10 ms·

This really isn't up to iRobot Corporation or Colin if the company gets acquired. They are publicly traded, hostile take overs are possible. The promise is mean

This really isn't up to iRobot Corporation or Colin if the company gets acquired. They are publicly traded, hostile take overs are possible. The promise is meaningless.

pmontra 9y ago
The first rule in these cases is not to collect data you don't want to get leaked.
JoshTriplett 9y ago
There are ways to construct contracts that bind your future self, even through acquisitions. Most companies don't, because they care more about the flexibility of "we can change our minds at any time". But they could.
- hammock 9y ago
  I would love to see a company put its consumer data in a trust, to be kept locked up forever in the event of an acquisition. Has this been done before? (And what happens if the trust gets acquired)
  - chippy 9y ago
    How about a data broker service? (Not that it's been done before - but that the idea has some merit)
    - hammock 9y ago
      Go on
- chimeracoder 9y ago
  Yup. It doesn't even have to be a contract in order to have legal consequences. Wizards of the Coast made a public announcement back in the 90s that they would not reprint cards on the reserved list in Magic: The Gathering. Even though they're now owned by Hasbro, they're still afraid of a lawsuit from collectors and trading shops if they do reprints or functional reprints (because that would drop the value of existing collections, causing material damages). They toyed with non-playable collector editions for a few years, and then even that was shut down.
  - deleted 9y ago
    [deleted]
  - icebraining 9y ago
    That works better if there are demonstrable damages (incl. wasted investments), though. Hard to show damages in a case like this.
    - chimeracoder 9y ago
      Right, and that's a challenge with privacy in general, whether or not there's a contract (and whether or not that's scoped to apply to future owners of the company). Right now, the legal system does not always afford breaches and violations of privacy the level of gravitas that they deserve.
      - AlexandrB 9y ago
        Given that personal data is bought and sold every day by various parties, it should be possible to put a dollar value on a particular piece of information (e.g. address, gender, demographic info). I'm not surprised this hasn't happened yet though since it would make assessing damages in privacy breaches much easier for the victims/users and open the door to more lawsuits. The challenge in this case is assessing the dollar value of a new piece of personal info (room geometry). Perhaps there should be a small floor value (priced in $/byte) for any personal data when assessing damages - it would greatly discourage collecting novel data about users "for future use" or "just because we can". Edit: "anonymized" data can be discounted based on an expert assessment of how easy it is to de-anonymize.
  - thaumasiotes 9y ago
    Whatever it is can't just be fear of lawsuits. They've done the following things: - Publicly stated that they regret the reserved list, it's a mistake, and its existence hurts the game. - Implemented a policy that employees are not allowed to publicly discuss the reserved list. - Released tournament-legal cards from the reserved list in a manner 100% compliant with the terms of the reserved list. - In response to complaints, strengthen the reserved list policy so such releases are no longer allowed.
- Paul-ish 9y ago
  Good point, I don't know anything about law so I wasn't aware of this. Maybe I can restate my comment as "This promise is meaningless, but there are meaningful promises they can make that they chose not to, and that is meaningful."
pmoriarty 9y ago
It's also not up to them if they get hacked.
- warent 9y ago
  Getting hacked isn't selling data. I don't understand your point.
  - jononor 9y ago
    The consequence to the user can be pretty much the same, their data shared and used without their consent.
  - dredmorbius 9y ago
    Selling data requires having it. Having it enables getting hacked. Not selling data enables not having it in the first place, which eliminates the entire failure class of "getting hacked". NB, and not specific to you, but I'm increasingly cognizant of the general inability (or unwillingness) of people to follow chains of reasoning forward, or in this case and more readily, backwards, to identify likely consequences and/or causal / contributory mechanisms, in even only modestly complex cases. It gives me a great deal of concern over the creation of an even only modestly complex information infrastructure.
ChuckMcM 9y ago
Exactly, unless there is some 'suicide' clause in the company bylaws that says all data will be destroyed on change of ownership (which would be fiduciarily [1] irresponsible anyway) then the statement of the CEO is constrained to 'during my tenure' at best. And 'during my tenure, while we are meeting our numbers goals' at worst. [1] I don't think that is a word but hopefully what I hope it would mean if it were a word is clear :-)
- ra1n85 9y ago
  I like that - but how would you enforce it? Wouldn't it actually just deter companies interested in acquiring out of interest in the acquisition's customer data?
  - SomeStupidPoint 9y ago
    At an implementation level, you could make it optional for customers to delete their data (preferably opt-out of deletion). A purchaser looking to woo your clients (and continue to provide your service) rather than exploit your goodwill shouldn't have trouble retaining the majority of the data. There's no reason to force data deletion, but leaving the choice to customers if they want to trust the purchasing company the way they trusted you prevents a lot of conflicts of interest and abusive behaviors.
  - ChuckMcM 9y ago
    > Wouldn't it actually just deter companies interested in acquiring out of interest > in the acquisition's customer data? Yes, that is exactly it. So at some level the data is a company asset that has 'value' to a potential acquiring company. And if you decide to destroy the value of that asset to an acquiring company (by having it self destruct on acquisition) then you've intentionally reduced the value of the company. Your fiduciary responsibility as a board member or executive is to maximize the value of the company. The long held theory here is that the share holder's elect board members to represent their interest in the company, which is notionally the 'value' of their shares, so for the board to be doing the shareholder's bidding they would not allow the CEO to explicitly damage the value of the company by impairing one of its assets with a destruct clause.
rebootthesystem 9y ago
The spread of personal information across myriad services is, I think, becoming a huge problem. I recently had a case with one such services. They store personal information that could be very damaging if it got out. SSN, driver's license, name, address, phone, credit card info, etc. I decided I no-longer needed the service and so I asked to close the account and clear all of my data from their servers and backups. I was particularly interested in the information that could be used for nefarious purposes given a data breach or a sale of the business. They refused and gave me some bullshit reason. I moved immediately to arbitration per their own TOS. Within a couple of days they became very responsive and have, in theory, cleared all my info from their service. And that's the issue. How do you know? They could have lied to me just to get me to drop arbitration. Hard to know how far to pursue something like this. No company should keep information on you that you do not authorize them to keep. A consumer ought to have the right to have any and all traces of their personal data erased from databases with absolute certainty. Privacy ought to supersede everything else. What if you want Facebook to clear all data related to your account? I don't think that's possible in the US, is it?
- toufka 9y ago
  The reason given for collecting such data is often, "for your protection" or a variant of, "to verify who you are." And invariably, I hear about that exact data becoming exposed a few months later. It's extraordinarily frustrating that even when you articulate this viscous cycle to them, they still blindly push forward with the same efforts.
  - deleted 9y ago
    [deleted]
- twblalock 9y ago
  Once Facebook has data, it ends up in their database backups and potentially in their logs, and also potentially in CDN caches, so even if they deleted it from their production database it wouldn't really be gone. This is one of those cases where it is impossible to prove a negative -- one can never prove that the data you gave to Facebook doesn't still exist somewhere, even if they look for it everywhere they can think of. Similarly, the company you entered into arbitration with might have made a good-faith effort to delete your data, but they might not have fully succeeded. Therefore, one must assume that any data given to any company might somehow survive even if the company attempts to delete it.
muzani 9y ago
Reminds me of WhatsApp.

