7 ms·

I wrote this. I had/have absolutely no expectation that Flock would comply with my request, but figured I should try anyway For Science. Their reply rubbed me w

I wrote this. I had/have absolutely no expectation that Flock would comply with my request, but figured I should try anyway For Science. Their reply rubbed me wrong, though. They seem to claim that there are no restrictions on their collection and processing of PII because other people pay them for it. They say: > Flock Safety’s customers own the data and make all decisions around how such data is used and shared. which seems to directly oppose the CCPA. It's my data, not their customers'. Again, I didn't really expect this to work. And yet, I'm still disappointed with the path by which it didn't work.

carefree-bob 6mo ago
They were saying "don't write to us, talk to the people who own the cameras and ask them to delete the data". A company that manufactures video cameras is not the one to talk to when someone records you, talk to the person who recorded you. But a reasonable person would say -- the data is stored on Flock servers, not with the camera owners. And Flock would say, just because we sell data storage functionality to camera owners doesn't mean we own the data, anymore than a storage service you rent a space from owns what you put in that space. But then an even more reasonable person would say: the infrastructure is designed in such a way as to create inadvertent sharing, and the system has vulnerabilities that compromise the data, so Flock has responsibility for setting up the system in such a way that it's basically designed to violate privacy. And that is the main criticism of Flock. You need to have a more nuanced criticism. It would be really interesting to see this litigated.
- fudgy73 6mo ago
  AFAIK Flock owns the cameras and leases them out [0]. [0] https://www.flocksafety.com/blog/flock-safety-does-my-neighborhood-need-flock-security-cameras https://www.flocksafety.com/blog/flock-safety-does-my-neighb...
  - mminer237 6mo ago
    If you go to Rent-A-Center and rent a DSLR, that doesn't make Rent-A-Center responsible for the pictures taken by their cameras.
    - kstrauser 6mo ago
      If Rent-A-Center installed the camera in a bathroom, I'd contend that it does. Flock's cameras aren't in bathrooms. However, they're still recording people who haven't opted into it. ("But you have no expectation of privacy in a public place!" "You have the expectation that someone might inadvertently overhear you. You don't have the expectation that someone is actively recording you at all times.")
      - valianteffort 6mo ago
        [dead]
    - danielsunsu 6mo ago
      I think if it were only offline storage it would not be as big of an issue. A more accurate analogy would be renting a DSLR that automatically transmits every picture to Rent-A-Center servers.
    - yabutlivnWoods 6mo ago
      Your example is apples and oranges. Flock maintains private infrastructure that stores data. If the DSLR uploaded them to Rent-A-Center owned/leased servers it would in fact require Rent-A-Center to take the necessary steps. As Rent-A-Center would be the only group with proper access to data storage they would have inserted themselves into the chain of custody, and thereby have such obligation to ensure others data is wiped from systems they control.
      - tptacek 6mo ago
        AWS also maintains private infrastructure that stores data. Go write them asking to purge data pertaining to you from S3 and see how that goes.
  - ldoughty 6mo ago
    But the data collected is property of the government and flock is not allowed to use that data for additional business gain (according to their statements)... So they can't sell the fact that you're at Target at 8:00 p.m. on Thursday to anybody... Nor build profiles to sell to advertisers... And if that's the case that's very similar to cloud storage vendors. If I access hacker news, and the record of my visit is stored in an AWS S3 bucket, I can't submit to AWS to delete my visitor record, even though the server, network cards, wires, and storage medium are AWS property, it was hacker news' website that generated that record and their responsibility to take my request to delete it.. AWS' stance would rightly be "talk to the website operator for CCPA requests"
    - tptacek 6mo ago
      This is also true according to their contracts (we were one of the first munis in the country to ostentatiously cancel our Flock contract, and the lead up to that was a bunch of progressive legal experts poring over that contract looking for holes.)
      - fsckboy 6mo ago
        >a bunch of progressive legal experts poring over that contract looking for holes all attorneys represent their clients; your attorney does not have to share your opinion of the law or public policy, they can still interpret what the law means to you. if you are afraid your attorney might have a bias (they are human) you may get better advice from the "misaligned" POV: the flaws/holes in a privacy law found by a pro-business conservative attorney are more likely to find sympathy in the courts from both fellow conservatives and progressive judges.
        shermantanktop 6mo ago
        As a practical matter, this may be good advice. But it also places a demand on someone with a legitimate concern that they go find an ideological "beard" to make themselves more palatable and sympathetic. It's not hard to see how this enables an institution to gate itself from criticism.
