35 ms·

GDPR Violation: Scribd acquires PII on 500M users in a deal with LinkedIn

324 points by user5994461 6y ago

user5994461 6y ago
TL;DR Follow the instructions at the end of the article to opt-out of all your personal information being transferred, before the company changes ownership in the coming weeks.
- voiper1 6y ago
  I had to click "Change Password" to find the delete option.
cheeze 6y ago
That's YC06 ScribD, no?
cm2012 6y ago
What a silly title. Obviously if a company acquires another company they will acquire the email contacts and accounts as well. And LinkedIn has the right to connect accounts they own across their web properties. The rest of the article is bottom tier conspiracy theory that this is a stealthy way for LinkedIn to secretly sell all their PII. This is dumb for a variety of reasons: 1) Linkedin makes all their money selling people ads and recruiting messages, they lose this if they sell direct access to their users. 2) 500m emails sale value isn't worth jack shit to a company the size of LI/Microsoft (see point 1).
- guitarbill 6y ago
  The GDPR "obviously" doesn't allow this, and as the blog says, this is a developer in London.
  - tssva 6y ago
    It is not obvious the GDPR doesn't allow this. Transfer of data during sale of a business is allowed under the GDPR. Notification of a change in controller is required but there is no opt-in requirement. If the deal is structured so that it is a transfer of shares there is no need to even notify because the controller is considers to be the same.
    - BlackFly 6y ago
      No, it seems pretty obvious. Each use case of processing of personal information must satisfy the GDPR necessary requirement or have a priori informed consent. During merger of Scribd into LinkenIn, they can argue that it is necessary to treat the databases as a single controller as a cost cutting measure. However, if they are going to treat Scribd as a separate severable entity, then it cannot be argued that it is necessary to process personal information into the Scribd databases which going forward will only process data in a manner not consented to. If Scribd is not able to distinguish at that point original users that have meaningfully consented to being processed by Scribd from LinkedIn users who have not meaningfully consented to being processed, then they have no meaningful consent at all and therefore no real lawful user data because not knowing if a user has meaningfully consented or not is equivalent to not having meaningful consent for that user. The most similar scenario is when GDPR took effect and many companies essentially had no meaningful consent for their userbase. During the grace period between GDPR taking effect and GDPR fines being enforceable, companies contacted their userbase to acquire consent and the diligent companies destroyed the user records of the users that did not contact them back since meaningful consent cannot be opt out. Of course, many companies were not diligent and held onto user records nevertheless and are waiting to see if they will have to pay the piper or not. This is easily distinct from change of a controller when the new controller will continue the business: consent to have data processed in a particular way was acquired. In this case the separated entity will process data in a manner which was not consented to. Unless Scribd is somehow going to try to convince recruiters to use their service to find users who are going to manicure CV like profiles, which is more or less what LinkedIn users consent to.
      - tssva 6y ago
        But at least at this point Scribd has announced that they intend to run Slideshare as a separate entity and the database will not be integrated with the Scribd database.
  - yxhuvud 6y ago
    Does GDPR still apply to London though, or is that yet another victim of Brexit? But yeah, the rest of EU is clearly off limit.
    - isostatic 6y ago
      The GDPR was implemented in UK law by the Data Protection Act 2018 https://www.legislation.gov.uk/ukpga/2018/12/contents https://www.legislation.gov.uk/ukpga/2018/12/contents Which is still in force
- oefrha 6y ago
  Step 1: Mega Corp buys small company A most of its users don’t give a shit about. Step 2: Mega Corp shares all its user account info with small company A. Step 3: Mega Corp sells small company A to ethically questionable company B (yes, I find the entire business model of Scribd very questionable), along with user info of all its users. Now the vast majority of those users who never gave a shit about A nor B are on B’s spam list. Yes, the casual sales of user info may not mean jack shit to Mega Corp, but it does mean something to B, and users who are completely unrelated to A nor B have a right to be incensed. (Btw, I haven’t received this as a LinkedIn user, so can’t attest to the accuracy of TFA. Maybe they don’t even have the courtesy to notify non-EU users?)
  - cm2012 6y ago
    There's some excellent points in your comment that are not served by the breathless conspiratorial tone of the parent article. It's also possible that LI didn't share extra info at all with Scribd. The author takes a huge leap and assumes that all 500m LI emails have been transferred to Scribd because he got an email he doesn't recall ever signing up for.
    - deleted 6y ago
      [deleted]
    - Legogris 6y ago
      Oh it's absolutely the case, from someone who: * Never deleted an email from archive * Don't recall ever registering on either ScribD or Slideshare * Got the same email as the author, which is the first from either Slideshare or ScribD * Could log in using my LinkedIn account and saw all my personal information from LinkedIn there
    - basejumping 6y ago
      I didn't even receive a LI email, checked my spam as well, yet I can login to slideshare and see my account with full name and profile scraped from my LI account. Great! By the way, my email is marked private on my linkedin account, but now it's on slideshare. So selling information you marked as private!
- deleted 6y ago
  [deleted]
- klelatti 6y ago
  The title and the article seem to me to be factually correct and raise legitimate concerns about the sharing of personal data with third parties in a way that is potentially illegal for a large subset of the users concerned. Whether this is financially significant the the parties involved is beside the point.
- jll29 6y ago
  > And LinkedIn has the right to connect accounts they own across their web properties. Your claim is not generally true: EU citizens are protected from data processing (of their personal data) without seeking prior consent by GDPR. And that is a-priori "opt in", not a-posteriori "opt out".
  - matthewheath 6y ago
