top | item 28139889

New EU Law Removes Digital Privacy

295 points| zajio1am | 4 years ago |patrick-breyer.de | reply

167 comments

order
[+] noduerme|4 years ago|reply
This assault on privacy is premised on a very flimsy concern over CP, which is a problem but is absolutely no reason (just as terrorism isn't) to deprive citizens of their rights. I'm just curious - first of all, what happened to the large amount of child pornography and the industry around it that existed in Denmark throughout the 1970s? The pendulum certainly swings both ways, but it's strange and interesting that the fact that it was legal to produce CP in swathes of Europe has simply been swept under the rug. I'd assume those images and films are now hashed and searched for, but I'd also assume there are hard copies of them laying around in a plurality of Danish households. How do you prosecute possession of something that was legal at the time? Secondly, just to keep using liberal ol' Denmark as an example, since the legal age of consent there is still 15 years old, how do you "harmonize" spying on adults there with spying on minors in the rest of Europe? It's okay to read every 15 year old's text messages and look at their photos because it might be illegal in some other country? What if a 15 year old Dane sends a dick pick to a 17 year old girl in France? Is she a child pornographer?

Sexual assault is one thing, but it's worth taking a minute to realize how arbitrary and ridiculous some of these laws are before you start throwing children into jail for texting... let alone stripping away basic civil liberties on the basis of "some people are bad so we can't have nice things."

[+] dijit|4 years ago|reply
> What if a 15 year old Dane sends a dick pick to a 17 year old girl in France? Is she a child pornographer?

Yes.

When I was 15, I had nudes of a 17 year old. Age of consent is 16 in the UK but sexual images of people under 18 is illegal.

Having that content was illegal; and I have the criminal record to prove it.

[+] randomchars|4 years ago|reply
> What if a 15 year old Dane sends a dick pick to a 17 year old girl in France? Is she a child pornographer?

In some countries, you can have sex at 14, but only do sexting at 18. Total mindfuck.

[+] fogihujy|4 years ago|reply
> What if a 15 year old Dane sends a dick pick to a 17 year old girl in France? Is she a child pornographer?

No, but he would be. She would merely be in possession of it.

For the record, Denmark has, indeed, punished a large number of underage offenders for spreading child pornography through social media. It's mostly been regarding clips spread without the participants' consent though.

Not sure whether other countries go by the age of sexual consent, but I've personally never heard any other definition of child porn than "sexually explicit/suggestive content involving people under the age of 18". Assuming that's valid everywhere, then it would indeed be child pornography since the Dane was under 18.

EU-wide harmonization of such laws would be a welcome step to take before privacy-invading measures were to be taken, and such legislation definitely should address underage sexting.

[+] peoplefromibiza|4 years ago|reply
> What if a 15 year old Dane sends a dick pick to a 17 year old girl in France? Is she a child pornographer?

It depends on what country they are, right now.

Age of consent in both France and Denmark is 15.

[+] thoughty|4 years ago|reply
Is it me or is there a clear pattern here. Seems like the major governments in the world are creating China-like surveillance under the guise of the trojan horse called CSAM.
[+] kypro|4 years ago|reply
The default state (and almost universal state) of human societies throughout history has been authoritarianism.

Authoritarian's universally believe individuals left to themselves make bad decisions either because they're too stupid or too cruel so we need benevolent leaders like themselves to order society.

Only in the last few hundred years countries in Western Europe began to reject this and accept while some individuals may make bad decisions the cost of "benevolent" leaders is too great.

Today in the West we seem to be forgetting that freedom comes with costs and this can only lead in one direction. We should understand China isn't the exception, they are the norm. It was in fact the West who was always more likely to revert to the mean than for China to embrace freedom. People like Orwell understood this very well.

The more freedom individuals have the more likely individuals will say and do things leaders don't like and if our leaders no longer celebrate this disagreement as progress they will seek to restrict freedom. Of course, some actions are almost universally seen as bad and in these cases it's worth carefully restricting freedoms, but this clearly isn't one of those cases. And most attempts to limit freedom of speech also aren't.

