5 ms·

Is inferring something from data you legally obtained illegal or immoral?

Spivak 2y ago
Only in tech can you ask a question like this and have it be taken seriously. Which is ironic because we're the people who understand authz vs authn. I'm sure from their ToS Facebook legally has claim to my firstborn but this is obviously flagrantly unethical. There's too much money to be made behaving unethically for any legal hurdles to exist. There is a reasonable expectation about what you are allowed to do with someone else's data that you're stewarding. And data-mining your users to discover information they haven't and wouldn't voluntarily disclosed you isn't one of them. Hell in most cases accessing that data at all not in service of a direct user request shouldn't be allowed. There is no reason for Google to access files stored in my Google Drive except to serve them back to me when asked. I say this as someone who at $dayjob is a steward of petabytes of extremely personal data about people. I/my company would be genuinely be betraying our users' trust if we pulled something like this. Because we could and it would even arguably be useful, but it would be a complete violation of their privacy. Does end-running around privacy by saying, "well I technically didn't violate your privacy I just compared your semi-private data you gave us/we collected to millions of other people and now know a bunch of private information about you with high accuracy" feel like it would go over well with people?
bastawhiz 2y ago
Both, as it turns out
seanhunter 2y ago
The short answer to your question is it is obviously unethical unless it is specifically done for a relevant and lawful purpose and it can absolutely be illegal depending on the data protection regime you are operating under. Specifically in the UK and EU, sexual orientation is a highly-protected class of personal information known as "Special Category Data". The UK ICO has actually issued guidance on the legality of inference on this category of data[1]: If this is the case, then you are processing special category data regardless of how confident you are that the inference is correct. If you carry out any form of profiling which infers things like ethnicity, beliefs, politics, health status (condition or risks), sexual orientation or sex life, you will be processing special category data and must identify an Article 9 condition for processing. The only article 9 conditions that suffice to make processing of special category data legal are "explicit consent", "not for profit bodies" (under certain conditions) and "substantial public interest" [2] [1] https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/special-category-data/what-is-special-category-data/#scd7 https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-re... [2] https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/childrens-information/childrens-code-guidance-and-resources/age-appropriate-design-a-code-of-practice-for-online-services/annex-c-lawful-basis-for-processing/#lawfulbasis5 https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-re...

Only in tech can you ask a question like this and have it be taken seriously. Which is ironic because we're the people who understand authz vs authn. I'm sure from their ToS Facebook legally has claim to my firstborn but this is obviously flagrantly unethical. There's too much money to be made behaving unethically for any legal hurdles to exist. There is a reasonable expectation about what you are allowed to do with someone else's data that you're stewarding. And data-mining your users to discover information they haven't and wouldn't voluntarily disclosed you isn't one of them. Hell in most cases accessing that data at all not in service of a direct user request shouldn't be allowed. There is no reason for Google to access files stored in my Google Drive except to serve them back to me when asked. I say this as someone who at $dayjob is a steward of petabytes of extremely personal data about people. I/my company would be genuinely be betraying our users' trust if we pulled something like this. Because we could and it would even arguably be useful, but it would be a complete violation of their privacy. Does end-running around privacy by saying, "well I technically didn't violate your privacy I just compared your semi-private data you gave us/we collected to millions of other people and now know a bunch of private information about you with high accuracy" feel like it would go over well with people?

bastawhiz 2y ago

Both, as it turns out

seanhunter 2y ago

The short answer to your question is it is obviously unethical unless it is specifically done for a relevant and lawful purpose and it can absolutely be illegal depending on the data protection regime you are operating under. Specifically in the UK and EU, sexual orientation is a highly-protected class of personal information known as "Special Category Data". The UK ICO has actually issued guidance on the legality of inference on this category of data[1]: If this is the case, then you are processing special category data regardless of how confident you are that the inference is correct. If you carry out any form of profiling which infers things like ethnicity, beliefs, politics, health status (condition or risks), sexual orientation or sex life, you will be processing special category data and must identify an Article 9 condition for processing. The only article 9 conditions that suffice to make processing of special category data legal are "explicit consent", "not for profit bodies" (under certain conditions) and "substantial public interest" [2] [1] https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/special-category-data/what-is-special-category-data/#scd7 https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-re... [2] https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/childrens-information/childrens-code-guidance-and-resources/age-appropriate-design-a-code-of-practice-for-online-services/annex-c-lawful-basis-for-processing/#lawfulbasis5 https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-re...