5 ms·

How in the world is it legal for that dataset to be freely available for anyone to download when it clearly contains uniquely identifiable personal information?

How in the world is it legal for that dataset to be freely available for anyone to download when it clearly contains uniquely identifiable personal information? I can literally identify multiple people! Why hasn't this data at the very least been aggregated in such a way that any random idiot like me can't just take a quick look and identify at least 2 people in less than 5 minutes? How is this in line with GDPR? Certainly the exceptions for statistics don't totally eliminate the requirement for them to minimize the data collection and publication to only fulfill the requirements. What legal basis do they have to make personal information of thousands of people freely available with no anonymization at all? What public benefit is there in making public the data for specific people, instead of non-uniquely identifiable buckets of people?

TheFragenTaken 3y ago
They (the students) probably accepted it, and signed an informed consent.
- johngladtj 3y ago
  I can assure you I didn't! The only forms I signed were the ones that I was required to sign in order to even go on Erasmus
  - marbu 3y ago
    I studied in the Netherlands as Czech Erasmus student about 12 years ago and I recall that one had to fill out a questionnaire about their experience and study during the exchange, and that the results were public for anyone to see[1], which included information about home and receiving institution, courses and so on. And people often consulted this database before submitting an application for their stay, so I would not say that they didn't know about it. And while it's likely that local legal conditions differs a bit and that it changed over time, I'm not surprised that such high level data are public. [1] https://erasmus-databaze.naep.cz/modules/erasmus/ https://erasmus-databaze.naep.cz/modules/erasmus/
- tgv 3y ago
  Then it would still be odd for the EU to publish the raw data.
Udo 3y ago
The map doesn't seem to work for me. What's the identifiable data like? Are there names? From the article it seemed it's just publicly-available city-to-city connection data.
arlort 3y ago
The map is not loading for me (I assume it's a map) but how is it letting you identify multiple people?
helsinkiandrew 3y ago
>.. identify at least 2 people in less than 5 minutes? How did you identify two people from that data? have I missed something, I only see the following: HOMEINSTITUTION;COUNTRYCODEOFHOMEINSTITUTION;AGE;GENDER;NATIONALITY;SUBJECTAREA;LEVELSTUDY;YEARSPRIOR;MOBILITYTYPE;HOSTINSTITUTION;COUNTRYCODEOFHOSTINSTITUTION;PLACEMENTENTERPRISE;COUNTRYOFPLACEMENT;ENTERPRISESIZE;TYPEPLACEMENTSECTOR;LENGTHSTUDYPERIOD;LENGTHPLACEMENT;SHORTDURATION;STUDYSTARTDATE;PLACEMENTSTARTDATE;CONSORTIUMAGREEMENTNUMBER;ECTSCREDITSSTUDY;ECTSCREDITSPLACEMENT;TOTALECTSCREDITS;SNSUPPLEMENT;TAUGHTHOSTLANG;LANGUAGETAUGHT;LINGPREPARATION;STUDYGRANT;PLACEMENTGRANT;PREVIOUSPARTICIPATION;QUALIFICATIONATHOST
- johngladtj 3y ago
  Some universities have very low number of students going to other specific universities. Based on that alone I now know the unique ID of the people who went, and subsequently their start and end date, their gender, the courses they took, etc... Data that I would otherwise not know about them. This isn't a theoretical risk either, i legitimately identified someone else, and learned information I did no know about them from that dataset. Now we're friends and I'm sure they wouldn't mind me knowing what I learned, but it's nonetheless a violation.
  - jkukul 3y ago
    > Based on that alone I now know the unique ID of the people who went What unique ID do you mean? I can't find any unique ID type of column in any of the files published. > the courses they took In what file can you see the list of courses they took? I don't think it's shared anywhere. > and subsequently their start and end date, their gender > now we're friends and I'm sure they wouldn't mind me knowing what I learned You're friends and you just learned their gender? Sorry to be nitpicking like this. You had known their gender previously and that helped you identify them in the dataset, not the other way round?
    - helsinkiandrew 3y ago
      > Sorry to be nitpicking like this. I don't think you are. I'm guessing that for an institution with a small number of people on the Erasmus program you can match people by gender/approximate age/start date to someone in the Erasmus data and hence what, when and where they studied on their Erasmus year. This looks like information that would be on LinkedIn. I'm not sure many people would find this to be an invasion of privacy and isn't covered by the the GDPR
KeplerBoy 3y ago
It's not identifying if you already knew they went from city A to city B. Yes, you might know which specific person took that journey, but you have prior knowledge.
- johngladtj 3y ago
  How is that an excuse? GDPR doesn't make that distinction. The fact is I learned new personal information about someone else from this dataset. The fact that I already had some information about that person is no excuse.
  - KeplerBoy 3y ago
    You need to explain it a bit further. What could you possible learn from the map you didn't already know before? The time they went and if they taught their native language their and similar stuff. Yeah, okay i see your point.
    - johngladtj 3y ago
      And the course they went to. All of those things are personal information subject to GDPR. I would certainly get in trouble if I collected information on the location of specific people and made it available, why don't they?
      - KeplerBoy 3y ago
        Probably because that survey scheme predates the GDPR and nobody thought about it's conformity since.
        johngladtj 3y ago
        Sounds like it's time for a fine then. What's 4% of the turnover of the EU?

