6 ms·

Seems like an obvious and sane target for antitrust legislation - compare with e.g. the mobile number portability directive in the EU way back in 2002. Related

by tpmx 6y ago

Seems like an obvious and sane target for antitrust legislation - compare with e.g. the mobile number portability directive in the EU way back in 2002. Related opinion piece: > Data portability: An antitrust weapon for the digital economy? (Le Monde, 2018) http://www.fondapol.org/en/the-foundation/medias-en-en/data-portability-an-antitrust-weapon-for-the-digital-economy/ http://www.fondapol.org/en/the-foundation/medias-en-en/data-... > In concrete terms, what would portability in the digital economy look like? Let us imagine we could easily transfer our playlists between online music platforms (Spotify, Deezer, Apple Music, etc.), our files between cloud service providers (Google Drive, DropBox, OneDrive, etc.), our purchase records between online retailers (Amazon, CDiscount, Zalando, etc.) or our social graph between social media platforms (Facebook, Twitter, Snapchat, etc). By limiting platform lock-in, such measures would significantly intensify competition within these market segments.

actuator 6y ago
Also, it runs afoul of sections of GDPR. I don't agree that Spotify has to let users transfer Spotify curated playlists as that is a business strength. Songshift seems to show Spotify curated playlists on their homepage like Discover Weekly so I can see why Spotify won't like this. But if my understanding of GDPR is right they have to allow users to transfer playlists created by themselves.
- tpmx 6y ago
  Right. Forgot that. Regarding GDPR and data portability: In practise you can expect to receive a (link to a) zip file via email with a bunch of XML documents after going through a convoluted dance. Also, it often takes some time (days) to receive the data. Basically, nothing that can easily be automated by a third part service - you need user auth of the requesting user to access the data.) "You must comply with a request for data portability without undue delay and at the latest within one month of receipt of the request" I guess it's because data portability isn't trivial, and it was wasn't the key aspect of GDPR. As a contrast: The EU mobile number portability legislation says: max 1 working day.
  - actuator 6y ago
    Yeah, data portability is hard to define as a strict standard as it is extremely product specific. Even when we implemented it for my last company, we did JSON exports on signed S3 paths. I thought structured data was the easiest way for any competitor or user to use their data.
    - tpmx 6y ago
      I feel they could have included a clause that would let a designated third party access the extracted data on the requester's behalf in an automated way. I think it could have worked pretty well to keep it as vague as that. (The auth aspects would need more detail, obviously.) I don't think data format fragmentation is a big issue (just implement adapters for the top five competitors in your market...), but rather the impossibility of doing it in a quick and seamless manner on behalf of someone wanting to migrate their data to your service from some other service.
      - actuator 6y ago
        > I feel they could have included a clause that would let a designated third party access the extracted data on the requester's behalf in an automated way. Yeah, this would have been nice. I am not sure if legally you could enforce that as automation itself is vague and depends on the source and target both. > I don't think data format fragmentation is a big issue (just implement adapters for the top five competitors in your market...), but rather the impossibility of doing it in a quick and seamless manner on behalf of someone wanting to migrate their data to your service from some other service. I think if companies were being honest in their efforts for data portability, as a first step they would not try to reap the benefit of the 30 day window by as much as they can. For most, it should take mins or hours to get the export yet the best turnaround I have seen from any service has been from Tinder, it was I think 3 days.
        watermelon0 6y ago
        This really depends on the service. In my experience, Netflix and Facebook took only a few hours to export the data.
- jtbayly 6y ago
  Lol. GDPR. That great white knight.
  - tpmx 6y ago
    Lol. A jingoist.
    - jtbayly 6y ago
      I’m pretty sure it’s a violation of community standards to use a person’s country of origin as an insult or slur. Are you intentionally trying to denigrate a people group?
      - tpmx 6y ago
        I apologize. I edited the comment accordingly.
        jtbayly 6y ago
        Lol. Nice. Anyway, let me know when the GDPR actually helps with something instead of just making the internet more of a usability train wreck.
