6 ms·

Stross: Klout violates UK privacy laws.

99 points by tsellon 15y ago

alexchamberlain 15y ago
I strongly wonder how many US firms understand EU data laws... Isn't there a campaign against a small company called Facebook and their disregard for our laws?
- jasonlotito 15y ago
  And yet we complain loudly when a service isn't available outside the US.
  - alexchamberlain 15y ago
    Yes, but the UK laws aren't hard to implement - they are quite reasonable. Firms should obide by them - it's good practice anyway.
- rmc 15y ago
  Yes http://europe-v-facebook.org/ http://europe-v-facebook.org/. It's possible because Facebook has a EU company, and hence is bound by EU law.
  - Tyrannosaurs 15y ago
    I'm not sure you even need an EU company, just to be doing business in the EU. An opposite example is Rovio in Finland are being sued under US patent law by some bunch of patent trolls or other (and it's the Finnish Rovio office rather than any US subsidy named in the suit).
    - alexchamberlain 15y ago
      But there are international treaties relating to Patents - none for privacy.
- gyardley 15y ago
  If you want US firms to pay attention to EU data laws, you'd have to devote some real resources to enforcement. From this side of the pond, these laws look like they're only very sporadically enforced, and only against large entities like Facebook who've got the legal resources to deal with the hassle. When viewed with typical American attitudes, that barely makes them laws at all - they're the equivalent of jaywalking in NYC.
CurtHagenlocher 15y ago
Why does Klout in particular seem to piss off so many people? If the text he cites from the Data Protection law were to be interpreted broadly enough to make Klout illegal in the UK, wouldn't it also cover the information about you that Google and Bing collect and process?
- salvadors 15y ago
  Without defending Klout, who do seem to go somewhat further than others on this front, the Data Protection Law in the UK isn't quite as strict as the post implies. The issue of consent, for example, is part of a chain of ors, not ands — i.e. it's a sufficient but not necessary condition for processing someone's personal data. If consent was always required for anyone to ever do anything with your information, the press, for example, would never be able to publish critical articles about anyone.
- wmf 15y ago
  Klout was scoring people without asking them, leading to a lot of people getting low scores (effectively being told "you suck at social media"). When there was no opt-out, people felt like they were being cajoled into playing a game that they don't want to play. (Similar concerns were raised about Get Satisfaction.) "there are many people who don’t wish to be a part of a non-regulated system, and one that can (rightly or wrongly) be used as a third-party validator for expertise." http://dannybrown.me/2011/10/25/a-letter-to-joe-fernandez-of-klout/ http://dannybrown.me/2011/10/25/a-letter-to-joe-fernandez-of... "People are emotionally attached to their score. It is tied to their ego" It seems mean to go around telling people they suck, especially when those people never asked Klout's opinion. This is like Zynga-style dark gamification. "Just as an SAT score is used to judge students and a credit score is used to judge financial standing, Fernandez hopes that the Klout score will become an ingredient in job interviews." So not only does Klout tell everyone that you suck, but they want to hurt your career, too. http://latino.foxnews.com/latino/community/2011/11/03/klout-ceo-fernandez-responds-to-critics-gives-tips-and-talks-future/ http://latino.foxnews.com/latino/community/2011/11/03/klout-... Counterpoint: http://techcrunch.com/2011/10/26/nobody-gives-a-damn-about-your-klout-score/ http://techcrunch.com/2011/10/26/nobody-gives-a-damn-about-y...
- 15y ago
icebraining 15y ago
But is Klout incorporated or hosted in the UK or EU? If not, how exactly do they violate UK law? I mean, pornography is illegal in many countries, but that doesn't mean a US pornographic website is illegal, even if it's available to citizens of that country.
- MattBearman 15y ago
  But (I'm pretty sure) it would be illegal for someone from a no-pornography country to view a US porn site. So my understanding is what klout does is 'fine' for US users, but gathering data on UK/EU users is subject to EU data protection laws. And of course, IANAL
  - icebraining 15y ago
    But (I'm pretty sure) it would be illegal for someone from a no-pornography country to view that site. Using that analogy, then it would be Stross the one committing the offense, not Klout? So my understanding is what klout does is 'fine' for US users, but gathering data on UK/EU users is subject to EU data protection laws. That would be the same as it being illegal for a US site to distribute pornography to a person in a country where it was illegal. The fact is, unless Klout is hosted or incorporated in the UK or EU, the latter have no jurisdiction over the company, and such their laws don't apply.
    - MattBearman 15y ago
      Both good points, well played :) All I can say is as a UK resident I feel like UK data protection laws should protect me from a company like this no matter where they are based.
    - cstross 15y ago
      <em>The fact is, unless Klout is hosted or incorporated in the UK or EU, the latter have no jurisdiction over the company, and such their laws don't apply.</em> Try telling that to the US government, which hounds internet gambling sites wherever they're based. The issue of territorial jurisdiction and law on the internet is a really complex one, and much more so when you deal with a fundamental mis-match between legal systems (the EU constitutional-level right to privacy vs. the US lack of same).
shrikant 15y ago
