5 ms·

I am trying to think what the secondary consequences of GDPR are going to be. If any user can see their data on any service than any government can quickly plu

I am trying to think what the secondary consequences of GDPR are going to be. If any user can see their data on any service than any government can quickly plug-in to access all user data on any service. This is like NSA Prism for everything. If a user can export their data easily from any service, they can easily resell their own data for money to services that seek to monetize that data. They could even rent out their data by the day for model training using the right to delete. Account takeovers by hackers will lead to much more severe data breaches, since all data on that user in the system is easily accessible. The information apocalypse is made all that more easy because acount takeover + deep fakes + lyrebird plus all that easily accessible juicy data = impersonate anyone. Data renting will create a way to monetize account takeover. The account takeover will include all possible information used to identify a person so how are the data brokers supposed to know it isn't you and how are you supposed to get your data back once it's out there getting monetized?

camillomiller 8y ago
The option to monetize your own data is an amazing idea: a startup that pays you to upload the data you can download from your google, apple, facebook, BIGNAME account, basically renting it daily until you revoke consent, then uses it to do all sort of shit you can with it. You’ll get hypeprofiled and harassed with all sorts of advertising, but you’re actually getting real money for that.
- gregknicholson 8y ago
  When “you are the product”, you can sell that product.
  - zerostar07 8y ago
    you would have to find a market for them first. realistically private data is useless outside of a marketing platform like google or facebook. Maybe you can fill up some forms or polls for a few cents, that's it.
- scrollaway 8y ago
  The problem with that model is... how much money is a single profile worth, really? I'd love to be proven wrong and for a company to implement this. But as far as I know, it's not being done because the math doesn't work out. It's too cheap for regular people to be interested, and an incentive for spamtech to mass create fake profiles and get paid pennies for it. In fact, the one variant I am aware of that works is survey sites, but that's because you get paid per result rather than for your data as a whole. If you're just renting your data daily, you'd get a lot less.
  - akerro 8y ago
    > The problem with that model is... how much money is a single profile worth, really? I remember some estimates, facebook profile with a few years of history is around 1$, a few profiles from different sites of the same person 5$.
  - deleted 8y ago
    [deleted]
- matte_black 8y ago
  Your data is worth about 21 cents.
dullgiulio 8y ago
What do you think changed for governments? If there is a search warrant, police could and still can access data. GDPR didn't change anything in this regard. My feeling is that in the EU there is a different view of government: it's not a third adversarial entity. Many other remarks you've made don't have anything to do with GDPR, for example fake accounts and takeovers.
- oblio 8y ago
  > My feeling is that in the EU there is a different view of government: it's not a third adversarial entity. That should be the de facto stance regarding government in democratic countries, in my opinion. The government is a third party that intermediates, fundamentally, between: * individuals/groups of individuals and other individuals/groups of individuals, all inside the same country * itself and the governments of other countries The first point is very important, a society of a big enough scale, in the absence of hierarchy invariably degenerates into an anarchy where the only law is the law of the jungle: the strongest survive. That's why we add this third party that can intervene for the weak. This third party can be corrupted by various interests, but the hope is that these interests balance themselves out. And even a corrupt state is better than no state at all (or even a very weak state). Look at current day Somalia, Iraq post 2001, Libya post 2011.
- zerostar07 8y ago
  > EU there is a different view of government: it's not a third adversarial entity. We are not from another planet. EU likes to portray itself as trustworthy - it largely is - but that doesn't mean there are no problems. EU governments can vastly differ in quality , you just happen to hear from the most accountable ones.
chatmasta 8y ago
On the positive side, it could also reduce product lock-in by increasing data portability. For example if I'm creating a social network startup, and users can export their data from Facebook in a parseable format, then it's trivial for me to offer an "import your data from Facebook" feature. The interesting question then becomes, could Facebook do anything about that? In the past they would be able to sue the startup for appropriating data that Facebook was granted an exclusive license to via TOS. Now it's not so clear. Where are the limits of my control of my own data?
- dx034 8y ago
  The data belongs to the user. There's nothing Facebook can do to prevent exporting if it's via the data backup. They can just design it in a way that is easy to read by humans but very challenging for parsers.
  - chatmasta 8y ago
    Yeah, I understand it belongs to the user and they can export it. But does any third party service then have a right to allow the users to import their data from Facebook?
