5 ms·

This has everything to do with the GDPR because the GDPR outlines the conditions you need to meet to process data, simply put actually gathering the data and us

This has everything to do with the GDPR because the GDPR outlines the conditions you need to meet to process data, simply put actually gathering the data and using this tool is not legal within the EU. >If I simply sit in the cafe watching someone continuously near me, I am collecting data, and nobody can do anything about it. But the tool is doing more than that as it's also using data gathered from crawling social media profiles and then matching people, you cannot do this without specific consent under the GDPR. >When you leave your home, your privacy is gone. >When you make anything public your privacy is gone. GDPR provides controls on privacy, it does not say you are guaranteed privacy in every situation but that if somebody misuses your data in a way that violates your privacy you have rights to correct this misuse, e.g., the right to opt out and the right to erasure of data among others.

jobigoud 7y ago
Does GDPR applies to third party users of a website? Does it cover use of public data by other visitors or just use of private data by the site owner?
- Aengeuad 7y ago
  This is a bit of a vague question, but most importantly the GDPR doesn't make a distinction between public/private data except in some niche contexts, the GDPR is more concerned about personal data which can be anything that can identify a natural person, e.g., names, email addresses, location data, IP addresses (in some circumstances, not all), etc. The GDPR mainly concerns processors and controllers of data where a processor or processing of data can include collecting that data, so in this context can mean third parties to a website, for example a company crawling social media for instance would have to follow the GDPR and have a lawful basis for collecting (processing) that data. The GDPR also generally applies to everybody (within the EU or serving EU customers) except 'a natural person in the course of a purely personal or household activity', it's important to note that non-profits still have to comply with the GDPR. Generally there's a lot of legal ways to process data as a legitimate business, the law is mostly concerned with giving individuals a means to opt out or to give them some rights with regards to their data, like the 'right to be forgotten' or the right to access the data a company may have on them.
majkinetor 7y ago
> the right to opt out and the right to erasure of data among others. Algorythm doesn't have to collect any data on you besides your image which is not considered private data given that you need to carry one. It can have single image and compare it to the porn collection without storing any results anywhere, but just returning 'XXX was a porn star in YYY'. Tool can also create opt out mechanism which would have to be pretty complex as providing ZZZ in the name blacklist isn't appropriate solution given that many people share this name. > But the tool is doing more than that as it's also using data gathered from crawling social media profiles and then matching people, you cannot do this without specific consent under Implementation detail. This can be totally avoided. Tool can accept picture and return the result.
- Aengeuad 7y ago
  >Algorythm doesn't have to collect any data on you besides your image which is not considered private data given that you need to carry one. The GDPR doesn't care about 'private' data (for the most part) as it only cares about personal data, and faces absolutely are considered personal data under article 4 point 14. Faces are even in a special category of data which you are prohibited from processing at all unless some conditions are met, although article 9 point 2e allows processing such data if they have been 'manifestly made public'. The GDPR doesn't define what 'manifestly made public' means but the Scottish Parliament[0] suggests that it could mean images purposely uploaded to social media and made public, but note that just because you are not prohibited from processing such images does not mean you have a lawful basis for processing that data in the first place. >It can have single image and compare it to the porn collection without storing any results anywhere, but just returning 'XXX was a porn star in YYY'. >Implementation detail. This can be totally avoided. Tool can accept picture and return the result. This is an implementation detail that I had not considered. The original tool and article talks about crawling both porn sites as well as social media and both are fraught with legal issues, not every video or image on porn sites is going to be legal in the first place (revenge porn, stolen images) never mind the copyright issues involved, and crawling social media for this information is simply not acceptable under the GDPR. >Tool can also create opt out mechanism Such a tool would almost certainly need to be opt in from the data subject, article 6 makes this clear, you need specific consent from the data subject or some other conditionals which aren't applicable here. Best case scenario if you want to operate such a tool in Europe is that you argue (in court, mind) that you have a legitimate interest to run such a tool which does not override the fundamental rights and freedoms of the data subject, which does not seem like it would go in your favour at all. [0] Page 6: https://www.parliament.scot/S5ChamberOffice/2018_06_01_Motions_Guidance_FINAL.pdf https://www.parliament.scot/S5ChamberOffice/2018_06_01_Motio...

jobigoud 7y ago

Does GDPR applies to third party users of a website? Does it cover use of public data by other visitors or just use of private data by the site owner?

Aengeuad 7y ago
This is a bit of a vague question, but most importantly the GDPR doesn't make a distinction between public/private data except in some niche contexts, the GDPR is more concerned about personal data which can be anything that can identify a natural person, e.g., names, email addresses, location data, IP addresses (in some circumstances, not all), etc. The GDPR mainly concerns processors and controllers of data where a processor or processing of data can include collecting that data, so in this context can mean third parties to a website, for example a company crawling social media for instance would have to follow the GDPR and have a lawful basis for collecting (processing) that data. The GDPR also generally applies to everybody (within the EU or serving EU customers) except 'a natural person in the course of a purely personal or household activity', it's important to note that non-profits still have to comply with the GDPR. Generally there's a lot of legal ways to process data as a legitimate business, the law is mostly concerned with giving individuals a means to opt out or to give them some rights with regards to their data, like the 'right to be forgotten' or the right to access the data a company may have on them.

majkinetor 7y ago

> the right to opt out and the right to erasure of data among others. Algorythm doesn't have to collect any data on you besides your image which is not considered private data given that you need to carry one. It can have single image and compare it to the porn collection without storing any results anywhere, but just returning 'XXX was a porn star in YYY'. Tool can also create opt out mechanism which would have to be pretty complex as providing ZZZ in the name blacklist isn't appropriate solution given that many people share this name. > But the tool is doing more than that as it's also using data gathered from crawling social media profiles and then matching people, you cannot do this without specific consent under Implementation detail. This can be totally avoided. Tool can accept picture and return the result.

Aengeuad 7y ago
>Algorythm doesn't have to collect any data on you besides your image which is not considered private data given that you need to carry one. The GDPR doesn't care about 'private' data (for the most part) as it only cares about personal data, and faces absolutely are considered personal data under article 4 point 14. Faces are even in a special category of data which you are prohibited from processing at all unless some conditions are met, although article 9 point 2e allows processing such data if they have been 'manifestly made public'. The GDPR doesn't define what 'manifestly made public' means but the Scottish Parliament[0] suggests that it could mean images purposely uploaded to social media and made public, but note that just because you are not prohibited from processing such images does not mean you have a lawful basis for processing that data in the first place. >It can have single image and compare it to the porn collection without storing any results anywhere, but just returning 'XXX was a porn star in YYY'. >Implementation detail. This can be totally avoided. Tool can accept picture and return the result. This is an implementation detail that I had not considered. The original tool and article talks about crawling both porn sites as well as social media and both are fraught with legal issues, not every video or image on porn sites is going to be legal in the first place (revenge porn, stolen images) never mind the copyright issues involved, and crawling social media for this information is simply not acceptable under the GDPR. >Tool can also create opt out mechanism Such a tool would almost certainly need to be opt in from the data subject, article 6 makes this clear, you need specific consent from the data subject or some other conditionals which aren't applicable here. Best case scenario if you want to operate such a tool in Europe is that you argue (in court, mind) that you have a legitimate interest to run such a tool which does not override the fundamental rights and freedoms of the data subject, which does not seem like it would go in your favour at all. [0] Page 6: https://www.parliament.scot/S5ChamberOffice/2018_06_01_Motions_Guidance_FINAL.pdf https://www.parliament.scot/S5ChamberOffice/2018_06_01_Motio...