I haven't looked too hard at too many privacy policies, but this seems fairly boilerplate to me. I'd suppose if you compare this to [say] Twitter's privacy policy, it would end up reading pretty much the same. They also say (in "Profile Settings"): > Klout only analyzes public data or data that we are given explicit access to. We never share your private information with any third party or brand and you can control the information that we make available on your Klout profile page. The full sentence from Klout's privacy policy (which cstross 'edited' out to make his point) reads: > Service Providers. We engage certain trusted third parties to perform functions and provide services to us, including, without limitation, hosting and maintenance, customer relationship, database storage and management, and direct marketing campaigns. I believe this lets them off the hook for storing/using your PII with service providers like AWS, Rackspace, Salesforce and Mailchimp/CampaignMonitor. Disclaimer: not affiliated with Klout in any way except as a user. EDIT: Yeap, from Twitter's privacy policy: > Twitter may use both session cookies and persistent cookies to better understand how you interact with our Services, to monitor aggregate usage by our users and web traffic routing on our Services, and to improve our Services. > We engage certain trusted third parties to perform functions and provide services to us. We may share your personal information with these third parties, but only to the extent necessary to perform these functions and provide such services, and only pursuant to obligations mirroring the protections of this privacy policy.
- Confusion 15y ago
  I don't understand what you are arguing. If Twitter also break UK law, they are still both breaking UK law. Only Klout also actively creates an account for you and attempts to collect information on every move you make.
  - shrikant 15y ago
    Admittedly, I went about it in a ham-handed manner (I blame the Monday), but my core point is this: Klout is doing nothing differently evil with your data, than any other social network. No laws are being broken because [Klout says] no PII is being sold willy-nilly. There's a comment over on the post that nails exactly what I'm trying to say, and in a much better way: http://www.antipope.org/charlie/blog-static/2011/11/evil-social-networks.html#comment-217380 http://www.antipope.org/charlie/blog-static/2011/11/evil-soc...
deepkut 15y ago
How do I delete my Klout account? These guys are devious and I want out.
- shrikant 15y ago
  "Profile Settings" > scroll to the bottom of the page, where there is a "If you would like to delete your account, click here."
dalore 15y ago
> Here in the civilized world we have a fundamental right to privacy. I live in the UK. I thought it was quite funny that he tried to compare the privacy policies by saying the UK is better. Now the UK might be better in some regards but with the amount of CCTVs abound I still say they have problems with privacy.
- maximusprime 15y ago
  Please don't pedal this nonsense. The UK has a large amount of privately owned and operated CCTV cameras. Most are operated by private shop owners etc. They solve countless crimes every day, and deter crime. There's also CCTV put in place by local councils, to stop anti social behavior and again, prevent crime. You've been reading reddit too much I expect. There is no conspiracy, no centralized CCTV program where the government spies on us all. Unlike some countries I could mention, we have a pretty low crime rate. Some of which is due to having various CCTV systems. The UK does have a problem with speed cameras though. It's a way to generate extra revenue from the population.
  - dalore 15y ago
    I never said there is a big central repository. There doesn't have to be for privacy to be invaded. I would say you have a low crime rate due to social reasons, you can't just point and say it's because of CCTVs.
    - maximusprime 15y ago
      So a ton of shop owners just installed CCTV cameras for the hell of it did they? No correlation with them doing that and shoplifting/other crime going down eh? I'm sure councils also install CCTV cameras on the streets just for the fun of it, or to spy on people rather than to cut down anti social behavior, muggings, pickpocketing, knife crime etc. Yes, we have a low crime rate due to our culture. But we have an even lower crime rate due to the private CCTV cameras, and council run CCTV systems. I don't really understand how your privacy is invaded by shop owners videoing the shop to make sure people aren't stealing stuff. It's not like they make the tapes public or don't erase them after a few days... How many breaches of trust have you heard of? Have there been cases of shop owners identifying people buying sausages and posting their mugshots online or something?
mark_l_watson 15y ago
I agree with Charlie. Also, try "opting out" of Klout - good luck. Best I could do was disable Klout app access to Twitter, etc. I regret ever signing up with them.
peterzakin 15y ago
"In the past I've fulminated about various social networking systems. The basic gist is this: the utility of a social network to any given user is proportional to the number of users it has" This is a bit clumsy. If all of my friends are on a social network, it doesn't much matter who else is on it. The utility of a social network is proportional to the number of users I care about.
benregenspan 15y ago
As far as I can tell, the claim of automatically creating accounts is 100% false. So is that of automatically Tweeting or Facebook sharing. If you sign in to Klout, you'll get fairly in-your-face pitches to invite friends to it. Should you choose to send such an invite, the friend you sent it to would have to respond to this and manually OAuth their account. Similarly, sharing an action taken on Klout to Facebook or Twitter is a manual process. I don't remember seeing any "dark patterns"* at work at all here - nothing is sent automatically, there's no sneaky small print or prefilled checkbox, etc. It seems the author is also confusing account creation with the service requesting and storing public data from Twitter. Twitter's own privacy policy (https://twitter.com/privacy https://twitter.com/privacy) is clear re: content being available to search engines and via API. If people do not want their Tweets to be available to search engines and third-party sites that comply with Twitter's policies, they can set their Twitter profiles to private, or can use a service that does not have such an open ecosystem. * http://wiki.darkpatterns.org/Home http://wiki.darkpatterns.org/Home