    Consent is just one basis of processing. There are others, such as "legitimate interest" or for the performance of a contract, for example.
    - user5994461 6y ago
      I downvoted because your statement is misleading. A contract has to be lawful to be valid. A contract could transfer users, assuming regulations are followed and users were acquired legitimately (both of which are debatable here). However a contract that requires to transfer users without notice nor consent is defacto null because it is not lawful. These are extremely serious considerations for the case at hands. Companies knew what they were doing, the acquisition and PII transfer is not merely accidental, that should be covered in the contract. Depending on the wording and the intent of the companies (and any public backslash that might ensue and bring things to light), either side might lawyer up and reconsider the contract, or a third party like a regulator might jump in (could fine the parties or void the acquisition).
      - razakel 6y ago
        >massive fines With GDPR that can be a maximum 4% of global turnover, so "massive" is a bit of an understatement.
        isostatic 6y ago
        > In the 2019 fiscal year, LinkedIn brought in $6.8 billion worth of revenue $272m isn't small change for each infringement, and there's millions of them here [0] https://www.businessofapps.com/data/linkedin-statistics/ https://www.businessofapps.com/data/linkedin-statistics/
- jacquesm 6y ago
  You should have a look into what 'legal basis for processing' means. In this case it is very relevant.
- m12k 6y ago
  > Obviously if a company acquires another company they will acquire the email contacts and accounts as well. And LinkedIn has the right to connect accounts they own across their web properties. Let's assume this is true, and see where it can take us. Let's imagine every online company in the US takes turns buying another such company, consolidating the user accounts, then splitting off/re-selling the other company. Eventually anybody that had an account with any company would have an account with every company, and this would be perfectly legal despite no users ever having been asked if their personal information could be shared? I think this is the rub: "And LinkedIn has the right to connect accounts they own across their web properties" I cannot speak to US law, but that is not true of the GDPR - collection of personally identifiable information requires consent, and that consent must be given for a specific purpose. Use of that information outside of the initial purpose that was consented to requires the user to re-consent to the additional uses. So no, a company is not allowed to just transfer my PII to a different business unit that provides a different service without my consent (and optionally then sell off that business unit like they did in the linked post).
  - cm2012 6y ago
    Even GDPR does not require fresh consent for every new product and service. You have to have to update the privacy policy, inform users you're doing so, and let them opt out if they want (no objection rule). Which is exactly what LI is doing here. Keep in mind LI is NOT using this as a scheme like you describe to sell 500m emails.
    - emn13 6y ago
      I don't believe there is such a no objection rule - or perhaps I'm looking at it from a different angle - can you be more specific? Products and services aren't the issue; it's how you use+process users' data. Many products and services don't materially affect that, so won't require additional consent (e.g. if you're a company that sends news-updates by email to users that opted in, I don't believe sending them other updates is a PII issue - course, it might be spam, and IANAL). Also, products and services you're explicitly contracted for are exempt anyhow (e.g. if the user is paying you to remind them to take their meds on time, you don't need additional GDPR consent to store and process their sensitive personal data to the extent necessary to fulfill that contract - though other laws almost certainly apply to medical data).
sseneca 6y ago
So, I just deleted my account. 15 minutes after I got confirmation of the deletion, I got a "sseneca, welcome to SlideShare!" email, lol.
- jacquesm 6y ago
  That's a GDPR violation right there, assuming you are in the EU.
  - dathinab 6y ago
    If the email is "dispatched" the moment you sign in i.e. before the account is delete is not a violation. Furthermore deletion of the account and information doesn't need to be done instantious, e.g. doing the cleanup once a day in a batch job is ok.
    - jacquesm 6y ago
      I hate to be that guy but did you actually read the comment? It said "after". So not the moment he signed in, 15 minutes after where to all intents and purposes that should have been impossible. After all, we can sign people up in 20 milliseconds, I don't see why marking an account as in the process of deletion should be so hard.
      - klyrs 6y ago
        Many large sites do batched emails -- it's fully plausible that the email sat in a queue for 15 minutes before going out.
      - dathinab 6y ago
        Dispatched != Send != Received Through I could have been more clear. Also like I mentioned GDPR doesn't require fast deletion practically delaying the deletion by a day is totally legal as far as I know. There is another law wrt. opting out from mail under which you maybe (just maybe) could argue it being illegal. But then again you can always argue there was a delay between dispatch and sending.
babo 6y ago
The correct order to delete your account is Sign in to SlideShare Go to Menu “Account Settings” Change Password Delete Account Yes, Delete my Account
- phkahler 6y ago
  I've never used Slideshare, will I have to sign up?
  - user5994461 6y ago
    If you have a LinkedIn account, you were signed up to SlideShare automatically without your knowledge or consent. You should be able to login right away, no need to sign up (again). "Login" button in corner then "Login with LinkedIn" button.
    - imglorp 6y ago
      One non-obvious step I encountered. After login with LinkedIn, it doesn't look like you logged in but you did. You have to hit the "Explore" button on the top bar and then you'll see your name menu on the upper right, and you can proceed to settings.
      - EwanToo 6y ago
        Thanks I had exactly this problem!
      - agustif 6y ago
        Refresh/F5 worked for me.
      - corford 6y ago
        Another thing: if you've never directly used Slideshare and instead signed in via your Linkedin in username, you'll need to set a password in order to delete the account (it prompts you to set one in the delete modal).
ErrantX 6y ago
