6 ms·

This is deeply troubling. As a scientist who uses* Dropbox I gave no informed consent. I know they claim personally identifiable information was removed but sti

by plg 8y ago

This is deeply troubling. As a scientist who uses* Dropbox I gave no informed consent. I know they claim personally identifiable information was removed but still I gave no consent for this. *not for long, perhaps

raphman 8y ago
Exactly. See also https://twitter.com/kopfnuss/status/1020575998205710336 https://twitter.com/kopfnuss/status/1020575998205710336 and https://twitter.com/RaphaelWimmer/status/1020582873345163264 https://twitter.com/RaphaelWimmer/status/1020582873345163264
bsder 8y ago
I continue to be stunned that people still somehow think that these services have any modicum of consideration for their users. If you don't want your information accessed--run your own servers, people. That's your only option.
yborg 8y ago
I can't speak to how informed you were when you gave the consent, but if you are using the service, you provided it. "Law & Order and the Public Interest. We may disclose your information to third parties if we determine that such disclosure is reasonably necessary to: (a) comply with any applicable law, regulation, legal process, or appropriate government request; (b) protect any person from death or serious bodily injury; (c) prevent fraud or abuse of Dropbox or our users; (d) protect Dropbox’s rights, property, safety, or interest; or (e) perform a task carried out in the public interest." I would assume that this research fell under the "task carried out in the public interest" clause.
- plg 8y ago
  If THAT is their defense —- we all agreed to it even if we didn’t understand it at the time —- well then good luck to them
  - smokeyj 8y ago
    Why else would Condi Rice be on the board /puts on tinfoil hat
  - Alex3917 8y ago
    Isn’t public interest a criteria for getting IRB approval? Having read all the recent AoIR threads on ethics, this doesn’t seem outside of the accepted norms.
    - krageon 8y ago
      Accepted by who? Obviously not the person you are responding to. Ethics is a relative field, not one full of absolutes.
- IshKebab 8y ago
  That doesn't stand up under the GDPR any more as far as I know.
  - trampypizza 8y ago
    I imagine the work was carried out by a processor, which could be perfectly legal if the contract between the two entities had adequate data protection clauses. This is just a guess though, I'm sure its much more complex than that.
    - blub 8y ago
      If they asked consent specifically for these types of studies, then it's legal. As in: a form asking the user if their information can be used in this way and giving them the possibility of opting out. Adding one more clause to the privacy policy doesn't count.
      - greggman 8y ago
        opting-out is not OK via the GDPR. Only Opt-In is allowed or at least that's my reading GDRP section 32 Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject's agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement. This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject's acceptance of the proposed processing of his or her personal data. Silence, pre-ticked boxes or inactivity should not therefore constitute consent. Consent should cover all processing activities carried out for the same purpose or purposes. When the processing has multiple purposes, consent should be given for all of them. If the data subject's consent is to be given following a request by electronic means, the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided. https://eur-lex.europa.eu/legal-content/EN/TXT/?qid=1532348683434&uri=CELEX:02016R0679-20160504 https://eur-lex.europa.eu/legal-content/EN/TXT/?qid=15323486... Am I mis-understanding?
ErikVandeWater 8y ago
This may come across as argumentative, but it's still a valid question - What's the harm to you?
- ggg9990 8y ago
  The harm is that 1) data which seems anonymized can be de-anonymized due to carelessness or advances in analytical techniques, and 2) it’s mine. I have laptops in my house for example that I’ve not used in years and will never use again. That doesn’t give you the right to steal them even if there’s no explicit “harm” to me.
- another-one-off 8y ago
  The point of consent is that it isn't your (or Dropbox's) opinion on what constitutes harm that matters. It is the person who gives consent.
- jeffwass 8y ago
  Maybe the parent was performing a research project on Dropbox collaboration techniques and got scooped? But seriously, as an example, I know people that share sensitive personal information with their accountants at tax time using Dropbox. Would suck for any of that to be made available to any third parties.
- nl 8y ago
  Given it was from universities, then prior disclosure of IP for patent applications could be a "harm". Even the directory names and structures could be key information in some applications.
- ggg9990 8y ago
  Imagine you have a folder in your Dropbox with 237 subfolders, and each of those subfolders has a certain number of files in it. The largest folder has 1,132 files, for example, the second largest has 916, the third-largest has 771, etc. Then imagine you have a second folder with 117 subfolders with another pattern like above. Now imagine that the first folder structure matches a torrent of embarrassing pornography and the second appears to be a superset of a project published to GitHub under your name (i.e. with some directories being gitignored)
pacbard 8y ago
I wonder how they got approval from the Northwestern Institutional Review Board. Not having explicit consent from research subjects might indicate that they qualified for some form of exempt status. Did they sell them that Dropbox collects that data as part of their normal operation, therefore consent is not required? Did they say that Dropbox's anonymization was enough to guarantee subjects' anonymity? Did they say that Dropbox's user agreement already enrolls users into research projects?
- fhsm 8y ago
  Looks easy enough to ask: https://irb.northwestern.edu/participants/questions-and-concerns https://irb.northwestern.edu/participants/questions-and-conc... Participant questions go to eyates@northwestern.edu and non-participant questions go to irb@northwestern.edu.
- ggg9990 8y ago
  As a Dropbox paying customer and never having heard of the Northwestern Institutional Review Board it's not them that pisses me off. I haven't reconsidered my usage of Dropbox for a very long time, since I made the decision to stay with them after their no-password fiasco. Today is the first day in a long time.

