4 ms·

> "The researcher reported an issue where someone’s deleted Instagram images and messages would be included in a copy of their information (...) We’ve fixed the

> "The researcher reported an issue where someone’s deleted Instagram images and messages would be included in a copy of their information (...) We’ve fixed the issue" This makes it sound like they consider "you could see it" the issue, not "we were still keeping it". In other words, the fix was to hide it, not to delete it. If I were the Irish DPA (and actually wanted to do my job and had the resources to, instead of being intentionally lazy/crippled to attract tech firm headquarters), I'd definitely be asking for retention plans and evidence that the data is now being removed in a timely manner, and start issuing fines (small ones for past transgressions, big ones if they keep doing it or don't have a decent plan how to make sure to get rid of data they shouldn't be having). For comparison: Deutsche Wohnen (large real estate) got slapped [1] with a 14.5 million EUR fine for over-retaining sensitive tenant data and not having an automated system to delete it. [1] https://www.dataprotectionreport.com/2019/11/first-multi-million-gdpr-fine-in-germany-e14-5-million-for-not-having-a-proper-data-retention-schedule-in-place/ https://www.dataprotectionreport.com/2019/11/first-multi-mil...

davidhyde 6y ago
Why small fines initially? I’d like to see privacy fines being used to make lots of money like traffic fines are used today. It’s a way to tax tech companies in your jurisdiction with the added benefit of improving privacy.
- londons_explore 6y ago
  Initially it was almost certainly accidental, or in a system first implemented before data protection laws covered this sort of thing. From the moment the problem is brought to their attention, then it becomes intentional and willful, so the fines should be much bigger.
- jacquesm 6y ago
  Because the goal is compliance, not to put companies out of business. When the laws were first enacted everybody was screaming that it was just to put companies out of business. Now they are wondering why the small initial fines. It's simple: change your ways and use the initial fines as a wake up call. If you then do not wake up and persist the fines will get heavier and heavier until you will pay attention. A Dutch hospital managed to get to the third round of fines and they weren't all that happy afterwards. 460K Euro fine for a single instance of ignoring the regulators on a single individual. Believe me when I tell you they have understood now. The initial fine was zero, just a warning to improve. The case revolved around a very minor dutch celebrity whose data was reviewed by hospital employees that should not have had that access.
  - luckylion 6y ago
    > Because the goal is compliance, not to put companies out of business. There's middle ground between "we take 100% of your revenue" and "we take 0.001% of your revenue". Given that we're not this lenient with private citizens and small companies, why should we be with international corporations?
    - jacquesm 6y ago
      That's why the fines can be ramped up. The largest fines were a substantial fraction of the revenues for the companies they were addressed to and there is no practical limit once you take per violation figures into account. You ignore this at your peril.
    - foepys 6y ago
      It's not 100%. The fine can get up to 4% global revenue or 20 million Euro, whichever is higher.
      - jacquesm 6y ago
        There is still some unclarity as to whether or not multiple fines can be issued for different transgressions, there hasn't been such a case yet and nobody has gotten close to the limit so for now this is still grey. But I think that once fined at that level no sane CEO is going to risk getting a second such fine in the same year or even at all.
  - davidhyde 6y ago
    Imagine if we lived in a society where you were given a small fine for the first time you commit murder and then life imprisonment for the second offence. This may lead people to believe that murder is a serious but forgivable offence when it is not. That’s my first argument: small fines play down the seriousness of the “crime”. My second argument is the efficiency of using capitalism to fight capitalism. Take money from companies who make mistakes with personal information. Be that out of ignorance, malice or bad luck. Why does it need to be fair and just - make money from it. Make it a risk to capture personal information in the first place. If those companies go out of business then so be it. Others will take their place. It’s not impossible to do business without storing personal information, there is just not enough incentive to bother.
j45 6y ago
If it takes deleting one's account to truly wipe your data, it should be made clear.
- lozf 6y ago
  What makes you think even deleting one's account will truly wipe data? These companies profit from personal info whether one is a customer or not. I would imagine everything exists with a "user de-activated since $DATE" entry or similar in their database. Perhaps I'm too cynical?
  - bryan_w 6y ago
    Actually I think the incentives are aligned here. If they can't show the pictures that they have claimed to have deleted then they can't use it to bring in eyes for advertisers, which means that the data is a net loss for them, causing them to have to buy more storage sooner. They should want to delete data as soon as possible
    - lozf 6y ago
      Hmm yes, they probably free up the bulk of space and just keep extensive metadata instead: "We don't have the picture, but we know you took one at date, time, location, make & model, shutter speed & aperture, and we regognized the faces of these 2 users X & Y, and another non-user for whom we have shadow profile Z wwas also tagged."

