5 ms·

What ar the agreements with amazon and google/firebase regarding the privacy of your data? If they ensure privacy, can they be trusted? For the data of childr

What ar the agreements with amazon and google/firebase regarding the privacy of your data? If they ensure privacy, can they be trusted? For the data of children, shouldn't they be held to a higher standard? E.g. for protected government data, you have to run in amazon's govcloud.

judge2020 6y ago
AWS terms do not grant them a license or ownership over your data, although "If you process the personal data of End Users or other identifiable individuals in your use of a Service, you are responsible for providing legally adequate privacy notices and obtaining necessary consents for the processing of such data" - so if you just store random files on s3 or EBS it's not like AWS can do anything they want with it. https://aws.amazon.com/service-terms/ https://aws.amazon.com/service-terms/ The GDPR DPA does a good job of encompassing the entire extent of their data use: > AWS will not access or use, or disclose to any third party, any Customer Data, except, in each case, as necessary to maintain or provide the Services, or as necessary to comply with the law or a valid and binding order of a governmental body (such as a subpoena or court order)... https://d1.awsstatic.com/legal/aws-gdpr/AWS_GDPR_DPA.pdf https://d1.awsstatic.com/legal/aws-gdpr/AWS_GDPR_DPA.pdf
asciimike 6y ago
Firebase's terms are here: https://firebase.google.com/terms https://firebase.google.com/terms (and GCP's data processing terms are here: https://cloud.google.com/terms/data-processing-terms https://cloud.google.com/terms/data-processing-terms) Having worked on those products (and in some cases, written the terms), I'd say so.
- Nextgrid 6y ago
  Facebook used to promise that phone numbers collected for 2FA purposes wouldn't be used for advertising purposes, and then broke that promise. That is just one example which was made public and was done intentionally. There's potentially plenty more cases where it's either done but concealed (because of how many factors go into ad targeting it's often impossible to categorically prove/disprove which data was used to target an ad) or done by accident from earlier code that just assumed all data is fine to use for ads (or that the new product which shouldn't share its data for advertising purposes was accidentally storing data in the same place as other products who do share data for advertising purposes). Why should we trust companies that have a business incentive to break their promises? If Google's biggest revenue stream is ads and that requires personal data then I wouldn't trust any of their promises not to use some personal data unless I can 100% audit all the code myself and prove that it's indeed that code that is running in production.
  - ClumsyPilot 6y ago
    Why are there no consequences to breaking their promices
    - danaris 6y ago
      Because we have, as an industry, collectively surrendered our morality to "the market", which is supposed to fix all these problems by its almighty powers. Because the prevailing voices our country have spent the past half-century telling us that government is Bad, and business (and greed) is Good, and enough of us have bought into the idea that we've systematically dismantled enough of the systems that keep corporate greed from running amok and ruining people's lives that they now effectively run large chunks of government (eg, see ALEC). Because too much of our society—especially in the tech sector, and more especially in the parts of it that are overrepresented on HackerNews—has come to worship wealth and the wealthy, and to believe that they should be allowed huge amounts of latitude to do what they want with their wealth.
Spooky23 6y ago
There are many contractual commitments to privacy on all of the big platforms. Like any tool, the wielder can make bad implementation choices. (And I can assure you, on-prem Edu IT is a shitshow) > E.g. for protected government data, you have to run in amazon's govcloud. Not really. Many .gov workloads are fine in commercial cloud. It depends on your compliance requirements. Sometimes there are downsides too - some services aren’t available. At one point, Azure Gov required separate credentials.
gerash 6y ago
Naive question: why do children need a higher standard of privacy vs. adults? It feels like "children" here are mainly used to evoke an emotional response. If I had to choose a stage of my life to become part of the public records, I'd definitely pick my childhood over my adulthood.
- bryanrasmussen 6y ago
  >If I had to choose a stage of my life to become part of public records, I'd definitely pick my childhood over my adulthood. that doesn't sound sensible unless you are assuming at adulthood you would be out of public records, in which case sounds great! because your adulthood will hopefully be a lot longer than your childhood. On the other hand I don't think an advanced society would work with that model. Secondly - why do children need a higher standard? People at different changes of their life are not necessarily the same people, a man at 50 might not be very much like who he was at 20. Unfortunately our society does not do much to support such a concept. It does however support the very rudimentary concept that things you did as a child should not follow you as an adult - when you have different legal responsibilities and possibilities of action. So that is something that probably shouldn't be taken away. Furthermore as a child is not fully developed in reasoning it is probably nice that things the child does is not part of their permanent record.
- learnstats2 6y ago
  As an adult, any service provider can claim that you agreed, when you signed up to a service, to give away your personal data. It’s presented as a contract mutually agreed between you and the service provider - you get the service; the provider gets the data. A legal contract. But, in all systems of law that I’m aware of, you can’t make enforceable contracts with children. This exists as a way of protecting children from making disadvantageous agreements that they don’t yet have competence to understand. So, the service provider can’t use any contract as justification for handling personal data of children. This leaves the service provider without legal justification and then calls their ethics into question.
  - dragonwriter 6y ago