        tpmx 6y ago
        I'm pretty sure it has helped a lot already. The key part is the "the don't keep data around forever just because you can" part. Sure, the GDPR got a bit bloated, but I honestly believe most europeans lives got a little bit better because of it. Edit: I think you're thinking about that horrible cookie warning law. That one needs to burned to the ground.
        yoavm 6y ago
        It's not even just European lives that got better because of GDPR, we're all benefiting from having big companies forced to comply with it. I have used the "Right to erasure" multiple times with American companies just by saying I'm from Europe.
- saagarjha 6y ago
  Which ones? GDPR guarantees "right to data portability", not "right to an open API". I'm sure they could give you a CSV if you personally write to them and still be compliant.
  - deleted 6y ago
    [deleted]
wayneftw 6y ago
According to Spotify’s own site [0], their users have > ...the right to request a copy of your personal data in electronic format and the right to transmit that personal data for use in another party’s service... [0] https://www.spotify.com/us/legal/privacy-policy/#s3 https://www.spotify.com/us/legal/privacy-policy/#s3 Why can’t a transfer service just use that file? Perhaps, it doesn’t include playlists or liked artists/albums/songs?
- tpmx 6y ago
  I haven't tried doing so with Spotify, but basically it's typically too complicated and slow (see other comments) to be practically useful for the typical consumer of today.
- tzs 6y ago
  I've just requested my data. When I get it I'll take a look and see if it contains playlist information and either edit this comment or post a reply to myself if the edit window has closed with the results. They say it can take up to 30 days to process.
  - morsch 6y ago
    Here's a previous discussion of someone getting the full dataset: https://news.ycombinator.com/item?id=17681289 https://news.ycombinator.com/item?id=17681289 Tried the GDPR data export from Spotify. By default, you get like 6 JSON files with almost nothing. After many emails and complaining and a month of waiting, I got a 250MB archive with basically EVERY INTERACTION I ever did with any Spotify client, all my searches. Everything.
  - DaiPlusPlus 6y ago
    > They say it can take up to 30 days to process. What the heck... My current day-job is a multi-tenant SaaS system - every single entity in any of our heterogenous databases is tagged with a tenant identifier (it's also used in composite PKs/FKs in RDBMS databases to prevent incorrect inter-tenant references). Every database system we use (MSSQL, MySQL, Cassandra, etc) has some way to query itself (INFORMATION_SCHEMA, system_schema, etc) which allows for query-generation to generate queries that will reliably dump all data we have associated with any tenant (and by extension, any user) within seconds, even if there's been some ad-hoc or unplanned database design changes (this is the only time I use "SELECT *" in production code!) - this is from a weekend project where I wrote a simple web-application that generates and runs those queries and dumps data to CSV files for tables and JSON for document-stores, shoves them into a zip and uploads them to Azure Blob storage. I didn't build it for GDPR compliance but actually to allow me to undo any unintentional data-deletion without needing to do a full database restore. My operation's scale is nothing compared to Spotify - but if a tool I built in a couple of days can reliably dump all data about a subject across multiple independent cloud databases within seconds - what's Spotify's excuse?
milofeynman 6y ago
This one is clearly anti-competive and I hope someone will help them out and pick it up. This is the most obvious requirement for the future of preventing these monopolies. The ability to get your data out.
deleted 6y ago
[deleted]
eadz 6y ago
The irony is that Spotify is a partner in the app store fairness coalition (https://appfairness.org/ https://appfairness.org/). I consider their developer platform[1] to be an app store of sorts, and they do not play fair when it comes to holding onto their market power in certain areas. Anyone have a contact in the App Fairness Coalition to raise these points with? [1] https://developer.spotify.com/community/showcase/ https://developer.spotify.com/community/showcase/
- ec109685 6y ago
  Yeah, seriously. There isn’t some higher ideal — every company is in it for themselves and then works on justifying the policy that will further their interests through such coalitions. No doubt that the same company that sends a cease and desist to a developer who provides an export feature would act the same way as Apple if they were in its shoes.

