5 ms·

As an aside from the interesting article, does any one else find it pretty scary and privacy invading that stackoverflow think it's ok to match our IP addresses

As an aside from the interesting article, does any one else find it pretty scary and privacy invading that stackoverflow think it's ok to match our IP addresses to the company we work in? It seems like a massive invasion of privacy (which I guess lots of websites are doing). But to me that SO can so casually mention the mass surveillance and privacy invasion they're doing without thinking that there's anything wrong with it is the worst part of it. I certainly never knowingly agreed that they could check my IP address and then try and figure out what company I work at from it. EDIT: Once GDPR is live in the EU, I think it might be interesting to see if I can challenge this privacy invasion and inappropriate use of personally identifying data. I guess we'll see if GDPR has any actual teeth in this instance.

dasil003 9y ago
Does SO operate in the EU?
- mattmanser 9y ago
  They don't block EU users, so they do business in the EU. As it offers goods and services to EU citizens, it has to operate according to GDPR as far as I understand it. And it does do sales in the EU, there are plenty of SO jobs being advertized (and paid for) in the EU.
  - dasil003 9y ago
    I know GDPR is written this way, the question is how it will be enforced? If SO has no operations in the EU, and it's literally just take EUR payments, and the volume is relatively small (or they figure out some offshore processing hack) then they could make the decision to stop processing EUR and give GDPR the middle finger. That's a lot of ifs, but it's not a foregone conclusion that European markets are worth the GDPR headache.
    - mattmanser 9y ago
      No, they'd have to block the whole of the EU from accessing the site.
tkone 9y ago
They said they only did this for US based IP addresses. (Not that it makes it OK...)
- mattmanser 9y ago
  Not explicitly, they might have been just using US data as an example in this blog post. Even if they aren't, I still wonder that if they're checking everyones IP addresses against that database, essentially sharing our access of SO with a third-party, would it still be an inappropriate use of personally identifiable information?
  - sapper123 9y ago
    It seems they're using data from a company called MaxMind https://www.maxmind.com/en/geoip2-isp-database#features https://www.maxmind.com/en/geoip2-isp-database#features . Quoting their website, "The organization name is available for about 40% of corporate, government, and educational networks."
Cthulhu_ 9y ago
Your IP is public, so you can't hide it; privacy invasion is a non-argument there. IP data retention, on the other hand, will be interesting. On the one hand, law enforcement wants to have ISPs and companies to track and remember those, for future investigations. But on the other hand, privacy advocates want that kind of data to not be stored at all.
- mattmanser 9y ago
  It's not the IP address that's the problem, it's that they're processing personally identifiable information about their users in a way they haven't asked permission for and is not related to the service they're providing. Here's the UK's ICO guidance for what you can process, as far as I can tell they've got no lawful basis for trying to match a user's IP address to a company without the user asking them to. https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/ https://ico.org.uk/for-organisations/guide-to-the-general-da...
  - andrewem 9y ago
    I skimmed that link and couldn't figure out what they mean by "processing". (It's related to compliance with a law, so I assume that the common sense meaning of a word isn't necessarily what is meant.) Do you understand what they mean by "processing" in this context? It seems like you're saying that analyzing IP addresses a user connected from in order to determine their likely employer is against the UK's GDPR guidance, even if the data is released only in aggregate (but that it might be fine to keep that IP data since perhaps there are other uses for it which would be legitimate). Is that your understanding?
    - teget 9y ago
      Since these provisions are most likely based on EU directives I would assume that this definition is also reflected in UK law: > (b) 'processing of personal data' ('processing') shall mean any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction; (Directive 95/46/EC) All IPs are personal data (even if they are dynamicly assigned) if I read [1] correctly (Not a lawyer and there is most likely something I miss). [1] http://curia.europa.eu/juris/celex.jsf?celex=62014CJ0582&lang1=de&type=TXT&ancre= http://curia.europa.eu/juris/celex.jsf?celex=62014CJ0582&lan...
rainbowmverse 9y ago
Much of the industry Stack Overflow serves is based on collecting, aggregating, and selling access to exactly this sort of data. I'm not sure what to think of this specific example, but it's just one small manifestation of whatever it is, bad thing or not.

dasil003 9y ago

Does SO operate in the EU?

mattmanser 9y ago
They don't block EU users, so they do business in the EU. As it offers goods and services to EU citizens, it has to operate according to GDPR as far as I understand it. And it does do sales in the EU, there are plenty of SO jobs being advertized (and paid for) in the EU.
- dasil003 9y ago
  I know GDPR is written this way, the question is how it will be enforced? If SO has no operations in the EU, and it's literally just take EUR payments, and the volume is relatively small (or they figure out some offshore processing hack) then they could make the decision to stop processing EUR and give GDPR the middle finger. That's a lot of ifs, but it's not a foregone conclusion that European markets are worth the GDPR headache.
  - mattmanser 9y ago
    No, they'd have to block the whole of the EU from accessing the site.

tkone 9y ago

They said they only did this for US based IP addresses. (Not that it makes it OK...)

mattmanser 9y ago
Not explicitly, they might have been just using US data as an example in this blog post. Even if they aren't, I still wonder that if they're checking everyones IP addresses against that database, essentially sharing our access of SO with a third-party, would it still be an inappropriate use of personally identifiable information?
- sapper123 9y ago
  It seems they're using data from a company called MaxMind https://www.maxmind.com/en/geoip2-isp-database#features https://www.maxmind.com/en/geoip2-isp-database#features . Quoting their website, "The organization name is available for about 40% of corporate, government, and educational networks."

Cthulhu_ 9y ago

Your IP is public, so you can't hide it; privacy invasion is a non-argument there. IP data retention, on the other hand, will be interesting. On the one hand, law enforcement wants to have ISPs and companies to track and remember those, for future investigations. But on the other hand, privacy advocates want that kind of data to not be stored at all.

mattmanser 9y ago
It's not the IP address that's the problem, it's that they're processing personally identifiable information about their users in a way they haven't asked permission for and is not related to the service they're providing. Here's the UK's ICO guidance for what you can process, as far as I can tell they've got no lawful basis for trying to match a user's IP address to a company without the user asking them to. https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/ https://ico.org.uk/for-organisations/guide-to-the-general-da...
- andrewem 9y ago
  I skimmed that link and couldn't figure out what they mean by "processing". (It's related to compliance with a law, so I assume that the common sense meaning of a word isn't necessarily what is meant.) Do you understand what they mean by "processing" in this context? It seems like you're saying that analyzing IP addresses a user connected from in order to determine their likely employer is against the UK's GDPR guidance, even if the data is released only in aggregate (but that it might be fine to keep that IP data since perhaps there are other uses for it which would be legitimate). Is that your understanding?
  - teget 9y ago
    Since these provisions are most likely based on EU directives I would assume that this definition is also reflected in UK law: > (b) 'processing of personal data' ('processing') shall mean any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction; (Directive 95/46/EC) All IPs are personal data (even if they are dynamicly assigned) if I read [1] correctly (Not a lawyer and there is most likely something I miss). [1] http://curia.europa.eu/juris/celex.jsf?celex=62014CJ0582&lang1=de&type=TXT&ancre= http://curia.europa.eu/juris/celex.jsf?celex=62014CJ0582&lan...

rainbowmverse 9y ago

Much of the industry Stack Overflow serves is based on collecting, aggregating, and selling access to exactly this sort of data. I'm not sure what to think of this specific example, but it's just one small manifestation of whatever it is, bad thing or not.