by plg 8y ago

raphman 8y ago

Exactly. See also https://twitter.com/kopfnuss/status/1020575998205710336 https://twitter.com/kopfnuss/status/1020575998205710336 and https://twitter.com/RaphaelWimmer/status/1020582873345163264 https://twitter.com/RaphaelWimmer/status/1020582873345163264

bsder 8y ago

I continue to be stunned that people still somehow think that these services have any modicum of consideration for their users. If you don't want your information accessed--run your own servers, people. That's your only option.

yborg 8y ago

I can't speak to how informed you were when you gave the consent, but if you are using the service, you provided it. "Law & Order and the Public Interest. We may disclose your information to third parties if we determine that such disclosure is reasonably necessary to: (a) comply with any applicable law, regulation, legal process, or appropriate government request; (b) protect any person from death or serious bodily injury; (c) prevent fraud or abuse of Dropbox or our users; (d) protect Dropbox’s rights, property, safety, or interest; or (e) perform a task carried out in the public interest." I would assume that this research fell under the "task carried out in the public interest" clause.

plg 8y ago
If THAT is their defense —- we all agreed to it even if we didn’t understand it at the time —- well then good luck to them
- smokeyj 8y ago
  Why else would Condi Rice be on the board /puts on tinfoil hat
- Alex3917 8y ago
  Isn’t public interest a criteria for getting IRB approval? Having read all the recent AoIR threads on ethics, this doesn’t seem outside of the accepted norms.
  - krageon 8y ago
    Accepted by who? Obviously not the person you are responding to. Ethics is a relative field, not one full of absolutes.
IshKebab 8y ago
That doesn't stand up under the GDPR any more as far as I know.
- trampypizza 8y ago
  I imagine the work was carried out by a processor, which could be perfectly legal if the contract between the two entities had adequate data protection clauses. This is just a guess though, I'm sure its much more complex than that.
  - blub 8y ago
    If they asked consent specifically for these types of studies, then it's legal. As in: a form asking the user if their information can be used in this way and giving them the possibility of opting out. Adding one more clause to the privacy policy doesn't count.
    - greggman 8y ago
      opting-out is not OK via the GDPR. Only Opt-In is allowed or at least that's my reading GDRP section 32 Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject's agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement. This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject's acceptance of the proposed processing of his or her personal data. Silence, pre-ticked boxes or inactivity should not therefore constitute consent. Consent should cover all processing activities carried out for the same purpose or purposes. When the processing has multiple purposes, consent should be given for all of them. If the data subject's consent is to be given following a request by electronic means, the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided. https://eur-lex.europa.eu/legal-content/EN/TXT/?qid=1532348683434&uri=CELEX:02016R0679-20160504 https://eur-lex.europa.eu/legal-content/EN/TXT/?qid=15323486... Am I mis-understanding?

ErikVandeWater 8y ago

This may come across as argumentative, but it's still a valid question - What's the harm to you?

ggg9990 8y ago
The harm is that 1) data which seems anonymized can be de-anonymized due to carelessness or advances in analytical techniques, and 2) it’s mine. I have laptops in my house for example that I’ve not used in years and will never use again. That doesn’t give you the right to steal them even if there’s no explicit “harm” to me.
another-one-off 8y ago
The point of consent is that it isn't your (or Dropbox's) opinion on what constitutes harm that matters. It is the person who gives consent.
jeffwass 8y ago
Maybe the parent was performing a research project on Dropbox collaboration techniques and got scooped? But seriously, as an example, I know people that share sensitive personal information with their accountants at tax time using Dropbox. Would suck for any of that to be made available to any third parties.
nl 8y ago
Given it was from universities, then prior disclosure of IP for patent applications could be a "harm". Even the directory names and structures could be key information in some applications.
ggg9990 8y ago
Imagine you have a folder in your Dropbox with 237 subfolders, and each of those subfolders has a certain number of files in it. The largest folder has 1,132 files, for example, the second largest has 916, the third-largest has 771, etc. Then imagine you have a second folder with 117 subfolders with another pattern like above. Now imagine that the first folder structure matches a torrent of embarrassing pornography and the second appears to be a superset of a project published to GitHub under your name (i.e. with some directories being gitignored)

pacbard 8y ago

I wonder how they got approval from the Northwestern Institutional Review Board. Not having explicit consent from research subjects might indicate that they qualified for some form of exempt status. Did they sell them that Dropbox collects that data as part of their normal operation, therefore consent is not required? Did they say that Dropbox's anonymization was enough to guarantee subjects' anonymity? Did they say that Dropbox's user agreement already enrolls users into research projects?

fhsm 8y ago
Looks easy enough to ask: https://irb.northwestern.edu/participants/questions-and-concerns https://irb.northwestern.edu/participants/questions-and-conc... Participant questions go to eyates@northwestern.edu and non-participant questions go to irb@northwestern.edu.
ggg9990 8y ago
As a Dropbox paying customer and never having heard of the Northwestern Institutional Review Board it's not them that pisses me off. I haven't reconsidered my usage of Dropbox for a very long time, since I made the decision to stay with them after their no-password fiasco. Today is the first day in a long time.