6 ms·

Frankly, I think a lot of this data isn't the users, but rather Spotify's. If Spotify didn't exist then the interaction data with it wouldn't exist. I don't see

by tensor 8y ago

Frankly, I think a lot of this data isn't the users, but rather Spotify's. If Spotify didn't exist then the interaction data with it wouldn't exist. I don't see how it can possibly be "owned" only by the user here. Does a user "own" security footage in a store that they enter? Definitely not.

heisenbergs 8y ago
That's the wrong analogy. The camera isn't some "security footage" in a random store, it's security footage from my own living room. A better analogy is this: if i install a video camera in my home and pay a service to store and process that data (think nest cam), but that i'm paying monthly for, then that data should be mine. Stuff going on in my living room (aka my music listening habits) should be mine and i should have access to my habits and restrict others from using it if i want to. Update: more importantly, without having access to data stored by any service, i can't make an informed decision as to whether the service is storing dubious information about myself that it shouldn't. Services can no longer hide the data they store about people.
- nickysielicki 8y ago
  None of these analogies make any sense or have any relevance to the nature of what's going on when you use a service. Fundamentally you are sending requests from your computer to their computers, and their computers are sending things back to your computer in response. They have every right to log what activities their own computers are doing, and (in my mind) they have every right to claim sole ownership over the logs that they create. The fact that they have to legally release this kind of thing is really twisted, at least to me. If you want to have logs of your listening data --- if you want to have logs of what your computer is doing --- how about you log it yourself? If that's too much work for you, whose fault is that? Don't use it if you don't like it. Music services are a dime a dozen nowadays. The biggest reason that any given consumer stays with a given service has to do with recommendations and playlists and the profile that they've built on you. The fact that these companies now have to give that data back to consumers, which they could presumably feed into another (cheaper) service, disincentivizes companies from building better recommendation engines and down the line it ultimately makes for a worse experience for music listeners.
  - _r_o_y_ 8y ago
    With that logic you could argue that almost nothing should be regulated, as the "work" nowadays is always done by someone else, what is the different between this and a credit score?
delinka 8y ago
If the user didn't use Spotify, then the interaction data wouldn't exist. It takes two. Perhaps if these companies had taken that tact (mutual ownership), then there'd have been no need for a law to specifically allow users to get the data created with their own effort.
- dsp1234 8y ago
  If I write down every song that I play through Spotify for a year. Does Spotify own that?
  - ralusek 8y ago
    No, but that's you writing down every song. The alternative is them saving one of their interactions to their server. These aren't remotely comparable...
    - dsp1234 8y ago
      Party A records every interaction with Party B. Party B records every interaction with Party A. Who owns what Party A recorded, and who owns what Party B recorded?
      - detaro 8y ago
        That's why "ownership" is a bad model for this, and (to my knowledge) not really used in any privacy laws. They are not about who owns records, it's about who has which rights to them. Under GDPR, you do not own data about you a company has, but you have rights related to it.
      - anonytrary 8y ago
        Are you suggesting that the user should track their interactions themselves if they want to own a copy?
      - fipple 8y ago
        When Party A is a multibillion dollar corporation and Party B is an individual, the arguments can not be parallelized.
lostlogin 8y ago
A lot of countries have laws that allow you to have access to any information stored that relates to you, health, education, criminal justice, etc. I think this logical but ‘ownership’ seems a bit of a reach.
ncol 8y ago
> Does a user "own" security footage in a store that they enter? Definitely not. Why not? Data is everywhere these days. You won't be able just quit e.g. social media in the future to avoid being tracked. One of your friends will tag you, your face will be indexed, your name will be correlated to your phone number, your phone number to your ip address and now they know everything you read anyway. If that isn't the future you want you can either come up with all sorts of rules for when and where you can and can't take pictures and collect data, which all the companies will try to avoid anyways. Or you can say that people own their own data and only reasonable usage is granted automatically. Presumably reasonable usage of a security camera would be to, you know, ensure security. Maybe you can opt in to some consumer behavior survey. But they shouldn't just be able to sell the data to a data mining company for face recognition, location tracking and consumer intelligence.
sbr464 8y ago
I’m upvoting and agree in the realistic point you are making, but feel this isn’t the most popular point of view right now? I personally believe info just shouldn’t be captured period, beyond reasons for authentication protection purposes/identifying malicious/off pattern use of my login/auth token. We are releasing a new business/info mgmt product soon that has no GA/full story/user tracking whatsoever. It’s not clear why everyone enables a floodgate of tracking just ‘cause. We are implementing better feedback/reporting channels instead.
- robbiemitchell 8y ago
  > I personally believe > It’s not clear why everyone enables a floodgate of tracking just ‘cause. Have you worked in marketing, product development, or customer support? There are plenty of services that are used to help people generally do their jobs, identify problems, figure out what to build, improve the product, and to enable support folks to support customers. But yes, there are all sorts of other, third-party trackers and cookies that are not as directly relevant.
  - sbr464 8y ago
    Yes, I have. It’s a tough argument/longer conversation I realize. I feel it’s getting out of hand overall. As technology/saas products make it easier to simply capture everything, including user actions/playback/screenshots, to the point that someone in marketing at X startup is watching my private usage of their app on their MacBook Air somewhere without really caring or realizing how intrusive they are being. I realize 99.9% don’t intend to abuse or don’t even realize the intrusion, there needs to be a reset where companies take a stand and find greater value in simply not engaging in this low hanging fruit.
