20 ms·

Princeton researcher apologizes for GDPR/CCPA email study

222 points by Mizza 5y ago

Cerium 5y ago
I guess it is good for the researcher to apologize, but I would rather be reading a postmortem from the Princeton IRB.
- chaircher 5y ago
  This is why I lost interest in a career in accademia and set myself up in industry. I saw one too many situations like this where people assumed they'd be stopped by the institution if they took things too far and they were not.
  - dataflow 5y ago
    Did you actually find academics take things "too far" more frequently than corporations do?
h2odragon 5y ago
> [the system] sends up to several emails that simulate real user inquiries about GDPR or CCPA processes. This research method is analogous to the audit and “secret shopper” methods that are common in academic research, enabling realistic evaluation of business practices. That was the whole problem. An open "we're researching responses" would've been fine. A murky "we're someone who looks fake talking about nebulous legal consequences" Isn't going to be welcomed anywhere, is it? This is a better response than I expected, and I wish them luck and success in communicating the lessons they've learned here more widely.
- jhgb 5y ago
  > An open "we're researching responses" would've been fine. That seems to be highly unscientific/prone to skewing the sample. It probably would have rendered the results useless.
  - yjftsjthsd-h 5y ago
    If you can't study something ethically, the conclusion is not that you get to ignore the ethical problem, the conclusion is that you can't study it.
    - jhgb 5y ago
      Yes, perhaps they should have hired real people to do real requests. That would have been a bulletproof way of studying this ethically so your conclusion is moot.
  - dogleash 5y ago
    >That seems to be highly unscientific/prone to skewing the sample. I'd argue the emails they did send are MORE prone to skewing the sample. If I had no CCPA plan and got an email from someone introducing themselves as researchers, I'd tell them I haven't gotten around to it, and that I intend to comply but haven't had anything prompt me to put in effort regarding CCPA. If I got the email they did send, that would be exactly the request that makes me go do the legal research, and my response would as narrow as possible.
anon946 5y ago
I would be very much interested in seeing the IRB submission/application that was submitted for this study. I wonder whether or not it was mischaracterized to the IRB, or written in such a way as to diminish the problematic aspects.
- nightpool 5y ago
  From TFA: We submitted an application detailing our research methods to the Princeton University Institutional Review Board, which determined that our study does not constitute human subjects research. The focus of the study is understanding website policies and practices, and emails associated with the study do not solicit personally identifiable information. This came up during the Linux security patch debacle as well. IRB guidelines are focused on a narrow set of harms based in historic abuses of medical research, and don't necessarily condemn the types of deception available here. As TFA points out, “secret shopper” methods are common in academic research of business practices.
  - dcow 5y ago
    This is exactly what I don't understand about the whole thing. People are arguing that this was unethical but the researchers literally proposed the study to their review board which said "go ahead it's not a human subjects research study and does not need consent and is not by that virtue unethical". Perhaps the review board was wrong, people make mistakes, whatever. But assuming the review board was correct in its analysis of the situation (and who are we really to challenge that unless there's a glaring negligent tier mistake), I have yet to hear an argument that dissects the ethics of this case and clearly lays out what ethical quandary we have on our hands and where the line was crossed. It really seems to me that people are conflating "annoying" with "unethical". Sure, spamming people is annoying. But how is it unethical? I had the same questions about the linux kernal security patches issue. Annoying waste of a few maintainers time, arguably yes for some definition of waste. But unethical? How so and can someone link me to literature detailing the ethical framework that disallows otherwise legal activity in good faith pursuit of knowledge because someone got annoyed in the process? I think that would be an interesting read.
najqh 5y ago
If you can screw somebody over just for asking to comply with a legal request, the problem is the law.
- kstrauser 5y ago
  It’s more complicated than that. The email I received was wrong about my legal obligations to respond. First, I received the email regarding a tiny personal site I operate for the fun of it, and I don’t meet the CCPA deadlines. Second, nothing in the CCPA said I have to reply to random information-gathering requests anyway. And yet, the email gave me a deadline to respond and cited a specific law, claiming that I owed them a response.
- netizen-936824 5y ago
  Not the legal system which requires the steep cost of representation?
- curiousgal 5y ago
  They did not screw anyone over, their email specifically says that it is not a data request. I remember one person saying they had a panic attack reading the email. Like come on, let's be real.
  - kstrauser 5y ago
    I got the email and I nearly had a panic attack. The email wasn’t completely generic: it referred to my specific site. It also read an awful lot as if it was coming from someone who would be looking for the slightest mistake in my response so that they could sue me. Similar things happen[1]. And finally, it lied and said I was compelled to respond, quoting a law that said no such thing (and which wouldn’t apply to my zero-revenue personal project website anyway). The stress wasn’t from the email. It’s that it gave every indication that I was being contacted by a legal troll, and that I might have to defend my hobby project in a courtroom. I couldn’t afford the costs of doing that, even if I ultimately won, and the idea of “well, there goes the college fund because of a stupid lawsuit on my hobby” was awful. [1] https://tucson.com/business/group-barred-from-filing-disability-lawsuits-against-az-businesses-in-state-court/article_57403da8-fa38-534b-9a74-631f0cff3625.html https://tucson.com/business/group-barred-from-filing-disabil...
NohatCoder 5y ago
Does anyone have the text of such an email?
- MattSteelblade 5y ago
  https://joewein.net/blog/2021/04/21/questions-about-gdpr-data-access-process-spam-from-virginia/ https://joewein.net/blog/2021/04/21/questions-about-gdpr-dat...
yifanlu 5y ago
I have a blog hosted on GH Pages generated with Jekyll. I got this email from the researcher: > To Whom It May Concern: > > My name is Tom Harris, and I am a resident of Sacramento, California. I have a few questions about your process for responding to General Data Protection Regulation (GDPR) data access requests: > > Would you process a GDPR data access request from me even though I am not a resident of the European Union? > Do you process GDPR data access requests via email, a website, or telephone? If via a website, what is the URL I should go to? > What personal information do I have to submit for you to verify and process a GDPR data access request? > What information do you provide in response to a GDPR data access request? > To be clear, I am not submitting a data access request at this time. My questions are about your process for when I do submit a request. > > Thank you in advance for your answers to these questions. If there is a better contact for processing GDPR requests regarding yifan.lu, I kindly ask that you forward my request to them. > > I look forward to your reply without undue delay and at most within one month of this email, as required by Article 12 of GDPR. > > Sincerely, > > Tom Harris I honestly thought it was one of those legal trolls who sent the same email to everyone hoping to find someone to sue but I responded anyways explaining how statically generated sites worked and that I’m willing to provide the information, being that the information is that I have none… The last paragraph in particular made it sound like a veiled legal threat (or that they’re hinting that they’re willing to go down that road). I felt that I had to respond just to establish some record.
- kstrauser 5y ago
  That’s similar to what I got, and I had the same thoughts about it. I responded more publicly though: https://blog.freeradical.zone/post/ccpa-scam-2021-12/ https://blog.freeradical.zone/post/ccpa-scam-2021-12/ .
- dmingod666 5y ago
  It was specifically crafted to sound like there will be legal consequence - this internet tough-guy goes into the same bucket as deceptive 'microsoft technicians' asking you to buy gift cards - not as scammy or nefarious, but in a similar vein nevertheless.
kstrauser 5y ago
