6 ms·
German watchdog orders Sam Altman's biometric ID project World to delete data
- blackeyeblitzar 2y agoWill they delete it for real? I feel like many companies either just hide the data or have it sitting in older backups, leaving everyone’s privacy vulnerable.
- Cyclone_ 2y agoI usually wonder if they do that as well. In some cases it may be hard to depending on how data is stored. In vertica, a database I worked with would never truly delete data on disk.
- delusional 2y agoThat seems like nonsense. Software cannot constrain the physical world. I could touch the bits on the drive itself, or I could physically destroy the hard-drive. Both would "truly delete" the data.
- dietr1ch 2y agoGood luck deleting data from my 5th backup drives that I didn't tell you about. It's not hard because destroying a hard drive is hard, it's hard because you need to find not one, but all of the drives that are likely replicated and distributed around the globe already if you ever intended to do business with that data.
- post-it 2y agoIt's not a technical problem to solve, it's a legal one. If there is a crushing penalty if data that was supposed to be deleted shows up one day, companies will find a way to delete it.
- im3w1l 2y agoOne issue I foresee is that you can't legislate bugs away.
- post-it 2y agoA bug is just a mistake, and the legal system already deals with mistakes in a variety of ways.
- okanat 2y agoUmm you can. You can force companies to pass their code through an examination (even by a third party) and define a procedure of ensuring strict data hygiene. If they cannot pass each year, they will be subject to fines.
- Y-bar 2y agoOnly marking as “deleted” while indefinitely keeping it is illegal in the EU/EEA. The GDPR _requires_ a hard deletion in cases like this, but allows a grace period of a few weeks for the deletion to propagate throughout systems.
- adastra22 2y agoThere are backup systems that are write-only. What’s to be done then?
- dboreham 2y agoThe acid bath.
- post-it 2y agoIt's imprudent to use technology that makes it impossible to comply with the law.
- polskibus 2y agoYou could replay this backup, and skip problematic record when writing new copy of the backup. Delete old backup. What’s important is to keep such log of „records to be deleted from backup”.
- adastra22 2y agoThat cost real money and requires literally throwing out the old backup (which may or may not be destroyable). Think optical media and stuff like that.
- Y-bar 2y agoThe GDPR was proposed and discussed in 2014, it was voted on in 2016, and went into effect in 2018. As 2025 is at the door, what excuses are there really to use a non-compliant tech stack when handling personal data?
- 2y ago
- deleted 2y ago[deleted]
- pfoof 2y agoNow imagine backups stored on tapes. How many companies would resort to rewinding all of them in search of this single record.
- rollcat 2y agoEasy: - Rotate old tapes to store the freshest backup (according to retention policy) - Store row ID for each deletion request - Replay deletions during restore Either way you want (or already have) a scrubbing procedure to import production data into a staging environment, so this is not a technical issue.
- pfoof 2y agoYeah during restore. But is this still compliant with GDPR deletion request when you still physically have access to a copy of user's data? I mean, sure, it's very theoretical, you can't prove that Meta or Google doesn't delete your data until a leak.
- onetokeoverthe 2y agoAgree. The file locker site i use said my account was deactivated due to inactivity. But after a simple email pw reset all my uploads are back online. Makes me aware any deletion i do is probably NOT done server side.
- oytis 2y agoAt least before GDPR it was a common wisdom among backend people that deleting things is just not worth it. I remember when I joined an otherwise cloud-focused team as an embedded engineer and suggested that we add a way to delete an account it was made clear to me that I am asking for an impossible thing. I hope GDPR has managed to change something
- onetokeoverthe 2y agoRight. Most all users want the restore option much more than a clean delete.
- tim333 2y agoI'd quite like if they deleted my iris data as they've given me about $300 so far and if so I could open another account or two and do it over.
- yazzku 2y ago[dead]
- 23B1 2y ago[flagged]
- delusional 2y agoThat's not coincidence. He's the head of one of the most "transformative" companies because he's a brazen liar.
- adastra22 2y agoSurely we are not talking about Worldcoin?
- mplewis 2y agoYeah, what a shame. Which company did you mean here?
- 23B1 2y agoyes
- echelon 2y agoI was raised in the evangelical south to conservative parents. World(coin) sounds like it's right out of the plot of some Sunday morning preacher's sermons [1] about Revelations and the "mark of the Beast". Central organization scanning people and controlling how they transact? Literally the antichrist's M.O. [1] https://youtu.be/zjHrExOM-ww https://youtu.be/zjHrExOM-ww
- gadflyinyoureye 2y ago[flagged]
- oytis 2y agoTogether with the vision of the future where all labour is automated and controlled by a few megacorps it paints a truly apocalyptic picture
- AnarchismIsCool 2y agoI'm a flaming atheist but holy fuck do I get uncomfortable with universal IDs and the growing drumbeat of identity verification. Borders, passports, IDs, personal documentation, it's all just a modern caste system. Yes, it's uncomfortable to think of a world without them but to me, after global warming, digital class slavery is probably the second biggest issue of our time. So much of the world works because bureaucracy is inefficient and non-omniciant, just like humans, yet so many people want the world to be one big TSA checkpoint where everyone must be unnaturally perfect at all times. It's utopian thinking that is leading us towards a type of hell I don't think any of us can even begin to imagine.
- tim333 2y agoBorders and passports have been with us for a while now and are not really a tech thing. I'll give you modern KYC stuff is annoying - it seems you have to provide proof of identity, address where you live, and often now where your money came from which can be tricky if you haven't documented it. Worldcoin is actually a step away from the KYC situation where you can prove you are a unique person but not have to give them your name address and finances etc. But so far that's a bit theoretical - all the financial institutions I deal with want KYC stuff and don't accept Worldcoin.