99 points by tsellon 15y ago

I strongly wonder how many US firms understand EU data laws... Isn't there a campaign against a small company called Facebook and their disregard for our laws?

jasonlotito 15y ago
And yet we complain loudly when a service isn't available outside the US.
- alexchamberlain 15y ago
  Yes, but the UK laws aren't hard to implement - they are quite reasonable. Firms should obide by them - it's good practice anyway.
rmc 15y ago
Yes http://europe-v-facebook.org/ http://europe-v-facebook.org/. It's possible because Facebook has a EU company, and hence is bound by EU law.
- Tyrannosaurs 15y ago
  I'm not sure you even need an EU company, just to be doing business in the EU. An opposite example is Rovio in Finland are being sued under US patent law by some bunch of patent trolls or other (and it's the Finnish Rovio office rather than any US subsidy named in the suit).
  - alexchamberlain 15y ago
    But there are international treaties relating to Patents - none for privacy.
gyardley 15y ago
If you want US firms to pay attention to EU data laws, you'd have to devote some real resources to enforcement. From this side of the pond, these laws look like they're only very sporadically enforced, and only against large entities like Facebook who've got the legal resources to deal with the hassle. When viewed with typical American attitudes, that barely makes them laws at all - they're the equivalent of jaywalking in NYC.

CurtHagenlocher 15y ago

Why does Klout in particular seem to piss off so many people? If the text he cites from the Data Protection law were to be interpreted broadly enough to make Klout illegal in the UK, wouldn't it also cover the information about you that Google and Bing collect and process?

