4 ms·
To be fair "checking attendance" fundamentally erodes privacy. That's not the issue (at least as I see it). The big questions in my head include "Who's storin
by bigiain 7y ago
To be fair "checking attendance" fundamentally erodes privacy.
That's not the issue (at least as I see it).
The big questions in my head include "Who's storing the biometric data? How are they securing it? Who has authorized access to it, and what processes and mechanisms are n place to ensure they only use it in authorized ways? What are authorized uses of the data? How is it ensured that authorized uses will ot be increased in scope? What process or mechanisms are in place to detect attempts or successful cases of some authorized 3rd party obtaining that data? What penalties are there for unauthorized use of the data and to whom will they be applied? What penalties are there for inadequately securing the data and to whom will those be applied? What processes mechanisms or policies are in place to ensure unauthorized access or failures to secure the data are detected and disclosed? How are those processes mechanisms or policies measured to ensure they're working?"
Pretty much _anyone_ dealing with EU citizen's data should already have the answers to those (and related) questions written down. (If you do not, think about how sure you are that the answer to those " .. to whom will the penalty be applied?" questions will not be "Who's responsible for the data breach? Oh, that'd be Barrin from the dev team. Here, let me give you his full contact details and their HR file! BTW, they'll be fired and marched out before close of business, might be best if you call them on their personal cell phone."
- sverhagen 7y agoIs that a thing, developers being personally responsible for the company that was not in compliance and that they, at some point, worked for?
- fridek 7y agoI wouldn't be surprised if you could chase someone for gross negligence, if it was a result of, for example, consciously prioritising features over security, or "I know the rules but they are BS" thinking. You can do that with doctors, and they often make mistakes because the hospital overworks them, or simply allows bad behaviours to continue.
- pkz 7y agoTo be fair, they did the following: - Data and analysis was done at a server in the class room (locked in a cabinet) - All parents signed a consent form before the trial started. - All data was erased after the trial ended. The Swedish DPA decided that: 1. Consent is not valid of there is a power difference between the subject and the requester. 2. They should have documented a PIA (Privacy impact assessment). 3. They should have contacted the DPA before starting the trial.
- TazeTSchnitzel 7y agoHmm, when can parents consent on behalf of children? Can children retract the consent given for them by their parents?
- mytailorisrich 7y agoThis is a big issue these days. Parents should be able to consent on behalf of their children and retraction should come from parents as well. This used to be considered common sense but not anymore.
- balfirevic 7y ago> This used to be considered common sense but not anymore. Good! Some progress at least.
- mytailorisrich 7y agoChildren cannot reasonably consent to most things concerning them. Ignoring reality for the sake of ideology isn't progress. By that logic, next a doctor will refuse to vaccinate an 8 year old because the child refused to give consent.
- balfirevic 7y agoNo, you misunderstand what the logic here is. Parents should be able to consent to some things in the name of their children and absolutely should not be able to do it for other things (even those things their children would be able to consent to were they grown ups, so I don't mean illegal things). Exactly what stuff the parents can consent to is the real question and should be argued properly and not treated as any kind of "common sense". Things that are necessary for the safety of the children - like vaccines - yes. Other things are on much more shaky grounds.