discoursism

I mean terms of service are not that hard to read. Facebook's TOS is only 4k words long. It is not particularly dense or full of legalese. I have written source code comments a tenth that length for a single function. That is not many words to describe the plethora of implications of using their service.

Go ahead and have a glance at it. What would you remove from it that wouldn't cause a significant gap?

Some example clauses:

> For content that is covered by intellectual property rights, like photos and videos (IP content), you specifically give us the following permission, subject to your privacy and application settings: you grant us a non-exclusive, transferable, sub-licensable, royalty-free, worldwide license to use any IP content that you post on or in connection with Facebook (IP License). This IP License ends when you delete your IP content or your account unless your content has been shared with others, and they have not deleted it.

(They have to put this. If they didn't, they would get sued by someone who shared a video and then was mad that other people could see it.)

> Facebook users provide their real names and information, and we need your help to keep it that way. Here are some commitments you make to us relating to registering and maintaining the security of your account:

>

> You will not provide any false personal information on Facebook, or create an account for anyone other than yourself without permission.

(Not exactly dense legalese. It is good to ban impersonation, and it is right that they should include such a ban in their terms.)

> We’ll notify you before we make changes to these terms and give you the opportunity to review and comment on the revised terms before continuing to use our Services.

(Seems reasonable to me. Many years ago, people used to complain that the terms changed without notice, so FB committed to not doing that any more.)

I don't know. This whole "terms of service are impossible to read except by a lawyer" meme just doesn't hold water for me.

No less an authority than Danny Baker . . . the comedy writer, born in '57? Or else who? How would he know about this?

This is silly. We do not know that the overall construction methodology had anything to do with the bridge's collapse. Does the Nipigon River Bridge's collapse show how cable-stayed bridges can go wrong?

The author is a history professor, not an engineer, and it shows with the faffery about metonyms of ecological development in South Florida near the end. If the issue here was with the ABC methodology (as opposed to a misapplication of it), we'll soon learn, but I doubt it. In the mean time, the only person who stands to gain from this FUD is the author.

Which tech corporations have complained about this tax?

90% of billions and billions of dollars is still billions and billions of dollars.

I agree we are not using the same definition of data discovery. In my use case, you know a priori which user provided the data, you just need to plumb the information through to all downstream systems. This seems sufficient for GDPR as I understand it. I had not read your entire comment and did not realize you were promoting a system to try to do something like this automatically. I did not realize the initial question was rhetorical.

FWIW I would be worried about relying on such a system! But based on the description it seems helpful. What does it do about derivative data that doesn't directly contain any PII?

Hrm, did you expect me to design the output of an entire industry in an HN comment? I didn't say it was easy to do. But it is what must be done. My goal was not to provide code, but an outline, a very rough sketch, rough to the extent that it could fit in a pair of sentences. I guess in that sense the owl metaphor is accurate!

We've had two years to work on this. At my company, we've had entire teams spending significant fractions of their time over the last year prepping. As a result, we'll be ready when the switch flips.

> we have no idea which overheads are actually going to prove justified and which are just throwing money away

Life is risk. I contend that if you make a good faith effort to comply with this law (i.e. consult with a lawyer, once, to develop those eight documents you mentioned in another part of this thread) and generally practice good private information hygiene (wipe out old data, don't log private info, don't retain logs or emails too long, etc.), you're probably going to be fine. This is probably not going to be in the "inner loop" of risks your small business faces.

In every regulation, there are winners and losers. Some of the losers didn't do anything wrong, but are just losing because that's the nature of designing laws that factor in disparate interests. At this point, it's the law, and your only choice is how you're going to handle it. And my contention is that, if your small business is receiving letters like this with any regularity, calling a lawyer and spending half a day on it each time is not among the reasonable spectrum of risk-mitigating responses.

> For a letter like this . . . our lawyer is the first call I'm making

/shrug It's your money. You could do that, or you could even light it on fire if you wish. It's no skin off my back. If your company is profitable enough to eat this self-imposed overhead, then its owners will just make less money. If it's not, then leaner competitors will replace it. I'm fine with either outcome.

> How do you automate personal data discovery, especially for already existing data?

You attach an owner id to every record, and make sure all your systems can dump all information they store according to owner id. To the extent existing systems don't, you fix them.

Hopefully if you are a company that small, you haven't had time to develop multiple data warehouses. You can write up a script to query your single warehouse to get the necessary data. You won't create a unique response for each letter, except for filling in all the user's personal information. Instead, you'll write a letter like:

Here is a listing of everything you have a right to know about our company and processes under GDPR:

<huge info dump>

Here is all of the personal data we have about you:

<very long CSV file>

Ideally, the most time-consuming part of responding, after the first such letter, will be verifying the user's identity.

You probably need a lawyer to help you write the document the first time, and to update it when you make new partnerships or develop major new pipelines for data. You probably don't need a lawyer every time you receive such a letter.

Ha. With my friends, if we have one of these "we don't know" scenarios, and my friend tries to take out their phone to look it up, I tell them to put that goddamned thing away. Knowing is not fun. Reasoning is fun, asking around is fun, guessing is fun, bullshitting is fun. If you don't need to know, don't look it up!

Would you rather get to know someone through many conversations and shared experiences, or by reading a (hypothetical, futuristic) brain scan? And so with the world.

There are a lot of private parking garages in NYC. Are those all government mandated?

And if it's your car, and you want to claim that it's not you, they ask you who it is.