More important: > We have also received consistent feedback encouraging us to promptly discard responses to study email. We agree, and we will delete all response data on December 31, 2021. I wrote one of the blogs posts that got linked here on HN, and I have some strong feelings about that. None of them are joy, though. I think it’s good and appropriate that the study is deleting all the data; since it was collected by misleading methods, I don’t think it was valid. I’m not happy that a study covering an important subject, and led by researchers who had good motivations, went so far off the rails in the first place that it had to be axed. Edit: I wrote more about my response to this whole situation at https://honeypot.net/post/dealing-with-princetons-flawed-privacy-research/ https://honeypot.net/post/dealing-with-princetons-flawed-pri... .
- gpm 5y ago
  Ignoring the ethical concerns, all the data they collected was completely worthless, because many of their subjects were contacting eachother and responding to it with the knowledge that it was a mass email sent with a variety of presumably fraudulent names.
  - charcircuit 5y ago
    Early data may be less biased than later data. The data should just be released anyways since the damage has already been done.
- seoulmetro 5y ago
  It definitely was valid. Probably the most valid data you're going to get if you want to test for this thing. Your emotions are getting in the way of your logic. I personally don't see what the problem is. People should be allowed to send whatever emails they like, it's up to you to reply to them. If they had sent emails out asking how everyone's day was going, would you get upset? What about how many employees they had?
  - ad404b8a372f2b9 5y ago
    Researchers are held to a higher ethical standard than random people because experimenting on people is morally dubious unless you follow strict guidelines. I feel like there is a lot of hyperbole wrt the harm that was done by this study but on the other hand I think it's clear researchers shouldn't have free reign to manipulate people as they see fit just because it's through email.
throwawyaaccoun 5y ago
[Throwaway for privacy.] I know this was hashed out on the other threads a bit, but can someone please explain to me why folks are so up in arms about this, compared to, say, studies that scrape user data without consent (something the IRB allows all the time by saying that no human subjects are involved)? Is it simply because there is no visibility into this practice (i.e., no email sent?) Scraping user data from public profiles, aggregating it into a model, and publishing a paper or whatever -- that seems demonstrably more invasive to individuals, storing and keeping their user data, than an email quoting a statute. I agree that the deception was unnecessary, but that's it. It doesn't feel any wronger than that. Especially because these researchers really were acting in "meta" good faith trying to probe the privacy ecosystem, I fear there may be a chilling effect. Consumers deserve privacy rights and privacy knowledge in the asymmetric surveillance economy we find ourselves in, IMO. I'm open to being wrong.
- halpert 5y ago
  Your question is essentially whataboutism. Both things can be wrong. We can care about this instance without diluting the conversation talking about something else that is also bad.
  - throwawyaaccoun 5y ago
    It's not intended to be whataboutism (sorry about that, I edited this in to clarify) -- I agree that the deception was wrong. But there seems to be something about this particular event that is riling people up, and that's what I am getting at. I am not trying to whatabout, to be super clear.
    - runnerup 5y ago
      To clarify. I don't think people would be riled up about individuals sending out these emails. Individuals are required to be legal, not 'ethical'. The people who are riled up believe that University studies should be performed ethically. They know that IRB's exist to prevent researchers from doing unethical, but legal, things. In this case, they feel the harm caused should have been prevented. Scraping data silently doesn't cause stress/harm to the participants directly, as they are unaware of any potential threat. It's not "human experimentation should be banned" its "human experimentation should be heavily scrutinized to prevent harm to participants as much as possible. And definitely never cause harm to unwilling / unwitting participants".
endisneigh 5y ago
Hot take: the researcher did nothing wrong. Some random person could make the same legitimate requests. If you dislike what this person did then really you just dislike that portion of the law. You cannot simultaneously believe anyone can request their data via these laws and then get mad that people do it, research or not. It’s literally designed this way.
- varjag 5y ago
  Anyone can yell on you on the street so it's fine I yell on you for research purposes.
  - endisneigh 5y ago
    That is not the same thing. The process for GDPR involves sending an email very similar to the one sent. The action you should take doesn’t depend on whether or not the email you’ve received is for research purposes. If someone doesn’t understand this then they have no business running a public website.
    - tverbeure 5y ago
      It only takes a quick scan of the comments in this thread to see that there were people who received this email while hosting a static github.io website with their personal blog. That's a public website. Do you honestly think that anyone running a personal blog has no business doing so unless they are knowledgeable about the details of European and California website privacy rules? What a brilliant way to stifle public speech. Your answer will probably be: "personal blog don't fall under these regulations, so it's a non-issue" but that's exactly the point: these researchers scared a bunch of people into spending time to research a law that doesn't even apply to them, yet the chance that some random from Europe would send a GDPR request to their blog is essentially zero, because even privacy crusaders are smarter than these Princeton research to know that it makes no sense to do this. Even if the general principle were ethical (not that I agree), the Princeton researches should have used a curated list of websites that could reasonably be expected to receive GDPR requests.
hellojesus 5y ago
It's bizarre to me that anyone would respond to what would surmount to a legal request which was delivered via email. Unless the gov has a supeona that was verifiably delivered to me physically, an email will be either totally ignored, or I'll respond telling them to go pound sand.
- dahfizz 5y ago
  Is that how you would respond to any GDPR-related request? GDPR legally requires you to respond to requests within a month. If someone making a request points that out to you, you may feel like you've been threatened. That doesn't change the law.
  - hellojesus 5y ago
    Yes, that is how I would respond to a request inquiring as to what my GDPR practices are. The requestor here isn't asking for access their information for GDPR reasons. They are asking what my private business operations are, which are not part of what I'm required to disclose, so far as my understanding goes. Separate from the above, if I run a US based business, why would I care if the EU wanted to try and sue me for breaking a law that has no jurisdiction over me?
  - astura 5y ago
    >GDPR legally requires you to respond to requests within a month GDPR requires nothing of me, I don't live in Europe or do business with anyone who does. Anyways, this email wasn't a request for data, it's an inquiry about business practices.
- jhgb 5y ago
  As per the law, a GDPR data access request may be sent by e-mail, or even delivered verbally. So the form is actually irrelevant.
  - hellojesus 5y ago
    Yes, but the researchers aren't asking about their data. They are asking about internal business policies, which they are not granted under the law. From the OP's links's FAQ: """ Why does this study involve contacting websites? Very few websites post details of their processes for handling GDPR and CCPA requests. Both the GDPR and the CCPA contemplate users and intermediaries reaching out with questions about data rights processes, and we are using that opportunity to understand current website policies and practices. """ From the sites I've seen discussing responsibilities, internal business processes for how GDPR requests are handled are not covered under GDPR. https://docs.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/gdpr-compliance?view=o365-worldwide https://docs.microsoft.com/en-us/microsoft-365/admin/securit... """ Data subject rights The GDPR establishes data subject rights, which means that, with respect to their personal data, customers, employees, business partners, clients, contractors, students, suppliers, and so forth have the right to: Be informed about their data: You must inform individuals about your use of their data. Have access to their data: You must give individuals access to any of their data that you hold (for example, by using account access or in some manual manner). Ask for data rectification: Individuals can ask you to correct inaccurate data. Ask for data to be deleted: Also known as the 'right to erasure', this right allows an individual to request that any of their personal data a company has collected is deleted across all systems that use it or share it. Request restricted processing: An individual can ask that you suppress or restrict their data. However, it is only applicable under certain circumstances. Have data portability: An individual can ask for their data to be transferred to another company. Object: An individual can object to their data being used for various uses including direct marketing. Ask not to be subject to automated decision-making, including profiling: The GDPR has strict rules about using data to profile people and automate decisions based on that profiling. """
