4 ms·

GDPR Documents: Your Right to be Informed and Erased

66 points by neon_me 7y ago

gloflo 7y ago
A sibling repo to collect anonymised datasets would be superb. Or does that exist already?
- neon_me 7y ago
  I don't know any. But would support anything like that. What we plan now is to finalize erase request, start translations into the most of European languages as well as create some static page for generating those PDFs via entering data via form ... (list of authorities to report would be also great - because, from my experience, most of the results of the request were fails (from the company side))
megous 7y ago
It's probably not very useful to ask for too much, in a generic manner. My approach is to ask about what is not obvious or answerable by reading the privacy policy. For example source of particular data point that I have not given myself (like phone number, etc.), and that is not publicly available. Most of the answers to questions in the access request are usually available on the comapny's website already. And if you send generic sounding e-mail, you'll get a generic reply to read the privacy policy.
Guzba 7y ago
If someone took a leaked dataset, like for example the Dixons Carphone leak with 1.2 million records with personal info, then generated 1.2 million letters using the template from this repo, that would make for an interesting DoS attack. With that in mind, a big blast is also easy to filter out. Perhaps, instead of sending them all at once, you sent a random number from 1 to 100 per day, every day, indefinitely. No way to filter out the bogus requests, forced work for the company, and unknown consequences of having these people emailed about their private information usage. Chaotic good or chaotic evil? I have my opinion.
- deleted 7y ago
  [deleted]
- icebraining 7y ago
  Companies not only can, but are actually required, to verify your identity before giving out data. They can just send a template email with the necessary steps to verify it, and only do the work when that is done.
  - Guzba 7y ago
    People getting letters / emails about verifying their identity with a company would be a perfect outcome depending on your goal.
    - icebraining 7y ago
      What would that gain, compared to e.g. using the "reset password" form that most sites have now?
- emiliobumachar 7y ago
  Beware, impersonating people is more of a crime than alternative means of giving a company hell. IANAL.
deleted 7y ago
[deleted]
abootstrapper 7y ago
So when will we be able to delete hacker news accounts?
- hombre_fatal 7y ago
  Probably the same time HN gets a "this site has cookies" popup.
  - Nextgrid 7y ago
    Why would HN need one? HN only uses a session cookie, placed when you log in, which falls under legitimate interest (as there's no other way to provide their service overall). I wish the idea that all cookies require disclosure would die. Cookies don't require disclosure per-se. Stalking and tracking, regardless of method (whether it's a cookie, a token in the URL, in local storage, browser fingerprinting, etc) requires consent - cookies for functional purposes (hint: stalking doesn't count) don't require consent.
Proven 7y ago
No, you do not have the right to be informed. You have the right to inform yourself, but only if it doesn't violate another person's right (e.g. to their data secrecy). Also you don't have the right to be erased. You have the right to erase your own data. The Github repo is merely a toolbox for state-assisted harassment of individuals and organizations. You should be ashamed of yourself.
ajxs 7y ago
Has anyone here made a request for their information under the GDPR laws? I'm curious about what they received back. I'm specifically curious regarding the FAANG companies, and what kind of responses people have received from companies which so directly profit from customer data. Forgive any naïveté regarding the implementation of the laws if they have a built-in mechanism to defeat this, but I'd imagine that the companies would make the entire process as arbitrarily difficult as they legally could. Also, as a non-EU resident, do I have any ability to make such a request? I suppose the answer is 'no' from a strictly legal standpoint, but is it possible in practice? Or will the company require a comprehensive verification process that precludes such illegitimate requests.
- ygra 7y ago
  There were a few people that did this with Facebook years ago in Germany (GDPR is merely the EU-level legislature, some parts of it have existed in member state law for a while). The result basically was that you got a DVD with a lot of PDFs on it, if I remember correctly. Including all things you once uploaded and later deleted, which were apparently kept.
- number6 7y ago
  I would advice companies to also answer requests from non-EU residents. There is no discrimination between EU citizens and non-EU citizens in the Articles.
  - ajxs 7y ago
    Thank you for pointing that out. I'll have a look for myself and based on what I see I might send request in anyway. At very least I'll be able to definitively conclude what the response of these companies will be.