[+] xvector|4 years ago|reply
Surprise surprise, the cypherpunks and crypto-anarchists were right all along, but you'll still find people that want to ban technologies like cryptocurrencies and Tor.
[+] anticristi|4 years ago|reply
I start seeing a pattern in Western societies: The pendulum swings between "for" and "against" mass surveillance with a period of a decade.

2001: Terroist attack, swing towards mass surveillance.

2010: Gov't went too far, surveillance seen as a greater threat than terrorism, swing pendulum back to privacy.

2021: Gang violence increases in Europe, swing pendulum to mass surveillance.

Can anyone guess what will happen 2030?

[+] raxxorrax|4 years ago|reply
If you look at the current EU commission, this is clearly something where they think the can build a profile. I hoped more people could see this as the insecurity of leadership that it is.
[+] WhyNotHugo|4 years ago|reply
In hindsight, it seems that China was ahead of the trend and everyone else is just catching up.
[+] hulitu|4 years ago|reply
Yes. Slowly but sure. Not so suddenly brutal like China. They never learn from the past.
[+] AnssiH|4 years ago|reply
Note that there isn't yet any concrete proposed legislation for mandatory screening, if there ever will be any - there's only the linked initiative requesting comments (https://ec.europa.eu/info/law/better-regulation/have-your-sa...).

I strongly believe such a legislation would not be able to pass EU parliament if it would require actually breaking E2E encryption.

[+] still_grokking|4 years ago|reply
The parliament is not making the laws the EU. The not elected European Commission and the not elected European Council do.

That's why we over here call it a democracy-simulation.

Breyer is one of the very few trustworthy people in that system. One should listen to his concerns as they're real.

[+] raxxorrax|4 years ago|reply
I don't think the EU parliament hat the integrity or competency to evaluate the repercussion of such a law. So no, I don't think the parliament is a trustworthy democratic defense, if they get a say at all that is.
[+] iso1210|4 years ago|reply
"Over 80% of respondents oppose its application to end-to-end encrypted communications"

I suspect that is nothing like the actual feeling of the residents of the EU

[+] cbg0|4 years ago|reply
Why would you suspect that? 77.5% of the respondents were EU citizens.
[+] peoplefromibiza|4 years ago|reply
this has been addressed several times here on HN in the past and it's still false.

No one removed digital privacy in EU.

The pirate party is desperate for attention among EU electors, it only has a total of 4 members, Breyer is the only German that was elected and the only one from a western European country.

They need to get titles on newspapers, they're good at doing it, but sometimes they go on a hyperbole.

Moreover: data retention is Breyer's pet peeve, he built a career around it so he obviously talk constantly about it.

If some of you here ever spent time in the environment of the EU elected representatives, you'd know how much each one of them lobby for their agenda, all the time, non-stop.

To add some more details: this is not a private company spying on its users, this is a coalition formed by 25 sovereign countries passing a law that harmonize the different legislation around searching for potentially unlawful digital communications.

But the article 5a) specifically states that

> Notwithstanding their legitimate objective, these activities constitute an interference with the fundamental rights to respect for private and family life and protection of personal data of all users. Any limitation to the fundamental right to respect for private and family life, including the confidentiality of communications, cannot be justified merely on the ground that certain technologies were previously deployed when the services concerned did not, from a legal perspective, constitute electronic communications services. Such interference is only possible under certain conditions. It needs to be provided for by law, respect the essence of the rights to private and family life and to the protection of personal data and, in compliance with the principle of proportionality, be necessary and genuinely meet objectives of general interest recognised by the Union or the need to protect the rights and freedoms of others as enshrined in Article 52 (1) of the Charter. Where such measures permanently involve a general and indiscriminate monitoring and analysis of communications of all users, they interfere with the right to confidentiality of communications.

[+] ud_0|4 years ago|reply
> No one removed digital privacy in EU.

Digital privacy is demonstrably being eroded on many fronts, all over the world. The EU currently has tenuous protections that are in danger of being superceded by concerns that are perceived as higher precedence. The article does seem to be doing a reasonable job of highlighting one such process and sets it in context with the bigger issue.