This really isn't up to iRobot Corporation or Colin if the company gets acquired. They are publicly traded, hostile take overs are possible. The promise is meaningless.

pmontra 9y ago

The first rule in these cases is not to collect data you don't want to get leaked.

JoshTriplett 9y ago

There are ways to construct contracts that bind your future self, even through acquisitions. Most companies don't, because they care more about the flexibility of "we can change our minds at any time". But they could.

hammock 9y ago
I would love to see a company put its consumer data in a trust, to be kept locked up forever in the event of an acquisition. Has this been done before? (And what happens if the trust gets acquired)
- chippy 9y ago
  How about a data broker service? (Not that it's been done before - but that the idea has some merit)
  - hammock 9y ago
    Go on
chimeracoder 9y ago
Yup. It doesn't even have to be a contract in order to have legal consequences. Wizards of the Coast made a public announcement back in the 90s that they would not reprint cards on the reserved list in Magic: The Gathering. Even though they're now owned by Hasbro, they're still afraid of a lawsuit from collectors and trading shops if they do reprints or functional reprints (because that would drop the value of existing collections, causing material damages). They toyed with non-playable collector editions for a few years, and then even that was shut down.
- deleted 9y ago
  [deleted]
- icebraining 9y ago
  That works better if there are demonstrable damages (incl. wasted investments), though. Hard to show damages in a case like this.
  - chimeracoder 9y ago
    Right, and that's a challenge with privacy in general, whether or not there's a contract (and whether or not that's scoped to apply to future owners of the company). Right now, the legal system does not always afford breaches and violations of privacy the level of gravitas that they deserve.
    - AlexandrB 9y ago
      Given that personal data is bought and sold every day by various parties, it should be possible to put a dollar value on a particular piece of information (e.g. address, gender, demographic info). I'm not surprised this hasn't happened yet though since it would make assessing damages in privacy breaches much easier for the victims/users and open the door to more lawsuits. The challenge in this case is assessing the dollar value of a new piece of personal info (room geometry). Perhaps there should be a small floor value (priced in $/byte) for any personal data when assessing damages - it would greatly discourage collecting novel data about users "for future use" or "just because we can". Edit: "anonymized" data can be discounted based on an expert assessment of how easy it is to de-anonymize.
- thaumasiotes 9y ago
  Whatever it is can't just be fear of lawsuits. They've done the following things: - Publicly stated that they regret the reserved list, it's a mistake, and its existence hurts the game. - Implemented a policy that employees are not allowed to publicly discuss the reserved list. - Released tournament-legal cards from the reserved list in a manner 100% compliant with the terms of the reserved list. - In response to complaints, strengthen the reserved list policy so such releases are no longer allowed.
Paul-ish 9y ago
Good point, I don't know anything about law so I wasn't aware of this. Maybe I can restate my comment as "This promise is meaningless, but there are meaningful promises they can make that they chose not to, and that is meaningful."

