6 ms·

It isn't your data. It is their data about you, which is a very important distinction. Facebook and Oracle aren't the bad actors here, if you think there is a

by nxc18 10y ago

It isn't your data. It is their data about you, which is a very important distinction. Facebook and Oracle aren't the bad actors here, if you think there is a bad actor. The baddies are the people giving Oracle (and others) that data about you. (And now I have to hang my head in shame for saying something that sounds like it is a defense of Oracle. They're baddies for many, many other reasons, just not this one)

tossedaway334 10y ago
There is plenty of blame to go around, people running data broker services are far from blameless.
white-flame 10y ago
The fruits of the bad actors, namely the data itself, is what needs to be regulated, analogous to what HIPPA does.
kuschku 10y ago
If you’re an EU citizen, by law, all data about you is owned by you, and only by you. That includes personal data, but also any intellectual property you create, and is irrevocable (you can sell usage rights, but never the ownership rights). So, yes, they have a legal responsibility to not have that data about you, and you can at any point require any company to delete any and all data they have about you, or created by you, and any data derived from it (oops, does that mean training neural networks on your private data means they have to be deleted, too?)
- nxc18 10y ago
  That seems particularly absurd (which isn't to doubt you, but as much as I like the EU, they have some absurd policies). If you take a very narrow view of data as just bits on a hard drive somewhere, then this seems reasonable. But if the ownership right to your data is centered on the information itself, and not the company part, that raises issues. I can't simply destroy the memory of reading the message you wrote - is someone to cudgel me until I do? If I write in my diary that I saw xyz person walking down the street and they had blue hair, could they demand that I destroy the entry? Would they have to know about the diary entry before they could make such demands, or could they simply say, "destroy all information regarding me"? Further, as I understand it, municipal security cameras are in wide use, particularly in European cities. Could I demand that the city/town/council/etc delete all footage of me ever? Could I deny them permission to make those recordings? And last but not least, how on earth would this stance on data ownership not ruin data retention? E.g. this would seem to open up a pretty big hole where I could commit fraud or launder money, and then demand that my bank destroy the evidence. These are all awkward questions that come up when you try to protect very broad definitions of privacy. Privacy is a thoroughly unnatural concept; In the physical world, it takes a lot of work to do anything in private, and even then, you're just making it easier for people to avoid stumbling on what you're doing.
  - kuschku 10y ago
    > Could I demand that the city/town/council/etc delete all footage of me ever? In fact, that is required automatically – all recordings have to be deleted as soon as possible, the maximum retention periods unless there is specific evidence against you is usually a few weeks or months. > And last but not least, how on earth would this stance on data ownership not ruin data retention? That’s literally what happened. The European Court of Justice has ruled that data retention unless technically required is illegal.
  - pluma 10y ago
    It's simple: you don't get to store data unless there's a technical requirement to keep that data stored to provide whatever service a user signed up for. If a user didn't agree to their data to be stored in the first place, you don't get to retain it at all. Whether you can discard data about a user "against their wishes" is likely covered by your terms of service. If you're a commercial hosting provider, there's probably a higher barrier than if you're a free doodling website. This has nothing to do with privacy, though. If a user tells you to destroy their information, you need to destroy all information about them. There's obviously some wiggle room (e.g. if you keep a flat "view count" on an article, there's likely no way to argue that you should have to deduct the user's views but if you're keeping a record of "views" linked to user IDs the user ID may still be personally identifiable if it can