1998: GDPR

|< < Prev Comic #1998 (May 25, 2018) Next > >|

GDPR

Title text: By clicking anywhere, scrolling, or closing this notification, you agree to be legally bound by the witch Sycorax within a cloven pine.

Explanation

This comic was released on the date on which the General Data Protection Regulation (GDPR) law went into effect. Most people will have already seen a large number of updated privacy policies in the week or two leading up to this law going active. And while xkcd would likely be outside of the jurisdiction that the law can enforce, it technically does fall within the scope of the law (as certainly EU citizens visit xkcd).

There are several references made to this law, but also several jokes are included about the way people treat privacy policies specifically, and user agreements in general.

The comic is a joke privacy policy, with terms that no one would agree to under normal circumstances. In most cases, website users will use websites without reading the policies, potentially "agreeing" to something unexpected.

"purely out of the goodness of our hearts" is a phrase never expected to be found ever anywhere in any privacy policy. "and has nothing to do with ..." is a blatantly transparent lie - if this were a real privacy policy.

"governs your interactions" starts out as a plausibly valid statement including "the service" and "the website". But then balloons outward to include the entire Internet and Facebook. As this presumably is a privacy policy only for xkcd, this policy should not attempt to claim that it also represents Facebook or the entire Internet. The extension to Facebook may be a reference to reports that "for many people ... Facebook is the Internet."

"Please don't send us your personal information" is also a phrase never expected to be found ever in a privacy policy. A privacy policy, by default, is a contract users agree to BECAUSE personal information is being stored. This is likely a reference to the previous comic 1997: Business Update

The language that the privacy policy will not "deny or disparage" any preexisting rights mirrors that of the Ninth Amendment to the United States Constitution, substituting "this policy" for "the Constitution" and "users" for "people."

The agreement claims that it does not "deny or disparage" any of the user's other rights, but then immediately denies the user the right not to quarter troops in their home, which is a constitutional right described by the Third Amendment to the United States Constitution. Refusing to quarter troops in one's home was previously referenced in 496: Secretary: Part 3. Note that the Third Amendment only applies to Americans. However, similar laws preventing troops being quartered in ones home also exist in European countries.

"If you tell us your name" is presumably something that Randall does in real life and is not part of a privacy policy.

"This website places pixels" is something websites are designed to do and has nothing to do with privacy policies. Websites are more often employing "callback pixels" from companies such as Facebook and Twitter, which is an image file that is hosted on an external server that allows cross-platform and cross-session tracking for targeted advertisements. This is a controversial topic, as many people are against this kind of targeted advertising.

"We use cookies to enhance your performance." apparently says that Randall is giving out actual cookies that can be eaten. Privacy policies normally deal with electronic cookies that track user activity and store personal information.

"may use local storage" is threatening to turn the user's device into cloud storage should Randall run out of space on his drive.

The Warning beacons of Gondor were a system to call for aid used by Gondor in The Lord of the Rings. They were used before the Battle of the Pelennor Fields to request the aid of the Rohirrim. The use of the Beacons has previously been mentioned in 921: Delivery Notification.

3rd Party was a three-member dance-pop group that released one album in 1997, "Alive". In software, "third-party extensions" are small programs that plug into a larger program to modify its behavior, and are created neither by the maker of the larger program nor the user.

"requesting permission" can be construed in several frightening ways. 1. We will ask you after you die if you are willing to donate your organs. 2. We were not asking permission before, but now we have to ask. 3. We will ask you, but your answer doesn't actually matter. 4. We've switched from an organ donation program (legal) to an organ harvesting program (wildly illegal). 5. Anyone not in the EU will have (or, possibly, continue to have) their organs harvested without permission. Besides these frightening scenarios, there is also the question of how a website (and not a doctor) is going to perform the harvesting.

"supersedes" is an apparently valid statement. Its inclusiveness is quite extreme, but appears to be a technically valid statement. However, many laws and constitutional rights cannot be superseded by an ordinary privacy policy.

"unenforceable" claims to have higher jurisdiction than any court and can somehow maintain legality even if a court disagrees. A typical policy would read that an unenforceable provision would not invalidate the rest of the policy.

"not liable" and "shall not be construed" are blanket statements that are supposed to have limiters. For example, a restaurant could have a policy stating "not liable for burns received from our hot coffee." A statement made to a court could say "The defendant's statement of giving the prostitute money shall not be construed as an admission of committing a crime." This makes little sense when claiming the website “is not liable” for anything, and “shall not be construed” to have any meaning whatsoever.

The Food and Drug Administration has nothing to do with privacy policies. As such, this is an accurate statement. Silly, but accurate.

"cure and treat any disease" is claiming to be a medical panacea. Panacea do not exist. It is also mocking the label on many food and health supplements, which are legally required to say they are “not intended to cure or treat any disease.”

