5 ms·

In my opinion, it shouldn't be up to the whims of companies to decide who they share your private data with if they don't have your explicit permission, or a va

In my opinion, it shouldn't be up to the whims of companies to decide who they share your private data with if they don't have your explicit permission, or a valid warrant, subpoena or court order, to do so.

7e 3y ago
Doesn’t the third party doctrine and/or ECPA only require a subpoena, especially for old, partially delivered notifications? It seems like Apple and Google are daring law enforcement to sue so that they can establish a stricter precedent.
chmod775 3y ago
You're asking for something like the GDPR.
- foepys 3y ago
  It's incredibly confusing to me that so many American tech workers were ranting on HN how the GDPR is the biggest mistake ever and will sink the EU tech scene, only to discover that GDPR is a citizen's tool against total government surveillance.
  - dns_snek 3y ago
    Unfortunately GDPR carves out exemptions for government and law enforcement purposes. They would never willingly impose additional restrictions onto themselves. https://gdpr-info.eu/art-23-gdpr/ https://gdpr-info.eu/art-23-gdpr/
- cherryteastain 3y ago
  GDPR won't protect you from law enforcement, let alone intelligence agencies. The legal mechanisms these organizations use have broad carve outs from GDPR. Before GDPR, there already were other protections against domestic three letter agency surveillance. As Snowden showed us, this was easily circumvented by getting UK to spy on US citizens instead and sending over the data (and vice versa).
  - morelisp 3y ago
    Although GDPR doesn't restrict the activities of law enforcement, it does restrict what other companies have and therefore what LE can request of them. The biggest issue is not that LE can investigate specific things, it's that they have easy access to such a massive self-perpetuating dragnet of everything.
  - jeroenhd 3y ago
    The GDPR may not protect you from law enforcement, but it's not like you're free to send over whatever you wish to the police without following the proper process, either. If you have information on someome the police asks for, there are strict processes that need to be followed. Sharing information with the police at a mere request, like what happened in this case, may even force you to inform the people whose information you have provided. Unless law enforcement can demand confidentiality, they're a normal party in the eyes of the law. For example, when the police requests security camera owners for footage in a wide area around where a crime took place, sharing that footage may be illegal without blurring or cropping if other innocent people not matching the suspect's description are in clear view, or you may need to inform those people that you have provided the police with footage they're visible in. This very much depends on where the camera is located and where it's pointed at, and I doubt anyone had ever filed a GDPR complaint with their DPA about it, but without following the proper legal process, the police is as valid a party to share information with as any other person or organisation. In this case, where the police asked Apple but did not fully utilise their investigatory powers (because Apple could've demanded a warrant), a GDPR-like law would've made it harder for governments to spy on people. It's not like warrants are hard to come by for spy agencies, but such warrants would at least produce a paper trail of some kind in the case of a witch hunt.
deleted 3y ago
[deleted]
threeseed 3y ago
But those companies would say they do have your permission. Because users explicitly click on the Agree button when they signup.
- cma 3y ago
  It is crazy the level of care we have in wiretapping laws for domestic phone calls, while almost nothing for digital communication if the company volunteers it.
  - thfuran 3y ago
    Yeah, the third party doctrine is complete crap in the modern era. At the very least, what constitutes voluntarily turning over information to a third party needs to be far more narrowly defined, but I think the entire premise is a bit shaky.
  - _heimdall 3y ago
    It actually seems understandable to me. Many politicians in the US are former lawyers, judges, etc. They could easily have learned lessons of how much privacy protections can get in the way of "real" investigations. They're also part of a government that has been handed more and more power for the better part of 60 years, privacy laws are a problem if your honest view is that the government is there to protect us by whatever means are necessary.
- kergonath 3y ago
  These terms should be null and void. You cannot give informed consent as you have no clue what could happen in the future. Consent should be given on a case by case basis. Also, not hidden in 100 pages long EULAs that you have to agree to in block in order to do anything. There cannot be informed consent with coercion and deception either. Personal data are as private as medical records.
  - jeroenhd 3y ago
    This is why the GDPR demands explicit consent in many cases (even though many companies don't follow the law, unfortunately). The EULA is not a defence for a lot of data sharing anymore. In my opinion, the USA deserves a similar law to protect its citizens from this type of crap. Unfortunately, privacy protection doesn't seem to be a very popular topic in American politics.
matwood 3y ago
You're asking for legislation, but what we have seen coming out of the government are laws looking to make it easier to get access to data. Unfortunately, companies are all we have right now.
- john_the_writer 3y ago
  100% so many governments of the world spend time drafting laws to make it easier. "protect the children."
vmfunction 3y ago
We shouldn't be storing ANY personal stuff on company CLOUD. We all ought to have OUR own data, usb online.

