10 ms·

Request your personal information

139 points by ramphastidae 5y ago

MathMonkeyMan 5y ago
> We’ve received and are processing your request to access your personal data. We will provide your information to you as soon as we can. Usually, this should not take more than a month. In exceptional cases, for example if a request is more complex or if we are processing a high volume of requests, it might take longer, but if so we will notify you that there will be a delay. I wonder what the formats are. Also, is there a team of poor souls navigating internal bureaucracy to manually fulfill these requests? Is it a black hole? A nice policy would be to decree "Every [property] in Amazon must provide an internally registered [endpoint] that speaks [protocol] serving requests consistent with [schema]. Request volume will be limited to at most [limit]." Require it for new stuff, and add it to the backlog for existing stuff. Ah, but it wouldn't increase revenue, and everything is existing stuff. Still, I like the idea.
- sockpuppet69 5y ago
- xoxxala 5y ago
  I requested my Amazon data a year ago or so and it was a few different Excel files. One file for orders, one for digital orders, one for returns, etc. They included everything back to my first order in ‘99. Took a few days to process, but certainly less than a week.
marban 5y ago
I don't see anything interesting to choose from in the likes of Amazon knows me better than I know myself — Basically it's just a dump of your profile setup.
MattGaiser 5y ago
> Usually, this should not take more than a month. This tells me that there are people involved in manually packaging it up somehow.
- sbkg0002 5y ago
  It tells me that they want to discourage people to do it often.
alephnan 5y ago
https://en.wikipedia.org/wiki/Right_of_access_to_personal_data https://en.wikipedia.org/wiki/Right_of_access_to_personal_da...
omgitsabird 5y ago
I lost an AWS account many years ago to losing an MFA device during an adventure that I will avoid documenting here. What is really weird is that AWS account is tied to a very old (1998?) Amazon account. I wonder what this request will reveal.
- dotancohen 5y ago
  Stories like this are what keep me using strong passwords (in Keepass) instead of MFA. I'd love to hear more details as I'm finding more and more services push the MFA aspect, and I don't use a smartphone. Thanks.
  - tactile-setter 5y ago
    Most password managers can also store TOTP tokens. A few services support registering redundant Yubikeys. Failing that, they usually give you a recovery code with which you can restore access to an account you're locked out of.
bruhhh 5y ago
interesting how the request takes about a month to process.. it's almost... almost like... they dont really wanna do it but have to
- stigz 5y ago
  Yep CCPA
- ozzythecat 5y ago
  I built a system just like this at another company whose products or services you likely use often or everyday. This pessimistic view assumes the worst about people like me who build these kinds of systems, as if we’re evil or corrupt or somehow doing this to take something from you. In reality, data is stored in disparate systems, under the custodianship of different organizations. Once you can find everything and account for it, you need to query every single system - many systems which aren’t built for this kind of “on demand” workload. Then you need to parse the data, turn it into some kind of useful values, especially if the internal representation contains flags, enums, or other magic or pseudo values that wouldn’t be meaningful to anyone but the logic or programmer who wrote it. Systems go down. Things break. Pipelines get clogged. It’s one thing to build a god system that can decrypt, read, and perform etl on every application, table, db, or whatever storage used anywhere in your entire company. It’s exponentially harder to solve this problem when it’s all legacy integrations with shit that’s duct taped together and will easily tip over. Now you have to do this at scale - except these systems have millions of lines of code and can’t just be rewritten into a solution that can handle hundreds or thousands or even tens of thousands of queries per second… not without a Herculean effort not even accounting for all the tribal knowledge that’s been lost on how the system is expected to work. If 30 days is too long for you, essentially you’re wanting these companies to spend potentially hundreds of millions of dollars to rearchitect a significant chunk of their systems that were built prior to all these privacy laws coming online. Honestly, the legal landscape changes often. Some of the law is open to interpretation. My own experience working in this are require working closely with a team of lawyers. Honestly, even the Staff Engineers in my larger org getting paid $700k a year would have preferred any other project but this.
  - 5y ago
svennek 5y ago
Please notice, at all companies (I don't know about AWS) that I have worked for each GDPR request eats up a few man-days of work internally. Some companies getting hit a lot by GDPR have likely automated it, but even a big company (that I know of) with 100k+ private customers (that all have the right) only receives a few requests a quarter, usually by angry customers.. This AWS thingy might not be GDPR, but it might have the same impact on internal resources.. Just because it is free and your right, please consider if you wanna to be a resource hog..
- Ansil849 5y ago
  > please consider if you wanna to be a resource hog.. Perhaps the corporations could also consider whether they want to be an information hog in the first place and slurp up people's data. You know what the easiest way to fulfill a data request is? To not have any data to give.
  - plandis 5y ago
    In Amazons case there are regulatory requirements for keeping around purchase history, tax, etc…
    - Ansil849 5y ago
      Yes, and? What about all of the data that is kept not owing to legal/regulatory requirements? That's the key issue here, not some trite truism about regulatory record-keeping requirements.
  - svennek 5y ago
    All data they process are required by law, but they have to collate a dozen systems manually and the legal department has to go thru everything and block out data the customer is not allowed to see (also by law)... No all companies are evil and the GDPR has really made a significant change all the places I know of.
    - svennek 5y ago
namuorg 5y ago
When I requested this back in August, it took 5 days to get the results. You get a long list of links that each triggers a download. It's a bit annoying to bulk download by clicking each link one by one, so I made a Browserflow flow that clicks all the links and downloads everything automatically: https://browserflow.app/shared/61e979ed-47f4-4c94-b5a5-3ade00da0a36 https://browserflow.app/shared/61e979ed-47f4-4c94-b5a5-3ade0...
- bobsmooth 5y ago