  - samrus 6mo ago
    Yeah but their argument is that if someone takes a photo of you with thier iphone and its uploaded to icloud, you cant ask apple to delete the photo, you need to ask the person who took it
- mistrial9 6mo ago
  the way this has been addressed in complex product liability in the past in the USA is that the public-facing Brand Owner has certain legal liability for the product, despite contractors or supply chains. In this case, it appears that the Flock company is the brand owner and is public-facing.
- halJordan 6mo ago
  It easily goes both ways. But we do sue American gun makers for deaths caused by lunatics. We sue drug makers for drugs prescribed by a doctor. We sue cloud providers for not reporting illegal photos. Printers are forced to id every printed page to combat counterfeiting. Banks are forced to do close accounts even though it's not their dirty money
  - thebaine 6mo ago
    Most of those examples have to do with the manufacturers knowing that their products were dangerous, addictive or illegal and advertising them aggressively as safe. They're mostly litigated on product liability claims. Banks are regulated by an entire architecture of laws, and we could enact laws that would regulate Flock too, as one of the other commenters pointed out they're doing in Oregon.
  - BobaFloutist 6mo ago
    > But we do sue American gun makers for deaths caused by lunatics. No we don't, there's a federal law explicitly protecting gun manufacturers from liability for gun crime. https://en.wikipedia.org/wiki/Protection_of_Lawful_Commerce_in_Arms_Act# https://en.wikipedia.org/wiki/Protection_of_Lawful_Commerce_...
- justinclift 6mo ago
  Wonder if Flock could be DMCA'd to remove the data they're hosting then? :)
- dozerly 6mo ago
  I don’t think you’re informed on the topic. They do not just manufacture cameras.
- deleted 6mo ago
  [deleted]
- deleted 6mo ago
  [deleted]
- robot-wrangler 6mo ago
  > They were saying "don't write to us, talk to the people who own the cameras and ask them to delete the data". The response to this should just be, "Yes, very well, please divulge a complete list of your customers, their contact information, and information about camera locations so I will be able to pursue this per instructions". When that obviously doesn't work either then we can all agree the law as written is completely useless, and feel great about rewriting it in a way that's calculated for maximum damage to both the vendor and their customers, and collateral damage to the whole panopticon. Or, just spitballing here, we can just skip to the punchline here and do all that anyway
  - MaxikCZ 6mo ago
    > we can all agree the law as written is completely useless But they wont agree, they find the law very nice in its current form, and have more brib.. ehm, lobying money for it to stay that way.
- beambot 6mo ago
  Isn't this the equivalent of asking Google to delete your image off every Android phone (not just yours)?
themafia 6mo ago
These laws get complicated quickly. There's a specific ALPR law in the CA civil code which seems to carve out several exceptions for a business like Flock: https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&title=1.81.23.&part=4.&chapter=&article= https://leginfo.legislature.ca.gov/faces/codes_displayText.x... The enforcement provisions are rather bleak as well and afford no opportunity to directly bring a case against the agency that operates the system but instead just the individual who misuses it. I think one of the more direct attacks would be going after jurisdictions that chronically have officers misusing the system. I think you're going to have to create precedent in this way to foment actual change.
everdrive 6mo ago
Nice work all the same. These systems need to be prodded and tested. Even unsuccessful results such as this tell us something about the situation we're in.
nainachirps_ 6mo ago
I am not a lawyer myself but can't one argue that this company has duty to ensure that data it is processing for client is legally obtained. If they are processing data after being told it was not obtained with consent do they not have any liability?
Glyptodon 6mo ago
I think you should write them back and ask that they provide you with a customer list and continually update you as they get new customers so that you may follow the advice they've given you.
- kstrauser 6mo ago
  Ooh. I like this.
  - kube-system 6mo ago
    Why? The response is predictable. No company is going to give you a customer list.