be correlated with other data). But most companies fail at deleting even the most obvious data. If you "delete" someone's account and they're unable to sign up with the same username or e-mail address again, you're likely not properly deleting information. And that's if you even offer the option of deleting an account at all. It's horrifying how many (especially American but sometimes even EU) websites don't offer any such option at all or even simply offer an option to "close" an account, marking it as disabled but still retaining all data forever. > Could I demand that the city/town/council/etc delete all footage of me ever? Yes. Security cameras have strict regulations and generally recordings have to be destroyed eventually unless there's a good reason to keep them (e.g. they're part of a criminal investigation). This even extends to police cameras: if a police officer makes a recording (e.g. at a demonstration) and the recording isn't relevant to any investigation, you can ask for it to be destroyed ASAP (rather than waiting for them to destroy it). This also extends to other information like your name and address. > I could commit fraud or launder money, and then demand that my bank destroy the evidence. There are special laws for financial transactions and criminal investigations. There is such a thing as a "permanent record" but it is clearly defined what goes on it and what doesn't (and at what point it has to be destroyed). There are also very strict laws for handling such information, similarly to the strict PCI rules for handling credit card information. You're basically arguing that privacy is a slippery slope but in reality it isn't. Privacy may be an "unnatural" concept but the expectation of privacy is a human right (like, officially, as part of the UN Declaration of Human Rights). The EU actually has very few "absurd" policies -- most of them only appear absurd when taken out of context. I assure you that EU privacy laws are not part of them. Except for the cookie notice. That's not only ineffective but outright ridiculous.
- vixen99 10y ago
  Perhaps someone in the EU bears this in mind: https://en.wikipedia.org/wiki/IBM_and_the_Holocaust https://en.wikipedia.org/wiki/IBM_and_the_Holocaust The 'Final Solution' was facilitated by knowing who everyone was and where they could be found. The technology at that time happened to be the Hollerith Punched Card system.
  - kuschku 10y ago
    Well, the go-to example is usually the Netherlands (they had a central registry of all Jews, so the Nazis invaded, and managed to eradicate almost all in mere weeks), but yes. And the StaSi, with constant surveillance of everyone in East Germany, also is still in collective memory, and another reason why no one wants that much surveillance (although acceptance for surveillance went up since the Berlin attacks, quite a bit, actually).
    - bogomipz 10y ago
      I went to the Stasi Museum recently. And I remember thinking if you traded the physical surveillance(a man in a van) for the now near ubiquitous security cameras, both the US and the UK are on par with the surveillance state that was the former East Germany. Albeit a much more technologically advanced one. It's a sad irony. What is the evidence that acceptance of being surveilled went up since the attacks? Opinion polls? Newly proposed legislation? Germany seems to be the bastion of privacy advocation these days so I am curious to hear. I hope that Germany resists letting politicians exploit a heightened emotional state such what exists while the country is grieving a terrible tragedy. I had never heard this before about the Netherlands and the registry. Do you know why they would have had such a registry?
      - kuschku 10y ago
        Opinion polls show that after a few days of searching for the attacker unsuccessfully, which could ahve easily been solved if we knew what he looked like (surveillance), the support for more surveillance went up. And no, I don't know much about why the Netherlands had such a registry — just that they did.
throwaway12145 10y ago
Some of those "baddies" you refer to are forced by contract to willingly upload that data and keep quiet about it. The penalties for breach of contract are severe; an entire company can go bankrupt overnight if they break the seal. It's not black and white, I'm afraid. Those companies writing up the unfair contracts (Oracle, Visa, etc.) deserve a decent share of the blame, too.