    - robbiemitchell 8y ago
      I wonder whether there's also a security compliance component here. For example, if you're SOC 2 compliant, does that preclude casual data review like that? If so, perhaps this will lead to greater demand for that kind of certification.
rsynnott 8y ago
Kind of: https://www.dataprotection.ie/docs/Data-Protection-CCTV/242.htm https://www.dataprotection.ie/docs/Data-Protection-CCTV/242.... You can make a subject access request for CCTV footage.
- robbiemitchell 8y ago
  Whoa. You're right. This is kind of insanely low fee mandated. > The data controller may charge up to €6.35 for responding to such a request and must respond within 40 days. > This normally involves providing a copy of the footage in video format. ... Where stills are supplied, it would be necessary to supply a still for every second of the recording in which the requester's image appears in order to comply with the obligation to supply a copy of all personal data held. > Where images of parties other than the requesting data subject appear on the CCTV footage the onus lies on the data controller to pixelate or otherwise redact or darken out the images of those other parties before supplying a copy of the footage or stills from the footage to the requestor. Alternatively, the data controller may seek the consent of those other parties whose images appear in the footage to release an unedited copy containing their images to the requester I wouldn't be surprised if some video workflow products pop up to help companies comply with requests like this. For example, select the target person on video, automatically pixelate the rest, stitch together and export all clips of the target, securely mail it and log the task completion, etc.
  - madeofpalk 8y ago
    This is nothing new. The right to request CCTV footage of you has been about in the UK for 20 years. It's covered by the Data Protection Act 1998. I remember some music video done this requested footage like 10 years ago https://www.youtube.com/watch?v=3LWpzHSOndk https://www.youtube.com/watch?v=3LWpzHSOndk Stop trying to VC-fund everything single idea that pops into your head.
    - robbiemitchell 8y ago
      > Stop trying to VC-fund everything single idea that pops into your head. Even if had suggested VC funding (I didn't), were an investor (I'm not), lived in the UK (I don't), and had experience with video automation (I don't), why would you care? The background info was helpful enough.
trav4225 8y ago
Exactly. Don't use logic though. Logic is cold and hateful. ;)
snowwrestler 8y ago
Try to use recognizable in-store footage of a person in a commercial advertisement without their consent and see what the lawyers say. It's not as clear-cut as you are making it out to be. You cannot just use photos or video of a person however you want without their consent.
- jamescostian 8y ago
  Spotify is not making commercial advertisements showing all the raw data they have collected on you. Instead, they are probably doing things like aggregating data on their users and looking for trends. It's more like watching security footage (or having machines watch it and let you know what they've observed) and then making decisions with that information.
- tapoxi 8y ago
  That's because footage of them uses their image/likeness. If I used an amalgamation of all my customers it would be fine.
anonytrary 8y ago
> If Spotify didn't exist then the interaction data with it wouldn't exist. Likewise, if you didn't exist, then the interaction data wouldn't exist either. I agree that the ownership is more complex in this case and is hard to attribute solely to one party. One party provides a system where interactions can take place, another party provides the interactions. Who owns the interactions? Clearly both parties are required for them to exist.
lmkg 8y ago
Personally I think that GDPR represents a rejection of the idea of "ownership" as it applies to data. You will note that GDPR does not use "ownership" terminology anywhere. The closest it has is Data Controller, but GDPR makes that nowhere near the same as ownership. GDPR establishes that data subjects are stakeholders in their data. It doesn't mean that they own the data, but it also doesn't mean that they don't own the data. They have rights to the data, which the Controller has to respect, while the Controller also has their own rights. It's probably possible to model this situation as ownership (property law is complicated), but I think it's easier not to. Data is not owned, it is controlled and processed. Activities related to data are restricted.
dorkwood 8y ago
If Spotify invented a device that could read my thoughts, and stored them all in a file, who would own them? Me or Spotify?
tomtimtall 8y ago
Your income wouldn’t exist without the existance of your parents. This does not mean they own your income. You are arguing based on a contrived and unuseful philosophical basis. Who owns the data is a matter of law not philosophy, and having laws like GDPR looks like a great way to empower consumers, so who cares if the data would not be there without Spotify? It would not be there without the consumer either, in fact Spotify itself would not be there without the consumers... should the consumers then “logically” own Spotify?
MR4D 8y ago
Damn - you bring up a good point. I wonder what a lawyer would say. Taking your thought one more step, what happens to the data the store creates thru a facial recognition system tied to the footage? Is that covered? I don’t know, but there are thousands of further permutations on his thought. Another reason I hate the GDPR (great intent, horrible execution).
- xg15 8y ago
  I think the general point of decision is still about "personally identifiable information". So my (IANAL) understanding is: If the data is somehow tied to your real life identity, it's protected. E.g., the headphone brand might be protected because it's uniquely associated with your user account which is uniquely tied to a real-life identity. I guess, whether or not the facial recognition output is protected, might depend on whether you want to use it to identify the person behind it - e.g., if it's an identifier to a database, it might be protected. If it's an emotion score or eye tracking analysis, it might not be protected, unless it's associated with your identity by some other process.
xg15 8y ago
> Does a user "own" security footage in a store that they enter? Definitely not. I recently visited the main station in Cologne, Germany. They literally had notices posted next to the time tables about CCTV being conducted and about your GDPR rights concerning CCTV footage taken from you. While this wasn't a straight "you own the footage", they did acknowledge you have certain rights regarding the footage.

