5 ms·

The full, complete set of tedium the author describes is: * Navigate through a handful of pages. * Scroll to the bottom of a menu. * Click an email confirmat

The full, complete set of tedium the author describes is: * Navigate through a handful of pages. * Scroll to the bottom of a menu. * Click an email confirmation link. * Wait 19 days. * Click 74 download links. That last part is pretty dumb! But it's also the only thing that seems remotely tedious, and I'm not sure where at any point he'd be confused. The author implies some sort of issue with the 19 day waiting period, but it seems entirely plausible to me that many of the datasets being requested have "ask an engineer to run through this long manual process" as a dependency.

pacaro 5y ago
I very much doubt that there is any human interaction on the Amazon end of this workflow. What seems more likely is that because this doesn't generate revenue it gets the minimum resources necessary to complete the request within some legally mandated time frame. The request probably sits in queues for most of its life. If a court order requests these same data, I suspect that it can be produced in under 24 hours
- deleted 5y ago
  [deleted]
- whoknew1122 5y ago
  And you'd be wrong. There are humans involved at every level of GDPR requests. Signed, Someone who has handled such requests for AWS
  - pacaro 5y ago
    That feels like an untenable solution, it wouldn't take much to create a denial of service...
    - shadowgovt 5y ago
      Very little about GDPR was designed with technical reality in mind. It's a grand example of using the mallet of law to try and beat the world into the shape someone wants it in, ignorant of why it's in the shape it's currently in.
mschuster91 5y ago
> That last part is pretty dumb! It's not just dumb, the whole process is at the edges of the law. Art. 12 GDPR mandates "intelligible and easily accessible form", which navigating through a number of pages, wait times and finally a 74-link download is certainly not fulfilling. The gold standard, for what it's worth, is a direct link from the privacy policy page in the section that details GDPR subject rights to the page that provides the download - basically, three clicks in total. > but it seems entirely plausible to me that many of the datasets being requested have "ask an engineer to run through this long manual process" as a dependency. Which is ridiculous for a company at Amazon's scale and again at the edges of legality - Art. 12 GDPR mandates "without undue delay" and the one month is clearly meant as an upper bound here, not as the regular case. That is the problem with American companies and also the US government: they all default to hoard data in warehouses and make use of it later, and completely ignoring that all the data they hoard must also be made accessible to the people it's related to.
- plandis 5y ago
  Clicking a bunch of links is pretty accessible, perhaps you’re translating accessible to convenient?
  - mschuster91 5y ago
    The spirit of the GDPR law was to make life for people easier. Putting hoops in front of users that are clearly not needed - Amazon could, for example, offer a single ZIP file like Twitter does - will some day earn them trouble.
- shadowgovt 5y ago
  This is yet another example of how the GDPR is bad law. "Intelligible and easily accessible" is way too vague. Are 74 zip files intelligible and easily accessible? Of course not! I don't want to pull 74 links! Is 1 zip file intelligible and easily accessible? Of course not! Way too big to pull in over my low-bandwidth connection. Are zip files intelligible and easily accessible? Of course not! Not everyone understands compression. ...etc., etc. I'd have a lot more respect for that law if it spelled out concretes instead of handwaving technical details and leaving it up to regulators to decide what passes and what doesn't.
hamiltonians 5y ago
having to wait 19 days is really unnaceptable. the rest are just annoying
whoknew1122 5y ago
Distributed systems store information in different databases and warehouses. You don't want your Amazon.com retail data co-mingled with Alexa data for multiple reasons. Two of the preeminent security concepts is least privilege and data segregation. Your data exists in different files and databases. That's why you get multiple files containing your data. And let's ignore that the zip archives contain files of different types. If all the files were of the same type, what would you prefer, that Amazon edit these files and combine them into a single file? How could you prove that Amazon didn't edit out any files maliciously? The typical way to verify file integrity is by checking hash sums. But here you don't have access to the original hashes (because they're internal Amazon files). Even if you had access to the hashes, we know the hashes wouldn't match because we're presupposing that the files have been modified to combine them. If they were to combine all the files together, there would be no way for Amazon to document that nothing was changed. Which means the process isn't auditable, and people will come up with conspiracies about how big bad Amazon is sanitizing files before sending them out.
- jkaplowitz 5y ago
  74 zip files could themselves be added unmodified as 74 individual entries within a parent zip file, optionally, for ease of download convenience. The hashes of those 74 zip files within the parent zip file would be just as auditable as with the current process.
  - whoknew1122 5y ago
    That's true, but then people will complain that they had to unzip 75 files instead of 74. The real issue here is that there are 74 files. Which is an issue without a good solution.
    - folmar 5y ago
      Unzipping 75 files is a one click job on any reasonably current system I know of.
- shadowgovt 5y ago