by nxc18 10y ago

tossedaway334 10y ago

There is plenty of blame to go around, people running data broker services are far from blameless.

white-flame 10y ago

The fruits of the bad actors, namely the data itself, is what needs to be regulated, analogous to what HIPPA does.

kuschku 10y ago

If you’re an EU citizen, by law, all data about you is owned by you, and only by you. That includes personal data, but also any intellectual property you create, and is irrevocable (you can sell usage rights, but never the ownership rights). So, yes, they have a legal responsibility to not have that data about you, and you can at any point require any company to delete any and all data they have about you, or created by you, and any data derived from it (oops, does that mean training neural networks on your private data means they have to be deleted, too?)

nxc18 10y ago
That seems particularly absurd (which isn't to doubt you, but as much as I like the EU, they have some absurd policies). If you take a very narrow view of data as just bits on a hard drive somewhere, then this seems reasonable. But if the ownership right to your data is centered on the information itself, and not the company part, that raises issues. I can't simply destroy the memory of reading the message you wrote - is someone to cudgel me until I do? If I write in my diary that I saw xyz person walking down the street and they had blue hair, could they demand that I destroy the entry? Would they have to know about the diary entry before they could make such demands, or could they simply say, "destroy all information regarding me"? Further, as I understand it, municipal security cameras are in wide use, particularly in European cities. Could I demand that the city/town/council/etc delete all footage of me ever? Could I deny them permission to make those recordings? And last but not least, how on earth would this stance on data ownership not ruin data retention? E.g. this would seem to open up a pretty big hole where I could commit fraud or launder money, and then demand that my bank destroy the evidence. These are all awkward questions that come up when you try to protect very broad definitions of privacy. Privacy is a thoroughly unnatural concept; In the physical world, it takes a lot of work to do anything in private, and even then, you're just making it easier for people to avoid stumbling on what you're doing.
- kuschku 10y ago
  > Could I demand that the city/town/council/etc delete all footage of me ever? In fact, that is required automatically – all recordings have to be deleted as soon as possible, the maximum retention periods unless there is specific evidence against you is usually a few weeks or months. > And last but not least, how on earth would this stance on data ownership not ruin data retention? That’s literally what happened. The European Court of Justice has ruled that data retention unless technically required is illegal.
- pluma 10y ago
  It's simple: you don't get to store data unless there's a technical requirement to keep that data stored to provide whatever service a user signed up for. If a user didn't agree to their data to be stored in the first place, you don't get to retain it at all. Whether you can discard data about a user "against their wishes" is likely covered by your terms of service. If you're a commercial hosting provider, there's probably a higher barrier than if you're a free doodling website. This has nothing to do with privacy, though. If a user tells you to destroy their information, you need to destroy all information about them. There's obviously some wiggle room (e.g. if you keep a flat "view count" on an article, there's likely no way to argue that you should have to deduct the user's views but if you're keeping a record of "views" linked to user IDs the user ID may still be personally identifiable if it can be correlated with other data). But most companies fail at deleting even the most obvious data. If you "delete" someone's account and they're unable to sign up with the same username or e-mail address again, you're likely not properly deleting information. And that's if you even offer the option of deleting an account at all. It's horrifying how many (especially American but sometimes even EU) websites don't offer any such option at all or even simply offer an option to "close" an account, marking it as disabled but still retaining all data forever. > Could I demand that the city/town/council/etc delete all footage of me ever? Yes. Security cameras have strict regulations and generally recordings have to be destroyed eventually unless there's a good reason to keep them (e.g. they're part of a criminal investigation). This even extends to police cameras: if a police officer makes a recording (e.g. at a demonstration) and the recording isn't relevant to any investigation, you can ask for it to be destroyed ASAP (rather than waiting for them to destroy it). This also extends to other information like your name and address. > I could commit fraud or launder money, and then demand that my bank destroy the evidence. There are special laws for financial transactions and criminal investigations. There is such a thing as a "permanent record" but it is clearly defined what goes on it and what doesn't (and at what point it has to be destroyed). There are also very strict laws for handling such information, similarly to the strict PCI rules for handling credit card information. You're basically arguing that privacy is a slippery slope but in reality it isn't. Privacy may be an "unnatural" concept but the expectation of privacy is a human right (like, officially, as part of the UN Declaration of Human Rights). The EU actually has very few "absurd" policies -- most of them only appear absurd when taken out of context. I assure you that EU privacy laws are not part of them. Except for the cookie notice. That's not only ineffective but outright ridiculous.
vixen99 10y ago
Perhaps someone in the EU bears this in mind: https://en.wikipedia.org/wiki/IBM_and_the_Holocaust https://en.wikipedia.org/wiki/IBM_and_the_Holocaust The 'Final Solution' was facilitated by knowing who everyone was and where they could be found. The technology at that time happened to be the Hollerith Punched Card system.
- kuschku 10y ago
  Well, the go-to example is usually the Netherlands (they had a central registry of all Jews, so the Nazis invaded, and managed to eradicate almost all in mere weeks), but yes. And the StaSi, with constant surveillance of everyone in East Germany, also is still in collective memory, and another reason why no one wants that much surveillance (although acceptance for surveillance went up since the Berlin attacks, quite a bit, actually).
  - bogomipz 10y ago
    I went to the Stasi Museum recently. And I remember thinking if you traded the physical surveillance(a man in a van) for the now near ubiquitous security cameras, both the US and the UK are on par with the surveillance state that was the former East Germany. Albeit a much more technologically advanced one. It's a sad irony. What is the evidence that acceptance of being surveilled went up since the attacks? Opinion polls? Newly proposed legislation? Germany seems to be the bastion of privacy advocation these days so I am curious to hear. I hope that Germany resists letting politicians exploit a heightened emotional state such what exists while the country is grieving a terrible tragedy. I had never heard this before about the Netherlands and the registry. Do you know why they would have had such a registry?
    - kuschku 10y ago
      Opinion polls show that after a few days of searching for the attacker unsuccessfully, which could ahve easily been solved if we knew what he looked like (surveillance), the support for more surveillance went up. And no, I don't know much about why the Netherlands had such a registry — just that they did.

throwaway12145 10y ago

Some of those "baddies" you refer to are forced by contract to willingly upload that data and keep quiet about it. The penalties for breach of contract are severe; an entire company can go bankrupt overnight if they break the seal. It's not black and white, I'm afraid. Those companies writing up the unfair contracts (Oracle, Visa, etc.) deserve a decent share of the blame, too.