by tensor 8y ago

heisenbergs 8y ago

That's the wrong analogy. The camera isn't some "security footage" in a random store, it's security footage from my own living room. A better analogy is this: if i install a video camera in my home and pay a service to store and process that data (think nest cam), but that i'm paying monthly for, then that data should be mine. Stuff going on in my living room (aka my music listening habits) should be mine and i should have access to my habits and restrict others from using it if i want to. Update: more importantly, without having access to data stored by any service, i can't make an informed decision as to whether the service is storing dubious information about myself that it shouldn't. Services can no longer hide the data they store about people.

nickysielicki 8y ago
None of these analogies make any sense or have any relevance to the nature of what's going on when you use a service. Fundamentally you are sending requests from your computer to their computers, and their computers are sending things back to your computer in response. They have every right to log what activities their own computers are doing, and (in my mind) they have every right to claim sole ownership over the logs that they create. The fact that they have to legally release this kind of thing is really twisted, at least to me. If you want to have logs of your listening data --- if you want to have logs of what your computer is doing --- how about you log it yourself? If that's too much work for you, whose fault is that? Don't use it if you don't like it. Music services are a dime a dozen nowadays. The biggest reason that any given consumer stays with a given service has to do with recommendations and playlists and the profile that they've built on you. The fact that these companies now have to give that data back to consumers, which they could presumably feed into another (cheaper) service, disincentivizes companies from building better recommendation engines and down the line it ultimately makes for a worse experience for music listeners.
- _r_o_y_ 8y ago
  With that logic you could argue that almost nothing should be regulated, as the "work" nowadays is always done by someone else, what is the different between this and a credit score?

delinka 8y ago

If the user didn't use Spotify, then the interaction data wouldn't exist. It takes two. Perhaps if these companies had taken that tact (mutual ownership), then there'd have been no need for a law to specifically allow users to get the data created with their own effort.

