4 ms·

Well... I hope this is something GPDR covers. If there was a case to start seeing the impact of the new law, this seems like a good example.

lightbyte 8y ago
Would GDPR even cover this? I don't see why La Liga would need to include any personal information about the user in their data. They are concerned with identifying the buisness streaming pirated matches, not who is watching. Edit: The official statement actually answers this >The codes will not refer to your name, but to your IP address and the specific ID assigned by the PPP when you register.
- paulcole 8y ago
  If someone's recording the sounds around me, I don't see anyway that's not personal information about me.
  - Tharkun 8y ago
    Who would be the guilty party here? If your phone is spying on me, I'll likely get angry with you. The fact that you're a victim of the football league isn't my problem, you're the one doing the spying.
    - chopin 8y ago
      La Liga of course. They are recording data about me, without my consent. Doing it through some third party (the phone owner) doesn't absolve them.
      - Tharkun 8y ago
        You're probably right, but doesn't the owner of the phone share some responsibility?
        chopin 8y ago
        I would think so. I would love to see authorities going after both. That would set a wonderful precedent.
- tupilaq 8y ago
  Well, that (IP address and specific ID) probably constitutes information from which the identity of a natural living person can be discerned and therefore does fall under the protections of GDPR. However, that by itself doesn't mean you can't collect it, just that you need to have specifically asked for their informed consent and not hidden this purpose away in a changelog.
- brownbat 8y ago
  Isn't this really gathering data about a nonconsenting third party, the business? Does GDPR generally allow you or your apps to collect information that helps identify legal and moral transgressions around you? What if you are watching the game at a friend's house? The collection is definitely going to have some false positives. In that case the coordinates would identify your friend. It seems like deputizing devices to spy on others. Regardless if those others may be doing something wrong or are caught up by accident, it seems like the sort of thing data protection would prevent. This will be a good test of real competing interests. I don't know that privacy should win in the end here, but both sides actually have powerful prima facie cases to make.
JorgeGT 8y ago
This was indeed discovered because as per GPDR, they had to specify why they were using the mic and GPS. As soon as the update hit the store (after the GPDR entered into effect) and some users saw the changelog and user permission requests disclosing this use, it started to hit the news here in Spain. The Spanish regulator, AEPD, has stated that preliminary steps to begin an official investigation are being conducted already: https://twitter.com/AEPD_es/status/1006115567227559936 https://twitter.com/AEPD_es/status/1006115567227559936 For those who understand Spanish, here's a good technical analysis: https://reversecodes.wordpress.com/2018/06/12/analizando-la-app-de-la-liga-para-android/ https://reversecodes.wordpress.com/2018/06/12/analizando-la-...
- thiagocsf 8y ago
  Thanks for sharing! Entertaining read. The app uses rot(4) to obscure data, includes a debug link with the collected data, and has the Fluzo service api key hardcoded, among other gems.
  - bthrm 8y ago
    Of course the API key is hardcoded... how else would the app contact the server?
    - jchw 8y ago
      At some point the app needs to have some credential hardcoded, but you can make it more obscured by getting the API key from your own server with some kind of challenge/response. This makes it easier to rotate third party API keys and cut off unauthorized usage, by including information in the challenge request that could be used to correlate unauthorized requests. Your hardcoded credential could then become a cryptographic key that you could rotate on app upfates. I am not sure how many apps actually go through this trouble.
- hartator 8y ago
  You mean they were using the mic to see if you were watching the game?

lightbyte 8y ago

Would GDPR even cover this? I don't see why La Liga would need to include any personal information about the user in their data. They are concerned with identifying the buisness streaming pirated matches, not who is watching. Edit: The official statement actually answers this >The codes will not refer to your name, but to your IP address and the specific ID assigned by the PPP when you register.

paulcole 8y ago
If someone's recording the sounds around me, I don't see anyway that's not personal information about me.
- Tharkun 8y ago
  Who would be the guilty party here? If your phone is spying on me, I'll likely get angry with you. The fact that you're a victim of the football league isn't my problem, you're the one doing the spying.
  - chopin 8y ago
    La Liga of course. They are recording data about me, without my consent. Doing it through some third party (the phone owner) doesn't absolve them.
    - Tharkun 8y ago
      You're probably right, but doesn't the owner of the phone share some responsibility?
      - chopin 8y ago
        I would think so. I would love to see authorities going after both. That would set a wonderful precedent.
tupilaq 8y ago
Well, that (IP address and specific ID) probably constitutes information from which the identity of a natural living person can be discerned and therefore does fall under the protections of GDPR. However, that by itself doesn't mean you can't collect it, just that you need to have specifically asked for their informed consent and not hidden this purpose away in a changelog.
brownbat 8y ago
Isn't this really gathering data about a nonconsenting third party, the business? Does GDPR generally allow you or your apps to collect information that helps identify legal and moral transgressions around you? What if you are watching the game at a friend's house? The collection is definitely going to have some false positives. In that case the coordinates would identify your friend. It seems like deputizing devices to spy on others. Regardless if those others may be doing something wrong or are caught up by accident, it seems like the sort of thing data protection would prevent. This will be a good test of real competing interests. I don't know that privacy should win in the end here, but both sides actually have powerful prima facie cases to make.

JorgeGT 8y ago

This was indeed discovered because as per GPDR, they had to specify why they were using the mic and GPS. As soon as the update hit the store (after the GPDR entered into effect) and some users saw the changelog and user permission requests disclosing this use, it started to hit the news here in Spain. The Spanish regulator, AEPD, has stated that preliminary steps to begin an official investigation are being conducted already: https://twitter.com/AEPD_es/status/1006115567227559936 https://twitter.com/AEPD_es/status/1006115567227559936 For those who understand Spanish, here's a good technical analysis: https://reversecodes.wordpress.com/2018/06/12/analizando-la-app-de-la-liga-para-android/ https://reversecodes.wordpress.com/2018/06/12/analizando-la-...

thiagocsf 8y ago
Thanks for sharing! Entertaining read. The app uses rot(4) to obscure data, includes a debug link with the collected data, and has the Fluzo service api key hardcoded, among other gems.
- bthrm 8y ago
  Of course the API key is hardcoded... how else would the app contact the server?
  - jchw 8y ago
    At some point the app needs to have some credential hardcoded, but you can make it more obscured by getting the API key from your own server with some kind of challenge/response. This makes it easier to rotate third party API keys and cut off unauthorized usage, by including information in the challenge request that could be used to correlate unauthorized requests. Your hardcoded credential could then become a cryptographic key that you could rotate on app upfates. I am not sure how many apps actually go through this trouble.
hartator 8y ago
You mean they were using the mic to see if you were watching the game?