    - dx034 8y ago
      Yes, the user owns the data and can give consent.
  - Sir_Substance 8y ago
    >They can just design it in a way that is easy to read by humans but very challenging for parsers. This is explicitly forbidden in article 20.1
    - dx034 8y ago
      Machine readable only means no images. You can still structure it in a way that it's a pain to import. Or use changing structures. Definitely violates the spirit of the law but don't think Facebook cares about that.
platelminto 8y ago
The assumption you're making with most of your points is that, currently, data is only safe from governments/hackers because its not readily available to users, and for some reason it being not easily accessible by users means its safer (correct me if I'm reading what you're saying wrong). I don't think making the data more available to users means it's now inherently less safe - actually, it could be argued that having all the data in one place makes it easier to protect ('Keep all your eggs in one basket, and put that basket in Fort Knox'). Additionally, if PII isn't stored securely enough, as it should, and that data gets breached, the company is at fault - again, which it should. Making these companies more liable incentivises them to take their security more seriously, which I think is good. (I also trust my government, but that's a separate argument)
- zerostar07 8y ago
  You have expanded the surface area for hackers for sure esp. if you have an automated system. If your system is manual, like a phone number, that's not immune to phishing/stolen identity attacks.
TeMPOraL 8y ago
> If any user can see their data on any service than any government can quickly plug-in to access all user data on any service. This is like NSA Prism for everything. This could streamline processing of warrants, but beyond that, not much changes. If company's infrastructure was vulnerable to governments, it probably still will be. Maybe less so, given that GDPR also adds extra motivation for keeping users' data secure. > If a user can export their data easily from any service, they can easily resell their own data for money to services that seek to monetize that data. They could even rent out their data by the day for model training using the right to delete. As it should be? They own it, so they can sell it. > Account takeovers by hackers will lead to much more severe data breaches, since all data on that user in the system is easily accessible. Not necessarily. GDPR isn't about storing all user data in one big table named PII. It's about knowing, via company procedures, what data you store and what the lifecycle of that data is. Also, with rights to delete data and revoke consents, there'll likely be less data available for an attacker to exfiltrate. > The information apocalypse is made all that more easy because acount takeover + deep fakes + lyrebird plus all that easily accessible juicy data = impersonate anyone. Not sure how this is relevant to GDPR. Could you elaborate? > Data renting will create a way to monetize account takeover. The account takeover will include all possible information used to identify a person so how are the data brokers supposed to know it isn't you and how are you supposed to get your data back once it's out there getting monetized? How was this different before GDPR? I don't see anything changing in that regard; what you wrote is already the case. Again, if anything, GDPR will reduce the amount of information an attacker can extract from a compromised account, because companies are incentivized to reduce the amount of data they store.
pjc50 8y ago
Nothing in the directive requires the access to personal data to be done "in band" through the normal login only. It's a valid interpretation of GDPR to only accept "give me all my data" requests by post, and require additional ID to confirm that you're giving it to the right person. "The controller shall take appropriate measures to provide any information referred to in Articles 13 and 14 and any communication under Articles 15 to 22 and 34 relating to processing to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a child. The information shall be provided in writing, or by other means, including, where appropriate, by electronic means. When requested by the data subject, the information may be provided orally, provided that the identity of the data subject is proven by other means." "Without prejudice to Article 11, where the controller has reasonable doubts concerning the identity of the natural person making the request referred to in Articles 15 to 21, the controller may request the provision of additional information necessary to confirm the identity of the data subject." (article 12)
csomar 8y ago
> If a user can export their data easily from any service, they can easily resell their own data for money to services that seek to monetize that data. They could even rent out their data by the day for model training using the right to delete. This has been tried infinitely. It doesn't work. Say your service can extract $5/year/user from advertisers. At 25million users, you can pull a $125m revenue. That's huge. But if users were to sell their data, it'd only give $2-3 if you take commissions into questions. As people realize that their data does not bring much cash, and the invasiveness of the procedure (will you agree to share your weekly grocery purchases for one year with 202 advertiser, and you get paid $2?). Most people will disagree as they realize how a horrible on an equation it is. Only bots and kids with no disposable income will remain.

