4 ms·

> And i don't believe for a second the data they're allowing you to "autodelete" genuinely gets deleted. It just gets removed from your view. While "deleted" m

> And i don't believe for a second the data they're allowing you to "autodelete" genuinely gets deleted. It just gets removed from your view. While "deleted" might take a while (eventual consistency FTW), any company with a presence in the EU has a lot to lose if such a scheme (beyond what they declare, eg. "31 days to recover your account") ever sees the light of day.

pdimitar 7y ago
You mean the fines that the board of directors writes off as a cost of business and they never change policy due to them? Those fines?
- pgeorgi 7y ago
  Not changing policy means escalating fines (those 4% of global revenue maximum are nothing to sneeze at, and so far compliance was the cheaper route) but also, at some point, the inability to operate in the EU. Even if a company only does the bare minimum required under GDPR, total deletion of data on request is part of that.
  - pdimitar 7y ago
    But these more severe measures are either 5-10 years away, or never going to happen at all (the latter part is my assumption, not claiming it as a fact). IMO the corporate board of directors will coast on the situation for as long as possible and only then will we see some changes, don't you agree?
    - pgeorgi 7y ago
      > IMO the corporate board of directors will coast on the situation for as long as possible and only then will we see some changes, don't you agree? There are a few cases already with fines around 2.8% of revenue, and those fines don't mean the DPA will go away. The expectation is that these fines are paid _and_ the reason for the fine is resolved. Turnover in the 2.8% case (Taxa 4x35 in Denmark) was from Fall 2018 (start of investigation) to March 2019 (when the DPA reported the incident to the police and "recommended" that fine). Sadly the only follow-ups on the case that I could find are behind paywalls (so I can't read them), but apparently the DPA isn't done with them yet. It's all a matter of exercising pressure, and it seems that the authorities are willing to do that.
everdev 7y ago
True, but I doubt EU courts could take up a case involving non-EU consumers. So, even though Google compiles in Europe, they don't have to afford the same protection to non-EU users.
- pgeorgi 7y ago
  > involving non-EU consumers GDPR covers any interaction of people or organizations in the EU. So non-EU consumers are covered once they're visiting the EU (citizen of a member state or not), and potentially (untested, not spelled out explicitly) when they use a VPN with an endpoint in the EU (because they're then likely talking to data centers under the control of the European subsidiary). > they don't have to afford the same protection to non-EU users Given that "EU user" is murky like that, I'm not sure if any company goes through the trouble of differentiating which action happened from inside or outside the EU beyond raw GDPR blocking that refuse service entirely for accesses from within the EU.
Nextgrid 7y ago
Legal action requires you to be able to prove they still hold the data. If they only use it for something where other factors affect the outcome (ad targeting, etc) they can still keep your data forever while hiding behind plausible deniability the other factors provide them (from outside, there’s no way to prove that a particular ad was served to you because of your data instead of another factor they use as input for the algorithm).
- i_cant_speel 7y ago
  There are a lot of mouths to keep shut on the inside. If anyone responsible for building the fake delete tool spoke out, Google would be in trouble.
  - Nextgrid 7y ago
    If people couldn’t be unethical at scale then Facebook wouldn’t exist at all and yet it does, so I’m sure the same would be possible at Google.
    - TeMPOraL 7y ago
      That's different. People can easily be unethical at scale when incentives align. What they almost never can be is coordinated at scale against the individual incentives - whether for good or bad.
      - kkarakk 7y ago
        Also maintaining that deleted data is an issue, can't just magically move it to your datacenter in the mountains. someone will notice the movement of data even if it's automated. i suspect google just extracts as much data as possible from the photo, maybe trains an algo or two with the metadata and then deletes
- pgeorgi 7y ago
  > from outside, there’s no way to prove that a particular ad was served to you because of your data instead of another factor they use as input for the algorithm Create an account, use it to excessively look for tea pots until you predominantly get ads for tea pots. Store the cookie[0] that encodes your user id. Delete the account. After the advertised account retention period, try the cookie again in an otherwise squeaky clean session that gives random ads without the cookie: Tea pots? Something survived. No tea pots? No targetting. (and yes, the onus to demonstrate your accusation well enough to convince a DPA is on you, IMHO as it should be) [0] or whatever bits of data are necessary: try to recreate the tea-pot session after a logout without logging in officially to determine what's necessary.
sixothree 7y ago
Even then I would still fear that data having already been transformed into something else and using word play to disassociate with the original set of data. edit: I've been subjected to Google's dark patterns for so many years that I doubt I will ever trust this company to be honest with me.
Darkphibre 7y ago
As someone impacted by the GDPR (AAA Game Studio, and all player stats / multiplayer matches getting impacted), backups are exempted: "The GDPR is open to interpretation, so we asked an EU Member State supervisory authority (CNIL in France) for clarification. CNIL confirmed that you’ll have one month to answer to a removal request, and that you don’t need to delete a backup set in order to remove an individual from it. Organizations will have to clearly explain to the data subject (using clear and plain language) that his or her personal data has been removed from production systems, but a backup copy may remain, but will expire after a certain amount of time (indicate the retention time in your communication with the data subject). Backups should only be used for restoring a technical environment, and data subject personal data should not be processed again after restore (and deleted again). While this adds some complexity, it allows organizations to have some time to re-engineer their data protection processes." https://blog.quantum.com/backup-administrators-the-1-advice-to-deal-with-gdpr-and-the-right-of-erasure/#.Wv7qy0xFwy9 https://blog.quantum.com/backup-administrators-the-1-advice-... You are absolutely correct that following the intent of the GDPR (we don't have access to the user data once they file the request) is of utmost importance. But the prior poster is correct that the data still exists. Edit: All opinions my own and not that of my employer, etc. etc.
01100011 7y ago
I wonder how they define 'your data'? If I train a neural net to recognize you and predict your behaviors and preferences, are the weights of the network yours, or can I keep them? What if the network covers you and your family? Do I have to retrain my network?
- icebraining 7y ago
  Yes, if the neural net can identify a person, it's covered by the GDPR: "Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person" (Recital 26). In which case you need a lawful basis for doing such processing (of which consent is just one possibility). Furthermore, that's considered "profiling" and is subject to extra rules if it can have strong impact on the person's life. On the other hand, if the data is well mixed with other people's, preventing that recognition, then it has been anonymized, and therefore it's not longer subject to the GDPR (Recital 26). But note that you're still subject to it when you're capturing and using personal data to train that model, even if the model itself is anonymized.