7e 3y ago

Doesn’t the third party doctrine and/or ECPA only require a subpoena, especially for old, partially delivered notifications? It seems like Apple and Google are daring law enforcement to sue so that they can establish a stricter precedent.

chmod775 3y ago

You're asking for something like the GDPR.

foepys 3y ago
It's incredibly confusing to me that so many American tech workers were ranting on HN how the GDPR is the biggest mistake ever and will sink the EU tech scene, only to discover that GDPR is a citizen's tool against total government surveillance.
- dns_snek 3y ago
  Unfortunately GDPR carves out exemptions for government and law enforcement purposes. They would never willingly impose additional restrictions onto themselves. https://gdpr-info.eu/art-23-gdpr/ https://gdpr-info.eu/art-23-gdpr/
cherryteastain 3y ago
GDPR won't protect you from law enforcement, let alone intelligence agencies. The legal mechanisms these organizations use have broad carve outs from GDPR. Before GDPR, there already were other protections against domestic three letter agency surveillance. As Snowden showed us, this was easily circumvented by getting UK to spy on US citizens instead and sending over the data (and vice versa).
- morelisp 3y ago
  Although GDPR doesn't restrict the activities of law enforcement, it does restrict what other companies have and therefore what LE can request of them. The biggest issue is not that LE can investigate specific things, it's that they have easy access to such a massive self-perpetuating dragnet of everything.
- jeroenhd 3y ago
  The GDPR may not protect you from law enforcement, but it's not like you're free to send over whatever you wish to the police without following the proper process, either. If you have information on someome the police asks for, there are strict processes that need to be followed. Sharing information with the police at a mere request, like what happened in this case, may even force you to inform the people whose information you have provided. Unless law enforcement can demand confidentiality, they're a normal party in the eyes of the law. For example, when the police requests security camera owners for footage in a wide area around where a crime took place, sharing that footage may be illegal without blurring or cropping if other innocent people not matching the suspect's description are in clear view, or you may need to inform those people that you have provided the police with footage they're visible in. This very much depends on where the camera is located and where it's pointed at, and I doubt anyone had ever filed a GDPR complaint with their DPA about it, but without following the proper legal process, the police is as valid a party to share information with as any other person or organisation. In this case, where the police asked Apple but did not fully utilise their investigatory powers (because Apple could've demanded a warrant), a GDPR-like law would've made it harder for governments to spy on people. It's not like warrants are hard to come by for spy agencies, but such warrants would at least produce a paper trail of some kind in the case of a witch hunt.

deleted 3y ago

[deleted]

threeseed 3y ago

But those companies would say they do have your permission. Because users explicitly click on the Agree button when they signup.

cma 3y ago
It is crazy the level of care we have in wiretapping laws for domestic phone calls, while almost nothing for digital communication if the company volunteers it.
- thfuran 3y ago
  Yeah, the third party doctrine is complete crap in the modern era. At the very least, what constitutes voluntarily turning over information to a third party needs to be far more narrowly defined, but I think the entire premise is a bit shaky.
- _heimdall 3y ago
  It actually seems understandable to me. Many politicians in the US are former lawyers, judges, etc. They could easily have learned lessons of how much privacy protections can get in the way of "real" investigations. They're also part of a government that has been handed more and more power for the better part of 60 years, privacy laws are a problem if your honest view is that the government is there to protect us by whatever means are necessary.
kergonath 3y ago
These terms should be null and void. You cannot give informed consent as you have no clue what could happen in the future. Consent should be given on a case by case basis. Also, not hidden in 100 pages long EULAs that you have to agree to in block in order to do anything. There cannot be informed consent with coercion and deception either. Personal data are as private as medical records.
- jeroenhd 3y ago
  This is why the GDPR demands explicit consent in many cases (even though many companies don't follow the law, unfortunately). The EULA is not a defence for a lot of data sharing anymore. In my opinion, the USA deserves a similar law to protect its citizens from this type of crap. Unfortunately, privacy protection doesn't seem to be a very popular topic in American politics.

matwood 3y ago

You're asking for legislation, but what we have seen coming out of the government are laws looking to make it easier to get access to data. Unfortunately, companies are all we have right now.

john_the_writer 3y ago
100% so many governments of the world spend time drafting laws to make it easier. "protect the children."

vmfunction 3y ago

We shouldn't be storing ANY personal stuff on company CLOUD. We all ought to have OUR own data, usb online.