salvadors 15y ago
Without defending Klout, who do seem to go somewhat further than others on this front, the Data Protection Law in the UK isn't quite as strict as the post implies. The issue of consent, for example, is part of a chain of ors, not ands — i.e. it's a sufficient but not necessary condition for processing someone's personal data. If consent was always required for anyone to ever do anything with your information, the press, for example, would never be able to publish critical articles about anyone.
wmf 15y ago
Klout was scoring people without asking them, leading to a lot of people getting low scores (effectively being told "you suck at social media"). When there was no opt-out, people felt like they were being cajoled into playing a game that they don't want to play. (Similar concerns were raised about Get Satisfaction.) "there are many people who don’t wish to be a part of a non-regulated system, and one that can (rightly or wrongly) be used as a third-party validator for expertise." http://dannybrown.me/2011/10/25/a-letter-to-joe-fernandez-of-klout/ http://dannybrown.me/2011/10/25/a-letter-to-joe-fernandez-of... "People are emotionally attached to their score. It is tied to their ego" It seems mean to go around telling people they suck, especially when those people never asked Klout's opinion. This is like Zynga-style dark gamification. "Just as an SAT score is used to judge students and a credit score is used to judge financial standing, Fernandez hopes that the Klout score will become an ingredient in job interviews." So not only does Klout tell everyone that you suck, but they want to hurt your career, too. http://latino.foxnews.com/latino/community/2011/11/03/klout-ceo-fernandez-responds-to-critics-gives-tips-and-talks-future/ http://latino.foxnews.com/latino/community/2011/11/03/klout-... Counterpoint: http://techcrunch.com/2011/10/26/nobody-gives-a-damn-about-your-klout-score/ http://techcrunch.com/2011/10/26/nobody-gives-a-damn-about-y...
15y ago

icebraining 15y ago

But is Klout incorporated or hosted in the UK or EU? If not, how exactly do they violate UK law? I mean, pornography is illegal in many countries, but that doesn't mean a US pornographic website is illegal, even if it's available to citizens of that country.

MattBearman 15y ago
But (I'm pretty sure) it would be illegal for someone from a no-pornography country to view a US porn site. So my understanding is what klout does is 'fine' for US users, but gathering data on UK/EU users is subject to EU data protection laws. And of course, IANAL
- icebraining 15y ago
  But (I'm pretty sure) it would be illegal for someone from a no-pornography country to view that site. Using that analogy, then it would be Stross the one committing the offense, not Klout? So my understanding is what klout does is 'fine' for US users, but gathering data on UK/EU users is subject to EU data protection laws. That would be the same as it being illegal for a US site to distribute pornography to a person in a country where it was illegal. The fact is, unless Klout is hosted or incorporated in the UK or EU, the latter have no jurisdiction over the company, and such their laws don't apply.
  - MattBearman 15y ago
    Both good points, well played :) All I can say is as a UK resident I feel like UK data protection laws should protect me from a company like this no matter where they are based.
  - cstross 15y ago
    <em>The fact is, unless Klout is hosted or incorporated in the UK or EU, the latter have no jurisdiction over the company, and such their laws don't apply.</em> Try telling that to the US government, which hounds internet gambling sites wherever they're based. The issue of territorial jurisdiction and law on the internet is a really complex one, and much more so when you deal with a fundamental mis-match between legal systems (the EU constitutional-level right to privacy vs. the US lack of same).

shrikant 15y ago

I haven't looked too hard at too many privacy policies, but this seems fairly boilerplate to me. I'd suppose if you compare this to [say] Twitter's privacy policy, it would end up reading pretty much the same. They also say (in "Profile Settings"): > Klout only analyzes public data or data that we are given explicit access to. We never share your private information with any third party or brand and you can control the information that we make available on your Klout profile page. The full sentence from Klout's privacy policy (which cstross 'edited' out to make his point) reads: > Service Providers. We engage certain trusted third parties to perform functions and provide services to us, including, without limitation, hosting and maintenance, customer relationship, database storage and management, and direct marketing campaigns. I believe this lets them off the hook for storing/using your PII with service providers like AWS, Rackspace, Salesforce and Mailchimp/CampaignMonitor. Disclaimer: not affiliated with Klout in any way except as a user. EDIT: Yeap, from Twitter's privacy policy: > Twitter may use both session cookies and persistent cookies to better understand how you interact with our Services, to monitor aggregate usage by our users and web traffic routing on our Services, and to improve our Services. > We engage certain trusted third parties to perform functions and provide services to us. We may share your personal information with these third parties, but only to the extent necessary to perform these functions and provide such services, and only pursuant to obligations mirroring the protections of this privacy policy.