harpiaharpyja 5y ago
Probably all they had to do was be transparent about the reason for sending out the emails, who they were, and probably throw in a link to that page (i.e. https://privacystudy.cs.princeton.edu https://privacystudy.cs.princeton.edu). Seems like a silly thing to overlook but it does seem the impact on people is serious and I guess they know better now...
- jonnybgood 5y ago
  Would people respond the same way if they knew it wasn’t a real request i.e. take it less seriously?
  - kstrauser 5y ago
    Possibly, but I'd bet the results would be way more accurate. If I got an email from a university I'd heard of, phrased like: > Hi! We're trying to study CCPA compliance of random sites. Could you help us by answering a few questions? then I absolutely would have replied, and would have replied honestly. People generally like to be helpful.
    - wayne-li2 5y ago
      That's the problem though -- it will skew the data towards friendly and helpful people like yourself. But it doesn't capture reality. To be honest, I don't know how you get this sort of analysis done without poisoning the intent and maintaining integrity.
      - kstrauser 5y ago
        Good point, and I don't know. But in the end, if it's not possible to conduct the study while acting ethically, then the study shouldn't be done.
abhv 5y ago
I am an academic and I am against this type of study. My main objection is that it wastes the valuable time of the website operator for little benefit. It is immoral to waste people's time. Many IRBs are unaware that these kinds of "public surveys" unduly burden respondents and cause them unnecessary stress. The little benefit will be a series of graphs indicating how site operators respond, which could be interesting, but does not justify the burden.
yk 5y ago
I fail to understand what the problem is. They send a mail asking the procedure of GDPR in a way that implies they consider using their rights. Now there is outrage to the extend that the researchers scrap their study, which is probably everything anybody needs to know about the state of the GDPR in practice.
- yjftsjthsd-h 5y ago
  > in a way that implies they consider using their rights. ... No, in a way that implied that they were about to take legal action, including against people who never had any legal obligation in the first place.
sebow 5y ago
godzillafarts 5y ago
My org received one of these emails. I was the engineer pinged on the support ticket. This request is neither threatening nor burdensome. This is a pretty standard run-of-the-mill GDPR request. We get them all the time. It took less than 60 seconds of my time to provide our support team with the information they needed to respond to the request. In fact, we already have a canned response to these requests - the person on the support team is a new hire and was unaware. If your org has users/customers in the EU, you need to have a GDPR playbook. Your support team needs to be briefed on these requests and how they should respond. I have a difficult time believing that any "controller" complaining about this is properly prepared to respond to GDPR access requests.... Which is kind of the whole point of the study, no?
- seoulmetro 5y ago
  I wonder how many people getting upset by this are also advocating for fire alarm drills to be removed because "they waste precious resources"? Emotion definitely overriding people's logic abilities here.
  - powersnail 5y ago
    If a researcher starts pulling fire alarms of random buildings, they will face felony charges.
    - seoulmetro 5y ago
      That's not how fire alarm drills work though. That's how fire alarms work. In this situation, the "researcher" is the person conducting the drills. Which are way more frequent than these emails.
      - powersnail 5y ago
        Without the permission of the property owner, conducting a fire alarm drill is no different than pulling the fire alarm.
dang 5y ago
The past major threads on this. Others? I was part of a human subject research study without my consent - https://news.ycombinator.com/item?id=29611139 https://news.ycombinator.com/item?id=29611139 - Dec 2021 (360 comments) CCPA Scam – Human subject research study conducted by Princeton University - https://news.ycombinator.com/item?id=29599553 https://news.ycombinator.com/item?id=29599553 - Dec 2021 (331 comments) Princeton-Radboud Study on Privacy Law Implementation - https://news.ycombinator.com/item?id=29599154 https://news.ycombinator.com/item?id=29599154 - Dec 2021 (10 comments)
- tjalfi 5y ago
  Here's one more thread. Ask HN: Is this CCPA-related spam? - https://news.ycombinator.com/item?id=29539266 https://news.ycombinator.com/item?id=29539266 - Dec 2021 (4 comments)
eli 5y ago
I've been very critical of this study from the start, but credit to the research team for acknowledging their errors and apologizing. I think the goal is a good one and I hope they're able to find a better way to accomplish it.
- addingnumbers 5y ago
  Their apology really doesn't address one of their most egregious wrongdoings. I see them boasting that the IRB determined "our study does not constitute human subjects research." I don't see them acknowledging that they slipped under the IRB's radar by consistently referring to human subjects as "websites."
  - eli 5y ago
    I think the IRB should investigate how they reached that conclusion and probably issue their own apology. Hard to say without seeing the actual application and not being familiar with Princeton IRB rules.
    - kodah 5y ago
      What is it about an apology that makes you seek them? I prefer action, charitable interpretation, and progress. I found this update rather encouraging: > Third, I will use the lessons learned from this experience to write and post a formal research ethics case study, explaining in detail what we did, why we did it, what we learned, and how researchers should approach similar studies in the future. I will teach that case study in coursework, and I will encourage academic colleagues to do the same. While I cannot turn back the clock on this study, I can help ensure that the next generation of technology policy researchers learns from it. Instead of wasting time by making another person or entity go through the humiliation gauntlet, let them improve their surroundings.
      - eli 5y ago
        Yes, a good apology always explains what is being done to prevent the wrong from happening again. I think we're saying the same thing.
jaclaz 5y ago
Personally I would like to know the exact numbers of e-mails actually sent. Hypothesis out of 1,000 mails: 5% were never read (because of spam filters/whatever) 10% were discarded manually or ignored 50% were replied to taking 30 minutes to write an accurate reply 30% were replied after consulting someone else (in the office or friend) let's say 1 hour 5% were replied after consulting a lawyer or consultant, let's make this 4 hours 500x1/2=250 300x1=300 50x4=200 Every 1,000 e-mails roughly 750 hours of people's work has been lost, that is at (say) 40 US$/hour some 30,000 US$ "burned".
- kbenson 5y ago
  That's one way to look at it. Another is that people spent some time to understand a law which may or may not affect them, but if it does, they should probably already have known about it. "Should" in the sense that it would be good for them it they did, not in the sense that I think they were negligent, as honestly I think there's a bunch of laws that affect people like this that that most of us are unaware of.
  - aero-glide2 5y ago
    I agree, I still don't see what was unethical about this.
    - nickff 5y ago
      How would you feel about getting threatening e-mails out of the blue, then finding out you were being used for the author's personal benefit?
    - bennysomething 5y ago
      I'm assuming you've never had something that approaches a real life legal threat? It's extremely stressful. It's one thing wanting people to know about laws, it's another thing to induce emotional distress just because you think some individual should know. Personally I think it was a horrible thing to do to an innocent person. Totally thoughtless and uncalled for.
    - 5y ago
mgamache 5y ago