  DownThemAll is a nearly 20 year old browser addon that can bulk-download links on a webpage.
  - ngngngng 5y ago
    Some of us were in Kindergarten about then so we would have missed the original Show HN for that. Glad to have found it eventually though.
    - DrAwdeOccarim 5y ago
      I know I'm not supposed to comment when it doesn't add to the conversation, buuuut, your reply made me literally laugh out loud. Thank you for this! I often forget being ~40 means I'm no longer ~20 and that there are people who are actually ~20 out on the internet...
      - ekanes 5y ago
        Hey while we're here in this closet shhhh posting non-additive replies... I have a website that's still up from 1996. Older than so many Kids These Days. :P
  - noduerme 5y ago
    Man, talk about a flashback. I remember DownThemAll. That was the way to scrape images off porn sites, back when porn sites only had images.
ubicomp 5y ago
"We’ve received and are processing your request to access your personal data. We will provide your information to you as soon as we can. Usually, this should not take more than a *month*. In exceptional cases, for example if a request is more complex or if we are processing a high volume of requests, it might take longer, but if so we will notify you that there will be a delay."
sol_invictus 5y ago
> We will provide your information to you as soon as we can. Usually, this should not take more than a month. What benefit does Amazon get out of delaying giving out this information?
- lokimedes 5y ago
  The ability to disconnect intent from response is likely perceived as a demotivator? Also, anecdotally, I ordered my GDPR info from my car company, when I finally received it (days later) my interest in it was gone.
- mrfluffybeard 5y ago
  They don't have the data ready as this data is scattered across multiple ( maybe multiple dozen systems) . Also it might not be fully automated.
  - sol_invictus 5y ago
    Doesn't make any sense, the computation time difference between pulling data from one system and fifty systems isn't measured in the months range.
    - joshSzep 5y ago
      It makes a difference if it's just humans doing the job. Given the long window I would assume that this lacks automation
      - sol_invictus 5y ago
        Yes, but "having a human in the system" isn't answering the original question: what does Amazon benefit from introducing excess cost into this equation? Surely there should be nothing clandestine in your own usage data, search queries etc.
        Dave3of5 5y ago
rsync 5y ago
I can't do this because amazon does not have my personal information. Amazon has a pseudonym with a dedicated Twilio number that delivers to a private postal box. I burn the pseudonym every few years. Which reminds me ... This is simple because VISA/MC do not validate cardholder name. Everyone thinks they do and most merchants believe that they do but ... they do not. You can use your card with "Mickey Mouse" and it will work just fine.
- cyode 5y ago
  My mind is blown. Reflecting on a lifetime of getting declined filling web forms in with a wrong CC number, billing address, expiration or CCV, I...don’t think I’ve ever misspelled my name. Trying this out on my next purchase for sure.
  - WA 5y ago
    Fun fact (from 2012): some credit cards had more than one CCV. You could find out by simply trying all 1000 combinations on some web shops. Back then, I did security consulting and we knew a shop or two where it was possible to enumerate the CCVs without submitting an order and without being blocked. Not sure if this is still valid nowadays, but it blew my mind as well.
    - captn3m0 5y ago
      Even better fun fact: There’s some issuers that won’t validate your CVV at all, so any of the 999 options work for those cards.
      - lillecarl 5y ago
        As a Swede, with both my CC and direct debit I'm transfered to the Swedish "Bank ID" service to do mfa with my phone using a 6+ digit code before any online purchase goes through. Kinda privacy invasive, but it's also impossible to steal money from me without these things: my card, my cvv, my phone, my phone unlock code, my bank ID code.
tawan 5y ago
I think there are two sides to a service like that: on the one hand it provides more transparency to the individual customer (good), on the other hand, any external or internal malicious actor now has a very convenient tool to gain access to lot of very personal information about a single individual (bad). It was probably not even possible without a tool like that, not even for jeff bezos.
32mb 5y ago
Is there a similar link for Google, Bing, and other services? If only someone had a list of these links in GitHub repo.
shever73 5y ago
It was requesting my personal information from Amazon that made me decide to dump all my Alexa smart devices. We had bought one for my in-laws and the Echo had picked up entire conversations between them even though the wake word had not been said. They were categorised under "Not intended for Alexa". My father in-law is at the end of his life, and I really hated the fact that deeply private and incredibly poignant conversations would probably be listened to by a human somewhere to better calibrate the device.
- patrec 5y ago
  Wow, that's bad. It seems obvious that something like Alexa would transmit some amount of data not intended for it and that would be listened to by someone for training purposes. And probably enough data that someone remotely privacy conscious would not voluntarily install some 24/7 listening device into their inner sanctum. But what on earth would posses Alexa to record entire conversations without either piping up ("sorry, I did not understand this request") or figuring out after a few seconds that this was probably a false alarm and turning itself off? How would this be remotely excusable? How long was the longest recording not really intended for Alexa?
  - shever73 5y ago
    I've switched off all voice-activated devices in my home. I'm not sure how long the longest recording was...I'll go back over the data to have a look, but the one that really broke my heart was about 20 seconds during which my mother in-law was upset because my father in-law was not waking up.
    - patrec 5y ago
      I'm sorry that you went through this. I think even a really short recording (under 20s), of a distraught, close person at some critical junction would feel very unsettling to me especially with the knowledge that it shouldn't really exist, I shouldn't be able to listen to it, and it probably was listened to by some complete strangers as well as part of some routine megacorp work.
klondike_klive 5y ago
I clicked on the link in the confirmation email and just got a big "Sorry, we couldn't find that page" with a picture of a dog and the caption "dogs of Amazon". I feel like this. https://www.youtube.com/watch?v=RfiQYRn7fBg https://www.youtube.com/watch?v=RfiQYRn7fBg