pdimitar 7y ago

You mean the fines that the board of directors writes off as a cost of business and they never change policy due to them? Those fines?

pgeorgi 7y ago
Not changing policy means escalating fines (those 4% of global revenue maximum are nothing to sneeze at, and so far compliance was the cheaper route) but also, at some point, the inability to operate in the EU. Even if a company only does the bare minimum required under GDPR, total deletion of data on request is part of that.
- pdimitar 7y ago
  But these more severe measures are either 5-10 years away, or never going to happen at all (the latter part is my assumption, not claiming it as a fact). IMO the corporate board of directors will coast on the situation for as long as possible and only then will we see some changes, don't you agree?
  - pgeorgi 7y ago
    > IMO the corporate board of directors will coast on the situation for as long as possible and only then will we see some changes, don't you agree? There are a few cases already with fines around 2.8% of revenue, and those fines don't mean the DPA will go away. The expectation is that these fines are paid _and_ the reason for the fine is resolved. Turnover in the 2.8% case (Taxa 4x35 in Denmark) was from Fall 2018 (start of investigation) to March 2019 (when the DPA reported the incident to the police and "recommended" that fine). Sadly the only follow-ups on the case that I could find are behind paywalls (so I can't read them), but apparently the DPA isn't done with them yet. It's all a matter of exercising pressure, and it seems that the authorities are willing to do that.

everdev 7y ago

True, but I doubt EU courts could take up a case involving non-EU consumers. So, even though Google compiles in Europe, they don't have to afford the same protection to non-EU users.

pgeorgi 7y ago
> involving non-EU consumers GDPR covers any interaction of people or organizations in the EU. So non-EU consumers are covered once they're visiting the EU (citizen of a member state or not), and potentially (untested, not spelled out explicitly) when they use a VPN with an endpoint in the EU (because they're then likely talking to data centers under the control of the European subsidiary). > they don't have to afford the same protection to non-EU users Given that "EU user" is murky like that, I'm not sure if any company goes through the trouble of differentiating which action happened from inside or outside the EU beyond raw GDPR blocking that refuse service entirely for accesses from within the EU.

