3 ms·

None of the data that was available sounds like sensitive PII so I'm not sure why anyone would be surprised by this. I would probably think that rider/driver fe

None of the data that was available sounds like sensitive PII so I'm not sure why anyone would be surprised by this. I would probably think that rider/driver feedback isn't PII at all. I suppose it might be a bit questionable if Lyft was creating and providing tools to make it easy to look this stuff up and promoting it within the company but that doesn't sound like the case either.

ageitgey 9y ago
> None of the data that was available sounds like sensitive PII so I'm not sure why anyone would be surprised by this. The first sentence says employees would "view the personal contact info and ride history of the startup’s passengers." I would consider contact info and exact physical movements to absolutely be PII and information that is sensitive. If not that, then what?
- mattdodge 9y ago
  Not all PII is inherently "sensitive" though. Meaning not everything that can be used to actually identify you needs to be encrypted and protected. I don't know for sure but I don't think names or addresses qualify as that.
  - morogop 9y ago
    Names and addresses are both personal data under almost all regulatory regimes. A reasonable rule of thumb is that if you _could_ use the data to identify a person or a household, then it's personal data, whether or not you do so.
  - zephyrus1985 9y ago
    various state by state. The above does qualify as PII in california
  - s73ver_ 9y ago
    I absolutely would say it would, especially where there's a very good chance that the home and work addresses are part of that list, and the idea that someone would use a database like that to spy on an ex and harass and/or assault them is an actual thing that happens.
deferred 9y ago
“This was said to be used to look up ex-lovers, check where their significant others were riding and to stalk people they found attractive who shared a Lyft Line with them... One staffer apparently bragged about obtaining Facebook CEO Mark Zuckerberg’s phone number.” Right so nothing to see here...

ageitgey 9y ago

> None of the data that was available sounds like sensitive PII so I'm not sure why anyone would be surprised by this. The first sentence says employees would "view the personal contact info and ride history of the startup’s passengers." I would consider contact info and exact physical movements to absolutely be PII and information that is sensitive. If not that, then what?

mattdodge 9y ago
Not all PII is inherently "sensitive" though. Meaning not everything that can be used to actually identify you needs to be encrypted and protected. I don't know for sure but I don't think names or addresses qualify as that.
- morogop 9y ago
  Names and addresses are both personal data under almost all regulatory regimes. A reasonable rule of thumb is that if you _could_ use the data to identify a person or a household, then it's personal data, whether or not you do so.
- zephyrus1985 9y ago
  various state by state. The above does qualify as PII in california
- s73ver_ 9y ago
  I absolutely would say it would, especially where there's a very good chance that the home and work addresses are part of that list, and the idea that someone would use a database like that to spy on an ex and harass and/or assault them is an actual thing that happens.

deferred 9y ago

“This was said to be used to look up ex-lovers, check where their significant others were riding and to stalk people they found attractive who shared a Lyft Line with them... One staffer apparently bragged about obtaining Facebook CEO Mark Zuckerberg’s phone number.” Right so nothing to see here...