The title text is a reference to Shakespeare's "The Tempest", in which the witch Sycorax imprisoned the sprite Ariel in a cloven pine prior to Ariel's rescue by Prospero. As this clause cannot be escaped by anything short of destroying your computer or throwing it away, it may also reflect on how hard it often proves to be to opt out of privacy policy agreements and other forms to be filled on website, for all that they may appear optional. The fact that it appears as a title-text akin to a footnote, which a careless reader of the Privacy Policy may not notice at first glance, may also continue the joke of small but unexpected clauses hidden amidst a long-winded block of legalese, agreed to by users who haven't read them.

Transcript

[The picture shows a long text:]

Privacy policy

We've updated our privacy policy. This is purely out of the goodness of our hearts, and has nothing to do with any hypothetical unions on any particular continents. Please read every part of this policy carefully, and don't just skip ahead looking for sex scenes.

This policy governs your interactions with this website, herein referred to as "The Service", "The Website", "The Internet", or "Facebook", and with all other websites and organizations of any kind. The enumeration in this policy, of certain rights, shall not be construed to deny or disparage others retained by the users. By using this service, you opt in to quartering troops in your home.

Your personal information

Please don't send us your personal information. We do not want your personal information. We have a hard enough time keeping track of our own personal information, let alone yours.

If you tell us your name, or any identifying information, we will forget it immediately. The next time we see you, we'll struggle to remember who you are, and try desperately to get through the conversation so we can go online and hopefully figure it out.

Tracking pixels, cookies, and beacons

This website places pixels on your screen in order to form text and images, some of which may remain in your memory after you close the page. We use cookies to enhance your performance. Our website may use local storage on your device if we run low on space on our end. We may use beacons to call Rohan for aid.

3rd party extension

This service may utilize 3rd party extensions in order to play the song Can U Feel It from their debut album Alive.

Permission

For users who are citizens of the European Union, we will now be requesting permission before initiating organ harvesting.

Scope and limitations

This policy supersedes any application federal, state, and local laws, regulations and ordinances, international treaties, and legal agreements that would otherwise apply. If any provision of this policy is found by a court to be unenforceable, it nevertheless remains in force.

This organization is not liable and this agreement shall not be construed. These statements have not been evaluated by the FDA. This website is intended to treat, cure and prevent any disease.

If you know anyone in Europe, please tell them we're cool.

 add a comment! ⋅  add a topic (use sparingly)! ⋅  refresh comments!

Discussion

This comic is a joke privacy policy, playing off a few things. Everyone right now is updating their privacy policy to meet the new requirements from the European Union coming into effect today, 2018-05-25, the GDPR. Link to wikipedia: [1]. It also is pointing out that no one ever reads them "by using this website you opt in to quartering troops in your home", something you probably did not agree to. --Fwacer (talk) 19:35, 25 May 2018 (UTC)

Your wording "joke privacy policy" is really good and you should add it to the existing explanation. Lassombra (talk) 19:41, 25 May 2018 (UTC)

Thanks, I have added that. First edit! --Fwacer (talk) 20:25, 25 May 2018 (UTC)

Fortunately, this doesn't appear to supersede the Shadow Proclamation. Also, I wouldn't mind quartering troops in my home if they were sexy... 172.68.90.82 20:56, 25 May 2018 (UTC) SiliconWolf

I wonder if this is the privacy policy of Beret Guy's company since he mentioned in the last comic that people keep sending them personal info even though they had asked them to stop.--172.69.42.112 21:07, 25 May 2018 (UTC)

What's the deal with the "Created by a Bot" coming up with relevant jokes as to what the explanation was created by? I didn't search exhaustively, but couldn't find any hints in other discussion pages. Is there a link to a discussion on this? Who did this? Dgbrt? I'm very curious. 00:30, 26 May 2018 (UTC) -- DanB (talk) (please sign your comments with ~~~~)

I've written the program creating the new pages when a new comic is out. It's run by the profile DgbrtBOT. This ensures that all comic pages look similar, the navigation works, and more. --Dgbrt (talk) 01:12, 26 May 2018 (UTC)

I see that now. But didn't it used to just say "Created by a bot" and not "Created by something relevant"? Or has it always done that and I missed it? Is it a reference to a comic, or just something fun? Thanks for all your work on this site, by the way. DanB (talk) 17:40, 26 May 2018 (UTC)

The original text is: "Created by a BOT - Please change this comment when editing this page. Do NOT delete this tag too soon." Check the history. And when a new comic is out there is always a race about being the first to change the word BOT to something else. It was funny when that happened first, but as every joke it isn't funny anymore when it's overused. --Dgbrt (talk) 19:01, 26 May 2018 (UTC)

It also means if you are not a citizen of the European Union, your organs can be harvested without permission, doesn't it? 162.158.62.39 (talk) (please sign your comments with ~~~~)

That depends on whether you have instructed that your whole body be supercool-vitrified and stored around Titan for until the exoplanet colony ships depart. 172.68.34.106 05:54, 26 May 2018 (UTC)

This comic failed to allow me to turn off everything Trump has ever tried to pay for; therefore, Randall owes me €300,000. 172.68.34.106 05:54, 26 May 2018 (UTC)

Point of technicality:

"purely out of the goodness of our hearts" is a phrase never expected to be found ever anywhere in any privacy policy

