3 ms·

> The form includes significant loopholes, like failing to require the apps to report data sharing with “service providers.” Mozilla is taking a principled sta

> The form includes significant loopholes, like failing to require the apps to report data sharing with “service providers.” Mozilla is taking a principled stance that _all_ sharing of data should fall into the same category of "we gave your data to someone else", but I think there's a much more pragmatic breakdown. Data can either be not-shared, shared to service providers with contractual obligations to treat that data as owned by the original service, or shared to service providers who may then use and further share that data for their own purposes. Examples of the latter two would be the difference between sending crash reports to a crash reporting service that doesn't interpret user data in any way and is only a mechanism used by the original service, vs, say, sending it to Facebook to report an advertisement conversion, where it will be used to further the Facebook ad modelling. As a privacy conscious user I typically don't mind the former, but despise the latter. Mozilla does not appear to distinguish between these two cases. One could argue that the former is still increasing the scope of data being hacked, or that companies might breach their contracts and use it anyway, but if you assume illegality then most of this breaks down anyway, we have to assume that companies stick to the law and their contracts for any of this to be of any use (and I think that's mostly reasonable for us to do). I work closely to this area at Google so I don't want to comment on how this fits with Google's data safety labels and the privacy policies of apps. I think people should read the documentation and draw their own conclusions. I personally think that this issue sits at the intersection of principles and pragmatism – making information correct but conveying a less immediately useful message, vs making information accessible and actionable for the majority of users. Google (and Apple) also still need to appeal to developers to get them to build for their platforms, and that again may require pragmatism.

lmkg 4y ago
> Data can either be not-shared, shared to service providers with contractual obligations [...], or shared to service providers who may then use [...]. To follow up, this distinction is also made by both GDPR in Europe, and CCPA in California. (In fact, CCPA uses the same term "Service Provider" and I wouldn't be surprised if that's where Google got it from.) Still, both GDPR and CCPA require disclosure of Processors/Service Providers. Transfers to a Processor/Service Provider have restrictions, and that's significant. Such third parties are treated differently under the law, with those restrictions removing the need for other safeguards. But the don't entirely remove any risk. Ultimately one of the goals of these disclosures is letting the user take control over how their data is used and distributed. Some users (including you, and including myself) are comfortable with data transfers that are protected by legal safeguards rather than technical ones. Some are not comfortable with that, and have valid reasons to be. Some users reasonably want to know their full security risk exposure, which means being aware of which parties are handling their data. Some users simply don't want to do business with certain platform providers, even indirectly. I'll also point out that the EU has found that US safeguards about transfers to Service Providers are inadequate, because if a third party has your data that means US law enforcement can get your data from that third party. So there are very valid concerns that the safeguards Google considers adequate for a Service Provider may not satisfy all users. All of which is to say, I agree that the distinction about Service Providers is useful and meaningful, but I think it is the wrong decision to exempt Service Providers from being listed altogether.
- danpalmer 4y ago
  Thanks, this is a good breakdown. It sounds like, apart from companies breaking the law, the only caveat to service providers being "safe" from user data sharing is law enforcement, and in particular US law enforcement. While this is something I care a lot about, I think many people would consider data use for profit, and data use for law enforcement substantially different, so it _may_ be reasonable for Google not to count law enforcement in their system design. This is a hypothetical, I don't know if this was a factor and I don't really hold this opinion, but I could understand it.
LeifCarrotson 4y ago
> As a privacy conscious user I typically don't mind the former, but despise the latter. Mozilla does not appear to distinguish between these two cases. One could argue that the former is still increasing the scope of data being hacked, or that companies might breach their contracts and use it anyway, but if you assume illegality then most of this breaks down anyway You have to assume not necessarily blatant illegal behavior, but instead a slow stretching of the law. There is huge financial motivation for a company to switch a data pipeline from the former use case to the latter. Those incentives will push them towards changing the fine print or creative interpretations of that fine print, or will get them acquired by a more profitable, less scrupulous company willing to do so. Look at the incentives, and that will tell you what the outcomes will eventually be. The only way to avoid this is either not sharing the data in the first place, or sharing the data only after it's encrypted so that the service provider cannot help but treat it as owned by the original service. Anything else is fighting a losing battle.
- danpalmer 4y ago
  I get that these things can change over time, and there are incentives to do so, but this is why we must take legislation like the GDPR seriously, companies must do their due-diligence on contracts with service providers, and we should hold those breaking contracts and/or the law to account. I don't "people are going to break the law so let's not do anything" is the most pragmatic response. I don't disagree, and can certainly empathise with it, but I do see it as closer to Mozilla's principled stance than to what I think most people would be happy with (assuming they had the facts, which most don't).