dsp1234 8y ago
If I write down every song that I play through Spotify for a year. Does Spotify own that?
- ralusek 8y ago
  No, but that's you writing down every song. The alternative is them saving one of their interactions to their server. These aren't remotely comparable...
  - dsp1234 8y ago
    Party A records every interaction with Party B. Party B records every interaction with Party A. Who owns what Party A recorded, and who owns what Party B recorded?
    - detaro 8y ago
      That's why "ownership" is a bad model for this, and (to my knowledge) not really used in any privacy laws. They are not about who owns records, it's about who has which rights to them. Under GDPR, you do not own data about you a company has, but you have rights related to it.
    - anonytrary 8y ago
      Are you suggesting that the user should track their interactions themselves if they want to own a copy?
    - fipple 8y ago
      When Party A is a multibillion dollar corporation and Party B is an individual, the arguments can not be parallelized.

lostlogin 8y ago

A lot of countries have laws that allow you to have access to any information stored that relates to you, health, education, criminal justice, etc. I think this logical but ‘ownership’ seems a bit of a reach.

ncol 8y ago

> Does a user "own" security footage in a store that they enter? Definitely not. Why not? Data is everywhere these days. You won't be able just quit e.g. social media in the future to avoid being tracked. One of your friends will tag you, your face will be indexed, your name will be correlated to your phone number, your phone number to your ip address and now they know everything you read anyway. If that isn't the future you want you can either come up with all sorts of rules for when and where you can and can't take pictures and collect data, which all the companies will try to avoid anyways. Or you can say that people own their own data and only reasonable usage is granted automatically. Presumably reasonable usage of a security camera would be to, you know, ensure security. Maybe you can opt in to some consumer behavior survey. But they shouldn't just be able to sell the data to a data mining company for face recognition, location tracking and consumer intelligence.

sbr464 8y ago

I’m upvoting and agree in the realistic point you are making, but feel this isn’t the most popular point of view right now? I personally believe info just shouldn’t be captured period, beyond reasons for authentication protection purposes/identifying malicious/off pattern use of my login/auth token. We are releasing a new business/info mgmt product soon that has no GA/full story/user tracking whatsoever. It’s not clear why everyone enables a floodgate of tracking just ‘cause. We are implementing better feedback/reporting channels instead.

robbiemitchell 8y ago
> I personally believe > It’s not clear why everyone enables a floodgate of tracking just ‘cause. Have you worked in marketing, product development, or customer support? There are plenty of services that are used to help people generally do their jobs, identify problems, figure out what to build, improve the product, and to enable support folks to support customers. But yes, there are all sorts of other, third-party trackers and cookies that are not as directly relevant.
- sbr464 8y ago
  Yes, I have. It’s a tough argument/longer conversation I realize. I feel it’s getting out of hand overall. As technology/saas products make it easier to simply capture everything, including user actions/playback/screenshots, to the point that someone in marketing at X startup is watching my private usage of their app on their MacBook Air somewhere without really caring or realizing how intrusive they are being. I realize 99.9% don’t intend to abuse or don’t even realize the intrusion, there needs to be a reset where companies take a stand and find greater value in simply not engaging in this low hanging fruit.
  - robbiemitchell 8y ago
    I wonder whether there's also a security compliance component here. For example, if you're SOC 2 compliant, does that preclude casual data review like that? If so, perhaps this will lead to greater demand for that kind of certification.

rsynnott 8y ago

Kind of: https://www.dataprotection.ie/docs/Data-Protection-CCTV/242.htm https://www.dataprotection.ie/docs/Data-Protection-CCTV/242.... You can make a subject access request for CCTV footage.