pmoriarty 9y ago

It's also not up to them if they get hacked.

warent 9y ago
Getting hacked isn't selling data. I don't understand your point.
- jononor 9y ago
  The consequence to the user can be pretty much the same, their data shared and used without their consent.
- dredmorbius 9y ago
  Selling data requires having it. Having it enables getting hacked. Not selling data enables not having it in the first place, which eliminates the entire failure class of "getting hacked". NB, and not specific to you, but I'm increasingly cognizant of the general inability (or unwillingness) of people to follow chains of reasoning forward, or in this case and more readily, backwards, to identify likely consequences and/or causal / contributory mechanisms, in even only modestly complex cases. It gives me a great deal of concern over the creation of an even only modestly complex information infrastructure.

ChuckMcM 9y ago

Exactly, unless there is some 'suicide' clause in the company bylaws that says all data will be destroyed on change of ownership (which would be fiduciarily [1] irresponsible anyway) then the statement of the CEO is constrained to 'during my tenure' at best. And 'during my tenure, while we are meeting our numbers goals' at worst. [1] I don't think that is a word but hopefully what I hope it would mean if it were a word is clear :-)

ra1n85 9y ago
I like that - but how would you enforce it? Wouldn't it actually just deter companies interested in acquiring out of interest in the acquisition's customer data?
- SomeStupidPoint 9y ago
  At an implementation level, you could make it optional for customers to delete their data (preferably opt-out of deletion). A purchaser looking to woo your clients (and continue to provide your service) rather than exploit your goodwill shouldn't have trouble retaining the majority of the data. There's no reason to force data deletion, but leaving the choice to customers if they want to trust the purchasing company the way they trusted you prevents a lot of conflicts of interest and abusive behaviors.
- ChuckMcM 9y ago
  > Wouldn't it actually just deter companies interested in acquiring out of interest > in the acquisition's customer data? Yes, that is exactly it. So at some level the data is a company asset that has 'value' to a potential acquiring company. And if you decide to destroy the value of that asset to an acquiring company (by having it self destruct on acquisition) then you've intentionally reduced the value of the company. Your fiduciary responsibility as a board member or executive is to maximize the value of the company. The long held theory here is that the share holder's elect board members to represent their interest in the company, which is notionally the 'value' of their shares, so for the board to be doing the shareholder's bidding they would not allow the CEO to explicitly damage the value of the company by impairing one of its assets with a destruct clause.

rebootthesystem 9y ago

The spread of personal information across myriad services is, I think, becoming a huge problem. I recently had a case with one such services. They store personal information that could be very damaging if it got out. SSN, driver's license, name, address, phone, credit card info, etc. I decided I no-longer needed the service and so I asked to close the account and clear all of my data from their servers and backups. I was particularly interested in the information that could be used for nefarious purposes given a data breach or a sale of the business. They refused and gave me some bullshit reason. I moved immediately to arbitration per their own TOS. Within a couple of days they became very responsive and have, in theory, cleared all my info from their service. And that's the issue. How do you know? They could have lied to me just to get me to drop arbitration. Hard to know how far to pursue something like this. No company should keep information on you that you do not authorize them to keep. A consumer ought to have the right to have any and all traces of their personal data erased from databases with absolute certainty. Privacy ought to supersede everything else. What if you want Facebook to clear all data related to your account? I don't think that's possible in the US, is it?

toufka 9y ago
The reason given for collecting such data is often, "for your protection" or a variant of, "to verify who you are." And invariably, I hear about that exact data becoming exposed a few months later. It's extraordinarily frustrating that even when you articulate this viscous cycle to them, they still blindly push forward with the same efforts.
- deleted 9y ago
  [deleted]
twblalock 9y ago
Once Facebook has data, it ends up in their database backups and potentially in their logs, and also potentially in CDN caches, so even if they deleted it from their production database it wouldn't really be gone. This is one of those cases where it is impossible to prove a negative -- one can never prove that the data you gave to Facebook doesn't still exist somewhere, even if they look for it everywhere they can think of. Similarly, the company you entered into arbitration with might have made a good-faith effort to delete your data, but they might not have fully succeeded. Therefore, one must assume that any data given to any company might somehow survive even if the company attempts to delete it.

muzani 9y ago

Reminds me of WhatsApp.