5 ms·

Not sure how this relates to GDPR - the arguments are nonsensical. People tend to bump everything under GDPR now like its some form of gods commandment. If I si

Not sure how this relates to GDPR - the arguments are nonsensical. People tend to bump everything under GDPR now like its some form of gods commandment. If I simply sit in the cafe watching someone continuously near me, I am collecting data, and nobody can do anything about it. When you leave your home, your privacy is gone. When you make anything public your privacy is gone. Not sure anything is ethically wrong with the software existence, the problem seems to be data usage, just as if somebody found out his neighbors wife is in porn and went to twitter and said it publicly with few pictures as a proof, and people do that. It's naive to think that this thing can/will go away, if anything, because of this news alone who knows how many more random programmers are retrying this (or even make business plans) at this very moment.

geezerjay 7y ago
> Not sure how this relates to GDPR GDPR states that the lawful basis for processing of data depends, among other things, on: * the individual's explicit consent to the processing of his or her personal data. * protecting the vital interests of a data subject or another individual This violates both criteria, thus is indirect violation of the GDPR.
- majkinetor 7y ago
  * Face is not considered personal data AFAIK * What the heck is vital interest ? For person playing in a movie it may as well be that everybody watch it.
  - geezerjay 7y ago
    * Photos of a person is personal data, particularly those that are scraped from social networks. This is pretty much the whole point of GDPR. * Screwing up someone's life, as it is extensively desribed in the article, fits well into the definition of "vital interest". I find it quite baffling how someone posting on HN is oblivious to the link between GDPR and the need to punish those who abuse data collected from social networks against the wishes and best interests of the users to screw up their lives.
    - majkinetor 7y ago
      We are talking here about the law, not about ideal world to live in. The question is if photograph is personal data according to GDPR. Here is what I found [1]: Under GDPR Article 9, biometric data is among the special categories of personal data that is prohibited from being processed at all unless certain exceptional circumstances apply, and the definition of biometric data specifically refers to "facial images". Any images collected, whether via photos or videos, will only constitute biometric data if “specific technical means” are used to uniquely identify or authenticate an individual. GDPR makes an important distinction between facial-recognition data and photographs. Recital 51 of the GDPR states the distinction as follows: The processing of photographs should not systematically be considered to be processing of special categories of personal data as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person. [1]: https://iapp.org/news/a/how-should-we-regulate-facial-recognition-technology https://iapp.org/news/a/how-should-we-regulate-facial-recogn...
Aengeuad 7y ago
This has everything to do with the GDPR because the GDPR outlines the conditions you need to meet to process data, simply put actually gathering the data and using this tool is not legal within the EU. >If I simply sit in the cafe watching someone continuously near me, I am collecting data, and nobody can do anything about it. But the tool is doing more than that as it's also using data gathered from crawling social media profiles and then matching people, you cannot do this without specific consent under the GDPR. >When you leave your home, your privacy is gone. >When you make anything public your privacy is gone. GDPR provides controls on privacy, it does not say you are guaranteed privacy in every situation but that if somebody misuses your data in a way that violates your privacy you have rights to correct this misuse, e.g., the right to opt out and the right to erasure of data among others.
- jobigoud 7y ago
  Does GDPR applies to third party users of a website? Does it cover use of public data by other visitors or just use of private data by the site owner?
  - Aengeuad 7y ago
    This is a bit of a vague question, but most importantly the GDPR doesn't make a distinction between public/private data except in some niche contexts, the GDPR is more concerned about personal data which can be anything that can identify a natural person, e.g., names, email addresses, location data, IP addresses (in some circumstances, not all), etc. The GDPR mainly concerns processors and controllers of data where a processor or processing of data can include collecting that data, so in this context can mean third parties to a website, for example a company crawling social media for instance would have to follow the GDPR and have a lawful basis for collecting (processing) that data. The GDPR also generally applies to everybody (within the EU or serving EU customers) except 'a natural person in the course of a purely personal or household activity', it's important to note that non-profits still have to comply with the GDPR. Generally there's a lot of legal ways to process data as a legitimate business, the law is mostly concerned with giving individuals a means to opt out or to give them some rights with regards to their data, like the 'right to be forgotten' or the right to access the data a company may have on them.
buckminster 7y ago
If you sit in a cafe continuously staring at someone you will probably be asked to leave and never come back. Try it some time.
- majkinetor 7y ago
  Your failure as an alpha male could be deduced based on this sentence. Try to be little more subtle next time. Tip: use peripheral vision. :)
DanBC 7y ago
> When you leave your home, your privacy is gone This is not true in Europe.