I received one of these emails (I think). I can post it if people think it's informative (I didn't respond as it felt sus).
- mgamache 5y ago
  Here it is: Email To Whom It May Concern: My name is XXXX XXXXXXX, and I am a resident of Roanoke, Virginia. I have a few questions about your process for responding to General Data Protection Regulation (GDPR) data access requests: 1. Would you process a GDPR data access request from me even though I am not a resident of the European Union? 2. Do you process GDPR data access requests via email, a website, or telephone? If via a website, what is the URL I should go to? 3. What personal information do I have to submit for you to verify and process a GDPR data access request? 4. What information do you provide in response to a GDPR data access request? To be clear, I am not submitting a data access request at this time. My questions are about your process for when I do submit a request. Thank you in advance for your answers to these questions. If there is a better contact for processing GDPR requests regarding allisonelearn.com, I kindly ask that you forward my request to them. I look forward to your reply without undue delay and at most within one month of this email, as required by Article 12 of GDPR. Sincerely, XXXX XXXXXX
throwaway918279 5y ago
I'm accessing this researcher's website from the EU [1]. They don't have a gdpr banner asking me for consent but I can see analytics tools including Google analytics and fastly[2]. Is this website complaint with GDPR regulations? [1] https://www.cs.princeton.edu/people/profile/jrmayer https://www.cs.princeton.edu/people/profile/jrmayer [2] https://builtwith.com/?https%3a%2f%2fwww.cs.princeton.edu%2f%7ejrmayer https://builtwith.com/?https%3a%2f%2fwww.cs.princeton.edu%2f...
- UncleMeat 5y ago
  You can reach out and ask. Mayer is among the most influential people out there pushing for improved privacy via technology and legislation, and has been doing so for years.
- dataflow 5y ago
  That's not the researcher's website, it's the department's website with a blurb about this researcher (and others) on it. The researcher almost surely had no influence on the existence of Google Analytics on that page. The entity you need to talk to is the department.
  - throwaway918279 5y ago
    Thanks good point. His personal website also used Google analytics and has no banner. https://builtwith.com/?https%3a%2f%2fjonathanmayer.org%2f https://builtwith.com/?https%3a%2f%2fjonathanmayer.org%2f
arbuge 5y ago
Part of the problem here was the smug tone of his student initially going on Twitter to make the dubious claim that the response to this study had been "overwhelmingly positive", when it was already abundantly clear that it was anything but.
- arbuge 5y ago
  ps. The tweet in question is still there, with no apology yet from this individual: https://twitter.com/RossTeixeira/status/1471249559879929861 https://twitter.com/RossTeixeira/status/1471249559879929861
kazinator 5y ago
Did these researchers talk to a lawyer, who recommended apologizing like this? It seems like a rather imprudent thing to do.
- UncleMeat 5y ago
  Mayer is a lawyer.
kevinpet 5y ago
This is a non-apology apology. It's "I'm sorry you feel that way." I don't think I'm reading too much into it either: "I am dismayed that the emails in our study came across as security risks or legal threats." "explaining in detail what we did, why we did it, what we learned, and how researchers should approach similar studies in the future." Nothing about how it impacts their unwilling subjects. Nothing about failing to indicate they were doing an academic study. Nothing about the falsity of their legal threats.
- matkoniecz 5y ago
  Also "our study does not constitute human subjects research". Since when threatening people does not involve humans? Or is it some "technically, this legal term does not apply - according to our lawyer"?
  - jessriedel 5y ago
    You've clipped the quote to remove the part where they are describing the opinion of the IRB, not making a claim themselves. That paragraph is describing why there was no IRB involvement, not claiming that humans wheren't involved in the research.
    - matkoniecz 5y ago
      1) IRB opinion was based upon untrue description provided by researchers 2) they themself put it into own FAQ to distract from harm they did 3) they failed to admit that this statement was untrue and misleading 4) they put it into FAQ like it would be relevant
      - jessriedel 5y ago
        I agree. That doesn't make it OK to deceptively remove context from a quote.
        matkoniecz 5y ago
rantee 5y ago
(disclaimer: non-practicing lawyer here, not yours or theirs, off-the-cuff very hot take) What part of 'A consumer shall have the right to request...' in the CCPA isn't clear? Nothing about "A fake user may request..." Looking forward to another ballot initiative to further clarify the law! The secret shopper thing is a big red herring - at least the secret shopper actually buys something, and in real non-academic life is usually hired by the company (or marketing company by extension). Disappointing to see the lack of judgment from a researcher who's otherwise done great work, and the IRB failure to boot. Good to see some acknowledgement but it feels like "let's build a tool to do the work and hope for good data." Not sure where this could've led other than a name-and-shame conference paper.
throw10920 5y ago
Claiming that this study was "human research" is straight-up insane. There's as much "human research" going on there as there is when statisticians acquire data by going to a human who possesses it and asking for it (e.g. they want to study baseball, so they go to the Head Excel Overlord of the MLB and ask for their data) - that is, exactly none. Analyzing data that was given to you by a human does not automatically make your research project "human research", full stop. The research question here is "How do organizations fulfill their legal requirements due to the GDPR and CCPA?" and has nothing to do with individuals. The researchers didn't want any data about the humans, they didn't ask for it, they weren't studying reaction time, psychological response, brain activity, or anything else about any humans at all. If the answer to the question "Could you replace a human in experiment with an automated process and still perform a meaningful experiment with conceptually identical results?" is "yes", then there is no human research going on. Test: Stanford Prison Experiment: answer "no" (because the students were actually the ones being studied), turns out to be human research. Test: studying the properties of a crystal in a lab, and one of the machines is operated by a human grad student, answer is "yes", not human research. (note also that this test just proves that human research isn't being done - if you replace the baseball players in the above example with robotic batters, the answer the above question is "no", but clearly human experimentation isn't happening) Similarly, if each of the individuals who were contacted were replaced with a Perl script scanning for keywords that automatically replied with the organization's GDPR and CCPA policies, the results from the experiment would be. Exactly. The. Same. In fact, let's go and look up the definition of "human subjects research": According to 45 CFR 46, a human subject is "a living individual about whom an investigator (whether professional or student) conducting research: Obtains information or biospecimens through intervention or interaction with the individual, and uses, studies, or analyzes the information or biospecimens; or Obtains, uses, studies, analyzes, or generates identifiable private information or identifiable biospecimens." ...from the NIH at https://grants.nih.gov/policy/humansubjects/research.htm https://grants.nih.gov/policy/humansubjects/research.htm, and clearly does not describe what's going here. Let me repeat again: the fact that humans responded to the emails about GDPR+CCPA compliance of an organization owning the email is completely irrelevant. The experimenters didn't care about whether their request was serviced by a human or a computer, and in fact would have preferred computerized responses (instant response, more standardized formats, no possibility of human error). Claiming that this is "human experimentation" is disingenuous to the point of malice.
ktosobcy 5y ago
For some reason I was completely oblivious to the hole "drama" but reading the older threads and example emails - they were simply a questions regarding adherence to the GDPR/CCPA. On the one hand stating that this is a research would probably be "nice" though in that case a lot of websites would probably comply in the nicest possible way skewing the result. Why this bothers me? Because w while back I was trying to get my personal data off of yelp I was nicely greeted with the middle finger (they scraped my data from the government website which is the only page that can publish it and noone is legally permitted to re-publish it but you know... us-based yelp doesn't care about law)…

