6 ms·

Hot take: the researcher did nothing wrong. Some random person could make the same legitimate requests. If you dislike what this person did then really you just

Hot take: the researcher did nothing wrong. Some random person could make the same legitimate requests. If you dislike what this person did then really you just dislike that portion of the law. You cannot simultaneously believe anyone can request their data via these laws and then get mad that people do it, research or not. It’s literally designed this way.

varjag 5y ago
Anyone can yell on you on the street so it's fine I yell on you for research purposes.
- endisneigh 5y ago
  That is not the same thing. The process for GDPR involves sending an email very similar to the one sent. The action you should take doesn’t depend on whether or not the email you’ve received is for research purposes. If someone doesn’t understand this then they have no business running a public website.
  - tverbeure 5y ago
    It only takes a quick scan of the comments in this thread to see that there were people who received this email while hosting a static github.io website with their personal blog. That's a public website. Do you honestly think that anyone running a personal blog has no business doing so unless they are knowledgeable about the details of European and California website privacy rules? What a brilliant way to stifle public speech. Your answer will probably be: "personal blog don't fall under these regulations, so it's a non-issue" but that's exactly the point: these researchers scared a bunch of people into spending time to research a law that doesn't even apply to them, yet the chance that some random from Europe would send a GDPR request to their blog is essentially zero, because even privacy crusaders are smarter than these Princeton research to know that it makes no sense to do this. Even if the general principle were ethical (not that I agree), the Princeton researches should have used a curated list of websites that could reasonably be expected to receive GDPR requests.
    - endisneigh 5y ago
      Being a personal blog isn’t really relevant here, and yes people should know the law, and now they do. Stifling free speech is ridiculous hyperbole - no one was silenced by this. At worst people needlessly wasted time consulting a lawyer.
      - tverbeure 5y ago
        I love the casualness about somebody wasting hundreds of dollars consulting a lawyer for something that isn’t relevant to them. As for the personal blog: it is relevant, because the email was send to owners of personal blogs. You claimed that the recipients of this email, such as personal blog owners, had no business running a website if they didn’t know the details a law that doesn’t apply to them. That’s stifling plain and simple.
        endisneigh 5y ago
        It’s not relevant because personal blogs could actually be collecting data. Also in the usa most lawyers offer a free initial consultation.
detaro 5y ago
They sent requests to people where their fake person would not have had any basis to make the requests.
- jhgb 5y ago
  In that case the response should have been just that, presumably. Nothing prevents you from making requests, they just might not be answered.
  - detaro 5y ago
    People to whom the law doesn't apply are not necessarily very familiar with the details of this, and thus are going to be cautious if presented with what appears to be a legal threat. For a pro, this is easy to reply to, for random hobbyists it's not.
    - jhgb 5y ago
      Maybe that's just me being an EU citizen but I fail to see the supposed threat. Is that a US thing to see a legal threat in everything?
      - endisneigh 5y ago
        Yes, actually.
      - kstrauser 5y ago
        Context is everything here. “Please respond quickly.”? Fine. “The law says you have a month to reply.”? A little aggressive, but OK. “According to such-and-such code, section 45, part b, subsection 3, you have 87 hours from the time I sent this — that is, from 12:43:56 PM Eastern time on this date — to give your on-the-record response.”? They’ve got a lawyer, and this is going to be a pain in the ass. These particular emails were somewhere between the second and third options.
        5y ago
dmingod666 5y ago
Everything except these 2 lines was okay "I look forward to your reply without undue delay and at most within one month of this email, as required by Article 12 of GDPR."
- endisneigh 5y ago
  I know it can sound scary but those lines are meaningless. At worst it just tells you why they’re entitled to make the request they’re making.
  - addingnumbers 5y ago
    It's not meaningless to imply that inaction is illegal.
    - endisneigh 5y ago
      How exactly did it imply that?
      - addingnumbers 5y ago
        I can't imagine any other purpose for citing a law that carries penalties for failure to respond while you invite a response.
        endisneigh 5y ago
        Yes, but whether or not it’s explicitly stated doesn’t really change the law. Ultimately I don’t really get the big deal. It takes 5 minutes to reply to this, and if you don’t unless you’re some huge organization no one is going to waste resources bringing you to court. It’s not that they’re implying that it is illegal - it’s that it is.
  - bpfrh 5y ago
    Edit: wrong comment, responded to the top comment instead
s1artibartfast 5y ago
You can believe that users should be able to request this information legitimately, but arbitrary third parties should not. The idea is that the burden and stress of response is outweighed by benefit to the legitimate user. In this case there is no legitimate user. This is similar to the concept of standing in the courts. Someone who is harmed can bring a suit for compensation or redress, but an uninvolved third party cannot.
- endisneigh 5y ago
  How would a legit user make the request without inquiring what their policies are? Keep in mind the experiment wasn’t even making requests.
  - s1artibartfast 5y ago
    They could send an identical email, but it would be coming from a legitimate user.
    - endisneigh 5y ago
      The answers to the questions don’t depend on whether or not the user is legitimate or not. Not to mention cases where the user isn’t even sure of their account information or lost email, etc.
      - s1artibartfast 5y ago
        I agree the answer does not depend on the legitimacy, but that doesn't matter. The answer to where were you last Tuesday night does not depend on who asks it, but only some have the right to ask that question and demand an answer.
        endisneigh 5y ago
        Your example isn’t relevant at all to the actual situation we are talking about. A more relevant example would be your right to go into a restaurant and see their food safety certificate.
eclipsetheworld 5y ago
I'm honestly baffled about the response, especially from the pro-privacy crowd on HN. This is simply the reality of GDPR. If you host and operate a website that serves EU visitors you must comply with GDPR. Of course this is a burden on small operators and it may come off alarming the first time you receive a GDPR request, however, this is GDPR working as intended. It is intended to force operators to explicitly decide which user data they are going to collect (incl. on how to inform users, correct, delete, export, etc. this data). I do agree that there might be ethical concerns on how this study was conducted, however, the email messages do not suggest pending legal action. They're pretty standard GDPR requests.
- mrtranscendence 5y ago
  The emails were sent to websites that do not process personal information and are thus not subject to GDPR, so the recipients were in some cases confused about what their responsibilities would be. And though the emails did not suggest that legal action was pending, they do suggest a willingness to resort to legal action in a relatively short time frame. This caused anxiety for apparently many small-time, non-profit bloggers. Is it unethical? I dunno. But it's nuanced, at least.
  - eclipsetheworld 5y ago
    As soon as the client's IP address touches your server you are processing personal information. E.g. I have seen many webserver which save these in their access logs. Again, this is the reality of GDPR. It is not okay to operate a website serving EU visitors without considering GDPR implications. This is how GDPR is intended. Don't operate a website serving EU visitors if you don't have a plan on how to respond to these emails. I'm not trying to be harsh or dissuade these small websites from operating. It is just the reality of GDPR.
bpfrh 5y ago
I think the argument would be that they send those request knowing that the sites do not have information stored. I think a ethical good study would be if they requested users to request their data from sites they use.
powersnail 5y ago
My door bell is designed to be pressed. But I do have a problem with someone who run down the street pressing every doorbell, because they want to gauge home owner's response time. Spamming and wrong intentions can make an otherwise legitimate action unethical.

