3 ms·

A photo itself is not a violation. An identifying photo on the other hand could be.

cromwellian 8y ago
But that's the rub. The system doesn't identify the photo, the user does. Imagine a photo service with Gmail-like filters, and I create a filter which says "If Photo Longitude/Latitude within this bounds, then photo is #GrangarsHouse". I've now turned a system with a general purpose EXIF metadata filter function into a system which can categorize locations that identify people's dwellings with high probability. "Identifying" a purpose could range from simply clustering visually similar photos using any number of non-machine-learning, non-biometrically-aware image processing algorithms, to using DNNs like FaceNet, or using the old eigenvector facial recognition algorithms of the 90s. As soon as I upload a photo I took of you to a photo hosting system that has any kind of search functionality at all, the risk is raised that you can be categorized and identified somehow. Really, "consent" was broken not by the company, but by the uploader. I really think the genie's out of the bottle on photos now. So many people are constantly photographing on their phones, and so many are uploading them to publicly accessible feeds all over the internet, that a federated crawler could already be built to track you, in fact, I think there's already some social media monitoring services that offer this. If you're out in public, you should pretty much assume you have no privacy with regards to your imagery, GDPR isn't gonna save you. You can control your own photos, but you can't control what other people do of photos taken of you.
- ghaff 8y ago
  I see people on this thread suggesting that it's the culture in many countries in continental Europe, for example, against having identifiable photos of them posted without permission. I'd suggest that there are probably billions of such photos online on Facebook, Flickr, and countless news sites, blogs, etc. I know I've posted plenty of them even just myself. I suppose you can object and campaign for the EU to setup its own Great Firewall or something along those lines and only allow companies to operate within its borders which adhere to stringent rules around posted imagery. Good luck with that.
  - kinsomo 8y ago
    > I suppose you can object and campaign for the EU to setup its own Great Firewall or something along those lines and only allow companies to operate within its borders which adhere to stringent rules around posted imagery. Good luck with that. Europe isn't China, and the distribution of those photos isn't an existential threat to the government, so a Great Firewall is overkill. Facebook has assets, operations, and revenue that originates in Europe that could be easily targeted with little controversy to gain compliance. If that doesn't work, Europle could always try to make the executive decision-makers personally liable. I'm sure Zuckerberg wants to be able to visit Europe in the future without being arrested.
    - ghaff 8y ago
      I actually tend to agree. At this point, I don't think there's so much space between the US and the EU's positions on privacy issues that large corporations can't find ways to reconcile. That said, I don't take it as a given that will always be the case. I can imagine future US companies offering services that run sufficiently afoul of current or future regulations in the EU and other jurisdictions that it makes sense to just not offer them there.

But that's the rub. The system doesn't identify the photo, the user does. Imagine a photo service with Gmail-like filters, and I create a filter which says "If Photo Longitude/Latitude within this bounds, then photo is #GrangarsHouse". I've now turned a system with a general purpose EXIF metadata filter function into a system which can categorize locations that identify people's dwellings with high probability. "Identifying" a purpose could range from simply clustering visually similar photos using any number of non-machine-learning, non-biometrically-aware image processing algorithms, to using DNNs like FaceNet, or using the old eigenvector facial recognition algorithms of the 90s. As soon as I upload a photo I took of you to a photo hosting system that has any kind of search functionality at all, the risk is raised that you can be categorized and identified somehow. Really, "consent" was broken not by the company, but by the uploader. I really think the genie's out of the bottle on photos now. So many people are constantly photographing on their phones, and so many are uploading them to publicly accessible feeds all over the internet, that a federated crawler could already be built to track you, in fact, I think there's already some social media monitoring services that offer this. If you're out in public, you should pretty much assume you have no privacy with regards to your imagery, GDPR isn't gonna save you. You can control your own photos, but you can't control what other people do of photos taken of you.

ghaff 8y ago
I see people on this thread suggesting that it's the culture in many countries in continental Europe, for example, against having identifiable photos of them posted without permission. I'd suggest that there are probably billions of such photos online on Facebook, Flickr, and countless news sites, blogs, etc. I know I've posted plenty of them even just myself. I suppose you can object and campaign for the EU to setup its own Great Firewall or something along those lines and only allow companies to operate within its borders which adhere to stringent rules around posted imagery. Good luck with that.
- kinsomo 8y ago
  > I suppose you can object and campaign for the EU to setup its own Great Firewall or something along those lines and only allow companies to operate within its borders which adhere to stringent rules around posted imagery. Good luck with that. Europe isn't China, and the distribution of those photos isn't an existential threat to the government, so a Great Firewall is overkill. Facebook has assets, operations, and revenue that originates in Europe that could be easily targeted with little controversy to gain compliance. If that doesn't work, Europle could always try to make the executive decision-makers personally liable. I'm sure Zuckerberg wants to be able to visit Europe in the future without being arrested.
  - ghaff 8y ago
    I actually tend to agree. At this point, I don't think there's so much space between the US and the EU's positions on privacy issues that large corporations can't find ways to reconcile. That said, I don't take it as a given that will always be the case. I can imagine future US companies offering services that run sufficiently afoul of current or future regulations in the EU and other jurisdictions that it makes sense to just not offer them there.