222 points by Mizza 5y ago

Cerium 5y ago

I guess it is good for the researcher to apologize, but I would rather be reading a postmortem from the Princeton IRB.

chaircher 5y ago
This is why I lost interest in a career in accademia and set myself up in industry. I saw one too many situations like this where people assumed they'd be stopped by the institution if they took things too far and they were not.
- dataflow 5y ago
  Did you actually find academics take things "too far" more frequently than corporations do?

h2odragon 5y ago

> [the system] sends up to several emails that simulate real user inquiries about GDPR or CCPA processes. This research method is analogous to the audit and “secret shopper” methods that are common in academic research, enabling realistic evaluation of business practices. That was the whole problem. An open "we're researching responses" would've been fine. A murky "we're someone who looks fake talking about nebulous legal consequences" Isn't going to be welcomed anywhere, is it? This is a better response than I expected, and I wish them luck and success in communicating the lessons they've learned here more widely.

jhgb 5y ago
> An open "we're researching responses" would've been fine. That seems to be highly unscientific/prone to skewing the sample. It probably would have rendered the results useless.
- yjftsjthsd-h 5y ago
  If you can't study something ethically, the conclusion is not that you get to ignore the ethical problem, the conclusion is that you can't study it.
  - jhgb 5y ago
    Yes, perhaps they should have hired real people to do real requests. That would have been a bulletproof way of studying this ethically so your conclusion is moot.
- dogleash 5y ago
  >That seems to be highly unscientific/prone to skewing the sample. I'd argue the emails they did send are MORE prone to skewing the sample. If I had no CCPA plan and got an email from someone introducing themselves as researchers, I'd tell them I haven't gotten around to it, and that I intend to comply but haven't had anything prompt me to put in effort regarding CCPA. If I got the email they did send, that would be exactly the request that makes me go do the legal research, and my response would as narrow as possible.

anon946 5y ago

I would be very much interested in seeing the IRB submission/application that was submitted for this study. I wonder whether or not it was mischaracterized to the IRB, or written in such a way as to diminish the problematic aspects.

nightpool 5y ago
From TFA: We submitted an application detailing our research methods to the Princeton University Institutional Review Board, which determined that our study does not constitute human subjects research. The focus of the study is understanding website policies and practices, and emails associated with the study do not solicit personally identifiable information. This came up during the Linux security patch debacle as well. IRB guidelines are focused on a narrow set of harms based in historic abuses of medical research, and don't necessarily condemn the types of deception available here. As TFA points out, “secret shopper” methods are common in academic research of business practices.
- dcow 5y ago
  This is exactly what I don't understand about the whole thing. People are arguing that this was unethical but the researchers literally proposed the study to their review board which said "go ahead it's not a human subjects research study and does not need consent and is not by that virtue unethical". Perhaps the review board was wrong, people make mistakes, whatever. But assuming the review board was correct in its analysis of the situation (and who are we really to challenge that unless there's a glaring negligent tier mistake), I have yet to hear an argument that dissects the ethics of this case and clearly lays out what ethical quandary we have on our hands and where the line was crossed. It really seems to me that people are conflating "annoying" with "unethical". Sure, spamming people is annoying. But how is it unethical? I had the same questions about the linux kernal security patches issue. Annoying waste of a few maintainers time, arguably yes for some definition of waste. But unethical? How so and can someone link me to literature detailing the ethical framework that disallows otherwise legal activity in good faith pursuit of knowledge because someone got annoyed in the process? I think that would be an interesting read.

najqh 5y ago

If you can screw somebody over just for asking to comply with a legal request, the problem is the law.

kstrauser 5y ago
It’s more complicated than that. The email I received was wrong about my legal obligations to respond. First, I received the email regarding a tiny personal site I operate for the fun of it, and I don’t meet the CCPA deadlines. Second, nothing in the CCPA said I have to reply to random information-gathering requests anyway. And yet, the email gave me a deadline to respond and cited a specific law, claiming that I owed them a response.
netizen-936824 5y ago
Not the legal system which requires the steep cost of representation?
curiousgal 5y ago
They did not screw anyone over, their email specifically says that it is not a data request. I remember one person saying they had a panic attack reading the email. Like come on, let's be real.
- kstrauser 5y ago
  I got the email and I nearly had a panic attack. The email wasn’t completely generic: it referred to my specific site. It also read an awful lot as if it was coming from someone who would be looking for the slightest mistake in my response so that they could sue me. Similar things happen[1]. And finally, it lied and said I was compelled to respond, quoting a law that said no such thing (and which wouldn’t apply to my zero-revenue personal project website anyway). The stress wasn’t from the email. It’s that it gave every indication that I was being contacted by a legal troll, and that I might have to defend my hobby project in a courtroom. I couldn’t afford the costs of doing that, even if I ultimately won, and the idea of “well, there goes the college fund because of a stupid lawsuit on my hobby” was awful. [1] https://tucson.com/business/group-barred-from-filing-disability-lawsuits-against-az-businesses-in-state-court/article_57403da8-fa38-534b-9a74-631f0cff3625.html https://tucson.com/business/group-barred-from-filing-disabil...

NohatCoder 5y ago

Does anyone have the text of such an email?

MattSteelblade 5y ago
https://joewein.net/blog/2021/04/21/questions-about-gdpr-data-access-process-spam-from-virginia/ https://joewein.net/blog/2021/04/21/questions-about-gdpr-dat...

yifanlu 5y ago

I have a blog hosted on GH Pages generated with Jekyll. I got this email from the researcher: > To Whom It May Concern: > > My name is Tom Harris, and I am a resident of Sacramento, California. I have a few questions about your process for responding to General Data Protection Regulation (GDPR) data access requests: > > Would you process a GDPR data access request from me even though I am not a resident of the European Union? > Do you process GDPR data access requests via email, a website, or telephone? If via a website, what is the URL I should go to? > What personal information do I have to submit for you to verify and process a GDPR data access request? > What information do you provide in response to a GDPR data access request? > To be clear, I am not submitting a data access request at this time. My questions are about your process for when I do submit a request. > > Thank you in advance for your answers to these questions. If there is a better contact for processing GDPR requests regarding yifan.lu, I kindly ask that you forward my request to them. > > I look forward to your reply without undue delay and at most within one month of this email, as required by Article 12 of GDPR. > > Sincerely, > > Tom Harris I honestly thought it was one of those legal trolls who sent the same email to everyone hoping to find someone to sue but I responded anyways explaining how statically generated sites worked and that I’m willing to provide the information, being that the information is that I have none… The last paragraph in particular made it sound like a veiled legal threat (or that they’re hinting that they’re willing to go down that road). I felt that I had to respond just to establish some record.

kstrauser 5y ago
That’s similar to what I got, and I had the same thoughts about it. I responded more publicly though: https://blog.freeradical.zone/post/ccpa-scam-2021-12/ https://blog.freeradical.zone/post/ccpa-scam-2021-12/ .
dmingod666 5y ago
It was specifically crafted to sound like there will be legal consequence - this internet tough-guy goes into the same bucket as deceptive 'microsoft technicians' asking you to buy gift cards - not as scammy or nefarious, but in a similar vein nevertheless.