139 points by ramphastidae 5y ago

> We’ve received and are processing your request to access your personal data. We will provide your information to you as soon as we can. Usually, this should not take more than a month. In exceptional cases, for example if a request is more complex or if we are processing a high volume of requests, it might take longer, but if so we will notify you that there will be a delay. I wonder what the formats are. Also, is there a team of poor souls navigating internal bureaucracy to manually fulfill these requests? Is it a black hole? A nice policy would be to decree "Every [property] in Amazon must provide an internally registered [endpoint] that speaks [protocol] serving requests consistent with [schema]. Request volume will be limited to at most [limit]." Require it for new stuff, and add it to the backlog for existing stuff. Ah, but it wouldn't increase revenue, and everything is existing stuff. Still, I like the idea.

sockpuppet69 5y ago
xoxxala 5y ago
I requested my Amazon data a year ago or so and it was a few different Excel files. One file for orders, one for digital orders, one for returns, etc. They included everything back to my first order in ‘99. Took a few days to process, but certainly less than a week.

marban 5y ago

I don't see anything interesting to choose from in the likes of Amazon knows me better than I know myself — Basically it's just a dump of your profile setup.

MattGaiser 5y ago

> Usually, this should not take more than a month. This tells me that there are people involved in manually packaging it up somehow.

sbkg0002 5y ago
It tells me that they want to discourage people to do it often.

alephnan 5y ago

https://en.wikipedia.org/wiki/Right_of_access_to_personal_data https://en.wikipedia.org/wiki/Right_of_access_to_personal_da...

omgitsabird 5y ago

I lost an AWS account many years ago to losing an MFA device during an adventure that I will avoid documenting here. What is really weird is that AWS account is tied to a very old (1998?) Amazon account. I wonder what this request will reveal.

dotancohen 5y ago
Stories like this are what keep me using strong passwords (in Keepass) instead of MFA. I'd love to hear more details as I'm finding more and more services push the MFA aspect, and I don't use a smartphone. Thanks.
- tactile-setter 5y ago
  Most password managers can also store TOTP tokens. A few services support registering redundant Yubikeys. Failing that, they usually give you a recovery code with which you can restore access to an account you're locked out of.

