4 ms·
I know of a local company that collected personal data for marketing including SSNs and there is no care given to how the data is stored. Most if not all of it
by RandoAds 3y ago
I know of a local company that collected personal data for marketing including SSNs and there is no care given to how the data is stored. Most if not all of it was stored in plain text. You might have more faith in regulatory systems than you should.
- bfjsnsibs 3y ago> You might have more faith in regulatory systems than you should. I don't. What I do have faith in us companies to have a profit motive and work in favor of self preservation. And that comes with reducing risk for the company. An example of a local company with bad security practices due to negligence or malice is no evidence of a publicly traded big tech company wanting to do the same.
- dylan604 3y agoand what is your description of facebook?
- pksebben 3y agoYou may want to look into the histories of equifax, transunion et al. Not local businesses and definitely repeatedly guilty of this flavor of transgression.
- deleted 3y ago[deleted]
- noduerme 3y agoA local company with bad security practices does not, at its core, make money by collecting user data. The collection of that data and the security or insecurity of its storage is pretty much orthogonal to the central business of every company in the world except for tech companies that sell consumer data. Hence, the dictum "don't ascribe malice where incompetence would suffice" doesn't carry across these two different classes of organizations.
- kerkeslager 3y agoIs Equifax not a publicly traded enough big tech company for you, or do you just not read the news?
- bfjsnsibs 3y agoThis subthread is about, or at least started out when I initially responded as - adtech using ssn as an user identifier. I responded to that. I didn't intend to make any claims about anything else. Equifax is not adtech and is explicitly in the business of collecting ssn and related data.
- kerkeslager 3y ago> Equifax is not adtech Equifax is absolutely adtech. Their data is sold used by advertisers all the time. You can make changes to elements of your credit report using techniques widely available on YouTube and watch the spam and junk mail you receive change.
- justrealist 3y agoLiterally no adtech company would accept or attempt to target based on SSN. Maybe your local company was collecting it out of ignorance, but if they uploaded it to google adsense, alarm bells would go off, the data would be purged, and you'd seriously risk having your account shut down.
- throw9away6 3y agoWhy not hash it and simply store it for future cross check while still being technically compliant?
- justrealist 3y agoThere's no simple "compliant" checkbox here. It's a balance of risks, since there's no single regulatory PII-management regime. And in this case, it's a huge toxic liability that adds almost no value over an email address.
- varenc 3y agoSSNs can’t really be anonymized by hashing since they’re essentially sequential numbers. I think the law is at least broad enough to consider a hashed SSN that can be easily reversed to be to equivalent to a real SSN. I agree with others that adtech companies want to proactively avoid SSNs. Too much liability and not at all necessary.
- klyrs 3y agoTo clarify, this is one of the must common and dangerous misconception regarding hashing: a SSN is a 9-digit number. Regardless of the strength of your hash, you can hash them all, and compute a lookup table, in a matter of minutes.
- throw9away6 3y agoYou don’t have to hash it so it’s not reversible only such that you don’t appear liable in the event of an incident. Technically compliant is good enough
- creato 3y ago"local company" being the problem. Local/small companies do not care at all about this kind of thing. Google's perniciousness is being about to follow the letter of the law while still getting what they want, not flagrantly ignoring it.