Scribd have consistently been a horrible company. They actively "slurped" (their word) as many documents as they could, ignoring things like copyright, into their archive. They brushed a lot of those concerns aside which left a really sour taste. HN actually used to have a feature to switch PDF links to Scribd ones (not sure if it was manual or automatic)[1] 1. https://news.ycombinator.com/item?id=1124940 https://news.ycombinator.com/item?id=1124940
- jacquesm 6y ago
  That was a - largely successful - attempt to boost ScribD by using HN. Indirectly this benefited YC.
  - ErrantX 6y ago
    Yep, still grates to this day.
- goodbye_twy 6y ago
  What even? Has there been an apology from dang for this? Is this sort of thing still happening? I have a rule not to read forums which do shady stuff to the content. Maybe it's time to adblock the HN homepage.
  - Rexxar 6y ago
    10 years ago pdf was not properly supported in browsers and there was a lot of complaints on each pdf submissions. This was probably seen as a good idea to fix this problem at the time.
  - plorkyeran 6y ago
    It happened significantly before dang's involvement in HN.
    - goodgriefer 6y ago
      It's always the same with VC's. Do what you can (illegal or no), obfuscate and redirect, ignore when possible, and finally fake-apology ("we're sorry you feel bad"). Sure the "rules" say to assume with best intentions. That goes along with "obfuscate and redirect". It's easier to point at rules as a club to make an example. But in reality, in the end VCs are themselves toxic. Look no further than the crowd of businesses and partners YC surrounds itself with.
arianvanp 6y ago
This sounds like class-action material to me. Honestly disgusted by this YC-backed company. People are commenting they didn't get a notice. My current running theory is that they only notified people in the EU due to GDPR.
- vertis 6y ago
  I got a notice on Aug 15 (that I missed). My very old SlideShare account was listed as being in Australia.
jacquesm 6y ago
Screw ScribD and the horse they rode in on. Between them and Installmonetizer it is hard to pick my least favorite YC company. At least new entrants know that they'll never bottom out in the ethics department since those two got in.
- beervirus 6y ago
  Absolutely unbelievable that YC would fund Installmonetizer.
  - yc_yuck 6y ago
    Why? There's nothing special about YC, they're venture capitalists like any other. No surprise that they want to make shitloads of cash through whatever dubious, underhanded means they think they can get away with.
    - jacquesm 6y ago
      What's surprising is that until that moment and a certain other moment which I've linked to enough about the source of funds YC was strictly speaking 'the good guys'. After that they turned into 'just like the rest, possibly worse'. That said, if you want to do a funded start-up and you're in the United States nothing will come close to beating YC for effectiveness, even today.
      - yc_yuck 6y ago
        It's somewhat reminiscent of Google's disingenuous "don't be evil" pledge, quietly discarded when it simply wasn't a believable slogan any more.
        jacquesm 6y ago
        I don't think YC ever had a slogan to that effect.
      - dang 6y ago
ffpip 6y ago
If anyone from Scirbd is reading this, please fix your mobile website. You advertise yourself more than the content. https://i.ibb.co/2n8HdBx/Screenshot-20200822-030755.jpg https://i.ibb.co/2n8HdBx/Screenshot-20200822-030755.jpg There must be a competition between Imgur,Reddit and Scribd for the worst User Exp
- tomp 6y ago
  > You advertise yourself more than the content. I'm pretty sure that's a "feature" not a bug.
- tolbish 6y ago
  These websites make their mobile websites good enough so you won't leave, but bad enough so you feel like you should download the app (such as gigantic banners that make mobile browsing miserable). The A/B testing shows that it's a very effective dark pattern.
  - ffpip 6y ago
    It makes me go away from their app. I removed all the banners with uBlock Origin. I had to temporarily get them back to take the screenshot.
  - mehdix 6y ago
    The only reason they push for their apps is showing hard to remove ads and harvesting more data. I stick to Firefox, ublock and adaway root.
tchalla 6y ago
The way to delete Slideshare account is Account Settings -> Change Password. You see a small "Delete Account" button at the below.
fangorn 6y ago
I just deleted my account, which I shouldn't have had, and I got an email saying: "We send these emails to help you get the most out of SlideShare.". Couldn't agree more, that's the most I got out of SlideShare.
JumpCrisscross 6y ago
Does this clearly violate California law?
dominotw 6y ago
Scribd needs to be bought to justice for all the copyrighted documents they stole from the users. What a shady group of people.
- miki123211 6y ago
  What about Google? Archive.org?
  - roryokane 6y ago
    ScribD, unlike Google and The Internet Archive, charges you money to read and download documents. ScribD doesn’t just distribute other people’s work, it resells their work and keeps all of the profits.
a_imho 6y ago
Basically every site is violating GDPR. Who cares? The EU does not.
- seslaire 6y ago
  It's the member states that are tasked with enforcing it. Here's what they've been up to: https://www.enforcementtracker.com/ https://www.enforcementtracker.com/
  - a_imho 6y ago
    The EU member states do not care. Is it better? It was adopted 4 years ago, enforceable for the past 2 years. Still every single site that even cares about showing a nagbox offers only opt-outs. Those numbers listed are a joke compared to the 4% worldwide revenue stick. What's the point of the big words if we are not prepared to back them up?
    - colejohnson66 6y ago
      What do you mean “The EU member states do not care”? @seslaire literally posted a link to a list of GDPR enforcements.
      - a_imho 6y ago
        I don't get the confusion 1. Most sites are blatantly non compliant, see opt-outs (presets). For example if someone from covered regions does a search on Google right now it presents them with 2 buttons, 'I agree' and 'See more', the former is pre-checked to enable tracking everything, the latter leads into a labyrinth of settings. Not even an opt-out everything is presented (itself non compliant, but still). It is presented everytime, unless they sign up for a Google Account and/or download their browser extension. This is definitely not how private by default should work. 2. The EU created a stick big enough in theory to go after anyone, yet they refuse to do so for years. Indeed, we are probably interpreting those numbers differently. They are a slap on the wrist at best and anchoring the discussion at the wrong point. For example in the above case the potential fines for Google could be up to ~$6B yet the listings do not add up to $60M, that's two orders of magnitude. As it stands, GDPR achieved very little so far to protect the average user. Tracking is as bad and invasive as it has been for years.