varjag 5y ago

Anyone can yell on you on the street so it's fine I yell on you for research purposes.

endisneigh 5y ago
That is not the same thing. The process for GDPR involves sending an email very similar to the one sent. The action you should take doesn’t depend on whether or not the email you’ve received is for research purposes. If someone doesn’t understand this then they have no business running a public website.
- tverbeure 5y ago
  It only takes a quick scan of the comments in this thread to see that there were people who received this email while hosting a static github.io website with their personal blog. That's a public website. Do you honestly think that anyone running a personal blog has no business doing so unless they are knowledgeable about the details of European and California website privacy rules? What a brilliant way to stifle public speech. Your answer will probably be: "personal blog don't fall under these regulations, so it's a non-issue" but that's exactly the point: these researchers scared a bunch of people into spending time to research a law that doesn't even apply to them, yet the chance that some random from Europe would send a GDPR request to their blog is essentially zero, because even privacy crusaders are smarter than these Princeton research to know that it makes no sense to do this. Even if the general principle were ethical (not that I agree), the Princeton researches should have used a curated list of websites that could reasonably be expected to receive GDPR requests.
  - endisneigh 5y ago
    Being a personal blog isn’t really relevant here, and yes people should know the law, and now they do. Stifling free speech is ridiculous hyperbole - no one was silenced by this. At worst people needlessly wasted time consulting a lawyer.
    - tverbeure 5y ago
      I love the casualness about somebody wasting hundreds of dollars consulting a lawyer for something that isn’t relevant to them. As for the personal blog: it is relevant, because the email was send to owners of personal blogs. You claimed that the recipients of this email, such as personal blog owners, had no business running a website if they didn’t know the details a law that doesn’t apply to them. That’s stifling plain and simple.
      - endisneigh 5y ago
        It’s not relevant because personal blogs could actually be collecting data. Also in the usa most lawyers offer a free initial consultation.

detaro 5y ago

They sent requests to people where their fake person would not have had any basis to make the requests.

