choice. Not educating yourself is a choice.

Choices have consequences.
This post confuses me.

It reads as if one could work a SWE job for 10 years, and retire on an index fund. Yet, that cannot possibly be true?

Cost of living is relative, but I can't imagine mine is very high. No kids. Own my car. $700/mo rent.

Yet, 10 years is not even close to enough time to bank enough money to retire. What am I doing wrong?
Just add to your terms and conditions - not available for EU residents.

Yeah you changed your EULA, but at least you don't need to completely review it for compliance.
Thanks for the rec. I recently read 1491 and really enjoyed it. So now I'm really looking forward to this.
Not really, he said in substance: "America do this, EU will not". Using this example to somehow gain a moral high ground.
> It's a foreign requirement that feels like a violation of sovereignty.

Sure, if you cater to users in your own country. If you cater (read: deal with data) to users from the EU, you should follow local consumer protection laws.

EU laws have always been more strict than US privacy laws: This caused unfair competition, where US companies were free to export their privacy-damaging business model overseas, while local companies were forced to respect privacy. Respecting privacy is just not very competitive/profitable at the moment.

Your viewpoint pushed to the extreme (sorry if you don't recognize your original view): China selling counterfeit goods or unsafe toys to the US, and feeling like any push-back is messing with their sovereignty of lax copyright -, trademark -, and health laws.
Take a look at article 82, a DPA and legitimate interest legal basis.
Haskell has infinite and recursive types but its type system is perfectly decidable, mainly because Haskell's type system is nominal, so cycles are easily detected and dealt with.
> Ok, it has an exception for the processing of data by natural persons in the course of a purely personal or household activity but that doesn't mean it doesn't apply to individuals in general.

If you set up a service that operates in the same way as a similar service would operate if it were done by a business then I suspect that you being a private individual is not going to be much protection, after all you are effectively roughly in the same situation as a sole proprietor business minus the incorporation.

If you process data for family and friends then that would most likely be enough to trigger the exception.

So the dividing line in the case of a Mastodon server would likely be whether or not you allow total strangers to make use of the service and whether or not you respect their rights.
Thanks for the citation root!

I agree, in spirit, with all three of his hypotheses for why the situation doesn't seem to be as dire one might otherwise expect. Peter writes that "it's possible data is actually corrupted, and apps don't care". That's true, of course, but it's also that the corruption is not always prominently visible.

Historically, improper concurrency control (e.g. in multithreaded programs written in unsafe languages) could quickly result in much more than logical invariant violations. Physical data corruption and memory access violations were (and still are) prevalent, with readily apparent results.

Modern database systems, however, aren't going to crash when you hit a serialization anomaly. They're not going to physically corrupt your data: your numbers will still be numbers, your strings will still be strings, and your foreign keys will still be sound.

We do occasionally bear witness to prominent failures that stem from weak database isolation levels: "oh, look at that cryptocurrency exchange backed by [database du jour], Eve was able to overdraw her account by issuing a bunch of concurrent requests. What amateurs!" and we all point and laugh from our houses of glass.

In truth, it's not the anomaly that's abnormal, it's the visibility. Those kinds of anomalies happen all the time, even to experienced practitioners, but the failure modes will generally be much more obscure and application-specific. Most aren't going to manifest as some exception in your logs, let alone as a top post on HN. You'll only find out about the problem when a ticket comes in saying "hey, the summary and itemized reports don't add up" or "this section is overflowing because the user has 6 email addresses and we told the designers that the application limits it to 5". That's how serialization anomalies usually manifest, and it's a death-by-a-thousand-cuts situation, because each occurrence saps precious time from everyone involved.

We have to do better.
Can you point me to any specific study which says that Europeans are more willing pay for content vs. rest of the world? I mean, if that were true, you would see a lot more paywalls in Europe vs. globally.
I find it funny to claim that the US could be more proportionate than the EU.

Less targeted ads are exactly what we need. That's what the regulation aims for!

Your argument is like claiming that unfortunately, due to car dafety regulations, we cannot enjoy as many fatal accidents as we once did.

And to make my point of view clear: not all businesses deserve to exist. We as society decide which business models and behaviours are okay. "Decrease the total amount of commercial businesses started" cannot ever be a persuasive argument.
There is nothing you could do with any conceivable technology. Even if a star would just traverse through the solar system it would probably throw the planets out of their orbits which would also be quite unpleasant.
Making sure you're at least facing in the correct direction (chin up, facing forward) would help even if sunglasses prevented locating the actual gaze target.

If you still want to use your phone, it'll be easier for the cops to catch you doing it.
To counter your point, my friends were blackberry fanatics, they just laughed when they saw the iphone without a physical keyboard and said this will never work.

None of this has anything whatsoever to do with the patent in question. It seems very important to the people in this thread to deflect from any discussion of the actual case. I wonder why that might be?
> I thought GDPR was applicable for all EU citizens regardless of where they physically are.

Do you mean a company and its customer, both located outside the European union, would still fall under this law if the customer happens to be a citizen of a EU country?
Yes there is. It's all over it. I'm not going to even bother linking to it.

Making consent a precondition of service is an illegal method of obtaining consent, unless the service relies on that consent. So a run tracking app may legitimately say consent to track location is a precondition, because they need that data to actually deliver their service. Facebook and Google though? Obviously not. Also the run tracking app can't then sell that data to an ad network without permission, and that can't be a precondition, because that's not why the data is being supplied.

Facebook and Google may try and argue they need it in court. We will see what happens, but I hope they lose and we can finish this dark, Orwellian chapter of the internet sooner rather than later.
This article can be summed up as "a lot of things could be way better... maybe".
I looked up information on how to legally comply with GDPR and it's a lot more complicated than you're making it out to be. You have to show regulators the well-defined pipeline for any personal data, and justify to them why that data is being collected.