JumpCrisscross 6y ago
Until the highest-level engineers who agreed to implement this are personally held liable for some damages, we are unlikely to see change. GDPR is a good amount of fluff. You can run laps around the competition and stall serious consequences for years. Meanwhile, a well-meaning start-up can shell our millions of dollars if an ornery national regulator decides they’re their pet project. Fine if one has a multi-million dollar L&L budget, though.
- luckylion 6y ago
  > Until the highest-level engineers who agreed to implement this are personally held liable for some damages, we are unlikely to see change. No need, you just need to add fines that hurt and enforce them. GDPR usually doesn't ("we only want them to feel it a little bit, but it should not hurt"). Increase it so that a clear, intentional violation can actually bankrupt the company and you'll not see them at the large scale. A small player might still do it, but very few 100mm+ companies will risk it all and open themselves individually to law suits from share holders. Google gets a 50mm fine here or there. Their revenue is 45bn. That's totally worth it.
rswail 6y ago
Well that made it easy to not only close my nonexistent Slideshare account, but also my linkedin account. Thanks for the reminder Scribd!
malisper 6y ago
IANAL - I don't believe acquiring another company and the PII along with it is necessary a GDPR violation. Article 14 of GDPR[0] lays out the requirements for what a company needs to do when a company acquires personal data, not directly from the data subject. I believe this is what applies when a company acquires another company. At first glance, it appears the email Scribd sent does comply with most of article 14 such as: - They notified you they were acquiring your personal data. - They notified you are able to opt out. The email is missing a few things such as the legal basis for processing. The email links to the privacy policy and an FAQ, which might be enough to provide that information. I'm not sure. Since Scribd is not processing the data for a purpose other than what it was collected for (they mention this in the email), continuing to process it for the original purpose is ok. Presumably SlideShare complied with article 6 of GDPR[1] and either asked for consent or used one of the other bases for processing the data before the acquisition. [0] https://gdpr-info.eu/art-14-gdpr/ https://gdpr-info.eu/art-14-gdpr/ [1] https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/
- user5994461 6y ago
  >>> The email links to the privacy policy and an FAQ, which might be enough to provide that information. I'm not sure. Plot twist: The link was broken. Had to use google to find the FAQ page on how to unlink linkedin with slideshare and delete the account. It's not trivial to do.
- mnw21cam 6y ago
  > Since Scribd is not processing the data for a purpose other than what it was collected for I disagree with that. Also, could you point out the bit in the email where it says so. If I sign up for LinkedIn and provide PII for that, then the purpose for which the PII can be processed is in order to handle my interaction with LinkedIn. If I signed up to LinkedIn before 2012, and LinkedIn bought Slideshare in 2012, then LinkedIn could only claim that my PII is still being processed for its original purpose when used by Slideshare if Slideshare was made an integral part of LinkedIn. If Slideshare is then sold to a third party, then it definitely is not an integral part of LinkedIn, and applying my PII in its operation is not processing it for the purpose it was originally collected for. LinkedIn does not have the legal right to bundle my PII in its sale of Slideshare to Scribd, and even if Scribd were to receive my PII, it would not legally be able to use it.
nottorp 6y ago
> If you have a LinkedIn account, you were signed up to SlideShare automatically without your knowledge or consent. This. If you have a linkedin account but never signed up to SlideShare go delete your SlideShare account NOW.
- harry8 6y ago
  why? To what end?
thewebcount 6y ago
It wasn't obvious to me how to login to delete my account since I didn't ever create one. For those who don't use social media, there's a "login with LinkedIn" button above the email and password on the login form. I am blind to these buttons because I don't have any type of account that allows this usually. (I didn't even know LinkedIn offered it.) Also, the workflow was utterly bizarre for me running on macOS Catalina in Safari. I clicked on "Login with LinkedIn" and it opened a smaller window with no address bar and asked for my LinkedIn credentials. I entered them and it loaded LinkedIn in this small window. Was it supposed to go to SlideShare? I went back to the SlideShare window and reloaded, but I still wasn't logged in, despite what others here have reported. I had to go back to the login page, do the whole thing again, then reload, and finally I was actually logged in. Very very bad UX.
vilifiedtwin 6y ago
We can clearly see that GDPR is a well marketed gimmick fulfilling Keynesian principles akin to broken window parable. It's about creating jobs that don't produce anything useful whilst giving a notch of false sense of security to people. Everyone is now conditioned to click "Agree" buttons without reading what it is about and EU governments have a weapon against any company that happen to cross them, because of ambiguity of the law. Watch some Defcon videos how GDPR is actually helping bad people fish for personal data. It is now easier than ever.
caymanjim 6y ago
I can't even sign in to SlideShare. "Login with LinkedIn" just returns to the home page without logging in. Maybe they panicked that they were losing their customer database and broke the site on purpose? The only thing anyone buys companies for anymore is their user DB. The product itself is probably worthless, so a mass exodus of users isn't something they want to see.
- caymanjim 6y ago
  Followup: although the signup UI is broken, I received email welcoming me and was able to delete the account afterwards (although the delete option was in an unintuitive place in the settings). Not sure I even had an account to be concerned with before that.
- stjohnswarts 6y ago
  If everyone on HN did this it wouldn't be but a drop in the ocean.
- shostack 6y ago
  Had this issue too. Try clearing the cache and refreshing. Seemed to work fine.
stjohnswarts 6y ago
Thanks. This is the quality content I keep coming back for :D

