8 ms·

So now, bar/restaurant owners can reliably track their customers: age/name, how often they come in each branch. Large franchise would also be able to track wher

by y04nn 5y ago

So now, bar/restaurant owners can reliably track their customers: age/name, how often they come in each branch. Large franchise would also be able to track where and how often their customers travel and what they eat. I think this is real privacy issue. If you what to store the data, please anonymize it first, at least when it leaks it would be a lesser privacy disaster.

zaarn 5y ago
GDPR Breach, plain and simple. No franchise would risk storing and leaking what amounts to medical records (since that is the source) in front of a GDPR Watchdog. Pretty sure you'd get the hammer if you did that. Either way, the official apps that let you check the record do not allow tracking, only verification. The simple solution is that if you don't see them using the official app, simply leave.
- michaelt 5y ago
  > the official apps that let you check the record do not allow tracking, only verification. So why are name and date of birth included in the QR code?
  - bigiain 5y ago
    I would guess so that they can use more traditional ID (like a drivers license) to confirm the vaccine record is yours.
  - mtmsr 5y ago
    Because you need a way for the pub to authenticate that this is indeed your qr code (matching your id)
    - Mediterraneo10 5y ago
      The EU standard was developed for the purposes of avoiding additional quarantine or testing during cross-border travel, not going to pubs within one’s own country. For domestic use of proof of COVID vaccination, some countries developed their own internal standards alongside the EU standard.
    - raxxorrax 5y ago
      Not currently visiting pubs, I still wait until they stop validating their guests.
  - solarexplorer 5y ago
    To check with your passport/id card that this is your QR code and not someone else’s…
  - fsw 5y ago
    To compare it with name and DOB in the government ID.
  - deleted 5y ago
    [deleted]
  - nottorp 5y ago
    I don't think name and date of birth are enough for identity theft anywhere in Europe...
- gpvos 5y ago
  > The simple solution is that if you don't see them using the official app, simply leave. It'd be easy to make something that looks like the official app but does store the information, especially if that app is open source (is it?).
  - libertine 5y ago
    That's beyond the point of GDPR, even if they collect the data illegally the value would be to reach the person (to give them promotional content, advertising, custom experience, what ever...) Basically even if they collected the data they wouldn't be able to use it. If they just collected your name to personalize your experience they'd be literally in deep shit if someone asked: "where did you get this information from?" - which to you may sound a weird question, but since 2018, at least in my country, more and more people ask this question. When in doubt, report. They'd need to show to authorities that the person gave explicit consent to store that data and to be used for personalized experiences. It's about consent. If the user didn't give consent you have no use for the data, and you'll be storing toxic material to get you fined.
  - zaarn 5y ago
    An app faking the official look would open you up to so many liabilities and the GDPR watchdogs will probably just drool at the thought of anyone trying to defend that in a court after getting hammered by record fines.
detaro 5y ago
If you want to store the data, don't, because it's a textbook example of illegal. And hopefully people will be paying close attention to what offered apps do.
- Mega1mpact 5y ago
  But the chance of getting caught is next-to-zero, enfocement is very spotty when it comes to GDPR and I wouldn't be suprised if you could easilly sell that data to an off-shore company
sltkr 5y ago
In the EU, using this data to track customers would be illegal. That doesn't mean it can't happen, of course, but it should deter particularly large franchises from abusing this data. In the US, bars often ask for photo ID to verify that customers are old enough to be served alcohol. That doesn't seem to lead to widespread customer tracking.
- TedDoesntTalk 5y ago
  > bars often ask for photo ID to verify that customers are old enough to be served alcohol. 1. This is a subset of all customers so it is not as useful as all customers 2. I’ve never seen a bartender or waitress scan my photo ID or record the data on the ID; without that it isn’t highly unlikely the data is being stored. Your comparison is just not valid.
  - hamandcheese 5y ago
    There are some bars in Sacramento, CA that not only scan your ID, but scan your face, and use facial recognition to match you with previous scans, ostensibly to make sure you aren’t sharing an ID with someone underage. It is extremely creepy.
    - sunshineforever 5y ago
      There's a gas station store that does this in Portland OR. They have a facial recognition camera at the door that scans each person to enter the store after sundown.
      - BurningFrog 5y ago
        I have a lot of sympathy for people working late night in crime prone jobs.
    - ccn0p 5y ago
      time to avoid those bars. extreme oversight to ensure a 20-year-old doesn't drink. but hey at least the same 20-year-old can drive a car, vote for our public officials, and join the armed forces.
originalvichy 5y ago
And what has been stopping malicious companies from doing this before? To enter bars in most European countries you are already required to show identification prior to entering.
- riffraff 5y ago
  > To enter bars in most European countries you are already required to show identification prior to entering. this has never been a thing in any European country I've been in. Maybe if you look underage, but definitely not the norm.
- refurb 5y ago
  From a US perspective: 1) ID is usually not required but rather checked when is not clear and 2) it’s usually a visual check not a scan of the ID (though I know some bars do do this) so nothing is electronically captured.
- deleted 5y ago
  [deleted]
- Dma54rhs 5y ago
  Absolutely not true unless you're a kid.
- zekica 5y ago
  I have never been asked to show my ID at any bar in any country in the EU I travelled to.
- mmcnl 5y ago
  Never happened to me. Never heard of this happening. Seems anecdotal and likely not widespread at all.
- CRConrad 5y ago
  You must have been to more European countries than I have... (Twelve, I think.)
baud147258 5y ago
large franchise can already do that with customer fidelity programs anyway...
- y04nn 5y ago
  They do, but you can opt out, here the check is mandatory, the same for paying by credit card, you can use cash.
pftburger 5y ago
The system is actually comprised of two apps, CovPass and CovCheck. Both are in the repo. The check app validates the pass in-app, and, as far as I can tell, doesn’t phone home or report any data. IE there is no logging of the scanned persons data
- DeusExMachina 5y ago
  And what prevents the checker from taking screenshots or recording the screen to harvest the data later?
  - 34679 5y ago
    The same thing that prevents them from stabbing you and taking your money. It's illegal and wrong.
  - torgard 5y ago
    For one thing, GDPR. It's illegal. Apps can also be configured to prohibit (or at least make it harder make) screenshots/screen-recordings. It can of course be circumvented, but still. It's illegal. I would consider it as safe as showing my ID to a bartender/bouncer. Safer, even, as they don't get as much data.
  - mmcnl 5y ago
    It's illegal due to GDPR.
BurningFrog 5y ago
Even if you care about this, it's only used during the current Covid restriction phase. In 1-2 years at the most* any investment in such a tracking scheme will be obsolete. * Famous last words, I know
- gillesjacobs 5y ago
  Then why specify a field in the format for "targeted diseases"?
  - _ph_ 5y ago
    An almost uncharacteristic case of reason and foresight. We are currently worried with Covid-19, but considering all the variants already present, lets just hope that there isn't a Covid-22. In any case, as soon as there are dedicated vaccinations against the variants, it is very likely that there is need for more fine-grained tracking. That is probably also the reason they include the vaccines used in the data set. And even if we don't have the need to check for our vaccination state when going to restaurants soon enough, it would be good if those certificates could be used to track any other vaccination you get. Just as the replacement or digital alternative for the usual yellow vaccination booklet. It would make checking your vaccination status for your doctor much easier than trying to decipher what a colleague has scribbled many years ago.
moron4hire 5y ago
Mah dude, they're already doing that from your credit card information.
dirkx 5y ago
This is meant for traveling. Countries like the Netherlands use Zero Knowlege proof based solutions for domestic use. To exactly prevent this from happening.