by tpmx 6y ago

actuator 6y ago

Also, it runs afoul of sections of GDPR. I don't agree that Spotify has to let users transfer Spotify curated playlists as that is a business strength. Songshift seems to show Spotify curated playlists on their homepage like Discover Weekly so I can see why Spotify won't like this. But if my understanding of GDPR is right they have to allow users to transfer playlists created by themselves.

tpmx 6y ago
Right. Forgot that. Regarding GDPR and data portability: In practise you can expect to receive a (link to a) zip file via email with a bunch of XML documents after going through a convoluted dance. Also, it often takes some time (days) to receive the data. Basically, nothing that can easily be automated by a third part service - you need user auth of the requesting user to access the data.) "You must comply with a request for data portability without undue delay and at the latest within one month of receipt of the request" I guess it's because data portability isn't trivial, and it was wasn't the key aspect of GDPR. As a contrast: The EU mobile number portability legislation says: max 1 working day.
- actuator 6y ago
  Yeah, data portability is hard to define as a strict standard as it is extremely product specific. Even when we implemented it for my last company, we did JSON exports on signed S3 paths. I thought structured data was the easiest way for any competitor or user to use their data.
  - tpmx 6y ago
    I feel they could have included a clause that would let a designated third party access the extracted data on the requester's behalf in an automated way. I think it could have worked pretty well to keep it as vague as that. (The auth aspects would need more detail, obviously.) I don't think data format fragmentation is a big issue (just implement adapters for the top five competitors in your market...), but rather the impossibility of doing it in a quick and seamless manner on behalf of someone wanting to migrate their data to your service from some other service.
    - actuator 6y ago
      > I feel they could have included a clause that would let a designated third party access the extracted data on the requester's behalf in an automated way. Yeah, this would have been nice. I am not sure if legally you could enforce that as automation itself is vague and depends on the source and target both. > I don't think data format fragmentation is a big issue (just implement adapters for the top five competitors in your market...), but rather the impossibility of doing it in a quick and seamless manner on behalf of someone wanting to migrate their data to your service from some other service. I think if companies were being honest in their efforts for data portability, as a first step they would not try to reap the benefit of the 30 day window by as much as they can. For most, it should take mins or hours to get the export yet the best turnaround I have seen from any service has been from Tinder, it was I think 3 days.
      - watermelon0 6y ago
        This really depends on the service. In my experience, Netflix and Facebook took only a few hours to export the data.
jtbayly 6y ago
Lol. GDPR. That great white knight.
- tpmx 6y ago
  Lol. A jingoist.
  - jtbayly 6y ago
    I’m pretty sure it’s a violation of community standards to use a person’s country of origin as an insult or slur. Are you intentionally trying to denigrate a people group?
    - tpmx 6y ago
      I apologize. I edited the comment accordingly.
      - jtbayly 6y ago
        Lol. Nice. Anyway, let me know when the GDPR actually helps with something instead of just making the internet more of a usability train wreck.
        tpmx 6y ago
        I'm pretty sure it has helped a lot already. The key part is the "the don't keep data around forever just because you can" part. Sure, the GDPR got a bit bloated, but I honestly believe most europeans lives got a little bit better because of it. Edit: I think you're thinking about that horrible cookie warning law. That one needs to burned to the ground.
        yoavm 6y ago
        It's not even just European lives that got better because of GDPR, we're all benefiting from having big companies forced to comply with it. I have used the "Right to erasure" multiple times with American companies just by saying I'm from Europe.
saagarjha 6y ago
Which ones? GDPR guarantees "right to data portability", not "right to an open API". I'm sure they could give you a CSV if you personally write to them and still be compliant.
- deleted 6y ago
  [deleted]

wayneftw 6y ago

According to Spotify’s own site [0], their users have > ...the right to request a copy of your personal data in electronic format and the right to transmit that personal data for use in another party’s service... [0] https://www.spotify.com/us/legal/privacy-policy/#s3 https://www.spotify.com/us/legal/privacy-policy/#s3 Why can’t a transfer service just use that file? Perhaps, it doesn’t include playlists or liked artists/albums/songs?

tpmx 6y ago
I haven't tried doing so with Spotify, but basically it's typically too complicated and slow (see other comments) to be practically useful for the typical consumer of today.
tzs 6y ago
I've just requested my data. When I get it I'll take a look and see if it contains playlist information and either edit this comment or post a reply to myself if the edit window has closed with the results. They say it can take up to 30 days to process.
- morsch 6y ago
  Here's a previous discussion of someone getting the full dataset: https://news.ycombinator.com/item?id=17681289 https://news.ycombinator.com/item?id=17681289 Tried the GDPR data export from Spotify. By default, you get like 6 JSON files with almost nothing. After many emails and complaining and a month of waiting, I got a 250MB archive with basically EVERY INTERACTION I ever did with any Spotify client, all my searches. Everything.
- DaiPlusPlus 6y ago
  > They say it can take up to 30 days to process. What the heck... My current day-job is a multi-tenant SaaS system - every single entity in any of our heterogenous databases is tagged with a tenant identifier (it's also used in composite PKs/FKs in RDBMS databases to prevent incorrect inter-tenant references). Every database system we use (MSSQL, MySQL, Cassandra, etc) has some way to query itself (INFORMATION_SCHEMA, system_schema, etc) which allows for query-generation to generate queries that will reliably dump all data we have associated with any tenant (and by extension, any user) within seconds, even if there's been some ad-hoc or unplanned database design changes (this is the only time I use "SELECT *" in production code!) - this is from a weekend project where I wrote a simple web-application that generates and runs those queries and dumps data to CSV files for tables and JSON for document-stores, shoves them into a zip and uploads them to Azure Blob storage. I didn't build it for GDPR compliance but actually to allow me to undo any unintentional data-deletion without needing to do a full database restore. My operation's scale is nothing compared to Spotify - but if a tool I built in a couple of days can reliably dump all data about a subject across multiple independent cloud databases within seconds - what's Spotify's excuse?

milofeynman 6y ago

This one is clearly anti-competive and I hope someone will help them out and pick it up. This is the most obvious requirement for the future of preventing these monopolies. The ability to get your data out.

deleted 6y ago

[deleted]

eadz 6y ago

The irony is that Spotify is a partner in the app store fairness coalition (https://appfairness.org/ https://appfairness.org/). I consider their developer platform[1] to be an app store of sorts, and they do not play fair when it comes to holding onto their market power in certain areas. Anyone have a contact in the App Fairness Coalition to raise these points with? [1] https://developer.spotify.com/community/showcase/ https://developer.spotify.com/community/showcase/

ec109685 6y ago
Yeah, seriously. There isn’t some higher ideal — every company is in it for themselves and then works on justifying the policy that will further their interests through such coalitions. No doubt that the same company that sends a cease and desist to a developer who provides an export feature would act the same way as Apple if they were in its shoes.