Nextgrid 7y ago

Legal action requires you to be able to prove they still hold the data. If they only use it for something where other factors affect the outcome (ad targeting, etc) they can still keep your data forever while hiding behind plausible deniability the other factors provide them (from outside, there’s no way to prove that a particular ad was served to you because of your data instead of another factor they use as input for the algorithm).

i_cant_speel 7y ago
There are a lot of mouths to keep shut on the inside. If anyone responsible for building the fake delete tool spoke out, Google would be in trouble.
- Nextgrid 7y ago
  If people couldn’t be unethical at scale then Facebook wouldn’t exist at all and yet it does, so I’m sure the same would be possible at Google.
  - TeMPOraL 7y ago
    That's different. People can easily be unethical at scale when incentives align. What they almost never can be is coordinated at scale against the individual incentives - whether for good or bad.
    - kkarakk 7y ago
      Also maintaining that deleted data is an issue, can't just magically move it to your datacenter in the mountains. someone will notice the movement of data even if it's automated. i suspect google just extracts as much data as possible from the photo, maybe trains an algo or two with the metadata and then deletes
pgeorgi 7y ago
> from outside, there’s no way to prove that a particular ad was served to you because of your data instead of another factor they use as input for the algorithm Create an account, use it to excessively look for tea pots until you predominantly get ads for tea pots. Store the cookie[0] that encodes your user id. Delete the account. After the advertised account retention period, try the cookie again in an otherwise squeaky clean session that gives random ads without the cookie: Tea pots? Something survived. No tea pots? No targetting. (and yes, the onus to demonstrate your accusation well enough to convince a DPA is on you, IMHO as it should be) [0] or whatever bits of data are necessary: try to recreate the tea-pot session after a logout without logging in officially to determine what's necessary.

sixothree 7y ago

Even then I would still fear that data having already been transformed into something else and using word play to disassociate with the original set of data. edit: I've been subjected to Google's dark patterns for so many years that I doubt I will ever trust this company to be honest with me.

Darkphibre 7y ago

As someone impacted by the GDPR (AAA Game Studio, and all player stats / multiplayer matches getting impacted), backups are exempted: "The GDPR is open to interpretation, so we asked an EU Member State supervisory authority (CNIL in France) for clarification. CNIL confirmed that you’ll have one month to answer to a removal request, and that you don’t need to delete a backup set in order to remove an individual from it. Organizations will have to clearly explain to the data subject (using clear and plain language) that his or her personal data has been removed from production systems, but a backup copy may remain, but will expire after a certain amount of time (indicate the retention time in your communication with the data subject). Backups should only be used for restoring a technical environment, and data subject personal data should not be processed again after restore (and deleted again). While this adds some complexity, it allows organizations to have some time to re-engineer their data protection processes." https://blog.quantum.com/backup-administrators-the-1-advice-to-deal-with-gdpr-and-the-right-of-erasure/#.Wv7qy0xFwy9 https://blog.quantum.com/backup-administrators-the-1-advice-... You are absolutely correct that following the intent of the GDPR (we don't have access to the user data once they file the request) is of utmost importance. But the prior poster is correct that the data still exists. Edit: All opinions my own and not that of my employer, etc. etc.

01100011 7y ago

I wonder how they define 'your data'? If I train a neural net to recognize you and predict your behaviors and preferences, are the weights of the network yours, or can I keep them? What if the network covers you and your family? Do I have to retrain my network?

icebraining 7y ago
Yes, if the neural net can identify a person, it's covered by the GDPR: "Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person" (Recital 26). In which case you need a lawful basis for doing such processing (of which consent is just one possibility). Furthermore, that's considered "profiling" and is subject to extra rules if it can have strong impact on the person's life. On the other hand, if the data is well mixed with other people's, preventing that recognition, then it has been anonymized, and therefore it's not longer subject to the GDPR (Recital 26). But note that you're still subject to it when you're capturing and using personal data to train that model, even if the model itself is anonymized.