by y04nn 5y ago

zaarn 5y ago

GDPR Breach, plain and simple. No franchise would risk storing and leaking what amounts to medical records (since that is the source) in front of a GDPR Watchdog. Pretty sure you'd get the hammer if you did that. Either way, the official apps that let you check the record do not allow tracking, only verification. The simple solution is that if you don't see them using the official app, simply leave.

michaelt 5y ago
> the official apps that let you check the record do not allow tracking, only verification. So why are name and date of birth included in the QR code?
- bigiain 5y ago
  I would guess so that they can use more traditional ID (like a drivers license) to confirm the vaccine record is yours.
- mtmsr 5y ago
  Because you need a way for the pub to authenticate that this is indeed your qr code (matching your id)
  - Mediterraneo10 5y ago
    The EU standard was developed for the purposes of avoiding additional quarantine or testing during cross-border travel, not going to pubs within one’s own country. For domestic use of proof of COVID vaccination, some countries developed their own internal standards alongside the EU standard.
  - raxxorrax 5y ago
    Not currently visiting pubs, I still wait until they stop validating their guests.
- solarexplorer 5y ago
  To check with your passport/id card that this is your QR code and not someone else’s…
- fsw 5y ago
  To compare it with name and DOB in the government ID.
- deleted 5y ago
  [deleted]
- nottorp 5y ago
  I don't think name and date of birth are enough for identity theft anywhere in Europe...
gpvos 5y ago
> The simple solution is that if you don't see them using the official app, simply leave. It'd be easy to make something that looks like the official app but does store the information, especially if that app is open source (is it?).
- libertine 5y ago
  That's beyond the point of GDPR, even if they collect the data illegally the value would be to reach the person (to give them promotional content, advertising, custom experience, what ever...) Basically even if they collected the data they wouldn't be able to use it. If they just collected your name to personalize your experience they'd be literally in deep shit if someone asked: "where did you get this information from?" - which to you may sound a weird question, but since 2018, at least in my country, more and more people ask this question. When in doubt, report. They'd need to show to authorities that the person gave explicit consent to store that data and to be used for personalized experiences. It's about consent. If the user didn't give consent you have no use for the data, and you'll be storing toxic material to get you fined.
- zaarn 5y ago
  An app faking the official look would open you up to so many liabilities and the GDPR watchdogs will probably just drool at the thought of anyone trying to defend that in a court after getting hammered by record fines.

detaro 5y ago

If you want to store the data, don't, because it's a textbook example of illegal. And hopefully people will be paying close attention to what offered apps do.