> The pirate party is desperate for attention among EU electors, it only has a total of 4 members [...]

Just because a political opinion has almost no supporters doesn't mean it's wrong. Historically, privacy alarmists got it right more often than not. None of the scenarios outlined in the article seem particularly over the top to me.

> Moreover: data retention is Breyer's pet peeve, he built a career around it so he obviously talk constantly about it.

I don't know this person, if you say they're untrustworthy I'll take your word for it. But being against data retention seems a reasonably stance in my opinion.

> If some of you here ever spent time in the environment of the EU elected representatives, you'd know how much each of them the lobby for their agenda, all the time, non-stop.

I'm not sure what to make of this sentence. I have no doubt that EU officials are lobbying for their agendas. But the debacle behind the upload filter / copyright directives has shown to me that those agendas either don't include digital rights (in which case they apparently default to deferring to industry lobbyists) or their agendas are not particularly well aligned with citizens' interests.

[+] yreg|4 years ago|reply
>this has been addressed several times here on HN in the past and it's still false

Can you debunk (some of) the specific claims made in the article?

[+] nicce|4 years ago|reply
In fact, GDPR is only 3 years old. Let’s put timeline of the past 10 years. Has privacy increased or decreased?
[+] c2k|4 years ago|reply
Also notice the date on which this law was passed. Everybody in Europe was distracted as "we" were in the mid-finals of UEFA EURO 2020.

At least in Germany it is a common pattern to pass controversial laws when big sporting events are happening...

[+] tvirosi|4 years ago|reply
I feel like they're just gonna keep pushing for this relentlessly and eventually the public will be too tired to fight back and then they'll win.
[+] 12ian34|4 years ago|reply
The blog post seems to be written in a slightly sensationalist manner. I tried to find out "what this actually means" but that's also difficult from reading the post itself. The "How does this affect you" section states:

> All of your chat conversations and emails will be automatically searched for suspicious content. Nothing remains confidential or secret. There is no requirement of a court order or an initial suspicion for searching your messages. It occurs always and automatically.

What, even the stuff that I have end-to-end encrypted?

Even this from the first line of the post:

> The EU decided to let providers search all private chats,

Which "providers" are being referred to here?

[+] zaik|4 years ago|reply
How will this be implemented? Will my XMPP client/gpg binary become illegal?
[+] londons_explore|4 years ago|reply
This is very nicely presented.

Anyone got any links to the other side of this same argument, hopefully as well presented, so us readers can read both to come to our own conclusions?

[+] turbinerneiter|4 years ago|reply
The other side does not need to present their case to the populace, they will push and decide against their will anyway.
[+] jacquesm|4 years ago|reply
The contrast between the comments in this thread and the ones about Apple and their image scanner is striking. Just an observation.
[+] cbg0|4 years ago|reply
It seems that this is primarily related to CSAM or child sexual abuse material, and this blog post is very clickbaity.
[+] Zak|4 years ago|reply
Proposals for mass surveillance are almost always related to CSAM or terrorism.
[+] pedroma|4 years ago|reply
Mild NSFW warning.
[+] yakubin|4 years ago|reply
What do you mean?
[+] libertine|4 years ago|reply
After GDPR this simply makes no sense.

Basically the EU is saying, companies can't do it... but we can!

[+] bengale|4 years ago|reply
I'm not sure it's what I'd want to happen, but it's not really that strange. There are plenty of things we allow the state to do that we wouldn't allow companies to also do.
[+] VMG|4 years ago|reply
it makes total sense if you realize it is all about control
[+] bobcostas55|4 years ago|reply
Think of it as a stationary bandit trying to limit various upstarts that might threaten his position.
[+] emteycz|4 years ago|reply
No, you just didn't read full GDPR. It contains countless instances where it explicitly says they can do it, or the companies have to do it for them.

Seems like data control was just the first step to data management.

[+] djbebs|4 years ago|reply
That seems very in line with GDPR and it's carve outs for the EU and member state governments