    - kstrauser 6mo ago
      I wouldn't be so sure. In this specific case, they told me to ask their customers to comply with my CCPA rights. Without that information, it's impossible for me to exercise those rights. IANAL, but that sounds like a pursuable path.
      - kube-system 6mo ago
        I don't see any provision in CCPA that requires that. And outside of an explicit requirement to do so, nobody is required to help you. Edit: from https://oag.ca.gov/privacy/ccpa https://oag.ca.gov/privacy/ccpa > If a service provider has said that it does not or cannot act on your request because it is a service provider, you may follow up to ask who the business is. However, sometimes the service provider will not be able to provide that information. You may be able to determine who the business is based on the services that the service provider provides, although sometimes this may be difficult or impossible.
        bloppe 6mo ago
        Perhaps the next step is writing to your state representative, or to Alastair Mactaggart, and complain about this hole in the legislation.
deleted 6mo ago
[deleted]
ratdragon 6mo ago
maybe eff.org would be able to help you lawyer up or otherwise to push this forward. good luck!
- kstrauser 6mo ago
  I've reached out, albeit very informally. I'll completely understand if this isn't something they have the time and energy to help with. If I accidentally caught them at a weak moment when they're looking for something to do, though, I'm all in.
tptacek 6mo ago
Wait, is it your data? If you drive your car in front of a Ring camera on my house (I don't have a Ring camera don't @ me), is it your claim that you own the data on that camera?
- kstrauser 6mo ago
  Did you put up a Ring camera on a stand in front of your house for the specific purpose of selling that I drove past at this specific timestamp? If so, yes. The CCPA[0] gives me explicit legal rights: * The right to know about the personal information a business collects about them and how it is used and shared; * The right to delete personal information collected from them (with some exceptions); * The right to opt-out of the sale or sharing of their personal information including via the GPC; This isn't someone incidentally taking pictures of license plates in an otherwise noncommercial setting. It's a company literally created to collect and sell PII. Laws are different for them than for us. [0]https://oag.ca.gov/privacy/ccpa https://oag.ca.gov/privacy/ccpa
  - snowwrestler 6mo ago
    “Personal information” has a legal definition and photos of you in a public street might not satisfy it, regardless of the photographer’s intent.
    - kstrauser 6mo ago
      I think it'd be challenging to rule that a license plate number is not personally identifiable information, when the same regulations often state that an IP address is.
      - uoaei 6mo ago
        "Anyone could have been driving my car, you can't positively identify me in the driver's seat with the evidence you have submitted" is routinely used to toss out cases involving traffic violations. It's not necessarily common but it does happen. By this logic a license plate does not personally identify the person driving, only the person the car is registered to.
mindslight 6mo ago
Isn't this just the routine fascist playbook at this point? Start by declaring that the law doesn't even apply to them, on whatever flimsiest of bases. Personally I would really like to see torts for attorneys who willfully promulgate blatantly incorrect legal interpretations - they're effectively providing incorrect legal advice. A non-attorney is likely to believe such advice coming from a member of the Bar, and the net goal is to discourage the target from seeking further legal advice.
- SoftTalker 6mo ago
  An attorney whom you have not engaged in counsel is not providing legal advice.
  - mindslight 6mo ago
    I'm well aware of how it's currently legally defined - hence "effectively". My comment is in the context of what ought, not what is.
  - efreak 6mo ago
    An expert in any subject matter should not be allowed to provide misleading statements, regardless of whether they're speaking in an official/paid capacity. It doesn't matter if it's considered legal advice or not, the fact that you've got a license and know better should be enough.
snowwrestler 6mo ago
It’s not clear to me that it is actually your data. If I take a picture of you in a public place, I own the picture, not you. But maybe I am unclear on how Flock works.
- bjt 6mo ago
  Setting aside Flock, the "ownership" situation is not as clear as you say above. What you own is the image copyright. But the right to copy is only one of the rights at issue. Under various state laws (California in particular), you might not be entitled to do all the things with that picture that you could do of one that doesn't have my likeness. Privacy laws like the CCPA are one possible carve-out. A "right of publicity" is another. There's an old saying about property law that "property is a bundle of sticks". The bundle can be subdivided. https://www.law.cornell.edu/wex/publicity https://www.law.cornell.edu/wex/publicity
- pksebben 6mo ago
  Isn't flock's whole thing that they extract information from the pictures they have? Like, say I have an interview in your office and you step out for coffee. I take a picture of the applicant list on your desk. That doesn't make the list of applicants "my data".
