6 ms·

I'm one of the creators of YourDigitalRights.org, a service which automates the process of sending data requests (it's free, open source and were a registered c

I'm one of the creators of YourDigitalRights.org, a service which automates the process of sending data requests (it's free, open source and were a registered charity). What is described in this article is, unfortunately, a common case with some big tech companies. I've recently started an experiment to send data deletion requests to 600 data brokers and document what happens. It's dark patterns all the way down. The solution is to escalate your request to the local data protection agency (attorney general in case of California). I believe that if enough of us do this it will make a difference, even in the case of Amazon. Following this realization we've recently added an optional features which will follow up with you some time after a request is made, and depending on the outcome, offer to automate the escalation process.

lelandfe 5y ago
> I've recently started an experiment to send data deletion requests to 600 data brokers and document what happens. It's dark patterns all the way down. I would love to read a long form piece on your findings! It sounds like it would a great way to advertise YourDigitalRights as well.
- yoaviram 5y ago
  We're going to be speaking about this at Good Tech Fest 2022 [1], and will also write it up post it to HN. https://www.goodtechfest.com/good-tech-fest-2022 https://www.goodtechfest.com/good-tech-fest-2022
TeeMassive 5y ago
You're doing privacy a great service, you're charity is awesome! Are your services also work outside of the US, like, say, Canada?
- yoaviram 5y ago
  Thank you! We are about to launch support for the Brazilian LGPD, and have 17 other regulations we want to support this year, including Canada.
ramphastidae 5y ago
I have been asking a broker to remove my data for weeks and they are giving me the runaround. However, I’m not in CA (another US state). Anything I can do?
- yoaviram 5y ago
  Please send me an email with the details (it's on the website).
mahastore 5y ago
What is the process of getting all my data collected by GOOGLE and MICROSOFT?
- mahastore 5y ago
  and APPLE?
  - mahastore 5y ago
    and WALMART
    - deleted 5y ago
      [deleted]
- yoaviram 5y ago
  https://yourdigitalrights.org/d/google.com https://yourdigitalrights.org/d/google.com https://yourdigitalrights.org/d/microsoft.com https://yourdigitalrights.org/d/microsoft.com https://yourdigitalrights.org/d/apple.com https://yourdigitalrights.org/d/apple.com https://yourdigitalrights.org/d/walmart.com https://yourdigitalrights.org/d/walmart.com
bobmichael 5y ago
That's so great. I wish there was something like this for Germany.
- yoaviram 5y ago
  We support the GDPR, so it will work in Germany.
  - lrem 5y ago
    Does the GDPR mandate usage of English? I know orgs that will allow antispam eat any communication not in the local language.
  - bobmichael 5y ago
    When I went to the German site and tried to generate a data request, the generated email was in English. Is that intended? I think I'm Germany you're much more likely to get a response if you write in German.
- koesterd 5y ago
  A similar service for German users is Datenanfragen.de
1vuio0pswjnm7 5y ago
"I've recently started an experiment to send data deletion requests to 600 data brokers and document what happens." Another idea for an experiment is to send 600 data deletion requests from 600 unique computer users simultaneously to a single data broker and see what happens. If the escalation process is automated when the data broker fails to respond, the most interesting results IMO will be from the data protection agency. It is difficult to ignore 600 cases. It also tests the broker's and agency's systems. In theory these systems should be able to scale. If they cannot, then it is arguable the broker and/or agency is making an assumption that privacy is something that only some people, a relatively small number, care about. At the very least there would be a question of whether these systems are adequate for what they are supposed to do. This experiment might be thought of like a petition that requires a minimum number of signatures. What is the purpose behind having petitions and minimums for the number of people who sign them. Here, a minimum number of people must sign on to make a data deletion request before the bundle of requests are actually sent.
vmception 5y ago
Can we have a non profit for this? I think one of the issues for getting tax exempt status is designating a “charitable class” of people that it would be helping
- verve_rat 5y ago
  Um, they are a charity?
  - vmception 5y ago
    > Conscious Digital MTÜ is a registered Estonian non-profit organization number 80600079. Ah they are, wonder about the US version The tax deductibility for us tax residents is a working major incentive
technerder 5y ago
I really do hope our politicians in Canada pass something like this
- wisemang 5y ago
  Perhaps not quite what you’re looking for but this may be of interest: https://accessmyinfo.ca https://accessmyinfo.ca
tgsovlerkhgsel 5y ago
> The solution is to escalate your request to the local data protection agency In many countries in Europe, you can expect a response within 30-90 days acknowledging receipt, and an actual response that they'll look into it and request a statement from the company after a year or so. Sometimes you get lucky, but then only hear back that the company has now changed that one specific bad behavior (after profiting from it for a year or two) and thus the case is closed. Zero meaningful enforcement. Until NGOs start suing at scale, nothing will change.
- EEBio 5y ago
  In Europe the GDPR states that businesses have a single calendar month to respond to you, either with the data, how to easily get them, or a damn good reason why they couldn't comply in time. It happened to me once that a business hasn't responded in time, but after I sent them a follow up that they are breaking the law by ignoring my request, they responded right away the next day. I also only sent the requests to the biggest offenders, so the sample is small. 30-90 days is therefore possibly the period one should expect to wait to get a response, even though more than approx. 30 days is illegal.

