4 ms·

>I refuse to own any store loyalty cards because they give the store an exact list of what I buy, tied to my identity, which is a much bigger privacy threat. Y

>I refuse to own any store loyalty cards because they give the store an exact list of what I buy, tied to my identity, which is a much bigger privacy threat. You're engaging in self delusion if you think the almost uniformly cashless payment systems you embrace in Sweden don't already cause this to be the case about you down to the minutest level: with your payments, where you make them, what you buy, when, and a very fine-grained general profile of your daily activities and movements (paying digitally in any phyiscal location obviously ties you to said location at a certain place and time). It's almost absurd that you even mention concerns about "potential" privacy invasions while claiming the system you live in is in any way a good thing, just because it's convenient. None of this is to mention the problems it could cause if some sort of major disaster occurs or a data breach somewhere in the chain causes part or all of your entire history of payments to become commodity data should anyone ever want to use it against you in some way.. Not to mention the potential future ramifications of paternalistic or authoritarian government policies being used to "guide" your buying habits and personal life through a near total capacity to access your purchase history, and then tying this to regulatory "incentives". It would be all too easy for a government to implement something like this under the right circumstances if the entire consumer economy is already cashless and run through large institutions. That you think this isn't a problem indicates a deep blindness to just how important fundamental privacy via untraceable payments on a basic level is to any society that does value a modicum of breathing space for a sincerely private life. Also, there's a vast margin of difference between some bank or other third party guessing where you shop with cash because of your address and them knowing exactly what you bought and where by (very easily) monitoring your digital payment activities.

ACS_Solver 7y ago
Unless I'm very wrong about the technical implementation, the data that the bank has is just the store where I shopped (merchant, card terminal) and the amount. They do not have data on what I bought, as in the data that's on the store's receipt. The store, on the other hand, only has the card number and not my name. This is where I see the need for legal protections. The store should not be allowed to keep that receipt info (item breakdown) for more than X days. They should not be allowed to transmit it at all. The bank should likewise not be allowed to engage in any data mining or forward that information anywhere. As for the broader privacy implication, that is something I would hope a national cryptocurrency addresses. While cash is anonymous, anonymity is not a property exclusive to cash. From my point of view, everything sucks about cash except anonymity - so, by a software analogy, it makes more sense to port anonymity to cashless systems than to maintain a legacy cash system.
- distances 7y ago
  > Unless I'm very wrong about the technical implementation, the data that the bank has is just the store where I shopped (merchant, card terminal) and the amount. They do not have data on what I bought, as in the data that's on the store's receipt. You're partly correct, partly wrong -- as far as I know the payment provider doesn't have/store this data but can request it from merchants. Merchants have to opt in, but by now I assume all the large ones are in, at least. These APIs can be used to get purchase details such as item names, quantities, and tax rates. See e.g. https://developer.visa.com/capabilities/visa-cardholder-purchase-inquiry https://developer.visa.com/capabilities/visa-cardholder-purc...
  - ACS_Solver 7y ago
    Some of the language there indicates that's primarily with the US in mind, which it probably is indeed. I think Sweden's different. I've read the data usage policy of my local grocery store chains (those are quite detailed thanks to GDPR), and they indicate that no such data is shared unless I'm in a loyalty program. Joining their loyalty program counts as consent for a lot of data manipulation, but as long as I'm just purchasing goods, they're not allowed to collect or store any personally identifiable information. Also worth noting that bank privacy is protected by law, and it's a criminal offense for the bank to violate that by, for instance, telling a marketing company where I shop. While not perfect, I'm fairly comfortable with this level of legal protection for my data.
    - distances 7y ago
      I know for a fact that these APIs (in general, not necessarily this exact VISA API) are starting to be used in Europe's privacy champion, Germany. I do believe that they can be only used for customer service enhancements (such as electronic receipt service or expense tracking), and are not freely available for third parties. I'm not an expert on the surrounding legislation though so that's just my assumption. Just pointing out that links to this data do exist, even if it has strong legal protections/opt-in barriers.
- elhudy 7y ago

ACS_Solver 7y ago

Unless I'm very wrong about the technical implementation, the data that the bank has is just the store where I shopped (merchant, card terminal) and the amount. They do not have data on what I bought, as in the data that's on the store's receipt. The store, on the other hand, only has the card number and not my name. This is where I see the need for legal protections. The store should not be allowed to keep that receipt info (item breakdown) for more than X days. They should not be allowed to transmit it at all. The bank should likewise not be allowed to engage in any data mining or forward that information anywhere. As for the broader privacy implication, that is something I would hope a national cryptocurrency addresses. While cash is anonymous, anonymity is not a property exclusive to cash. From my point of view, everything sucks about cash except anonymity - so, by a software analogy, it makes more sense to port anonymity to cashless systems than to maintain a legacy cash system.

distances 7y ago
> Unless I'm very wrong about the technical implementation, the data that the bank has is just the store where I shopped (merchant, card terminal) and the amount. They do not have data on what I bought, as in the data that's on the store's receipt. You're partly correct, partly wrong -- as far as I know the payment provider doesn't have/store this data but can request it from merchants. Merchants have to opt in, but by now I assume all the large ones are in, at least. These APIs can be used to get purchase details such as item names, quantities, and tax rates. See e.g. https://developer.visa.com/capabilities/visa-cardholder-purchase-inquiry https://developer.visa.com/capabilities/visa-cardholder-purc...
- ACS_Solver 7y ago
  Some of the language there indicates that's primarily with the US in mind, which it probably is indeed. I think Sweden's different. I've read the data usage policy of my local grocery store chains (those are quite detailed thanks to GDPR), and they indicate that no such data is shared unless I'm in a loyalty program. Joining their loyalty program counts as consent for a lot of data manipulation, but as long as I'm just purchasing goods, they're not allowed to collect or store any personally identifiable information. Also worth noting that bank privacy is protected by law, and it's a criminal offense for the bank to violate that by, for instance, telling a marketing company where I shop. While not perfect, I'm fairly comfortable with this level of legal protection for my data.
  - distances 7y ago
    I know for a fact that these APIs (in general, not necessarily this exact VISA API) are starting to be used in Europe's privacy champion, Germany. I do believe that they can be only used for customer service enhancements (such as electronic receipt service or expense tracking), and are not freely available for third parties. I'm not an expert on the surrounding legislation though so that's just my assumption. Just pointing out that links to this data do exist, even if it has strong legal protections/opt-in barriers.
elhudy 7y ago