324 points by user5994461 6y ago

TL;DR Follow the instructions at the end of the article to opt-out of all your personal information being transferred, before the company changes ownership in the coming weeks.

voiper1 6y ago
I had to click "Change Password" to find the delete option.

cheeze 6y ago

That's YC06 ScribD, no?

cm2012 6y ago

What a silly title. Obviously if a company acquires another company they will acquire the email contacts and accounts as well. And LinkedIn has the right to connect accounts they own across their web properties. The rest of the article is bottom tier conspiracy theory that this is a stealthy way for LinkedIn to secretly sell all their PII. This is dumb for a variety of reasons: 1) Linkedin makes all their money selling people ads and recruiting messages, they lose this if they sell direct access to their users. 2) 500m emails sale value isn't worth jack shit to a company the size of LI/Microsoft (see point 1).

guitarbill 6y ago
The GDPR "obviously" doesn't allow this, and as the blog says, this is a developer in London.
- tssva 6y ago
  It is not obvious the GDPR doesn't allow this. Transfer of data during sale of a business is allowed under the GDPR. Notification of a change in controller is required but there is no opt-in requirement. If the deal is structured so that it is a transfer of shares there is no need to even notify because the controller is considers to be the same.
  - BlackFly 6y ago
    No, it seems pretty obvious. Each use case of processing of personal information must satisfy the GDPR necessary requirement or have a priori informed consent. During merger of Scribd into LinkenIn, they can argue that it is necessary to treat the databases as a single controller as a cost cutting measure. However, if they are going to treat Scribd as a separate severable entity, then it cannot be argued that it is necessary to process personal information into the Scribd databases which going forward will only process data in a manner not consented to. If Scribd is not able to distinguish at that point original users that have meaningfully consented to being processed by Scribd from LinkedIn users who have not meaningfully consented to being processed, then they have no meaningful consent at all and therefore no real lawful user data because not knowing if a user has meaningfully consented or not is equivalent to not having meaningful consent for that user. The most similar scenario is when GDPR took effect and many companies essentially had no meaningful consent for their userbase. During the grace period between GDPR taking effect and GDPR fines being enforceable, companies contacted their userbase to acquire consent and the diligent companies destroyed the user records of the users that did not contact them back since meaningful consent cannot be opt out. Of course, many companies were not diligent and held onto user records nevertheless and are waiting to see if they will have to pay the piper or not. This is easily distinct from change of a controller when the new controller will continue the business: consent to have data processed in a particular way was acquired. In this case the separated entity will process data in a manner which was not consented to. Unless Scribd is somehow going to try to convince recruiters to use their service to find users who are going to manicure CV like profiles, which is more or less what LinkedIn users consent to.
    - tssva 6y ago
      But at least at this point Scribd has announced that they intend to run Slideshare as a separate entity and the database will not be integrated with the Scribd database.
- yxhuvud 6y ago
  Does GDPR still apply to London though, or is that yet another victim of Brexit? But yeah, the rest of EU is clearly off limit.
  - isostatic 6y ago
    The GDPR was implemented in UK law by the Data Protection Act 2018 https://www.legislation.gov.uk/ukpga/2018/12/contents https://www.legislation.gov.uk/ukpga/2018/12/contents Which is still in force
oefrha 6y ago
Step 1: Mega Corp buys small company A most of its users don’t give a shit about. Step 2: Mega Corp shares all its user account info with small company A. Step 3: Mega Corp sells small company A to ethically questionable company B (yes, I find the entire business model of Scribd very questionable), along with user info of all its users. Now the vast majority of those users who never gave a shit about A nor B are on B’s spam list. Yes, the casual sales of user info may not mean jack shit to Mega Corp, but it does mean something to B, and users who are completely unrelated to A nor B have a right to be incensed. (Btw, I haven’t received this as a LinkedIn user, so can’t attest to the accuracy of TFA. Maybe they don’t even have the courtesy to notify non-EU users?)
- cm2012 6y ago
  There's some excellent points in your comment that are not served by the breathless conspiratorial tone of the parent article. It's also possible that LI didn't share extra info at all with Scribd. The author takes a huge leap and assumes that all 500m LI emails have been transferred to Scribd because he got an email he doesn't recall ever signing up for.
  - deleted 6y ago
    [deleted]
  - Legogris 6y ago
    Oh it's absolutely the case, from someone who: * Never deleted an email from archive * Don't recall ever registering on either ScribD or Slideshare * Got the same email as the author, which is the first from either Slideshare or ScribD * Could log in using my LinkedIn account and saw all my personal information from LinkedIn there
  - basejumping 6y ago
    I didn't even receive a LI email, checked my spam as well, yet I can login to slideshare and see my account with full name and profile scraped from my LI account. Great! By the way, my email is marked private on my linkedin account, but now it's on slideshare. So selling information you marked as private!
deleted 6y ago
[deleted]
klelatti 6y ago
The title and the article seem to me to be factually correct and raise legitimate concerns about the sharing of personal data with third parties in a way that is potentially illegal for a large subset of the users concerned. Whether this is financially significant the the parties involved is beside the point.
jll29 6y ago
> And LinkedIn has the right to connect accounts they own across their web properties. Your claim is not generally true: EU citizens are protected from data processing (of their personal data) without seeking prior consent by GDPR. And that is a-priori "opt in", not a-posteriori "opt out".
- matthewheath 6y ago
  Consent is just one basis of processing. There are others, such as "legitimate interest" or for the performance of a contract, for example.
  - user5994461 6y ago
    I downvoted because your statement is misleading. A contract has to be lawful to be valid. A contract could transfer users, assuming regulations are followed and users were acquired legitimately (both of which are debatable here). However a contract that requires to transfer users without notice nor consent is defacto null because it is not lawful. These are extremely serious considerations for the case at hands. Companies knew what they were doing, the acquisition and PII transfer is not merely accidental, that should be covered in the contract. Depending on the wording and the intent of the companies (and any public backslash that might ensue and bring things to light), either side might lawyer up and reconsider the contract, or a third party like a regulator might jump in (could fine the parties or void the acquisition).
    - razakel 6y ago
      >massive fines With GDPR that can be a maximum 4% of global turnover, so "massive" is a bit of an understatement.
      - isostatic 6y ago
        > In the 2019 fiscal year, LinkedIn brought in $6.8 billion worth of revenue $272m isn't small change for each infringement, and there's millions of them here [0] https://www.businessofapps.com/data/linkedin-statistics/ https://www.businessofapps.com/data/linkedin-statistics/
jacquesm 6y ago
You should have a look into what 'legal basis for processing' means. In this case it is very relevant.
m12k 6y ago
> Obviously if a company acquires another company they will acquire the email contacts and accounts as well. And LinkedIn has the right to connect accounts they own across their web properties. Let's assume this is true, and see where it can take us. Let's imagine every online company in the US takes turns buying another such company, consolidating the user accounts, then splitting off/re-selling the other company. Eventually anybody that had an account with any company would have an account with every company, and this would be perfectly legal despite no users ever having been asked if their personal information could be shared? I think this is the rub: "And LinkedIn has the right to connect accounts they own across their web properties" I cannot speak to US law, but that is not true of the GDPR - collection of personally identifiable information requires consent, and that consent must be given for a specific purpose. Use of that information outside of the initial purpose that was consented to requires the user to re-consent to the additional uses. So no, a company is not allowed to just transfer my PII to a different business unit that provides a different service without my consent (and optionally then sell off that business unit like they did in the linked post).
- cm2012 6y ago
  Even GDPR does not require fresh consent for every new product and service. You have to have to update the privacy policy, inform users you're doing so, and let them opt out if they want (no objection rule). Which is exactly what LI is doing here. Keep in mind LI is NOT using this as a scheme like you describe to sell 500m emails.
  - emn13 6y ago
    I don't believe there is such a no objection rule - or perhaps I'm looking at it from a different angle - can you be more specific? Products and services aren't the issue; it's how you use+process users' data. Many products and services don't materially affect that, so won't require additional consent (e.g. if you're a company that sends news-updates by email to users that opted in, I don't believe sending them other updates is a PII issue - course, it might be spam, and IANAL). Also, products and services you're explicitly contracted for are exempt anyhow (e.g. if the user is paying you to remind them to take their meds on time, you don't need additional GDPR consent to store and process their sensitive personal data to the extent necessary to fulfill that contract - though other laws almost certainly apply to medical data).