lelandfe 5y ago

> I've recently started an experiment to send data deletion requests to 600 data brokers and document what happens. It's dark patterns all the way down. I would love to read a long form piece on your findings! It sounds like it would a great way to advertise YourDigitalRights as well.

yoaviram 5y ago
We're going to be speaking about this at Good Tech Fest 2022 [1], and will also write it up post it to HN. https://www.goodtechfest.com/good-tech-fest-2022 https://www.goodtechfest.com/good-tech-fest-2022

TeeMassive 5y ago

You're doing privacy a great service, you're charity is awesome! Are your services also work outside of the US, like, say, Canada?

yoaviram 5y ago
Thank you! We are about to launch support for the Brazilian LGPD, and have 17 other regulations we want to support this year, including Canada.

ramphastidae 5y ago

I have been asking a broker to remove my data for weeks and they are giving me the runaround. However, I’m not in CA (another US state). Anything I can do?

yoaviram 5y ago
Please send me an email with the details (it's on the website).

mahastore 5y ago

What is the process of getting all my data collected by GOOGLE and MICROSOFT?

mahastore 5y ago
and APPLE?
- mahastore 5y ago
  and WALMART
  - deleted 5y ago
    [deleted]
yoaviram 5y ago
https://yourdigitalrights.org/d/google.com https://yourdigitalrights.org/d/google.com https://yourdigitalrights.org/d/microsoft.com https://yourdigitalrights.org/d/microsoft.com https://yourdigitalrights.org/d/apple.com https://yourdigitalrights.org/d/apple.com https://yourdigitalrights.org/d/walmart.com https://yourdigitalrights.org/d/walmart.com

bobmichael 5y ago

That's so great. I wish there was something like this for Germany.

yoaviram 5y ago
We support the GDPR, so it will work in Germany.
- lrem 5y ago
  Does the GDPR mandate usage of English? I know orgs that will allow antispam eat any communication not in the local language.
- bobmichael 5y ago
  When I went to the German site and tried to generate a data request, the generated email was in English. Is that intended? I think I'm Germany you're much more likely to get a response if you write in German.
koesterd 5y ago
A similar service for German users is Datenanfragen.de

1vuio0pswjnm7 5y ago

"I've recently started an experiment to send data deletion requests to 600 data brokers and document what happens." Another idea for an experiment is to send 600 data deletion requests from 600 unique computer users simultaneously to a single data broker and see what happens. If the escalation process is automated when the data broker fails to respond, the most interesting results IMO will be from the data protection agency. It is difficult to ignore 600 cases. It also tests the broker's and agency's systems. In theory these systems should be able to scale. If they cannot, then it is arguable the broker and/or agency is making an assumption that privacy is something that only some people, a relatively small number, care about. At the very least there would be a question of whether these systems are adequate for what they are supposed to do. This experiment might be thought of like a petition that requires a minimum number of signatures. What is the purpose behind having petitions and minimums for the number of people who sign them. Here, a minimum number of people must sign on to make a data deletion request before the bundle of requests are actually sent.

vmception 5y ago

Can we have a non profit for this? I think one of the issues for getting tax exempt status is designating a “charitable class” of people that it would be helping

verve_rat 5y ago
Um, they are a charity?
- vmception 5y ago
  > Conscious Digital MTÜ is a registered Estonian non-profit organization number 80600079. Ah they are, wonder about the US version The tax deductibility for us tax residents is a working major incentive

technerder 5y ago

I really do hope our politicians in Canada pass something like this

wisemang 5y ago
Perhaps not quite what you’re looking for but this may be of interest: https://accessmyinfo.ca https://accessmyinfo.ca

tgsovlerkhgsel 5y ago

> The solution is to escalate your request to the local data protection agency In many countries in Europe, you can expect a response within 30-90 days acknowledging receipt, and an actual response that they'll look into it and request a statement from the company after a year or so. Sometimes you get lucky, but then only hear back that the company has now changed that one specific bad behavior (after profiting from it for a year or two) and thus the case is closed. Zero meaningful enforcement. Until NGOs start suing at scale, nothing will change.

EEBio 5y ago
In Europe the GDPR states that businesses have a single calendar month to respond to you, either with the data, how to easily get them, or a damn good reason why they couldn't comply in time. It happened to me once that a business hasn't responded in time, but after I sent them a follow up that they are breaking the law by ignoring my request, they responded right away the next day. I also only sent the requests to the biggest offenders, so the sample is small. 30-90 days is therefore possibly the period one should expect to wait to get a response, even though more than approx. 30 days is illegal.