4 ms·

Sure, that makes sense to me. But this seems more like "the company said it wouldn't allow anyone else to query the database" before I bought it. Now that I'm

Sure, that makes sense to me. But this seems more like "the company said it wouldn't allow anyone else to query the database" before I bought it. Now that I'm owner, do I still count as "anyone else?" I'd argue not. Edit: that's from a US perspective. Sounds like France (& the EU) put additional restrictions on how personal data may be used even after it's voluntarily provided.

shakna 9y ago
> on how personal data may be used even after it's voluntarily provided. That feels wrong. The personal data was provided under a contract. Now, you can pretend you're Vader and change your deal, but people can still attack you for changing the contract to terms they have not agreed on. And so far in court, long lengthy legalese Terms & Conditions haven't always held up to scrutiny, and nor has any contract that states "we can change these terms at any time". [0] Just buying the database doesn't let you do anything with it - you just bought the responsibility of fulfilling the contract. [0] One example: https://law.justia.com/cases/federal/appellate-courts/ca2/11-1311/11-1311-2012-09-07.html https://law.justia.com/cases/federal/appellate-courts/ca2/11...
- freeflight 9y ago
  > And so far in court, long lengthy legalese Terms & Conditions haven't always held up to scrutiny, and nor has any contract that states "we can change these terms at any time". [0] Especially not in the EU, many ToS that are completely legal in the US wouldn't see the light of the day in the EU due to consumer protection rights.
freeflight 9y ago
> how personal data may be used even after it's voluntarily provided It was voluntarily provided under the requirement that said data will not be shared with third parties for commercial purposes. Once that restriction does not apply anymore, as the data ends up being shared with third parties for commercial purposes, neither does your right to use that "voluntarily provided data". Imho private information should be handled like a license; Sure I can allow you to use it, but if you break against the rules we agreed on I reserve the right to revoke your license to use my personal information because at the end of the day it's still MY information.
geofft 9y ago
> Sure, that makes sense to me. But this seems more like "the company said it wouldn't allow anyone else to query the database" before I bought it. Now that I'm owner, do I still count as "anyone else?" I'd argue not. I don't think the change of ownership matters. If I say that I won't allow anyone else to query the database, that statement isn't about restricting others from wandering into my offices and pulling up a Python prompt. What I'm really saying is that I commit to not querying the data with the purpose of sending it to others. Maybe that means I commit to not building something to query it for them; maybe it means I commit to not running a mysqld that accepts connections from them; maybe it means I commit to not doing a database dump and sending it, but in all cases, I'm the one not doing a thing. So, the fact that you "own" the data doesn't mean you have the right to use it how you want - because if you could in fact use it how you want, you could send it to anyone you want. And if you transfer it, e.g., by selling your company, you don't transfer rights that you never had.
- ori_b 9y ago
  > I commit to not querying the data with the purpose of sending it to others. Nobody's arguing with that. The problem is that there was no commitment to avoid querying the data with the purpose of sending it to yourself. And when Facebook bought WhatsApp, they ceased to be "someone else".
  - vidarh 9y ago
    The issue here, I think, is that you assume they have a blanket right to access the data. But EU regulations restrict not just transfers between companies, but set down principles for how personal data should be handled. And those include among others that data should be collected for specified purposes, and should only be used for the purposes the person consented to, unless you obtain additional consent. If I consent to sharing my data for use on site A, and site B buys site A, the fact that they are now owned by the same company is not necessarily relevant unless the permissions collected very explicitly allowed the data collected by site A to be used for purposes related to site B too. That the sites suddenly have the same corporate owner is no guarantee that the consent collected made it expressly clear to users of site A that they could expect that their data might be shared with site B in the future. Some sites do collect very broad consent and make very clear to their users that data may be transferred elsewhere, but even if they do this, they also do need to ensure the data is still treated in accordance with EU Data Protection regulations.

shakna 9y ago

> on how personal data may be used even after it's voluntarily provided. That feels wrong. The personal data was provided under a contract. Now, you can pretend you're Vader and change your deal, but people can still attack you for changing the contract to terms they have not agreed on. And so far in court, long lengthy legalese Terms & Conditions haven't always held up to scrutiny, and nor has any contract that states "we can change these terms at any time". [0] Just buying the database doesn't let you do anything with it - you just bought the responsibility of fulfilling the contract. [0] One example: https://law.justia.com/cases/federal/appellate-courts/ca2/11-1311/11-1311-2012-09-07.html https://law.justia.com/cases/federal/appellate-courts/ca2/11...

freeflight 9y ago
> And so far in court, long lengthy legalese Terms & Conditions haven't always held up to scrutiny, and nor has any contract that states "we can change these terms at any time". [0] Especially not in the EU, many ToS that are completely legal in the US wouldn't see the light of the day in the EU due to consumer protection rights.

freeflight 9y ago

> how personal data may be used even after it's voluntarily provided It was voluntarily provided under the requirement that said data will not be shared with third parties for commercial purposes. Once that restriction does not apply anymore, as the data ends up being shared with third parties for commercial purposes, neither does your right to use that "voluntarily provided data". Imho private information should be handled like a license; Sure I can allow you to use it, but if you break against the rules we agreed on I reserve the right to revoke your license to use my personal information because at the end of the day it's still MY information.

geofft 9y ago

> Sure, that makes sense to me. But this seems more like "the company said it wouldn't allow anyone else to query the database" before I bought it. Now that I'm owner, do I still count as "anyone else?" I'd argue not. I don't think the change of ownership matters. If I say that I won't allow anyone else to query the database, that statement isn't about restricting others from wandering into my offices and pulling up a Python prompt. What I'm really saying is that I commit to not querying the data with the purpose of sending it to others. Maybe that means I commit to not building something to query it for them; maybe it means I commit to not running a mysqld that accepts connections from them; maybe it means I commit to not doing a database dump and sending it, but in all cases, I'm the one not doing a thing. So, the fact that you "own" the data doesn't mean you have the right to use it how you want - because if you could in fact use it how you want, you could send it to anyone you want. And if you transfer it, e.g., by selling your company, you don't transfer rights that you never had.

ori_b 9y ago
> I commit to not querying the data with the purpose of sending it to others. Nobody's arguing with that. The problem is that there was no commitment to avoid querying the data with the purpose of sending it to yourself. And when Facebook bought WhatsApp, they ceased to be "someone else".
- vidarh 9y ago
  The issue here, I think, is that you assume they have a blanket right to access the data. But EU regulations restrict not just transfers between companies, but set down principles for how personal data should be handled. And those include among others that data should be collected for specified purposes, and should only be used for the purposes the person consented to, unless you obtain additional consent. If I consent to sharing my data for use on site A, and site B buys site A, the fact that they are now owned by the same company is not necessarily relevant unless the permissions collected very explicitly allowed the data collected by site A to be used for purposes related to site B too. That the sites suddenly have the same corporate owner is no guarantee that the consent collected made it expressly clear to users of site A that they could expect that their data might be shared with site B in the future. Some sites do collect very broad consent and make very clear to their users that data may be transferred elsewhere, but even if they do this, they also do need to ensure the data is still treated in accordance with EU Data Protection regulations.