Confusion 15y ago
I don't understand what you are arguing. If Twitter also break UK law, they are still both breaking UK law. Only Klout also actively creates an account for you and attempts to collect information on every move you make.
- shrikant 15y ago
  Admittedly, I went about it in a ham-handed manner (I blame the Monday), but my core point is this: Klout is doing nothing differently evil with your data, than any other social network. No laws are being broken because [Klout says] no PII is being sold willy-nilly. There's a comment over on the post that nails exactly what I'm trying to say, and in a much better way: http://www.antipope.org/charlie/blog-static/2011/11/evil-social-networks.html#comment-217380 http://www.antipope.org/charlie/blog-static/2011/11/evil-soc...

deepkut 15y ago

How do I delete my Klout account? These guys are devious and I want out.

shrikant 15y ago
"Profile Settings" > scroll to the bottom of the page, where there is a "If you would like to delete your account, click here."

dalore 15y ago

> Here in the civilized world we have a fundamental right to privacy. I live in the UK. I thought it was quite funny that he tried to compare the privacy policies by saying the UK is better. Now the UK might be better in some regards but with the amount of CCTVs abound I still say they have problems with privacy.

maximusprime 15y ago
Please don't pedal this nonsense. The UK has a large amount of privately owned and operated CCTV cameras. Most are operated by private shop owners etc. They solve countless crimes every day, and deter crime. There's also CCTV put in place by local councils, to stop anti social behavior and again, prevent crime. You've been reading reddit too much I expect. There is no conspiracy, no centralized CCTV program where the government spies on us all. Unlike some countries I could mention, we have a pretty low crime rate. Some of which is due to having various CCTV systems. The UK does have a problem with speed cameras though. It's a way to generate extra revenue from the population.
- dalore 15y ago
  I never said there is a big central repository. There doesn't have to be for privacy to be invaded. I would say you have a low crime rate due to social reasons, you can't just point and say it's because of CCTVs.
  - maximusprime 15y ago
    So a ton of shop owners just installed CCTV cameras for the hell of it did they? No correlation with them doing that and shoplifting/other crime going down eh? I'm sure councils also install CCTV cameras on the streets just for the fun of it, or to spy on people rather than to cut down anti social behavior, muggings, pickpocketing, knife crime etc. Yes, we have a low crime rate due to our culture. But we have an even lower crime rate due to the private CCTV cameras, and council run CCTV systems. I don't really understand how your privacy is invaded by shop owners videoing the shop to make sure people aren't stealing stuff. It's not like they make the tapes public or don't erase them after a few days... How many breaches of trust have you heard of? Have there been cases of shop owners identifying people buying sausages and posting their mugshots online or something?

mark_l_watson 15y ago

I agree with Charlie. Also, try "opting out" of Klout - good luck. Best I could do was disable Klout app access to Twitter, etc. I regret ever signing up with them.

peterzakin 15y ago

"In the past I've fulminated about various social networking systems. The basic gist is this: the utility of a social network to any given user is proportional to the number of users it has" This is a bit clumsy. If all of my friends are on a social network, it doesn't much matter who else is on it. The utility of a social network is proportional to the number of users I care about.

benregenspan 15y ago

As far as I can tell, the claim of automatically creating accounts is 100% false. So is that of automatically Tweeting or Facebook sharing. If you sign in to Klout, you'll get fairly in-your-face pitches to invite friends to it. Should you choose to send such an invite, the friend you sent it to would have to respond to this and manually OAuth their account. Similarly, sharing an action taken on Klout to Facebook or Twitter is a manual process. I don't remember seeing any "dark patterns"* at work at all here - nothing is sent automatically, there's no sneaky small print or prefilled checkbox, etc. It seems the author is also confusing account creation with the service requesting and storing public data from Twitter. Twitter's own privacy policy (https://twitter.com/privacy https://twitter.com/privacy) is clear re: content being available to search engines and via API. If people do not want their Tweets to be available to search engines and third-party sites that comply with Twitter's policies, they can set their Twitter profiles to private, or can use a service that does not have such an open ecosystem. * http://wiki.darkpatterns.org/Home http://wiki.darkpatterns.org/Home