bruhhh 5y ago

interesting how the request takes about a month to process.. it's almost... almost like... they dont really wanna do it but have to

stigz 5y ago
Yep CCPA
ozzythecat 5y ago
I built a system just like this at another company whose products or services you likely use often or everyday. This pessimistic view assumes the worst about people like me who build these kinds of systems, as if we’re evil or corrupt or somehow doing this to take something from you. In reality, data is stored in disparate systems, under the custodianship of different organizations. Once you can find everything and account for it, you need to query every single system - many systems which aren’t built for this kind of “on demand” workload. Then you need to parse the data, turn it into some kind of useful values, especially if the internal representation contains flags, enums, or other magic or pseudo values that wouldn’t be meaningful to anyone but the logic or programmer who wrote it. Systems go down. Things break. Pipelines get clogged. It’s one thing to build a god system that can decrypt, read, and perform etl on every application, table, db, or whatever storage used anywhere in your entire company. It’s exponentially harder to solve this problem when it’s all legacy integrations with shit that’s duct taped together and will easily tip over. Now you have to do this at scale - except these systems have millions of lines of code and can’t just be rewritten into a solution that can handle hundreds or thousands or even tens of thousands of queries per second… not without a Herculean effort not even accounting for all the tribal knowledge that’s been lost on how the system is expected to work. If 30 days is too long for you, essentially you’re wanting these companies to spend potentially hundreds of millions of dollars to rearchitect a significant chunk of their systems that were built prior to all these privacy laws coming online. Honestly, the legal landscape changes often. Some of the law is open to interpretation. My own experience working in this are require working closely with a team of lawyers. Honestly, even the Staff Engineers in my larger org getting paid $700k a year would have preferred any other project but this.
- 5y ago

svennek 5y ago

Please notice, at all companies (I don't know about AWS) that I have worked for each GDPR request eats up a few man-days of work internally. Some companies getting hit a lot by GDPR have likely automated it, but even a big company (that I know of) with 100k+ private customers (that all have the right) only receives a few requests a quarter, usually by angry customers.. This AWS thingy might not be GDPR, but it might have the same impact on internal resources.. Just because it is free and your right, please consider if you wanna to be a resource hog..

Ansil849 5y ago
> please consider if you wanna to be a resource hog.. Perhaps the corporations could also consider whether they want to be an information hog in the first place and slurp up people's data. You know what the easiest way to fulfill a data request is? To not have any data to give.
- plandis 5y ago
  In Amazons case there are regulatory requirements for keeping around purchase history, tax, etc…
  - Ansil849 5y ago
    Yes, and? What about all of the data that is kept not owing to legal/regulatory requirements? That's the key issue here, not some trite truism about regulatory record-keeping requirements.
- svennek 5y ago
  All data they process are required by law, but they have to collate a dozen systems manually and the legal department has to go thru everything and block out data the customer is not allowed to see (also by law)... No all companies are evil and the GDPR has really made a significant change all the places I know of.
  - svennek 5y ago

namuorg 5y ago

When I requested this back in August, it took 5 days to get the results. You get a long list of links that each triggers a download. It's a bit annoying to bulk download by clicking each link one by one, so I made a Browserflow flow that clicks all the links and downloads everything automatically: https://browserflow.app/shared/61e979ed-47f4-4c94-b5a5-3ade00da0a36 https://browserflow.app/shared/61e979ed-47f4-4c94-b5a5-3ade0...

bobsmooth 5y ago
DownThemAll is a nearly 20 year old browser addon that can bulk-download links on a webpage.
- ngngngng 5y ago
  Some of us were in Kindergarten about then so we would have missed the original Show HN for that. Glad to have found it eventually though.
  - DrAwdeOccarim 5y ago
    I know I'm not supposed to comment when it doesn't add to the conversation, buuuut, your reply made me literally laugh out loud. Thank you for this! I often forget being ~40 means I'm no longer ~20 and that there are people who are actually ~20 out on the internet...
    - ekanes 5y ago
      Hey while we're here in this closet shhhh posting non-additive replies... I have a website that's still up from 1996. Older than so many Kids These Days. :P
- noduerme 5y ago
  Man, talk about a flashback. I remember DownThemAll. That was the way to scrape images off porn sites, back when porn sites only had images.

ubicomp 5y ago

"We’ve received and are processing your request to access your personal data. We will provide your information to you as soon as we can. Usually, this should not take more than a *month*. In exceptional cases, for example if a request is more complex or if we are processing a high volume of requests, it might take longer, but if so we will notify you that there will be a delay."