judge2020 6y ago

AWS terms do not grant them a license or ownership over your data, although "If you process the personal data of End Users or other identifiable individuals in your use of a Service, you are responsible for providing legally adequate privacy notices and obtaining necessary consents for the processing of such data" - so if you just store random files on s3 or EBS it's not like AWS can do anything they want with it. https://aws.amazon.com/service-terms/ https://aws.amazon.com/service-terms/ The GDPR DPA does a good job of encompassing the entire extent of their data use: > AWS will not access or use, or disclose to any third party, any Customer Data, except, in each case, as necessary to maintain or provide the Services, or as necessary to comply with the law or a valid and binding order of a governmental body (such as a subpoena or court order)... https://d1.awsstatic.com/legal/aws-gdpr/AWS_GDPR_DPA.pdf https://d1.awsstatic.com/legal/aws-gdpr/AWS_GDPR_DPA.pdf

asciimike 6y ago

Firebase's terms are here: https://firebase.google.com/terms https://firebase.google.com/terms (and GCP's data processing terms are here: https://cloud.google.com/terms/data-processing-terms https://cloud.google.com/terms/data-processing-terms) Having worked on those products (and in some cases, written the terms), I'd say so.

Nextgrid 6y ago
Facebook used to promise that phone numbers collected for 2FA purposes wouldn't be used for advertising purposes, and then broke that promise. That is just one example which was made public and was done intentionally. There's potentially plenty more cases where it's either done but concealed (because of how many factors go into ad targeting it's often impossible to categorically prove/disprove which data was used to target an ad) or done by accident from earlier code that just assumed all data is fine to use for ads (or that the new product which shouldn't share its data for advertising purposes was accidentally storing data in the same place as other products who do share data for advertising purposes). Why should we trust companies that have a business incentive to break their promises? If Google's biggest revenue stream is ads and that requires personal data then I wouldn't trust any of their promises not to use some personal data unless I can 100% audit all the code myself and prove that it's indeed that code that is running in production.
- ClumsyPilot 6y ago
  Why are there no consequences to breaking their promices
  - danaris 6y ago
    Because we have, as an industry, collectively surrendered our morality to "the market", which is supposed to fix all these problems by its almighty powers. Because the prevailing voices our country have spent the past half-century telling us that government is Bad, and business (and greed) is Good, and enough of us have bought into the idea that we've systematically dismantled enough of the systems that keep corporate greed from running amok and ruining people's lives that they now effectively run large chunks of government (eg, see ALEC). Because too much of our society—especially in the tech sector, and more especially in the parts of it that are overrepresented on HackerNews—has come to worship wealth and the wealthy, and to believe that they should be allowed huge amounts of latitude to do what they want with their wealth.

Spooky23 6y ago

There are many contractual commitments to privacy on all of the big platforms. Like any tool, the wielder can make bad implementation choices. (And I can assure you, on-prem Edu IT is a shitshow) > E.g. for protected government data, you have to run in amazon's govcloud. Not really. Many .gov workloads are fine in commercial cloud. It depends on your compliance requirements. Sometimes there are downsides too - some services aren’t available. At one point, Azure Gov required separate credentials.

gerash 6y ago

Naive question: why do children need a higher standard of privacy vs. adults? It feels like "children" here are mainly used to evoke an emotional response. If I had to choose a stage of my life to become part of the public records, I'd definitely pick my childhood over my adulthood.

bryanrasmussen 6y ago
>If I had to choose a stage of my life to become part of public records, I'd definitely pick my childhood over my adulthood. that doesn't sound sensible unless you are assuming at adulthood you would be out of public records, in which case sounds great! because your adulthood will hopefully be a lot longer than your childhood. On the other hand I don't think an advanced society would work with that model. Secondly - why do children need a higher standard? People at different changes of their life are not necessarily the same people, a man at 50 might not be very much like who he was at 20. Unfortunately our society does not do much to support such a concept. It does however support the very rudimentary concept that things you did as a child should not follow you as an adult - when you have different legal responsibilities and possibilities of action. So that is something that probably shouldn't be taken away. Furthermore as a child is not fully developed in reasoning it is probably nice that things the child does is not part of their permanent record.
learnstats2 6y ago
As an adult, any service provider can claim that you agreed, when you signed up to a service, to give away your personal data. It’s presented as a contract mutually agreed between you and the service provider - you get the service; the provider gets the data. A legal contract. But, in all systems of law that I’m aware of, you can’t make enforceable contracts with children. This exists as a way of protecting children from making disadvantageous agreements that they don’t yet have competence to understand. So, the service provider can’t use any contract as justification for handling personal data of children. This leaves the service provider without legal justification and then calls their ethics into question.
- dragonwriter 6y ago