lmkg 4y ago

> Data can either be not-shared, shared to service providers with contractual obligations [...], or shared to service providers who may then use [...]. To follow up, this distinction is also made by both GDPR in Europe, and CCPA in California. (In fact, CCPA uses the same term "Service Provider" and I wouldn't be surprised if that's where Google got it from.) Still, both GDPR and CCPA require disclosure of Processors/Service Providers. Transfers to a Processor/Service Provider have restrictions, and that's significant. Such third parties are treated differently under the law, with those restrictions removing the need for other safeguards. But the don't entirely remove any risk. Ultimately one of the goals of these disclosures is letting the user take control over how their data is used and distributed. Some users (including you, and including myself) are comfortable with data transfers that are protected by legal safeguards rather than technical ones. Some are not comfortable with that, and have valid reasons to be. Some users reasonably want to know their full security risk exposure, which means being aware of which parties are handling their data. Some users simply don't want to do business with certain platform providers, even indirectly. I'll also point out that the EU has found that US safeguards about transfers to Service Providers are inadequate, because if a third party has your data that means US law enforcement can get your data from that third party. So there are very valid concerns that the safeguards Google considers adequate for a Service Provider may not satisfy all users. All of which is to say, I agree that the distinction about Service Providers is useful and meaningful, but I think it is the wrong decision to exempt Service Providers from being listed altogether.

danpalmer 4y ago
Thanks, this is a good breakdown. It sounds like, apart from companies breaking the law, the only caveat to service providers being "safe" from user data sharing is law enforcement, and in particular US law enforcement. While this is something I care a lot about, I think many people would consider data use for profit, and data use for law enforcement substantially different, so it _may_ be reasonable for Google not to count law enforcement in their system design. This is a hypothetical, I don't know if this was a factor and I don't really hold this opinion, but I could understand it.

LeifCarrotson 4y ago

> As a privacy conscious user I typically don't mind the former, but despise the latter. Mozilla does not appear to distinguish between these two cases. One could argue that the former is still increasing the scope of data being hacked, or that companies might breach their contracts and use it anyway, but if you assume illegality then most of this breaks down anyway You have to assume not necessarily blatant illegal behavior, but instead a slow stretching of the law. There is huge financial motivation for a company to switch a data pipeline from the former use case to the latter. Those incentives will push them towards changing the fine print or creative interpretations of that fine print, or will get them acquired by a more profitable, less scrupulous company willing to do so. Look at the incentives, and that will tell you what the outcomes will eventually be. The only way to avoid this is either not sharing the data in the first place, or sharing the data only after it's encrypted so that the service provider cannot help but treat it as owned by the original service. Anything else is fighting a losing battle.

danpalmer 4y ago
I get that these things can change over time, and there are incentives to do so, but this is why we must take legislation like the GDPR seriously, companies must do their due-diligence on contracts with service providers, and we should hold those breaking contracts and/or the law to account. I don't "people are going to break the law so let's not do anything" is the most pragmatic response. I don't disagree, and can certainly empathise with it, but I do see it as closer to Mozilla's principled stance than to what I think most people would be happy with (assuming they had the facts, which most don't).