sseneca 6y ago

So, I just deleted my account. 15 minutes after I got confirmation of the deletion, I got a "sseneca, welcome to SlideShare!" email, lol.

jacquesm 6y ago
That's a GDPR violation right there, assuming you are in the EU.
- dathinab 6y ago
  If the email is "dispatched" the moment you sign in i.e. before the account is delete is not a violation. Furthermore deletion of the account and information doesn't need to be done instantious, e.g. doing the cleanup once a day in a batch job is ok.
  - jacquesm 6y ago
    I hate to be that guy but did you actually read the comment? It said "after". So not the moment he signed in, 15 minutes after where to all intents and purposes that should have been impossible. After all, we can sign people up in 20 milliseconds, I don't see why marking an account as in the process of deletion should be so hard.
    - klyrs 6y ago
      Many large sites do batched emails -- it's fully plausible that the email sat in a queue for 15 minutes before going out.
    - dathinab 6y ago
      Dispatched != Send != Received Through I could have been more clear. Also like I mentioned GDPR doesn't require fast deletion practically delaying the deletion by a day is totally legal as far as I know. There is another law wrt. opting out from mail under which you maybe (just maybe) could argue it being illegal. But then again you can always argue there was a delay between dispatch and sending.

babo 6y ago

The correct order to delete your account is Sign in to SlideShare Go to Menu “Account Settings” Change Password Delete Account Yes, Delete my Account

phkahler 6y ago
I've never used Slideshare, will I have to sign up?
- user5994461 6y ago
  If you have a LinkedIn account, you were signed up to SlideShare automatically without your knowledge or consent. You should be able to login right away, no need to sign up (again). "Login" button in corner then "Login with LinkedIn" button.
  - imglorp 6y ago
    One non-obvious step I encountered. After login with LinkedIn, it doesn't look like you logged in but you did. You have to hit the "Explore" button on the top bar and then you'll see your name menu on the upper right, and you can proceed to settings.
    - EwanToo 6y ago
      Thanks I had exactly this problem!
    - agustif 6y ago
      Refresh/F5 worked for me.
    - corford 6y ago
      Another thing: if you've never directly used Slideshare and instead signed in via your Linkedin in username, you'll need to set a password in order to delete the account (it prompts you to set one in the delete modal).