sol_invictus 5y ago

> We will provide your information to you as soon as we can. Usually, this should not take more than a month. What benefit does Amazon get out of delaying giving out this information?

lokimedes 5y ago
The ability to disconnect intent from response is likely perceived as a demotivator? Also, anecdotally, I ordered my GDPR info from my car company, when I finally received it (days later) my interest in it was gone.
mrfluffybeard 5y ago
They don't have the data ready as this data is scattered across multiple ( maybe multiple dozen systems) . Also it might not be fully automated.
- sol_invictus 5y ago
  Doesn't make any sense, the computation time difference between pulling data from one system and fifty systems isn't measured in the months range.
  - joshSzep 5y ago
    It makes a difference if it's just humans doing the job. Given the long window I would assume that this lacks automation
    - sol_invictus 5y ago
      Yes, but "having a human in the system" isn't answering the original question: what does Amazon benefit from introducing excess cost into this equation? Surely there should be nothing clandestine in your own usage data, search queries etc.
      - Dave3of5 5y ago

rsync 5y ago

I can't do this because amazon does not have my personal information. Amazon has a pseudonym with a dedicated Twilio number that delivers to a private postal box. I burn the pseudonym every few years. Which reminds me ... This is simple because VISA/MC do not validate cardholder name. Everyone thinks they do and most merchants believe that they do but ... they do not. You can use your card with "Mickey Mouse" and it will work just fine.

cyode 5y ago
My mind is blown. Reflecting on a lifetime of getting declined filling web forms in with a wrong CC number, billing address, expiration or CCV, I...don’t think I’ve ever misspelled my name. Trying this out on my next purchase for sure.
- WA 5y ago
  Fun fact (from 2012): some credit cards had more than one CCV. You could find out by simply trying all 1000 combinations on some web shops. Back then, I did security consulting and we knew a shop or two where it was possible to enumerate the CCVs without submitting an order and without being blocked. Not sure if this is still valid nowadays, but it blew my mind as well.
  - captn3m0 5y ago
    Even better fun fact: There’s some issuers that won’t validate your CVV at all, so any of the 999 options work for those cards.
    - lillecarl 5y ago
      As a Swede, with both my CC and direct debit I'm transfered to the Swedish "Bank ID" service to do mfa with my phone using a 6+ digit code before any online purchase goes through. Kinda privacy invasive, but it's also impossible to steal money from me without these things: my card, my cvv, my phone, my phone unlock code, my bank ID code.

tawan 5y ago

I think there are two sides to a service like that: on the one hand it provides more transparency to the individual customer (good), on the other hand, any external or internal malicious actor now has a very convenient tool to gain access to lot of very personal information about a single individual (bad). It was probably not even possible without a tool like that, not even for jeff bezos.

32mb 5y ago

Is there a similar link for Google, Bing, and other services? If only someone had a list of these links in GitHub repo.

shever73 5y ago

It was requesting my personal information from Amazon that made me decide to dump all my Alexa smart devices. We had bought one for my in-laws and the Echo had picked up entire conversations between them even though the wake word had not been said. They were categorised under "Not intended for Alexa". My father in-law is at the end of his life, and I really hated the fact that deeply private and incredibly poignant conversations would probably be listened to by a human somewhere to better calibrate the device.

patrec 5y ago
Wow, that's bad. It seems obvious that something like Alexa would transmit some amount of data not intended for it and that would be listened to by someone for training purposes. And probably enough data that someone remotely privacy conscious would not voluntarily install some 24/7 listening device into their inner sanctum. But what on earth would posses Alexa to record entire conversations without either piping up ("sorry, I did not understand this request") or figuring out after a few seconds that this was probably a false alarm and turning itself off? How would this be remotely excusable? How long was the longest recording not really intended for Alexa?
- shever73 5y ago
  I've switched off all voice-activated devices in my home. I'm not sure how long the longest recording was...I'll go back over the data to have a look, but the one that really broke my heart was about 20 seconds during which my mother in-law was upset because my father in-law was not waking up.
  - patrec 5y ago
    I'm sorry that you went through this. I think even a really short recording (under 20s), of a distraught, close person at some critical junction would feel very unsettling to me especially with the knowledge that it shouldn't really exist, I shouldn't be able to listen to it, and it probably was listened to by some complete strangers as well as part of some routine megacorp work.

klondike_klive 5y ago

I clicked on the link in the confirmation email and just got a big "Sorry, we couldn't find that page" with a picture of a dog and the caption "dogs of Amazon". I feel like this. https://www.youtube.com/watch?v=RfiQYRn7fBg https://www.youtube.com/watch?v=RfiQYRn7fBg