camillomiller 8y ago

The option to monetize your own data is an amazing idea: a startup that pays you to upload the data you can download from your google, apple, facebook, BIGNAME account, basically renting it daily until you revoke consent, then uses it to do all sort of shit you can with it. You’ll get hypeprofiled and harassed with all sorts of advertising, but you’re actually getting real money for that.

gregknicholson 8y ago
When “you are the product”, you can sell that product.
- zerostar07 8y ago
  you would have to find a market for them first. realistically private data is useless outside of a marketing platform like google or facebook. Maybe you can fill up some forms or polls for a few cents, that's it.
scrollaway 8y ago
The problem with that model is... how much money is a single profile worth, really? I'd love to be proven wrong and for a company to implement this. But as far as I know, it's not being done because the math doesn't work out. It's too cheap for regular people to be interested, and an incentive for spamtech to mass create fake profiles and get paid pennies for it. In fact, the one variant I am aware of that works is survey sites, but that's because you get paid per result rather than for your data as a whole. If you're just renting your data daily, you'd get a lot less.
- akerro 8y ago
  > The problem with that model is... how much money is a single profile worth, really? I remember some estimates, facebook profile with a few years of history is around 1$, a few profiles from different sites of the same person 5$.
- deleted 8y ago
  [deleted]
matte_black 8y ago
Your data is worth about 21 cents.

dullgiulio 8y ago

What do you think changed for governments? If there is a search warrant, police could and still can access data. GDPR didn't change anything in this regard. My feeling is that in the EU there is a different view of government: it's not a third adversarial entity. Many other remarks you've made don't have anything to do with GDPR, for example fake accounts and takeovers.

oblio 8y ago
> My feeling is that in the EU there is a different view of government: it's not a third adversarial entity. That should be the de facto stance regarding government in democratic countries, in my opinion. The government is a third party that intermediates, fundamentally, between: * individuals/groups of individuals and other individuals/groups of individuals, all inside the same country * itself and the governments of other countries The first point is very important, a society of a big enough scale, in the absence of hierarchy invariably degenerates into an anarchy where the only law is the law of the jungle: the strongest survive. That's why we add this third party that can intervene for the weak. This third party can be corrupted by various interests, but the hope is that these interests balance themselves out. And even a corrupt state is better than no state at all (or even a very weak state). Look at current day Somalia, Iraq post 2001, Libya post 2011.
zerostar07 8y ago
> EU there is a different view of government: it's not a third adversarial entity. We are not from another planet. EU likes to portray itself as trustworthy - it largely is - but that doesn't mean there are no problems. EU governments can vastly differ in quality , you just happen to hear from the most accountable ones.

chatmasta 8y ago

On the positive side, it could also reduce product lock-in by increasing data portability. For example if I'm creating a social network startup, and users can export their data from Facebook in a parseable format, then it's trivial for me to offer an "import your data from Facebook" feature. The interesting question then becomes, could Facebook do anything about that? In the past they would be able to sue the startup for appropriating data that Facebook was granted an exclusive license to via TOS. Now it's not so clear. Where are the limits of my control of my own data?

dx034 8y ago
The data belongs to the user. There's nothing Facebook can do to prevent exporting if it's via the data backup. They can just design it in a way that is easy to read by humans but very challenging for parsers.
- chatmasta 8y ago
  Yeah, I understand it belongs to the user and they can export it. But does any third party service then have a right to allow the users to import their data from Facebook?
  - dx034 8y ago
    Yes, the user owns the data and can give consent.
- Sir_Substance 8y ago
  >They can just design it in a way that is easy to read by humans but very challenging for parsers. This is explicitly forbidden in article 20.1
  - dx034 8y ago
    Machine readable only means no images. You can still structure it in a way that it's a pain to import. Or use changing structures. Definitely violates the spirit of the law but don't think Facebook cares about that.