There are also extra procedures you have to follow that could be really complicated depending on the business. This is even worse for small businesses. I can definitely understand those people who want to just wash their hands of it, especially if they don't get much business from Europe.
Do they have any opportunity now that they haven't always had?
> I'd love to see the dataset you have access to backing up any of that statement.

That would make you a sub-processor.
when you give out you data you are doing it willfully.

thinking it’s a good idea to give your personal data to FB is not FBs fault, it’s yours.
???

GDPR doesn’t require that EU users get to use your service for free. If you want to do business in the EU, you have to comply with EU law. If you don’t want to do that, then don’t do business in the EU.
Why are you being so dismissive? It seems like you are making this into some kind of contest to see who has bigger problems.

I am just being honest, and I think I am being helpful because other people will also react negatively to the way the documentation is written. I support the project and want it to be successful, providing feedback like this achieves progress towards that goal, in my estimation.
The New York Times recently did an article on the topic:
https://www.nytimes.com/interactive/2018/04/17/us/san-franci...

The short answer is that while a natural disaster is possible, the time frame between disastrous earthquakes is long enough for people to get by anyway. Builders do have a legal standard to follow, but whether that standard is safe enough is another question entirely.

Re insurance, many employers offer benefits packages that include basic life insurance coverage for employees, which would likely offer some compensation. YMMV.
There's a surprising amount of farmland in the bosque, which runs alongside the Rio Grande for most of its duration, and a lot of that farmland is low-value crops like alfalfa. I would guess this is due to a combination of not wanting to pay for it for their cows and not wanting to fail to use water rights, lest others try to make claims.
Agreed auto-correct is a big plus. Maybe a better way to phrase my question is this: Can auto-correct be implemented in pylint? Or does allowing configurations create too much of an obstacle?

In the ruby world for example, rubocop has an auto-correct feature. However it is only implemented for a subset of the style checks.
>high enough oxycodone levels for the shellfish to test positive

That doesn't really tell me anything. Are they testing by taste or by some fancy test that can detect down to 1 ppq?
do they make people smoke?

like do they MAKE you smoke? cos government MAKES me pay taxes Marlboro does not MAKE me smoke...
You're probably fine.

If you have a lawful basis for collecting the information, you're only passing it along to others as necessary to provide your service to your customers, the customers have clearly consented, and you employ reasonable protection of that data... it's extremely unlikely that you're in violation.

And if you were, they'd come to you first with a warning (at least based on past behavior). They're not going to seize assets unless you seriously provoke them.
The intended effect was to provide some context and to take away a worry. I can see why Americans would be worried because there are many examples of where America has 'exported' its laws all over the globe. The EU is emphatically not doing this, they simply require that if you do business in Europe that you have a European presence so they can enforce their local laws against you.
Decision Making Under Uncertainty and Reinforcement Learning [pdf]
TLDR : it does not really matter that much.
I'm merely saying that these ATM issues don't have to apply and I'm pretty sure there are other banks offering similar conditions on ATM withdrawals.
The more A/C in use, the hotter the city gets, exacerbating the urban heat island. And even if Arizona used exclusively solar (which it doesn't), the climate is still on a warming pattern.

Also, energy trapped by black solar panels & released by A/C is a net increase in heat into the city, compared to reflecting that energy off a high albedo surface, such as a metal or white roof, or the unmolested desert itself.
> Do you realize that this whole discussion exists precisely because it's unclear?

I realize that this statement is untrue.

Some people are dredging up all kinds of "but what if" and "I really, truly don't understand how my collecting data could be considered GDPR-triggering".

I find that dishonest. Protest as much as you want.

Oh, and surprisingly, just by some bizarre happenstance, you are "Currently working on Instinctive, a B2B marketing technology company."

I can tell you immediately that whatever you're doing falls under the GDPR.
When things really get going with outer space civilizations, the idea of weaponry and conflict is going to take some surprising and horrifying turns.

We bicker about islands and aircraft carriers, nuclear arsenals and orbital ballistics, and something like this would rend the entire planet limb from limb in the blink of an eye, without breaking a sweat.
You should be glad that it's so vague. The alternative is a law that lays out technical details of how you handle information, and no one wants that.
High enough levels that workers compensation insurance would not cover these mussels in a workplace injury. The mussel's personal insurance would need to cover the loss instead.
>The Seattle giant believes selling you groceries is the key to selling you everything else.

I mean...they're not wrong here. The grocery store is primarily for selling you groceries, but it's also the first place most people stop for cookware, trashbags, deodorant, etc because it's right there. I am a guy who tries to buy "quality" equipment for anything and everything, and usually I do meticulous research before buying anything online (read the Amazon reviews, cross reference with America's Test Kitchen and Serious Eats guides, etc). Nonetheless, I've bought my fair share of food containers or occasional kitchen tool from my grocery store because I had some cookie dough in my basket and I needed a cookie sheet right now or those cookies weren't going to happen.
What no one want to do was read the law. I actually had to do that, and how you dealt with it depended on your mindset. It was pretty clear that you could just disable all tracking and you'd be fine. If you wanted to use 3rd party tracking, using cookies, you'd need consent.

Because people wouldn't give up Google Analytics, targetted ads and "re-targetting" they opted of silly pop-ups, often delivered by a 3rd. party that will scan your site to keep track of all the data collectors your marketing department added without considering the users privacy.

The GDPR is written the way it is because companies refuse to accept the intentions of the cookie law, and choose to look for loopholes. At least that's my take.