5 ms·

Publicly available data under the GDPR

40 points by r_singh 7y ago

bilekas 7y ago
The GDPR however is about the information being stored being specific for the requirements, but more the consent for information to be stored and the option to not have information stored. Also the time for which that information can be stored. If it comes from public sources, there needs to be a proven reason why its stored there, and if it is not required, it must be removed. I wasn't sure of any good example of 'Public Information' from the article..
- jimmaswell 7y ago
  We have a wealth of information on Beethoven's life from his conversation books - I wonder if future generations will be deprived of such things from the important people of today because of these privacy laws.
- r_singh 7y ago
  > I wasn't sure of any good example of 'Public Information' from the article.. A decent example would be online reviews. When someone leaves a review on Yelp or Tripadvisor, they're making their name, avatar, city location, interest, opinion on a subject matter—all public. Now there are websites that scrape these reviews and display them on their own property with their source attributed to the original review (Google and Agoda are examples). And there are web applications like Podium, Yext, etc. which help companies manage their online reviews by scraping them from all the business' listings. While a user can delete their information from the original data source assuming that the original data source obliges with GDPR, they may not be aware of what other parties have scraped and stored this information in their databases without explicit consent. Another relevant example could be publishing info on LinkedIn and having it scraped by companies like HiQ.
  - bilekas 7y ago
    Okay, but that scraped information is not in line with GDPR. The user has not given consent for that information to be stored. Yelp may be in line, storing identifiable information for particular reasons in order to utilize their services. But scraping is never in line with GDPR, if you are scraping, which is allowed for example, the information on users and people cannot be stored.
    - deleted 7y ago
      [deleted]
    - mstolpm 7y ago
      Could someone downvoting bilekas comment please eli15 why his comment is wrong? I'm under the impression that this is exactly the GDPR position: You are not allowed to store and process PII if you don't have the consent of the person identified. I'd be happy to be proven wrong.
      - impartial-word 7y ago
        If you expose your information you’ll be spammed, and when the spammer is challenged he/she will reason that it was done under “legitimate interest”. The only way is closing the leak and avoid any of your personal information exposed on the internet. History time: a shady company that organises conferences contacted me guessing my corporate email from information in Linked-in. When challenged they said “legitimate interest” and removed my information at the moment. I sent a formal complain to as much people as I could (they also exposed a lot of emails online) and left in some message boards information about this company so other people affected could understand easier where the information was leaked. They contacted three months later with a different company name (same speakers, same program, same names everywhere, same web, different domain), I repeated the same procedure. Also my name in Linked-in has only my initials.
      - mikekchar 7y ago
        Generally speaking, I don't think you are wrong, although the use of the word "consent" is potentially confusing. There are multiple lawful bases with which you can use PII. "Consent" is one of the. Others include "contractual", "legal obligation", "vital interest", "public task", "legitimate interest". For the case of a private entity scraping a website, it is unlikely that these other bases would apply, but it's not impossible. It would be interesting, for instance, if some kind of police work might be classified under "vital interest". But generally, you will need consent because none of the other bases will apply.
- BrentOzar 7y ago
  > I wasn't sure of any good example of 'Public Information' from the article. Questions and answers at Stack Overflow. Questions often include code snippets, some of which even include personally identifiable information like names and addresses. That data becomes public immediately, and then it’s reused by others when they download and adapt the Stack Overflow Data dumps.
deleted 7y ago
[deleted]

40 points by r_singh 7y ago

The GDPR however is about the information being stored being specific for the requirements, but more the consent for information to be stored and the option to not have information stored. Also the time for which that information can be stored. If it comes from public sources, there needs to be a proven reason why its stored there, and if it is not required, it must be removed. I wasn't sure of any good example of 'Public Information' from the article..

jimmaswell 7y ago
We have a wealth of information on Beethoven's life from his conversation books - I wonder if future generations will be deprived of such things from the important people of today because of these privacy laws.
r_singh 7y ago
> I wasn't sure of any good example of 'Public Information' from the article.. A decent example would be online reviews. When someone leaves a review on Yelp or Tripadvisor, they're making their name, avatar, city location, interest, opinion on a subject matter—all public. Now there are websites that scrape these reviews and display them on their own property with their source attributed to the original review (Google and Agoda are examples). And there are web applications like Podium, Yext, etc. which help companies manage their online reviews by scraping them from all the business' listings. While a user can delete their information from the original data source assuming that the original data source obliges with GDPR, they may not be aware of what other parties have scraped and stored this information in their databases without explicit consent. Another relevant example could be publishing info on LinkedIn and having it scraped by companies like HiQ.
- bilekas 7y ago
  Okay, but that scraped information is not in line with GDPR. The user has not given consent for that information to be stored. Yelp may be in line, storing identifiable information for particular reasons in order to utilize their services. But scraping is never in line with GDPR, if you are scraping, which is allowed for example, the information on users and people cannot be stored.
  - deleted 7y ago
    [deleted]
  - mstolpm 7y ago
    Could someone downvoting bilekas comment please eli15 why his comment is wrong? I'm under the impression that this is exactly the GDPR position: You are not allowed to store and process PII if you don't have the consent of the person identified. I'd be happy to be proven wrong.
    - impartial-word 7y ago
      If you expose your information you’ll be spammed, and when the spammer is challenged he/she will reason that it was done under “legitimate interest”. The only way is closing the leak and avoid any of your personal information exposed on the internet. History time: a shady company that organises conferences contacted me guessing my corporate email from information in Linked-in. When challenged they said “legitimate interest” and removed my information at the moment. I sent a formal complain to as much people as I could (they also exposed a lot of emails online) and left in some message boards information about this company so other people affected could understand easier where the information was leaked. They contacted three months later with a different company name (same speakers, same program, same names everywhere, same web, different domain), I repeated the same procedure. Also my name in Linked-in has only my initials.
    - mikekchar 7y ago
      Generally speaking, I don't think you are wrong, although the use of the word "consent" is potentially confusing. There are multiple lawful bases with which you can use PII. "Consent" is one of the. Others include "contractual", "legal obligation", "vital interest", "public task", "legitimate interest". For the case of a private entity scraping a website, it is unlikely that these other bases would apply, but it's not impossible. It would be interesting, for instance, if some kind of police work might be classified under "vital interest". But generally, you will need consent because none of the other bases will apply.
BrentOzar 7y ago
> I wasn't sure of any good example of 'Public Information' from the article. Questions and answers at Stack Overflow. Questions often include code snippets, some of which even include personally identifiable information like names and addresses. That data becomes public immediately, and then it’s reused by others when they download and adapt the Stack Overflow Data dumps.

deleted 7y ago

[deleted]