TheFragenTaken 3y ago

They (the students) probably accepted it, and signed an informed consent.

johngladtj 3y ago
I can assure you I didn't! The only forms I signed were the ones that I was required to sign in order to even go on Erasmus
- marbu 3y ago
  I studied in the Netherlands as Czech Erasmus student about 12 years ago and I recall that one had to fill out a questionnaire about their experience and study during the exchange, and that the results were public for anyone to see[1], which included information about home and receiving institution, courses and so on. And people often consulted this database before submitting an application for their stay, so I would not say that they didn't know about it. And while it's likely that local legal conditions differs a bit and that it changed over time, I'm not surprised that such high level data are public. [1] https://erasmus-databaze.naep.cz/modules/erasmus/ https://erasmus-databaze.naep.cz/modules/erasmus/
tgv 3y ago
Then it would still be odd for the EU to publish the raw data.

Udo 3y ago

The map doesn't seem to work for me. What's the identifiable data like? Are there names? From the article it seemed it's just publicly-available city-to-city connection data.

arlort 3y ago

The map is not loading for me (I assume it's a map) but how is it letting you identify multiple people?

helsinkiandrew 3y ago

>.. identify at least 2 people in less than 5 minutes? How did you identify two people from that data? have I missed something, I only see the following: HOMEINSTITUTION;COUNTRYCODEOFHOMEINSTITUTION;AGE;GENDER;NATIONALITY;SUBJECTAREA;LEVELSTUDY;YEARSPRIOR;MOBILITYTYPE;HOSTINSTITUTION;COUNTRYCODEOFHOSTINSTITUTION;PLACEMENTENTERPRISE;COUNTRYOFPLACEMENT;ENTERPRISESIZE;TYPEPLACEMENTSECTOR;LENGTHSTUDYPERIOD;LENGTHPLACEMENT;SHORTDURATION;STUDYSTARTDATE;PLACEMENTSTARTDATE;CONSORTIUMAGREEMENTNUMBER;ECTSCREDITSSTUDY;ECTSCREDITSPLACEMENT;TOTALECTSCREDITS;SNSUPPLEMENT;TAUGHTHOSTLANG;LANGUAGETAUGHT;LINGPREPARATION;STUDYGRANT;PLACEMENTGRANT;PREVIOUSPARTICIPATION;QUALIFICATIONATHOST

johngladtj 3y ago
Some universities have very low number of students going to other specific universities. Based on that alone I now know the unique ID of the people who went, and subsequently their start and end date, their gender, the courses they took, etc... Data that I would otherwise not know about them. This isn't a theoretical risk either, i legitimately identified someone else, and learned information I did no know about them from that dataset. Now we're friends and I'm sure they wouldn't mind me knowing what I learned, but it's nonetheless a violation.
- jkukul 3y ago
  > Based on that alone I now know the unique ID of the people who went What unique ID do you mean? I can't find any unique ID type of column in any of the files published. > the courses they took In what file can you see the list of courses they took? I don't think it's shared anywhere. > and subsequently their start and end date, their gender > now we're friends and I'm sure they wouldn't mind me knowing what I learned You're friends and you just learned their gender? Sorry to be nitpicking like this. You had known their gender previously and that helped you identify them in the dataset, not the other way round?
  - helsinkiandrew 3y ago
    > Sorry to be nitpicking like this. I don't think you are. I'm guessing that for an institution with a small number of people on the Erasmus program you can match people by gender/approximate age/start date to someone in the Erasmus data and hence what, when and where they studied on their Erasmus year. This looks like information that would be on LinkedIn. I'm not sure many people would find this to be an invasion of privacy and isn't covered by the the GDPR

KeplerBoy 3y ago

It's not identifying if you already knew they went from city A to city B. Yes, you might know which specific person took that journey, but you have prior knowledge.

johngladtj 3y ago
How is that an excuse? GDPR doesn't make that distinction. The fact is I learned new personal information about someone else from this dataset. The fact that I already had some information about that person is no excuse.
- KeplerBoy 3y ago
  You need to explain it a bit further. What could you possible learn from the map you didn't already know before? The time they went and if they taught their native language their and similar stuff. Yeah, okay i see your point.
  - johngladtj 3y ago
    And the course they went to. All of those things are personal information subject to GDPR. I would certainly get in trouble if I collected information on the location of specific people and made it available, why don't they?
    - KeplerBoy 3y ago
      Probably because that survey scheme predates the GDPR and nobody thought about it's conformity since.
      - johngladtj 3y ago
        Sounds like it's time for a fine then. What's 4% of the turnover of the EU?