ErrantX 6y ago

Scribd have consistently been a horrible company. They actively "slurped" (their word) as many documents as they could, ignoring things like copyright, into their archive. They brushed a lot of those concerns aside which left a really sour taste. HN actually used to have a feature to switch PDF links to Scribd ones (not sure if it was manual or automatic)[1] 1. https://news.ycombinator.com/item?id=1124940 https://news.ycombinator.com/item?id=1124940

jacquesm 6y ago
That was a - largely successful - attempt to boost ScribD by using HN. Indirectly this benefited YC.
- ErrantX 6y ago
  Yep, still grates to this day.
goodbye_twy 6y ago
What even? Has there been an apology from dang for this? Is this sort of thing still happening? I have a rule not to read forums which do shady stuff to the content. Maybe it's time to adblock the HN homepage.
- Rexxar 6y ago
  10 years ago pdf was not properly supported in browsers and there was a lot of complaints on each pdf submissions. This was probably seen as a good idea to fix this problem at the time.
- plorkyeran 6y ago
  It happened significantly before dang's involvement in HN.
  - goodgriefer 6y ago
    It's always the same with VC's. Do what you can (illegal or no), obfuscate and redirect, ignore when possible, and finally fake-apology ("we're sorry you feel bad"). Sure the "rules" say to assume with best intentions. That goes along with "obfuscate and redirect". It's easier to point at rules as a club to make an example. But in reality, in the end VCs are themselves toxic. Look no further than the crowd of businesses and partners YC surrounds itself with.

arianvanp 6y ago

This sounds like class-action material to me. Honestly disgusted by this YC-backed company. People are commenting they didn't get a notice. My current running theory is that they only notified people in the EU due to GDPR.

vertis 6y ago
I got a notice on Aug 15 (that I missed). My very old SlideShare account was listed as being in Australia.

jacquesm 6y ago

Screw ScribD and the horse they rode in on. Between them and Installmonetizer it is hard to pick my least favorite YC company. At least new entrants know that they'll never bottom out in the ethics department since those two got in.

beervirus 6y ago
Absolutely unbelievable that YC would fund Installmonetizer.
- yc_yuck 6y ago
  Why? There's nothing special about YC, they're venture capitalists like any other. No surprise that they want to make shitloads of cash through whatever dubious, underhanded means they think they can get away with.
  - jacquesm 6y ago
    What's surprising is that until that moment and a certain other moment which I've linked to enough about the source of funds YC was strictly speaking 'the good guys'. After that they turned into 'just like the rest, possibly worse'. That said, if you want to do a funded start-up and you're in the United States nothing will come close to beating YC for effectiveness, even today.
    - yc_yuck 6y ago
      It's somewhat reminiscent of Google's disingenuous "don't be evil" pledge, quietly discarded when it simply wasn't a believable slogan any more.
      - jacquesm 6y ago
        I don't think YC ever had a slogan to that effect.
    - dang 6y ago

ffpip 6y ago

If anyone from Scirbd is reading this, please fix your mobile website. You advertise yourself more than the content. https://i.ibb.co/2n8HdBx/Screenshot-20200822-030755.jpg https://i.ibb.co/2n8HdBx/Screenshot-20200822-030755.jpg There must be a competition between Imgur,Reddit and Scribd for the worst User Exp

tomp 6y ago
> You advertise yourself more than the content. I'm pretty sure that's a "feature" not a bug.
tolbish 6y ago
These websites make their mobile websites good enough so you won't leave, but bad enough so you feel like you should download the app (such as gigantic banners that make mobile browsing miserable). The A/B testing shows that it's a very effective dark pattern.
- ffpip 6y ago
  It makes me go away from their app. I removed all the banners with uBlock Origin. I had to temporarily get them back to take the screenshot.
- mehdix 6y ago
  The only reason they push for their apps is showing hard to remove ads and harvesting more data. I stick to Firefox, ublock and adaway root.

tchalla 6y ago

The way to delete Slideshare account is Account Settings -> Change Password. You see a small "Delete Account" button at the below.

fangorn 6y ago

I just deleted my account, which I shouldn't have had, and I got an email saying: "We send these emails to help you get the most out of SlideShare.". Couldn't agree more, that's the most I got out of SlideShare.

JumpCrisscross 6y ago

Does this clearly violate California law?

dominotw 6y ago

Scribd needs to be bought to justice for all the copyrighted documents they stole from the users. What a shady group of people.

miki123211 6y ago
What about Google? Archive.org?
- roryokane 6y ago
  ScribD, unlike Google and The Internet Archive, charges you money to read and download documents. ScribD doesn’t just distribute other people’s work, it resells their work and keeps all of the profits.

a_imho 6y ago

Basically every site is violating GDPR. Who cares? The EU does not.

seslaire 6y ago
It's the member states that are tasked with enforcing it. Here's what they've been up to: https://www.enforcementtracker.com/ https://www.enforcementtracker.com/
- a_imho 6y ago
  The EU member states do not care. Is it better? It was adopted 4 years ago, enforceable for the past 2 years. Still every single site that even cares about showing a nagbox offers only opt-outs. Those numbers listed are a joke compared to the 4% worldwide revenue stick. What's the point of the big words if we are not prepared to back them up?
  - colejohnson66 6y ago
    What do you mean “The EU member states do not care”? @seslaire literally posted a link to a list of GDPR enforcements.
    - a_imho 6y ago
      I don't get the confusion 1. Most sites are blatantly non compliant, see opt-outs (presets). For example if someone from covered regions does a search on Google right now it presents them with 2 buttons, 'I agree' and 'See more', the former is pre-checked to enable tracking everything, the latter leads into a labyrinth of settings. Not even an opt-out everything is presented (itself non compliant, but still). It is presented everytime, unless they sign up for a Google Account and/or download their browser extension. This is definitely not how private by default should work. 2. The EU created a stick big enough in theory to go after anyone, yet they refuse to do so for years. Indeed, we are probably interpreting those numbers differently. They are a slap on the wrist at best and anchoring the discussion at the wrong point. For example in the above case the potential fines for Google could be up to ~$6B yet the listings do not add up to $60M, that's two orders of magnitude. As it stands, GDPR achieved very little so far to protect the average user. Tracking is as bad and invasive as it has been for years.