geezerjay 7y ago

> Not sure how this relates to GDPR GDPR states that the lawful basis for processing of data depends, among other things, on: * the individual's explicit consent to the processing of his or her personal data. * protecting the vital interests of a data subject or another individual This violates both criteria, thus is indirect violation of the GDPR.

majkinetor 7y ago
* Face is not considered personal data AFAIK * What the heck is vital interest ? For person playing in a movie it may as well be that everybody watch it.
- geezerjay 7y ago
  * Photos of a person is personal data, particularly those that are scraped from social networks. This is pretty much the whole point of GDPR. * Screwing up someone's life, as it is extensively desribed in the article, fits well into the definition of "vital interest". I find it quite baffling how someone posting on HN is oblivious to the link between GDPR and the need to punish those who abuse data collected from social networks against the wishes and best interests of the users to screw up their lives.
  - majkinetor 7y ago
    We are talking here about the law, not about ideal world to live in. The question is if photograph is personal data according to GDPR. Here is what I found [1]: Under GDPR Article 9, biometric data is among the special categories of personal data that is prohibited from being processed at all unless certain exceptional circumstances apply, and the definition of biometric data specifically refers to "facial images". Any images collected, whether via photos or videos, will only constitute biometric data if “specific technical means” are used to uniquely identify or authenticate an individual. GDPR makes an important distinction between facial-recognition data and photographs. Recital 51 of the GDPR states the distinction as follows: The processing of photographs should not systematically be considered to be processing of special categories of personal data as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person. [1]: https://iapp.org/news/a/how-should-we-regulate-facial-recognition-technology https://iapp.org/news/a/how-should-we-regulate-facial-recogn...

Aengeuad 7y ago

This has everything to do with the GDPR because the GDPR outlines the conditions you need to meet to process data, simply put actually gathering the data and using this tool is not legal within the EU. >If I simply sit in the cafe watching someone continuously near me, I am collecting data, and nobody can do anything about it. But the tool is doing more than that as it's also using data gathered from crawling social media profiles and then matching people, you cannot do this without specific consent under the GDPR. >When you leave your home, your privacy is gone. >When you make anything public your privacy is gone. GDPR provides controls on privacy, it does not say you are guaranteed privacy in every situation but that if somebody misuses your data in a way that violates your privacy you have rights to correct this misuse, e.g., the right to opt out and the right to erasure of data among others.

jobigoud 7y ago
Does GDPR applies to third party users of a website? Does it cover use of public data by other visitors or just use of private data by the site owner?
- Aengeuad 7y ago
  This is a bit of a vague question, but most importantly the GDPR doesn't make a distinction between public/private data except in some niche contexts, the GDPR is more concerned about personal data which can be anything that can identify a natural person, e.g., names, email addresses, location data, IP addresses (in some circumstances, not all), etc. The GDPR mainly concerns processors and controllers of data where a processor or processing of data can include collecting that data, so in this context can mean third parties to a website, for example a company crawling social media for instance would have to follow the GDPR and have a lawful basis for collecting (processing) that data. The GDPR also generally applies to everybody (within the EU or serving EU customers) except 'a natural person in the course of a purely personal or household activity', it's important to note that non-profits still have to comply with the GDPR. Generally there's a lot of legal ways to process data as a legitimate business, the law is mostly concerned with giving individuals a means to opt out or to give them some rights with regards to their data, like the 'right to be forgotten' or the right to access the data a company may have on them.

buckminster 7y ago

If you sit in a cafe continuously staring at someone you will probably be asked to leave and never come back. Try it some time.

majkinetor 7y ago
Your failure as an alpha male could be deduced based on this sentence. Try to be little more subtle next time. Tip: use peripheral vision. :)

DanBC 7y ago

> When you leave your home, your privacy is gone This is not true in Europe.