kstrauser 5y ago

More important: > We have also received consistent feedback encouraging us to promptly discard responses to study email. We agree, and we will delete all response data on December 31, 2021. I wrote one of the blogs posts that got linked here on HN, and I have some strong feelings about that. None of them are joy, though. I think it’s good and appropriate that the study is deleting all the data; since it was collected by misleading methods, I don’t think it was valid. I’m not happy that a study covering an important subject, and led by researchers who had good motivations, went so far off the rails in the first place that it had to be axed. Edit: I wrote more about my response to this whole situation at https://honeypot.net/post/dealing-with-princetons-flawed-privacy-research/ https://honeypot.net/post/dealing-with-princetons-flawed-pri... .

gpm 5y ago
Ignoring the ethical concerns, all the data they collected was completely worthless, because many of their subjects were contacting eachother and responding to it with the knowledge that it was a mass email sent with a variety of presumably fraudulent names.
- charcircuit 5y ago
  Early data may be less biased than later data. The data should just be released anyways since the damage has already been done.
seoulmetro 5y ago
It definitely was valid. Probably the most valid data you're going to get if you want to test for this thing. Your emotions are getting in the way of your logic. I personally don't see what the problem is. People should be allowed to send whatever emails they like, it's up to you to reply to them. If they had sent emails out asking how everyone's day was going, would you get upset? What about how many employees they had?
- ad404b8a372f2b9 5y ago
  Researchers are held to a higher ethical standard than random people because experimenting on people is morally dubious unless you follow strict guidelines. I feel like there is a lot of hyperbole wrt the harm that was done by this study but on the other hand I think it's clear researchers shouldn't have free reign to manipulate people as they see fit just because it's through email.

throwawyaaccoun 5y ago

[Throwaway for privacy.] I know this was hashed out on the other threads a bit, but can someone please explain to me why folks are so up in arms about this, compared to, say, studies that scrape user data without consent (something the IRB allows all the time by saying that no human subjects are involved)? Is it simply because there is no visibility into this practice (i.e., no email sent?) Scraping user data from public profiles, aggregating it into a model, and publishing a paper or whatever -- that seems demonstrably more invasive to individuals, storing and keeping their user data, than an email quoting a statute. I agree that the deception was unnecessary, but that's it. It doesn't feel any wronger than that. Especially because these researchers really were acting in "meta" good faith trying to probe the privacy ecosystem, I fear there may be a chilling effect. Consumers deserve privacy rights and privacy knowledge in the asymmetric surveillance economy we find ourselves in, IMO. I'm open to being wrong.

halpert 5y ago
Your question is essentially whataboutism. Both things can be wrong. We can care about this instance without diluting the conversation talking about something else that is also bad.
- throwawyaaccoun 5y ago
  It's not intended to be whataboutism (sorry about that, I edited this in to clarify) -- I agree that the deception was wrong. But there seems to be something about this particular event that is riling people up, and that's what I am getting at. I am not trying to whatabout, to be super clear.
  - runnerup 5y ago
    To clarify. I don't think people would be riled up about individuals sending out these emails. Individuals are required to be legal, not 'ethical'. The people who are riled up believe that University studies should be performed ethically. They know that IRB's exist to prevent researchers from doing unethical, but legal, things. In this case, they feel the harm caused should have been prevented. Scraping data silently doesn't cause stress/harm to the participants directly, as they are unaware of any potential threat. It's not "human experimentation should be banned" its "human experimentation should be heavily scrutinized to prevent harm to participants as much as possible. And definitely never cause harm to unwilling / unwitting participants".

endisneigh 5y ago

Hot take: the researcher did nothing wrong. Some random person could make the same legitimate requests. If you dislike what this person did then really you just dislike that portion of the law. You cannot simultaneously believe anyone can request their data via these laws and then get mad that people do it, research or not. It’s literally designed this way.

varjag 5y ago
Anyone can yell on you on the street so it's fine I yell on you for research purposes.
- endisneigh 5y ago
  That is not the same thing. The process for GDPR involves sending an email very similar to the one sent. The action you should take doesn’t depend on whether or not the email you’ve received is for research purposes. If someone doesn’t understand this then they have no business running a public website.
  - tverbeure 5y ago
    It only takes a quick scan of the comments in this thread to see that there were people who received this email while hosting a static github.io website with their personal blog. That's a public website. Do you honestly think that anyone running a personal blog has no business doing so unless they are knowledgeable about the details of European and California website privacy rules? What a brilliant way to stifle public speech. Your answer will probably be: "personal blog don't fall under these regulations, so it's a non-issue" but that's exactly the point: these researchers scared a bunch of people into spending time to research a law that doesn't even apply to them, yet the chance that some random from Europe would send a GDPR request to their blog is essentially zero, because even privacy crusaders are smarter than these Princeton research to know that it makes no sense to do this. Even if the general principle were ethical (not that I agree), the Princeton researches should have used a curated list of websites that could reasonably be expected to receive GDPR requests.

hellojesus 5y ago

It's bizarre to me that anyone would respond to what would surmount to a legal request which was delivered via email. Unless the gov has a supeona that was verifiably delivered to me physically, an email will be either totally ignored, or I'll respond telling them to go pound sand.

dahfizz 5y ago
Is that how you would respond to any GDPR-related request? GDPR legally requires you to respond to requests within a month. If someone making a request points that out to you, you may feel like you've been threatened. That doesn't change the law.
- hellojesus 5y ago
  Yes, that is how I would respond to a request inquiring as to what my GDPR practices are. The requestor here isn't asking for access their information for GDPR reasons. They are asking what my private business operations are, which are not part of what I'm required to disclose, so far as my understanding goes. Separate from the above, if I run a US based business, why would I care if the EU wanted to try and sue me for breaking a law that has no jurisdiction over me?
- astura 5y ago
  >GDPR legally requires you to respond to requests within a month GDPR requires nothing of me, I don't live in Europe or do business with anyone who does. Anyways, this email wasn't a request for data, it's an inquiry about business practices.
jhgb 5y ago
As per the law, a GDPR data access request may be sent by e-mail, or even delivered verbally. So the form is actually irrelevant.
- hellojesus 5y ago
  Yes, but the researchers aren't asking about their data. They are asking about internal business policies, which they are not granted under the law. From the OP's links's FAQ: """ Why does this study involve contacting websites? Very few websites post details of their processes for handling GDPR and CCPA requests. Both the GDPR and the CCPA contemplate users and intermediaries reaching out with questions about data rights processes, and we are using that opportunity to understand current website policies and practices. """ From the sites I've seen discussing responsibilities, internal business processes for how GDPR requests are handled are not covered under GDPR. https://docs.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/gdpr-compliance?view=o365-worldwide https://docs.microsoft.com/en-us/microsoft-365/admin/securit... """ Data subject rights The GDPR establishes data subject rights, which means that, with respect to their personal data, customers, employees, business partners, clients, contractors, students, suppliers, and so forth have the right to: Be informed about their data: You must inform individuals about your use of their data. Have access to their data: You must give individuals access to any of their data that you hold (for example, by using account access or in some manual manner). Ask for data rectification: Individuals can ask you to correct inaccurate data. Ask for data to be deleted: Also known as the 'right to erasure', this right allows an individual to request that any of their personal data a company has collected is deleted across all systems that use it or share it. Request restricted processing: An individual can ask that you suppress or restrict their data. However, it is only applicable under certain circumstances. Have data portability: An individual can ask for their data to be transferred to another company. Object: An individual can object to their data being used for various uses including direct marketing. Ask not to be subject to automated decision-making, including profiling: The GDPR has strict rules about using data to profile people and automate decisions based on that profiling. """

harpiaharpyja 5y ago

Probably all they had to do was be transparent about the reason for sending out the emails, who they were, and probably throw in a link to that page (i.e. https://privacystudy.cs.princeton.edu https://privacystudy.cs.princeton.edu). Seems like a silly thing to overlook but it does seem the impact on people is serious and I guess they know better now...