jhgb 5y ago
In that case the response should have been just that, presumably. Nothing prevents you from making requests, they just might not be answered.
- detaro 5y ago
  People to whom the law doesn't apply are not necessarily very familiar with the details of this, and thus are going to be cautious if presented with what appears to be a legal threat. For a pro, this is easy to reply to, for random hobbyists it's not.
  - jhgb 5y ago
    Maybe that's just me being an EU citizen but I fail to see the supposed threat. Is that a US thing to see a legal threat in everything?
    - endisneigh 5y ago
      Yes, actually.
    - kstrauser 5y ago
      Context is everything here. “Please respond quickly.”? Fine. “The law says you have a month to reply.”? A little aggressive, but OK. “According to such-and-such code, section 45, part b, subsection 3, you have 87 hours from the time I sent this — that is, from 12:43:56 PM Eastern time on this date — to give your on-the-record response.”? They’ve got a lawyer, and this is going to be a pain in the ass. These particular emails were somewhere between the second and third options.
      - 5y ago

dmingod666 5y ago

Everything except these 2 lines was okay "I look forward to your reply without undue delay and at most within one month of this email, as required by Article 12 of GDPR."

endisneigh 5y ago
I know it can sound scary but those lines are meaningless. At worst it just tells you why they’re entitled to make the request they’re making.
- addingnumbers 5y ago
  It's not meaningless to imply that inaction is illegal.
  - endisneigh 5y ago
    How exactly did it imply that?
    - addingnumbers 5y ago
      I can't imagine any other purpose for citing a law that carries penalties for failure to respond while you invite a response.
      - endisneigh 5y ago
        Yes, but whether or not it’s explicitly stated doesn’t really change the law. Ultimately I don’t really get the big deal. It takes 5 minutes to reply to this, and if you don’t unless you’re some huge organization no one is going to waste resources bringing you to court. It’s not that they’re implying that it is illegal - it’s that it is.
- bpfrh 5y ago
  Edit: wrong comment, responded to the top comment instead

s1artibartfast 5y ago

You can believe that users should be able to request this information legitimately, but arbitrary third parties should not. The idea is that the burden and stress of response is outweighed by benefit to the legitimate user. In this case there is no legitimate user. This is similar to the concept of standing in the courts. Someone who is harmed can bring a suit for compensation or redress, but an uninvolved third party cannot.

endisneigh 5y ago
How would a legit user make the request without inquiring what their policies are? Keep in mind the experiment wasn’t even making requests.
- s1artibartfast 5y ago
  They could send an identical email, but it would be coming from a legitimate user.
  - endisneigh 5y ago
    The answers to the questions don’t depend on whether or not the user is legitimate or not. Not to mention cases where the user isn’t even sure of their account information or lost email, etc.
    - s1artibartfast 5y ago
      I agree the answer does not depend on the legitimacy, but that doesn't matter. The answer to where were you last Tuesday night does not depend on who asks it, but only some have the right to ask that question and demand an answer.
      - endisneigh 5y ago
        Your example isn’t relevant at all to the actual situation we are talking about. A more relevant example would be your right to go into a restaurant and see their food safety certificate.

eclipsetheworld 5y ago

I'm honestly baffled about the response, especially from the pro-privacy crowd on HN. This is simply the reality of GDPR. If you host and operate a website that serves EU visitors you must comply with GDPR. Of course this is a burden on small operators and it may come off alarming the first time you receive a GDPR request, however, this is GDPR working as intended. It is intended to force operators to explicitly decide which user data they are going to collect (incl. on how to inform users, correct, delete, export, etc. this data). I do agree that there might be ethical concerns on how this study was conducted, however, the email messages do not suggest pending legal action. They're pretty standard GDPR requests.

mrtranscendence 5y ago
The emails were sent to websites that do not process personal information and are thus not subject to GDPR, so the recipients were in some cases confused about what their responsibilities would be. And though the emails did not suggest that legal action was pending, they do suggest a willingness to resort to legal action in a relatively short time frame. This caused anxiety for apparently many small-time, non-profit bloggers. Is it unethical? I dunno. But it's nuanced, at least.
- eclipsetheworld 5y ago
  As soon as the client's IP address touches your server you are processing personal information. E.g. I have seen many webserver which save these in their access logs. Again, this is the reality of GDPR. It is not okay to operate a website serving EU visitors without considering GDPR implications. This is how GDPR is intended. Don't operate a website serving EU visitors if you don't have a plan on how to respond to these emails. I'm not trying to be harsh or dissuade these small websites from operating. It is just the reality of GDPR.

bpfrh 5y ago

I think the argument would be that they send those request knowing that the sites do not have information stored. I think a ethical good study would be if they requested users to request their data from sites they use.

powersnail 5y ago

My door bell is designed to be pressed. But I do have a problem with someone who run down the street pressing every doorbell, because they want to gauge home owner's response time. Spamming and wrong intentions can make an otherwise legitimate action unethical.