  - lotsofpulp 6mo ago
    >I take a picture of the applicant list on your desk. That doesn't make the list of applicants "my data". If the list is sitting there out in the open, then yes, it does make it your data.
    - throwway120385 6mo ago
      Well, maybe not. A reasonable person might not think that about that applicant list. I bet you could make a different argument for taking a picture versus memorizing the list too. The legal system thrives on specifics of a situation, so simply asserting that the list of applicants is or is not "yours" because you can see it seems like a gross oversimplification. The specifics of how you came to be there, what your relationship with the officeholder is, and so on probably matters a lot in that situation and I think there might be some unwritten rules or social norms that you'd be expected to follow as well.
goodluckchuck 6mo ago
The CCPA clearly violates the 1st Amendment. If you're out in public, then people are allowed to see you, to remember it, to communicate that it happened, etc.
- 2bitencryption 6mo ago
  Not exactly. One can be charged with stalking, even though the offender only went to places in public that the victim also went to. If combined with a pattern of behavior that, in aggregate, infringes upon the rights of the target, it can become a crime.
- efreak 6mo ago
  > Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble, and to petition the Government for a redress of grievances. This is the entire text of the first amendment. Congress did not make the CCPA. The first amendment is irrelevant. Technically the first amendment also does not prevent Congress from saying you're not allowed to remember or see things, either, though likely there's other laws about this and/or an assumption that Congress will not make laws against thought crime and reality.
necovek 6mo ago
This answer is relevant: https://oag.ca.gov/privacy/ccpa#collapse6d https://oag.ca.gov/privacy/ccpa#collapse6d In short, Flock is a "service provider" and not the entity doing the recording. Perhaps you can make a case that they are a "data broker" instead (https://oag.ca.gov/privacy/ccpa#collapse1i https://oag.ca.gov/privacy/ccpa#collapse1i), but that is a separate law, and what you are really looking at is a combination of license plate, time and location being collected as data being collected and sold without your consent. Obviously, I am not a lawyer (and not even US-based), but I like when privacy is respected :)
zbrozek 6mo ago
I tried the same, got a similar response, and complained to the AG. Nothing.
wakamoleguy 6mo ago
The data ownership is really interesting, as many threads here are going into. I wonder if it's possible to sidestep that entirely, though! Under the CCPA, "personal information" is defined as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked — directly or indirectly — with a particular consumer or household. That says nothing about ownership. To the extent that Flock is only storing the data on behalf of their customers, I'd understand they wouldn't be required to delete it. But to the extent that they are indexing it, deriving from it, aggregating it across customers, and sharing it via their platform, it seems they should be required to remove that data from those services. But then again, I am not a lawyer!
tgsovlerkhgsel 6mo ago
Under GDPR, I believe that would be accurate. I think CCPA was to some extent inspired by GDPR so I wouldn't be surprised if they copied this point too. Which, hilariously, means that under GDPR, you only need to contact the web site, and they have to go talk to their 1207 partners that value your privacy to fulfill your request (I'm sure that in practice they'll say "sorry it's all 'anonymous' so we can't" or "we can't be sure that it's you even though you provided the identifier from your cookies"). I'm really disappointed that NOYB hasn't started going after web sites like that - that's quickly put a damper on the whole web surveillance economy.
charcircuit 6mo ago
>It's my data, not their customers'. Just because data is about you, that doesn't mean it is your data.
- john_strinlai 6mo ago
  you may be minunderstanding the california consumer privacy act (ccpa). in the ccpa, personal data is defined as: "Personal information is information that identifies, relates to, or could reasonably be linked with you or your household." and, you do have the rights set forth in the ccpa (know, delete, correct, limit exposure, etc.) regarding that data.
lmkg 6mo ago
> which seems to directly oppose the CCPA. I have some background in data privacy compliance. It sounds like they are claiming to be a Service Provider under CCPA, which is similar to a Processor under GDPR. Long story short, a Controller is the one legally responsible for ensuring the rights of the data subject, and a service provider/processor is a "dumb pipe" for a Controller that does what they're told. So IF they are actually a Service Provider, they're correct that the legal responsibility for CCPA belongs to their customers and not them. That's a big IF, though. Being a Processor/Service Providor means trade-offs. The data you collect isn't yours, you're not allowed to benefit from it. If Flock aggregates data from one customer and sells that aggregate to a different customer, they're no longer just a service provider. They're using data for their own purposes, and cannot claim to be "just" a service provider.
jsw97 6mo ago
You might reach out to the California AG. I suspect they are itching for this kind of thing right now.