jonnybgood 5y ago
Would people respond the same way if they knew it wasn’t a real request i.e. take it less seriously?
- kstrauser 5y ago
  Possibly, but I'd bet the results would be way more accurate. If I got an email from a university I'd heard of, phrased like: > Hi! We're trying to study CCPA compliance of random sites. Could you help us by answering a few questions? then I absolutely would have replied, and would have replied honestly. People generally like to be helpful.
  - wayne-li2 5y ago
    That's the problem though -- it will skew the data towards friendly and helpful people like yourself. But it doesn't capture reality. To be honest, I don't know how you get this sort of analysis done without poisoning the intent and maintaining integrity.
    - kstrauser 5y ago
      Good point, and I don't know. But in the end, if it's not possible to conduct the study while acting ethically, then the study shouldn't be done.

abhv 5y ago

I am an academic and I am against this type of study. My main objection is that it wastes the valuable time of the website operator for little benefit. It is immoral to waste people's time. Many IRBs are unaware that these kinds of "public surveys" unduly burden respondents and cause them unnecessary stress. The little benefit will be a series of graphs indicating how site operators respond, which could be interesting, but does not justify the burden.

yk 5y ago

I fail to understand what the problem is. They send a mail asking the procedure of GDPR in a way that implies they consider using their rights. Now there is outrage to the extend that the researchers scrap their study, which is probably everything anybody needs to know about the state of the GDPR in practice.

yjftsjthsd-h 5y ago
> in a way that implies they consider using their rights. ... No, in a way that implied that they were about to take legal action, including against people who never had any legal obligation in the first place.

sebow 5y ago

godzillafarts 5y ago

My org received one of these emails. I was the engineer pinged on the support ticket. This request is neither threatening nor burdensome. This is a pretty standard run-of-the-mill GDPR request. We get them all the time. It took less than 60 seconds of my time to provide our support team with the information they needed to respond to the request. In fact, we already have a canned response to these requests - the person on the support team is a new hire and was unaware. If your org has users/customers in the EU, you need to have a GDPR playbook. Your support team needs to be briefed on these requests and how they should respond. I have a difficult time believing that any "controller" complaining about this is properly prepared to respond to GDPR access requests.... Which is kind of the whole point of the study, no?

seoulmetro 5y ago
I wonder how many people getting upset by this are also advocating for fire alarm drills to be removed because "they waste precious resources"? Emotion definitely overriding people's logic abilities here.
- powersnail 5y ago
  If a researcher starts pulling fire alarms of random buildings, they will face felony charges.
  - seoulmetro 5y ago
    That's not how fire alarm drills work though. That's how fire alarms work. In this situation, the "researcher" is the person conducting the drills. Which are way more frequent than these emails.
    - powersnail 5y ago
      Without the permission of the property owner, conducting a fire alarm drill is no different than pulling the fire alarm.

dang 5y ago

The past major threads on this. Others? I was part of a human subject research study without my consent - https://news.ycombinator.com/item?id=29611139 https://news.ycombinator.com/item?id=29611139 - Dec 2021 (360 comments) CCPA Scam – Human subject research study conducted by Princeton University - https://news.ycombinator.com/item?id=29599553 https://news.ycombinator.com/item?id=29599553 - Dec 2021 (331 comments) Princeton-Radboud Study on Privacy Law Implementation - https://news.ycombinator.com/item?id=29599154 https://news.ycombinator.com/item?id=29599154 - Dec 2021 (10 comments)

tjalfi 5y ago
Here's one more thread. Ask HN: Is this CCPA-related spam? - https://news.ycombinator.com/item?id=29539266 https://news.ycombinator.com/item?id=29539266 - Dec 2021 (4 comments)

eli 5y ago

I've been very critical of this study from the start, but credit to the research team for acknowledging their errors and apologizing. I think the goal is a good one and I hope they're able to find a better way to accomplish it.

addingnumbers 5y ago
Their apology really doesn't address one of their most egregious wrongdoings. I see them boasting that the IRB determined "our study does not constitute human subjects research." I don't see them acknowledging that they slipped under the IRB's radar by consistently referring to human subjects as "websites."
- eli 5y ago
  I think the IRB should investigate how they reached that conclusion and probably issue their own apology. Hard to say without seeing the actual application and not being familiar with Princeton IRB rules.
  - kodah 5y ago
    What is it about an apology that makes you seek them? I prefer action, charitable interpretation, and progress. I found this update rather encouraging: > Third, I will use the lessons learned from this experience to write and post a formal research ethics case study, explaining in detail what we did, why we did it, what we learned, and how researchers should approach similar studies in the future. I will teach that case study in coursework, and I will encourage academic colleagues to do the same. While I cannot turn back the clock on this study, I can help ensure that the next generation of technology policy researchers learns from it. Instead of wasting time by making another person or entity go through the humiliation gauntlet, let them improve their surroundings.
    - eli 5y ago
      Yes, a good apology always explains what is being done to prevent the wrong from happening again. I think we're saying the same thing.

jaclaz 5y ago

Personally I would like to know the exact numbers of e-mails actually sent. Hypothesis out of 1,000 mails: 5% were never read (because of spam filters/whatever) 10% were discarded manually or ignored 50% were replied to taking 30 minutes to write an accurate reply 30% were replied after consulting someone else (in the office or friend) let's say 1 hour 5% were replied after consulting a lawyer or consultant, let's make this 4 hours 500x1/2=250 300x1=300 50x4=200 Every 1,000 e-mails roughly 750 hours of people's work has been lost, that is at (say) 40 US$/hour some 30,000 US$ "burned".

kbenson 5y ago
That's one way to look at it. Another is that people spent some time to understand a law which may or may not affect them, but if it does, they should probably already have known about it. "Should" in the sense that it would be good for them it they did, not in the sense that I think they were negligent, as honestly I think there's a bunch of laws that affect people like this that that most of us are unaware of.
- aero-glide2 5y ago
  I agree, I still don't see what was unethical about this.
  - nickff 5y ago
    How would you feel about getting threatening e-mails out of the blue, then finding out you were being used for the author's personal benefit?
  - bennysomething 5y ago
    I'm assuming you've never had something that approaches a real life legal threat? It's extremely stressful. It's one thing wanting people to know about laws, it's another thing to induce emotional distress just because you think some individual should know. Personally I think it was a horrible thing to do to an innocent person. Totally thoughtless and uncalled for.
  - 5y ago

mgamache 5y ago

I received one of these emails (I think). I can post it if people think it's informative (I didn't respond as it felt sus).