robbiemitchell 8y ago
Whoa. You're right. This is kind of insanely low fee mandated. > The data controller may charge up to €6.35 for responding to such a request and must respond within 40 days. > This normally involves providing a copy of the footage in video format. ... Where stills are supplied, it would be necessary to supply a still for every second of the recording in which the requester's image appears in order to comply with the obligation to supply a copy of all personal data held. > Where images of parties other than the requesting data subject appear on the CCTV footage the onus lies on the data controller to pixelate or otherwise redact or darken out the images of those other parties before supplying a copy of the footage or stills from the footage to the requestor. Alternatively, the data controller may seek the consent of those other parties whose images appear in the footage to release an unedited copy containing their images to the requester I wouldn't be surprised if some video workflow products pop up to help companies comply with requests like this. For example, select the target person on video, automatically pixelate the rest, stitch together and export all clips of the target, securely mail it and log the task completion, etc.
- madeofpalk 8y ago
  This is nothing new. The right to request CCTV footage of you has been about in the UK for 20 years. It's covered by the Data Protection Act 1998. I remember some music video done this requested footage like 10 years ago https://www.youtube.com/watch?v=3LWpzHSOndk https://www.youtube.com/watch?v=3LWpzHSOndk Stop trying to VC-fund everything single idea that pops into your head.
  - robbiemitchell 8y ago
    > Stop trying to VC-fund everything single idea that pops into your head. Even if had suggested VC funding (I didn't), were an investor (I'm not), lived in the UK (I don't), and had experience with video automation (I don't), why would you care? The background info was helpful enough.

trav4225 8y ago

Exactly. Don't use logic though. Logic is cold and hateful. ;)

snowwrestler 8y ago

Try to use recognizable in-store footage of a person in a commercial advertisement without their consent and see what the lawyers say. It's not as clear-cut as you are making it out to be. You cannot just use photos or video of a person however you want without their consent.

jamescostian 8y ago
Spotify is not making commercial advertisements showing all the raw data they have collected on you. Instead, they are probably doing things like aggregating data on their users and looking for trends. It's more like watching security footage (or having machines watch it and let you know what they've observed) and then making decisions with that information.
tapoxi 8y ago
That's because footage of them uses their image/likeness. If I used an amalgamation of all my customers it would be fine.

anonytrary 8y ago

> If Spotify didn't exist then the interaction data with it wouldn't exist. Likewise, if you didn't exist, then the interaction data wouldn't exist either. I agree that the ownership is more complex in this case and is hard to attribute solely to one party. One party provides a system where interactions can take place, another party provides the interactions. Who owns the interactions? Clearly both parties are required for them to exist.

lmkg 8y ago

Personally I think that GDPR represents a rejection of the idea of "ownership" as it applies to data. You will note that GDPR does not use "ownership" terminology anywhere. The closest it has is Data Controller, but GDPR makes that nowhere near the same as ownership. GDPR establishes that data subjects are stakeholders in their data. It doesn't mean that they own the data, but it also doesn't mean that they don't own the data. They have rights to the data, which the Controller has to respect, while the Controller also has their own rights. It's probably possible to model this situation as ownership (property law is complicated), but I think it's easier not to. Data is not owned, it is controlled and processed. Activities related to data are restricted.

dorkwood 8y ago

If Spotify invented a device that could read my thoughts, and stored them all in a file, who would own them? Me or Spotify?

tomtimtall 8y ago

Your income wouldn’t exist without the existance of your parents. This does not mean they own your income. You are arguing based on a contrived and unuseful philosophical basis. Who owns the data is a matter of law not philosophy, and having laws like GDPR looks like a great way to empower consumers, so who cares if the data would not be there without Spotify? It would not be there without the consumer either, in fact Spotify itself would not be there without the consumers... should the consumers then “logically” own Spotify?

MR4D 8y ago

Damn - you bring up a good point. I wonder what a lawyer would say. Taking your thought one more step, what happens to the data the store creates thru a facial recognition system tied to the footage? Is that covered? I don’t know, but there are thousands of further permutations on his thought. Another reason I hate the GDPR (great intent, horrible execution).

xg15 8y ago
I think the general point of decision is still about "personally identifiable information". So my (IANAL) understanding is: If the data is somehow tied to your real life identity, it's protected. E.g., the headphone brand might be protected because it's uniquely associated with your user account which is uniquely tied to a real-life identity. I guess, whether or not the facial recognition output is protected, might depend on whether you want to use it to identify the person behind it - e.g., if it's an identifier to a database, it might be protected. If it's an emotion score or eye tracking analysis, it might not be protected, unless it's associated with your identity by some other process.

xg15 8y ago

> Does a user "own" security footage in a store that they enter? Definitely not. I recently visited the main station in Cologne, Germany. They literally had notices posted next to the time tables about CCTV being conducted and about your GDPR rights concerning CCTV footage taken from you. While this wasn't a straight "you own the footage", they did acknowledge you have certain rights regarding the footage.