- kstrauser 6mo ago
  Because life is weird, my kid played little league baseball against his. I might have to do that.
  - orthecreedence 6mo ago
    So maybe your kid throws some softball pitches to his kid, and in exchange he opens a quick and easy lawsuit dismantling the surveillance state's ability to operate within CA. Quid pro quo...
deleted 6mo ago
[deleted]
AlBugdy 6mo ago
Read a few of your posts. Just wanted to comment on how I like your to-the-point succinct style and how you care about privacy. :) As a suggestion, I saw you have RSS: https://honeypot.net/feed.xml https://honeypot.net/feed.xml I didn't see it mentioned in the main page or About or Archive. Maybe add it to a more visible place?
- kstrauser 6mo ago
  Aww, thanks! I appreciate that. And that's a good point. I'll look at that when I get home.
rkagerer 6mo ago
It would be revealing to see a judge scrutinize the degree of control Flock maintains over the system and deliberate on whether the company truly is as hands-off as it claims when it comes to privacy obligations. Personally I feel if you're going to build so turnkey a system to facilitate collection of personal data by your customers at the scale Flock seeks, then at a minimum you should build an equally turnkey method to handle requests like the one you made. It would be a service both to their customers and to consumers at large who wish to exercise their rights under legislation to opt out. The fundamental reason we ended up in a world where companies just pay lip service to privacy and don't take it seriously is because consumers / voters put up with it. I'm heartened when I see individuals keyed into the issue. Is there some way to contribute funds toward your legal fees?
- woodydesign 6mo ago
  [dead]
- mixdup 6mo ago
  it is distinctly against Flock's interests to offer a turnkey system to help people opt out of data collection from among Flock's many customers. It might be a service to the general public, but it certainly would not be a service that Flock's actual customers would generally be interested in, at all
MrDrMcCoy 6mo ago
You know... you might have some success getting LeaglEagle involved, especially since they'd make money on the attention it would bring. Benn Jordan would probably love to be an expert witness.
pdpi 6mo ago
In GDPR terms, the point they're making is that people who own Flock hardware are the Data Controllers, and Flock act only as Data Processors. I'm not sure how (whether?) those roles map to the CCPA, and whether any court of law would agree with them is up for discussion, but at least the concept is not completely absurd. Of course, the word "owner" is almost rage baiting on their part.
- FireBeyond 6mo ago
  Except under Flock's own contracts and their own website, Flock are the people who own Flock hardware. And this correlates with my understanding from when I was an employee.
cebert 6mo ago
Police departments, courts, and similar entities are not subject to CCPA in the same way companies are.
gowld 6mo ago
Lawsuit challenging Flock's illegal data brokerage: https://www.courthousenews.com/california-drivers-accuse-flock-safety-of-sharing-data-with-federal-and-out-of-state-agencies/ https://www.courthousenews.com/california-drivers-accuse-flo...
laylower 6mo ago
Send it to EFF - they are big in California..

carefree-bob 6mo ago

They were saying "don't write to us, talk to the people who own the cameras and ask them to delete the data". A company that manufactures video cameras is not the one to talk to when someone records you, talk to the person who recorded you. But a reasonable person would say -- the data is stored on Flock servers, not with the camera owners. And Flock would say, just because we sell data storage functionality to camera owners doesn't mean we own the data, anymore than a storage service you rent a space from owns what you put in that space. But then an even more reasonable person would say: the infrastructure is designed in such a way as to create inadvertent sharing, and the system has vulnerabilities that compromise the data, so Flock has responsibility for setting up the system in such a way that it's basically designed to violate privacy. And that is the main criticism of Flock. You need to have a more nuanced criticism. It would be really interesting to see this litigated.