mgamache 5y ago
Here it is: Email To Whom It May Concern: My name is XXXX XXXXXXX, and I am a resident of Roanoke, Virginia. I have a few questions about your process for responding to General Data Protection Regulation (GDPR) data access requests: 1. Would you process a GDPR data access request from me even though I am not a resident of the European Union? 2. Do you process GDPR data access requests via email, a website, or telephone? If via a website, what is the URL I should go to? 3. What personal information do I have to submit for you to verify and process a GDPR data access request? 4. What information do you provide in response to a GDPR data access request? To be clear, I am not submitting a data access request at this time. My questions are about your process for when I do submit a request. Thank you in advance for your answers to these questions. If there is a better contact for processing GDPR requests regarding allisonelearn.com, I kindly ask that you forward my request to them. I look forward to your reply without undue delay and at most within one month of this email, as required by Article 12 of GDPR. Sincerely, XXXX XXXXXX

throwaway918279 5y ago

I'm accessing this researcher's website from the EU [1]. They don't have a gdpr banner asking me for consent but I can see analytics tools including Google analytics and fastly[2]. Is this website complaint with GDPR regulations? [1] https://www.cs.princeton.edu/people/profile/jrmayer https://www.cs.princeton.edu/people/profile/jrmayer [2] https://builtwith.com/?https%3a%2f%2fwww.cs.princeton.edu%2f%7ejrmayer https://builtwith.com/?https%3a%2f%2fwww.cs.princeton.edu%2f...

UncleMeat 5y ago
You can reach out and ask. Mayer is among the most influential people out there pushing for improved privacy via technology and legislation, and has been doing so for years.
dataflow 5y ago
That's not the researcher's website, it's the department's website with a blurb about this researcher (and others) on it. The researcher almost surely had no influence on the existence of Google Analytics on that page. The entity you need to talk to is the department.
- throwaway918279 5y ago
  Thanks good point. His personal website also used Google analytics and has no banner. https://builtwith.com/?https%3a%2f%2fjonathanmayer.org%2f https://builtwith.com/?https%3a%2f%2fjonathanmayer.org%2f

arbuge 5y ago

Part of the problem here was the smug tone of his student initially going on Twitter to make the dubious claim that the response to this study had been "overwhelmingly positive", when it was already abundantly clear that it was anything but.

arbuge 5y ago
ps. The tweet in question is still there, with no apology yet from this individual: https://twitter.com/RossTeixeira/status/1471249559879929861 https://twitter.com/RossTeixeira/status/1471249559879929861

kazinator 5y ago

Did these researchers talk to a lawyer, who recommended apologizing like this? It seems like a rather imprudent thing to do.

UncleMeat 5y ago
Mayer is a lawyer.

kevinpet 5y ago

This is a non-apology apology. It's "I'm sorry you feel that way." I don't think I'm reading too much into it either: "I am dismayed that the emails in our study came across as security risks or legal threats." "explaining in detail what we did, why we did it, what we learned, and how researchers should approach similar studies in the future." Nothing about how it impacts their unwilling subjects. Nothing about failing to indicate they were doing an academic study. Nothing about the falsity of their legal threats.

matkoniecz 5y ago
Also "our study does not constitute human subjects research". Since when threatening people does not involve humans? Or is it some "technically, this legal term does not apply - according to our lawyer"?
- jessriedel 5y ago
  You've clipped the quote to remove the part where they are describing the opinion of the IRB, not making a claim themselves. That paragraph is describing why there was no IRB involvement, not claiming that humans wheren't involved in the research.
  - matkoniecz 5y ago
    1) IRB opinion was based upon untrue description provided by researchers 2) they themself put it into own FAQ to distract from harm they did 3) they failed to admit that this statement was untrue and misleading 4) they put it into FAQ like it would be relevant
    - jessriedel 5y ago
      I agree. That doesn't make it OK to deceptively remove context from a quote.
      - matkoniecz 5y ago

rantee 5y ago

(disclaimer: non-practicing lawyer here, not yours or theirs, off-the-cuff very hot take) What part of 'A consumer shall have the right to request...' in the CCPA isn't clear? Nothing about "A fake user may request..." Looking forward to another ballot initiative to further clarify the law! The secret shopper thing is a big red herring - at least the secret shopper actually buys something, and in real non-academic life is usually hired by the company (or marketing company by extension). Disappointing to see the lack of judgment from a researcher who's otherwise done great work, and the IRB failure to boot. Good to see some acknowledgement but it feels like "let's build a tool to do the work and hope for good data." Not sure where this could've led other than a name-and-shame conference paper.

throw10920 5y ago

Claiming that this study was "human research" is straight-up insane. There's as much "human research" going on there as there is when statisticians acquire data by going to a human who possesses it and asking for it (e.g. they want to study baseball, so they go to the Head Excel Overlord of the MLB and ask for their data) - that is, exactly none. Analyzing data that was given to you by a human does not automatically make your research project "human research", full stop. The research question here is "How do organizations fulfill their legal requirements due to the GDPR and CCPA?" and has nothing to do with individuals. The researchers didn't want any data about the humans, they didn't ask for it, they weren't studying reaction time, psychological response, brain activity, or anything else about any humans at all. If the answer to the question "Could you replace a human in experiment with an automated process and still perform a meaningful experiment with conceptually identical results?" is "yes", then there is no human research going on. Test: Stanford Prison Experiment: answer "no" (because the students were actually the ones being studied), turns out to be human research. Test: studying the properties of a crystal in a lab, and one of the machines is operated by a human grad student, answer is "yes", not human research. (note also that this test just proves that human research isn't being done - if you replace the baseball players in the above example with robotic batters, the answer the above question is "no", but clearly human experimentation isn't happening) Similarly, if each of the individuals who were contacted were replaced with a Perl script scanning for keywords that automatically replied with the organization's GDPR and CCPA policies, the results from the experiment would be. Exactly. The. Same. In fact, let's go and look up the definition of "human subjects research": According to 45 CFR 46, a human subject is "a living individual about whom an investigator (whether professional or student) conducting research: Obtains information or biospecimens through intervention or interaction with the individual, and uses, studies, or analyzes the information or biospecimens; or Obtains, uses, studies, analyzes, or generates identifiable private information or identifiable biospecimens." ...from the NIH at https://grants.nih.gov/policy/humansubjects/research.htm https://grants.nih.gov/policy/humansubjects/research.htm, and clearly does not describe what's going here. Let me repeat again: the fact that humans responded to the emails about GDPR+CCPA compliance of an organization owning the email is completely irrelevant. The experimenters didn't care about whether their request was serviced by a human or a computer, and in fact would have preferred computerized responses (instant response, more standardized formats, no possibility of human error). Claiming that this is "human experimentation" is disingenuous to the point of malice.

ktosobcy 5y ago

For some reason I was completely oblivious to the hole "drama" but reading the older threads and example emails - they were simply a questions regarding adherence to the GDPR/CCPA. On the one hand stating that this is a research would probably be "nice" though in that case a lot of websites would probably comply in the nicest possible way skewing the result. Why this bothers me? Because w while back I was trying to get my personal data off of yelp I was nicely greeted with the middle finger (they scraped my data from the government website which is the only page that can publish it and noone is legally permitted to re-publish it but you know... us-based yelp doesn't care about law)…