Mega1mpact 5y ago
But the chance of getting caught is next-to-zero, enfocement is very spotty when it comes to GDPR and I wouldn't be suprised if you could easilly sell that data to an off-shore company

sltkr 5y ago

In the EU, using this data to track customers would be illegal. That doesn't mean it can't happen, of course, but it should deter particularly large franchises from abusing this data. In the US, bars often ask for photo ID to verify that customers are old enough to be served alcohol. That doesn't seem to lead to widespread customer tracking.

TedDoesntTalk 5y ago
> bars often ask for photo ID to verify that customers are old enough to be served alcohol. 1. This is a subset of all customers so it is not as useful as all customers 2. I’ve never seen a bartender or waitress scan my photo ID or record the data on the ID; without that it isn’t highly unlikely the data is being stored. Your comparison is just not valid.
- hamandcheese 5y ago
  There are some bars in Sacramento, CA that not only scan your ID, but scan your face, and use facial recognition to match you with previous scans, ostensibly to make sure you aren’t sharing an ID with someone underage. It is extremely creepy.
  - sunshineforever 5y ago
    There's a gas station store that does this in Portland OR. They have a facial recognition camera at the door that scans each person to enter the store after sundown.
    - BurningFrog 5y ago
      I have a lot of sympathy for people working late night in crime prone jobs.
  - ccn0p 5y ago
    time to avoid those bars. extreme oversight to ensure a 20-year-old doesn't drink. but hey at least the same 20-year-old can drive a car, vote for our public officials, and join the armed forces.

originalvichy 5y ago

And what has been stopping malicious companies from doing this before? To enter bars in most European countries you are already required to show identification prior to entering.

riffraff 5y ago
> To enter bars in most European countries you are already required to show identification prior to entering. this has never been a thing in any European country I've been in. Maybe if you look underage, but definitely not the norm.
refurb 5y ago
From a US perspective: 1) ID is usually not required but rather checked when is not clear and 2) it’s usually a visual check not a scan of the ID (though I know some bars do do this) so nothing is electronically captured.
deleted 5y ago
[deleted]
Dma54rhs 5y ago
Absolutely not true unless you're a kid.
zekica 5y ago
I have never been asked to show my ID at any bar in any country in the EU I travelled to.
mmcnl 5y ago
Never happened to me. Never heard of this happening. Seems anecdotal and likely not widespread at all.
CRConrad 5y ago
You must have been to more European countries than I have... (Twelve, I think.)

baud147258 5y ago

large franchise can already do that with customer fidelity programs anyway...

y04nn 5y ago
They do, but you can opt out, here the check is mandatory, the same for paying by credit card, you can use cash.

pftburger 5y ago

The system is actually comprised of two apps, CovPass and CovCheck. Both are in the repo. The check app validates the pass in-app, and, as far as I can tell, doesn’t phone home or report any data. IE there is no logging of the scanned persons data

DeusExMachina 5y ago
And what prevents the checker from taking screenshots or recording the screen to harvest the data later?
- 34679 5y ago
  The same thing that prevents them from stabbing you and taking your money. It's illegal and wrong.
- torgard 5y ago
  For one thing, GDPR. It's illegal. Apps can also be configured to prohibit (or at least make it harder make) screenshots/screen-recordings. It can of course be circumvented, but still. It's illegal. I would consider it as safe as showing my ID to a bartender/bouncer. Safer, even, as they don't get as much data.
- mmcnl 5y ago
  It's illegal due to GDPR.

BurningFrog 5y ago

Even if you care about this, it's only used during the current Covid restriction phase. In 1-2 years at the most* any investment in such a tracking scheme will be obsolete. * Famous last words, I know

gillesjacobs 5y ago
Then why specify a field in the format for "targeted diseases"?
- _ph_ 5y ago
  An almost uncharacteristic case of reason and foresight. We are currently worried with Covid-19, but considering all the variants already present, lets just hope that there isn't a Covid-22. In any case, as soon as there are dedicated vaccinations against the variants, it is very likely that there is need for more fine-grained tracking. That is probably also the reason they include the vaccines used in the data set. And even if we don't have the need to check for our vaccination state when going to restaurants soon enough, it would be good if those certificates could be used to track any other vaccination you get. Just as the replacement or digital alternative for the usual yellow vaccination booklet. It would make checking your vaccination status for your doctor much easier than trying to decipher what a colleague has scribbled many years ago.

moron4hire 5y ago

Mah dude, they're already doing that from your credit card information.

dirkx 5y ago

This is meant for traveling. Countries like the Netherlands use Zero Knowlege proof based solutions for domestic use. To exactly prevent this from happening.