Aren't I allowed to block ads from funding sources which include organizations whose privacy policies don't provide goods or services purely out of the goodness of their hearts? 172.68.34.106 06:17, 26 May 2018 (UTC)

...similar laws preventing troops being quartert in ones home also exist in European countries

I don't know every European constitution but I probably would know this. The Third Amendment to the United States Constitution seems to be very unique to me. Laws about troops should exist in every country but this is about a constitution. If nobody disagrees this has to be removed or enhanced. --Dgbrt (talk) 14:58, 26 May 2018 (UTC)

I don't know, I can say for myself that when I read "similar laws", I understood just that - laws. I don't think the sentence implies it is also part of the constitution in those countries. But if you misread it that way, others may, too, and ambiguity is never a good thing, so feel free to clear it up if you want, but I wouldn't remove the reference to those laws entirely. Jaalenja (talk) 06:06, 28 May 2018 (UTC)

suggest changing to "but then immediately forces the user to agree to quarter troops in their home, which is a violation of the Third Amendment to the United States Constitution and against the law in many other countries." or something along those lines, would read much clearer. Please excuse if my formatting sucks, this is my first wiki suggestion, ever, ya done popped my cherry. SPeD173.245.52.121 08:30, 28 May 2018 (UTC)

In Germy, while not specifying statoning of troops directly, §13 Grundgesetz guarantees the inviolability of the apartment. Stationing troops in ones home would violate that part of the German constitution. 162.158.89.37 12:15, 28 May 2018 (UTC)

I summarize: Explicitly mentioning troops being quartert in ones home is unique to the US constitution but most other countries have more common articles preventing the same. This narrow description on this matter only exists in the Third Amendment. --Dgbrt (talk) 14:02, 28 May 2018 (UTC)

Moved from the first paragraph

- this is incorrect, EU law applies to all legal entities currently physically within the EU - just like every other law and state in the world. If xkcd has a legal representative of some kind in the EU then it would be enforceable on that representative. so much fud.)

This was entered by IP 162.158.38.70 at the explanation but should be discussed here which may be followed by some changes in the explanation. Please do not enter discussions at the explanation. --Dgbrt (talk) 18:48, 26 May 2018 (UTC)

False. GDPR art. 3 (2): "This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or the monitoring of their behaviour as far as their behaviour takes place within the Union." So, if you're not physically present in the UE it might be harder to enforce, but may still be applicable. Don't want that? Then don't track EU citizens, or simply don't do business there at all.--162.158.91.89 10:26, 28 May 2018 (UTC)

Thanks, it's obvious the first paragraph in the explanation is correct. We should accompany it with a proper link. --Dgbrt (talk) 14:02, 28 May 2018 (UTC)

Done. A link to eugdpr.org seems better than a Wikipedia article. --Dgbrt (talk) 15:55, 28 May 2018 (UTC)

You are aware that eugdpr.org is not an official site? I'd expect it to be abandoned when the whole GDPR hype is over. 162.158.93.39 17:39, 28 May 2018 (UTC)

Yes, I'm aware of this. But Wikipedia isn't too. Any better idea? I wouldn't mind. --Dgbrt (talk) 18:21, 28 May 2018 (UTC)

I think [2] is the official page. Jdluk (talk) 10:26, 29 May 2018 (UTC)

Thanks for the link, but that's really TL;DR. The eugdpr.org article puts the extra-territorial thing to the top, that's what the first paragraph is about. Haven't done further research right now, but a newspaper article covering the same issue is maybe better. --Dgbrt (talk) 20:39, 29 May 2018 (UTC)

Oh, I agree! It is law, after all, and EU law at that. Of *course* it's TL;DR. That's why I didn't add it to the article. But if someone wants official, that's probably it.Jdluk (talk) 22:14, 29 May 2018 (UTC)

"Permissions" reminds me of Monty Python's Meaning of Life Part V: Live Organ Transplants. See https://www.youtube.com/watch?v=Sp-pU8TFsg0 162.158.75.4 (talk) (please sign your comments with ~~~~)

Policy is not an Agreement?

The explanation mentions in several places "the agreement" -- my understanding of a privacy policy is that it is more like a promise than an agreement; the entity declaring the policy is bound to it whether I agree to it or not. It lays out rules that the site operator will adhere to in obtaining consent, which seems different from an agreement to me. 162.158.93.39 17:35, 28 May 2018 (UTC)

Here in the netherlands, there is a law going into effect in a few years that allows the government to harvest your organs after death even without permission, as long as you didn't register against this. This sounds plenty like the organ harvesting part. 141.101.104.53 11:55, 29 May 2018 (UTC)

"This website places pixels on your screen in order to form text and images, some of which may remain in your memory after you close the page." Uh, yeah, I'd hope I'd remember some of the page... Your memory, not your computer's. 162.158.78.28 01:09, 3 June 2018 (UTC)

I did expect to see an entry in the agreement something like "Cookies may be employed, depending on how peckish the server is" :-) --OliReading (talk) 10:03, 3 June 2018 (UTC)