66 points by neon_me 7y ago

gloflo 7y ago

A sibling repo to collect anonymised datasets would be superb. Or does that exist already?

neon_me 7y ago
I don't know any. But would support anything like that. What we plan now is to finalize erase request, start translations into the most of European languages as well as create some static page for generating those PDFs via entering data via form ... (list of authorities to report would be also great - because, from my experience, most of the results of the request were fails (from the company side))

megous 7y ago

It's probably not very useful to ask for too much, in a generic manner. My approach is to ask about what is not obvious or answerable by reading the privacy policy. For example source of particular data point that I have not given myself (like phone number, etc.), and that is not publicly available. Most of the answers to questions in the access request are usually available on the comapny's website already. And if you send generic sounding e-mail, you'll get a generic reply to read the privacy policy.

Guzba 7y ago

If someone took a leaked dataset, like for example the Dixons Carphone leak with 1.2 million records with personal info, then generated 1.2 million letters using the template from this repo, that would make for an interesting DoS attack. With that in mind, a big blast is also easy to filter out. Perhaps, instead of sending them all at once, you sent a random number from 1 to 100 per day, every day, indefinitely. No way to filter out the bogus requests, forced work for the company, and unknown consequences of having these people emailed about their private information usage. Chaotic good or chaotic evil? I have my opinion.

deleted 7y ago
[deleted]
icebraining 7y ago
Companies not only can, but are actually required, to verify your identity before giving out data. They can just send a template email with the necessary steps to verify it, and only do the work when that is done.
- Guzba 7y ago
  People getting letters / emails about verifying their identity with a company would be a perfect outcome depending on your goal.
  - icebraining 7y ago
    What would that gain, compared to e.g. using the "reset password" form that most sites have now?
emiliobumachar 7y ago
Beware, impersonating people is more of a crime than alternative means of giving a company hell. IANAL.

deleted 7y ago

[deleted]

abootstrapper 7y ago

So when will we be able to delete hacker news accounts?

hombre_fatal 7y ago
Probably the same time HN gets a "this site has cookies" popup.
- Nextgrid 7y ago
  Why would HN need one? HN only uses a session cookie, placed when you log in, which falls under legitimate interest (as there's no other way to provide their service overall). I wish the idea that all cookies require disclosure would die. Cookies don't require disclosure per-se. Stalking and tracking, regardless of method (whether it's a cookie, a token in the URL, in local storage, browser fingerprinting, etc) requires consent - cookies for functional purposes (hint: stalking doesn't count) don't require consent.

Proven 7y ago

No, you do not have the right to be informed. You have the right to inform yourself, but only if it doesn't violate another person's right (e.g. to their data secrecy). Also you don't have the right to be erased. You have the right to erase your own data. The Github repo is merely a toolbox for state-assisted harassment of individuals and organizations. You should be ashamed of yourself.

ajxs 7y ago

Has anyone here made a request for their information under the GDPR laws? I'm curious about what they received back. I'm specifically curious regarding the FAANG companies, and what kind of responses people have received from companies which so directly profit from customer data. Forgive any naïveté regarding the implementation of the laws if they have a built-in mechanism to defeat this, but I'd imagine that the companies would make the entire process as arbitrarily difficult as they legally could. Also, as a non-EU resident, do I have any ability to make such a request? I suppose the answer is 'no' from a strictly legal standpoint, but is it possible in practice? Or will the company require a comprehensive verification process that precludes such illegitimate requests.

ygra 7y ago
There were a few people that did this with Facebook years ago in Germany (GDPR is merely the EU-level legislature, some parts of it have existed in member state law for a while). The result basically was that you got a DVD with a lot of PDFs on it, if I remember correctly. Including all things you once uploaded and later deleted, which were apparently kept.
number6 7y ago
I would advice companies to also answer requests from non-EU residents. There is no discrimination between EU citizens and non-EU citizens in the Articles.
- ajxs 7y ago
  Thank you for pointing that out. I'll have a look for myself and based on what I see I might send request in anyway. At very least I'll be able to definitively conclude what the response of these companies will be.