platelminto 8y ago

The assumption you're making with most of your points is that, currently, data is only safe from governments/hackers because its not readily available to users, and for some reason it being not easily accessible by users means its safer (correct me if I'm reading what you're saying wrong). I don't think making the data more available to users means it's now inherently less safe - actually, it could be argued that having all the data in one place makes it easier to protect ('Keep all your eggs in one basket, and put that basket in Fort Knox'). Additionally, if PII isn't stored securely enough, as it should, and that data gets breached, the company is at fault - again, which it should. Making these companies more liable incentivises them to take their security more seriously, which I think is good. (I also trust my government, but that's a separate argument)

zerostar07 8y ago
You have expanded the surface area for hackers for sure esp. if you have an automated system. If your system is manual, like a phone number, that's not immune to phishing/stolen identity attacks.

TeMPOraL 8y ago

> If any user can see their data on any service than any government can quickly plug-in to access all user data on any service. This is like NSA Prism for everything. This could streamline processing of warrants, but beyond that, not much changes. If company's infrastructure was vulnerable to governments, it probably still will be. Maybe less so, given that GDPR also adds extra motivation for keeping users' data secure. > If a user can export their data easily from any service, they can easily resell their own data for money to services that seek to monetize that data. They could even rent out their data by the day for model training using the right to delete. As it should be? They own it, so they can sell it. > Account takeovers by hackers will lead to much more severe data breaches, since all data on that user in the system is easily accessible. Not necessarily. GDPR isn't about storing all user data in one big table named PII. It's about knowing, via company procedures, what data you store and what the lifecycle of that data is. Also, with rights to delete data and revoke consents, there'll likely be less data available for an attacker to exfiltrate. > The information apocalypse is made all that more easy because acount takeover + deep fakes + lyrebird plus all that easily accessible juicy data = impersonate anyone. Not sure how this is relevant to GDPR. Could you elaborate? > Data renting will create a way to monetize account takeover. The account takeover will include all possible information used to identify a person so how are the data brokers supposed to know it isn't you and how are you supposed to get your data back once it's out there getting monetized? How was this different before GDPR? I don't see anything changing in that regard; what you wrote is already the case. Again, if anything, GDPR will reduce the amount of information an attacker can extract from a compromised account, because companies are incentivized to reduce the amount of data they store.

pjc50 8y ago

Nothing in the directive requires the access to personal data to be done "in band" through the normal login only. It's a valid interpretation of GDPR to only accept "give me all my data" requests by post, and require additional ID to confirm that you're giving it to the right person. "The controller shall take appropriate measures to provide any information referred to in Articles 13 and 14 and any communication under Articles 15 to 22 and 34 relating to processing to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a child. The information shall be provided in writing, or by other means, including, where appropriate, by electronic means. When requested by the data subject, the information may be provided orally, provided that the identity of the data subject is proven by other means." "Without prejudice to Article 11, where the controller has reasonable doubts concerning the identity of the natural person making the request referred to in Articles 15 to 21, the controller may request the provision of additional information necessary to confirm the identity of the data subject." (article 12)

csomar 8y ago

> If a user can export their data easily from any service, they can easily resell their own data for money to services that seek to monetize that data. They could even rent out their data by the day for model training using the right to delete. This has been tried infinitely. It doesn't work. Say your service can extract $5/year/user from advertisers. At 25million users, you can pull a $125m revenue. That's huge. But if users were to sell their data, it'd only give $2-3 if you take commissions into questions. As people realize that their data does not bring much cash, and the invasiveness of the procedure (will you agree to share your weekly grocery purchases for one year with 202 advertiser, and you get paid $2?). Most people will disagree as they realize how a horrible on an equation it is. Only bots and kids with no disposable income will remain.