pacaro 5y ago

I very much doubt that there is any human interaction on the Amazon end of this workflow. What seems more likely is that because this doesn't generate revenue it gets the minimum resources necessary to complete the request within some legally mandated time frame. The request probably sits in queues for most of its life. If a court order requests these same data, I suspect that it can be produced in under 24 hours

deleted 5y ago
[deleted]
whoknew1122 5y ago
And you'd be wrong. There are humans involved at every level of GDPR requests. Signed, Someone who has handled such requests for AWS
- pacaro 5y ago
  That feels like an untenable solution, it wouldn't take much to create a denial of service...
  - shadowgovt 5y ago
    Very little about GDPR was designed with technical reality in mind. It's a grand example of using the mallet of law to try and beat the world into the shape someone wants it in, ignorant of why it's in the shape it's currently in.

mschuster91 5y ago

> That last part is pretty dumb! It's not just dumb, the whole process is at the edges of the law. Art. 12 GDPR mandates "intelligible and easily accessible form", which navigating through a number of pages, wait times and finally a 74-link download is certainly not fulfilling. The gold standard, for what it's worth, is a direct link from the privacy policy page in the section that details GDPR subject rights to the page that provides the download - basically, three clicks in total. > but it seems entirely plausible to me that many of the datasets being requested have "ask an engineer to run through this long manual process" as a dependency. Which is ridiculous for a company at Amazon's scale and again at the edges of legality - Art. 12 GDPR mandates "without undue delay" and the one month is clearly meant as an upper bound here, not as the regular case. That is the problem with American companies and also the US government: they all default to hoard data in warehouses and make use of it later, and completely ignoring that all the data they hoard must also be made accessible to the people it's related to.

plandis 5y ago
Clicking a bunch of links is pretty accessible, perhaps you’re translating accessible to convenient?
- mschuster91 5y ago
  The spirit of the GDPR law was to make life for people easier. Putting hoops in front of users that are clearly not needed - Amazon could, for example, offer a single ZIP file like Twitter does - will some day earn them trouble.
shadowgovt 5y ago
This is yet another example of how the GDPR is bad law. "Intelligible and easily accessible" is way too vague. Are 74 zip files intelligible and easily accessible? Of course not! I don't want to pull 74 links! Is 1 zip file intelligible and easily accessible? Of course not! Way too big to pull in over my low-bandwidth connection. Are zip files intelligible and easily accessible? Of course not! Not everyone understands compression. ...etc., etc. I'd have a lot more respect for that law if it spelled out concretes instead of handwaving technical details and leaving it up to regulators to decide what passes and what doesn't.

hamiltonians 5y ago

having to wait 19 days is really unnaceptable. the rest are just annoying

whoknew1122 5y ago

Distributed systems store information in different databases and warehouses. You don't want your Amazon.com retail data co-mingled with Alexa data for multiple reasons. Two of the preeminent security concepts is least privilege and data segregation. Your data exists in different files and databases. That's why you get multiple files containing your data. And let's ignore that the zip archives contain files of different types. If all the files were of the same type, what would you prefer, that Amazon edit these files and combine them into a single file? How could you prove that Amazon didn't edit out any files maliciously? The typical way to verify file integrity is by checking hash sums. But here you don't have access to the original hashes (because they're internal Amazon files). Even if you had access to the hashes, we know the hashes wouldn't match because we're presupposing that the files have been modified to combine them. If they were to combine all the files together, there would be no way for Amazon to document that nothing was changed. Which means the process isn't auditable, and people will come up with conspiracies about how big bad Amazon is sanitizing files before sending them out.

jkaplowitz 5y ago
74 zip files could themselves be added unmodified as 74 individual entries within a parent zip file, optionally, for ease of download convenience. The hashes of those 74 zip files within the parent zip file would be just as auditable as with the current process.
- whoknew1122 5y ago
  That's true, but then people will complain that they had to unzip 75 files instead of 74. The real issue here is that there are 74 files. Which is an issue without a good solution.
  - folmar 5y ago
    Unzipping 75 files is a one click job on any reasonably current system I know of.
shadowgovt 5y ago