JumpCrisscross 6y ago

Until the highest-level engineers who agreed to implement this are personally held liable for some damages, we are unlikely to see change. GDPR is a good amount of fluff. You can run laps around the competition and stall serious consequences for years. Meanwhile, a well-meaning start-up can shell our millions of dollars if an ornery national regulator decides they’re their pet project. Fine if one has a multi-million dollar L&L budget, though.

luckylion 6y ago
> Until the highest-level engineers who agreed to implement this are personally held liable for some damages, we are unlikely to see change. No need, you just need to add fines that hurt and enforce them. GDPR usually doesn't ("we only want them to feel it a little bit, but it should not hurt"). Increase it so that a clear, intentional violation can actually bankrupt the company and you'll not see them at the large scale. A small player might still do it, but very few 100mm+ companies will risk it all and open themselves individually to law suits from share holders. Google gets a 50mm fine here or there. Their revenue is 45bn. That's totally worth it.

rswail 6y ago

Well that made it easy to not only close my nonexistent Slideshare account, but also my linkedin account. Thanks for the reminder Scribd!

malisper 6y ago

IANAL - I don't believe acquiring another company and the PII along with it is necessary a GDPR violation. Article 14 of GDPR[0] lays out the requirements for what a company needs to do when a company acquires personal data, not directly from the data subject. I believe this is what applies when a company acquires another company. At first glance, it appears the email Scribd sent does comply with most of article 14 such as: - They notified you they were acquiring your personal data. - They notified you are able to opt out. The email is missing a few things such as the legal basis for processing. The email links to the privacy policy and an FAQ, which might be enough to provide that information. I'm not sure. Since Scribd is not processing the data for a purpose other than what it was collected for (they mention this in the email), continuing to process it for the original purpose is ok. Presumably SlideShare complied with article 6 of GDPR[1] and either asked for consent or used one of the other bases for processing the data before the acquisition. [0] https://gdpr-info.eu/art-14-gdpr/ https://gdpr-info.eu/art-14-gdpr/ [1] https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/

user5994461 6y ago
>>> The email links to the privacy policy and an FAQ, which might be enough to provide that information. I'm not sure. Plot twist: The link was broken. Had to use google to find the FAQ page on how to unlink linkedin with slideshare and delete the account. It's not trivial to do.
mnw21cam 6y ago
> Since Scribd is not processing the data for a purpose other than what it was collected for I disagree with that. Also, could you point out the bit in the email where it says so. If I sign up for LinkedIn and provide PII for that, then the purpose for which the PII can be processed is in order to handle my interaction with LinkedIn. If I signed up to LinkedIn before 2012, and LinkedIn bought Slideshare in 2012, then LinkedIn could only claim that my PII is still being processed for its original purpose when used by Slideshare if Slideshare was made an integral part of LinkedIn. If Slideshare is then sold to a third party, then it definitely is not an integral part of LinkedIn, and applying my PII in its operation is not processing it for the purpose it was originally collected for. LinkedIn does not have the legal right to bundle my PII in its sale of Slideshare to Scribd, and even if Scribd were to receive my PII, it would not legally be able to use it.

nottorp 6y ago

> If you have a LinkedIn account, you were signed up to SlideShare automatically without your knowledge or consent. This. If you have a linkedin account but never signed up to SlideShare go delete your SlideShare account NOW.

harry8 6y ago
why? To what end?

thewebcount 6y ago

It wasn't obvious to me how to login to delete my account since I didn't ever create one. For those who don't use social media, there's a "login with LinkedIn" button above the email and password on the login form. I am blind to these buttons because I don't have any type of account that allows this usually. (I didn't even know LinkedIn offered it.) Also, the workflow was utterly bizarre for me running on macOS Catalina in Safari. I clicked on "Login with LinkedIn" and it opened a smaller window with no address bar and asked for my LinkedIn credentials. I entered them and it loaded LinkedIn in this small window. Was it supposed to go to SlideShare? I went back to the SlideShare window and reloaded, but I still wasn't logged in, despite what others here have reported. I had to go back to the login page, do the whole thing again, then reload, and finally I was actually logged in. Very very bad UX.

vilifiedtwin 6y ago

We can clearly see that GDPR is a well marketed gimmick fulfilling Keynesian principles akin to broken window parable. It's about creating jobs that don't produce anything useful whilst giving a notch of false sense of security to people. Everyone is now conditioned to click "Agree" buttons without reading what it is about and EU governments have a weapon against any company that happen to cross them, because of ambiguity of the law. Watch some Defcon videos how GDPR is actually helping bad people fish for personal data. It is now easier than ever.

caymanjim 6y ago

I can't even sign in to SlideShare. "Login with LinkedIn" just returns to the home page without logging in. Maybe they panicked that they were losing their customer database and broke the site on purpose? The only thing anyone buys companies for anymore is their user DB. The product itself is probably worthless, so a mass exodus of users isn't something they want to see.

caymanjim 6y ago
Followup: although the signup UI is broken, I received email welcoming me and was able to delete the account afterwards (although the delete option was in an unintuitive place in the settings). Not sure I even had an account to be concerned with before that.
stjohnswarts 6y ago
If everyone on HN did this it wouldn't be but a drop in the ocean.
shostack 6y ago
Had this issue too. Try clearing the cache and refreshing. Seemed to work fine.

stjohnswarts 6y ago

Thanks. This is the quality content I keep coming back for :D