davidhyde 6y ago

Why small fines initially? I’d like to see privacy fines being used to make lots of money like traffic fines are used today. It’s a way to tax tech companies in your jurisdiction with the added benefit of improving privacy.

londons_explore 6y ago
Initially it was almost certainly accidental, or in a system first implemented before data protection laws covered this sort of thing. From the moment the problem is brought to their attention, then it becomes intentional and willful, so the fines should be much bigger.
jacquesm 6y ago
Because the goal is compliance, not to put companies out of business. When the laws were first enacted everybody was screaming that it was just to put companies out of business. Now they are wondering why the small initial fines. It's simple: change your ways and use the initial fines as a wake up call. If you then do not wake up and persist the fines will get heavier and heavier until you will pay attention. A Dutch hospital managed to get to the third round of fines and they weren't all that happy afterwards. 460K Euro fine for a single instance of ignoring the regulators on a single individual. Believe me when I tell you they have understood now. The initial fine was zero, just a warning to improve. The case revolved around a very minor dutch celebrity whose data was reviewed by hospital employees that should not have had that access.
- luckylion 6y ago
  > Because the goal is compliance, not to put companies out of business. There's middle ground between "we take 100% of your revenue" and "we take 0.001% of your revenue". Given that we're not this lenient with private citizens and small companies, why should we be with international corporations?
  - jacquesm 6y ago
    That's why the fines can be ramped up. The largest fines were a substantial fraction of the revenues for the companies they were addressed to and there is no practical limit once you take per violation figures into account. You ignore this at your peril.
  - foepys 6y ago
    It's not 100%. The fine can get up to 4% global revenue or 20 million Euro, whichever is higher.
    - jacquesm 6y ago
      There is still some unclarity as to whether or not multiple fines can be issued for different transgressions, there hasn't been such a case yet and nobody has gotten close to the limit so for now this is still grey. But I think that once fined at that level no sane CEO is going to risk getting a second such fine in the same year or even at all.
- davidhyde 6y ago
  Imagine if we lived in a society where you were given a small fine for the first time you commit murder and then life imprisonment for the second offence. This may lead people to believe that murder is a serious but forgivable offence when it is not. That’s my first argument: small fines play down the seriousness of the “crime”. My second argument is the efficiency of using capitalism to fight capitalism. Take money from companies who make mistakes with personal information. Be that out of ignorance, malice or bad luck. Why does it need to be fair and just - make money from it. Make it a risk to capture personal information in the first place. If those companies go out of business then so be it. Others will take their place. It’s not impossible to do business without storing personal information, there is just not enough incentive to bother.

j45 6y ago

If it takes deleting one's account to truly wipe your data, it should be made clear.

lozf 6y ago
What makes you think even deleting one's account will truly wipe data? These companies profit from personal info whether one is a customer or not. I would imagine everything exists with a "user de-activated since $DATE" entry or similar in their database. Perhaps I'm too cynical?
- bryan_w 6y ago
  Actually I think the incentives are aligned here. If they can't show the pictures that they have claimed to have deleted then they can't use it to bring in eyes for advertisers, which means that the data is a net loss for them, causing them to have to buy more storage sooner. They should want to delete data as soon as possible
  - lozf 6y ago
    Hmm yes, they probably free up the bulk of space and just keep extensive metadata instead: "We don't have the picture, but we know you took one at date, time, location, make & model, shutter speed & aperture, and we regognized the faces of these 2 users X & Y, and another non-user for whom we have shadow profile Z wwas also tagged."