- shafyy 2y ago> Those three codes, which are extremely difficult to break are then stored in databases that are owned by third parties, which include the University of Berkeley, Zurich, Friedrich-Alexander-Universität Erlangen-Nürnberg (FAU) university and NeverMind What do they mean by "Zurich" here?
- javaunsafe2019 2y agoI guess university
- Luc 2y agoETH Zurich I assume, their Chief Economist is professor there.
- btown 2y agoPress release primary sources from the German watchdog, BayLDA: https://www.lda.bayern.de/media/pm/pm2024_08_en.pdf https://www.lda.bayern.de/media/pm/pm2024_08_en.pdf (EN) https://www.lda.bayern.de/media/pm/pm2024_08.pdf https://www.lda.bayern.de/media/pm/pm2024_08.pdf (DE) Quote from the officlal English version: > As a result, despite the improvements already introduced, adjustments are still required to bring the company's data processing in line with the applicable provisions Among other things, the company will be obliged to provide a deletion procedure that complies with the provisions of the GDPR within one month of the decision taking effect. In addition, “Worldcoin” will be obliged to provide explicit consent for certain processing steps in the future. Moreover, the deletion of certain data records previously collected without a sufficient legal basis was ordered ex officio. The company has already received the decision and has informed us that it is going to appeal it. The allusion to "improvements already introduced" would seem to refer (though I'm uncertain of this) to https://world.org/blog/announcements/worldcoin-foundation-unveils-new-smpc-system-deletes-old-iris-codes https://world.org/blog/announcements/worldcoin-foundation-un... - which was described there as "reinforced after conversations with data protection authorities focused around further biometric template protection, particularly the Bavarian Data Protection Authority (“BayLDA”), the Worldcoin Foundation’s Lead Supervisory Authority in the EU." Cryptographic systems that ensure no single party can access data at rest, even if that party were to be compromised, corrupted, or forced to reveal secrets by law enforcement, are absolutely incredible technical achievements - but it seems that, at least in this case, they are insufficient solutions in the eyes of EU regulators. (Not a lawyer, this is not legal advice.) I hope the stance towards cryptographic erasure evolves thoughtfully over time in general, but World's approach here, beginning to collect data for seemingly unlimited purposes before having a completed system for SMPC, was never going to be one that would lend itself towards establishing positive regulatory precedent.
- emporas 2y agoDoesn't Worldcoin produce Zero Knowledge Proofs of biometric data? If yes i do not see what kind of personal data the ledger may hold. It holds the proof of their data, not their data. If some people are not aware of ZKP here is a short really like [1]. [1] https://www.youtube.com/shorts/c6gpq9nKogo https://www.youtube.com/shorts/c6gpq9nKogo
- coppsilgold 2y agoIf they use ZKP's correctly then what you are proving is membership in a set. However, they are collecting iris scans which means they are the ones building the set and therefore own all the data about all the members of that set. To do it properly the government should be the ones who build the set. There are also problems with respect to stolen identities. If addressed, it's not fully private - you are given a token which you must reuse, making you pseudonymous. Or else a single stolen identity may be used infinitely without anyone realizing it.
- emporas 2y ago>If they use ZKP's correctly then what you are proving is membership in a set. >However, they are collecting iris scans which means they are the ones building the set and therefore own all the data about all the members of that set. Totally agree, but any other official of any kind can do the same and create their own membership set. A mayor of a town can create a similar set of citizens. A football's team coach can create their own membership set, of players and fans. I don't see why that particular membership set is more special than any other. > To do it properly the government should be the ones who build the set. To do it properly governments around the world should agree on a standard or two, and use that standard worldwide for the next 50 to 100 years. See for example screws and screwdrivers [1] which are effectively identical for so many years. When a standard is established for identity, for ownership, for ownership transactions, for signatures, for contracts, for passports and many other things then it is government's job to keep the data safe and private, we agree on that. As soon as identities for example are a technological screw, then we don't want incompatibilities between governments. > There are also problems with respect to stolen identities. The ZKP does not need to be the identity by itself. Another identity can be tied to the ZKP proof, and use it's children identities for everyday use. They implemented something like that for Python to avoid supply chain attacks [2]. [1] https://www.youtube.com/watch?v=MXWSn8rMeEo https://www.youtube.com/watch?v=MXWSn8rMeEo [2] https://news.ycombinator.com/item?id=42136375 https://news.ycombinator.com/item?id=42136375
- 29athrowaway 2y agoThe history of modern technology is the history of running away from government regulation.
- ptek 2y agoWhich is why when people make it to mars it will thrive. No taxes, no debt and no government regulation. Just build, build, build baby. Hopefully 3D printing and materials science will have some cool tech in the future otherwise it could be a slow start.
- NeutralCrane 2y agoAssuming humans make it to Mars is already a leap, but assuming a government won’t form almost immediately, if somehow one doesn’t exist from the beginning of colonization, seems even less likely
- brnt 2y agoIf you understood TESCREAL, you wouldnt think this a good thing.
- deleted 2y ago[deleted]
- tim333 2y agoYou'd be entirely dependent on Musk City with its regulations for having resources to stay alive. At least on Earth you can go live in the woods or become a tax exile or some such.
- vvvvcccc 2y ago[dead]
- TiredOfLife 2y agoIsn't Germany a country where you have to publish your name, home address and phone if you have a blog or twitter/bluesky.
- oytis 2y agoNormally not for Twitter, but for a standalone blog, yes, you do.