fudgy73 6mo ago
AFAIK Flock owns the cameras and leases them out [0]. [0] https://www.flocksafety.com/blog/flock-safety-does-my-neighborhood-need-flock-security-cameras https://www.flocksafety.com/blog/flock-safety-does-my-neighb...
- mminer237 6mo ago
  If you go to Rent-A-Center and rent a DSLR, that doesn't make Rent-A-Center responsible for the pictures taken by their cameras.
  - kstrauser 6mo ago
    If Rent-A-Center installed the camera in a bathroom, I'd contend that it does. Flock's cameras aren't in bathrooms. However, they're still recording people who haven't opted into it. ("But you have no expectation of privacy in a public place!" "You have the expectation that someone might inadvertently overhear you. You don't have the expectation that someone is actively recording you at all times.")
    - valianteffort 6mo ago
      [dead]
  - danielsunsu 6mo ago
    I think if it were only offline storage it would not be as big of an issue. A more accurate analogy would be renting a DSLR that automatically transmits every picture to Rent-A-Center servers.
  - yabutlivnWoods 6mo ago
    Your example is apples and oranges. Flock maintains private infrastructure that stores data. If the DSLR uploaded them to Rent-A-Center owned/leased servers it would in fact require Rent-A-Center to take the necessary steps. As Rent-A-Center would be the only group with proper access to data storage they would have inserted themselves into the chain of custody, and thereby have such obligation to ensure others data is wiped from systems they control.
    - tptacek 6mo ago
      AWS also maintains private infrastructure that stores data. Go write them asking to purge data pertaining to you from S3 and see how that goes.
- ldoughty 6mo ago
  But the data collected is property of the government and flock is not allowed to use that data for additional business gain (according to their statements)... So they can't sell the fact that you're at Target at 8:00 p.m. on Thursday to anybody... Nor build profiles to sell to advertisers... And if that's the case that's very similar to cloud storage vendors. If I access hacker news, and the record of my visit is stored in an AWS S3 bucket, I can't submit to AWS to delete my visitor record, even though the server, network cards, wires, and storage medium are AWS property, it was hacker news' website that generated that record and their responsibility to take my request to delete it.. AWS' stance would rightly be "talk to the website operator for CCPA requests"
  - tptacek 6mo ago
    This is also true according to their contracts (we were one of the first munis in the country to ostentatiously cancel our Flock contract, and the lead up to that was a bunch of progressive legal experts poring over that contract looking for holes.)
    - fsckboy 6mo ago
      >a bunch of progressive legal experts poring over that contract looking for holes all attorneys represent their clients; your attorney does not have to share your opinion of the law or public policy, they can still interpret what the law means to you. if you are afraid your attorney might have a bias (they are human) you may get better advice from the "misaligned" POV: the flaws/holes in a privacy law found by a pro-business conservative attorney are more likely to find sympathy in the courts from both fellow conservatives and progressive judges.
      - shermantanktop 6mo ago
        As a practical matter, this may be good advice. But it also places a demand on someone with a legitimate concern that they go find an ideological "beard" to make themselves more palatable and sympathetic. It's not hard to see how this enables an institution to gate itself from criticism.
- samrus 6mo ago
  Yeah but their argument is that if someone takes a photo of you with thier iphone and its uploaded to icloud, you cant ask apple to delete the photo, you need to ask the person who took it
mistrial9 6mo ago
the way this has been addressed in complex product liability in the past in the USA is that the public-facing Brand Owner has certain legal liability for the product, despite contractors or supply chains. In this case, it appears that the Flock company is the brand owner and is public-facing.
halJordan 6mo ago
It easily goes both ways. But we do sue American gun makers for deaths caused by lunatics. We sue drug makers for drugs prescribed by a doctor. We sue cloud providers for not reporting illegal photos. Printers are forced to id every printed page to combat counterfeiting. Banks are forced to do close accounts even though it's not their dirty money
- thebaine 6mo ago
  Most of those examples have to do with the manufacturers knowing that their products were dangerous, addictive or illegal and advertising them aggressively as safe. They're mostly litigated on product liability claims. Banks are regulated by an entire architecture of laws, and we could enact laws that would regulate Flock too, as one of the other commenters pointed out they're doing in Oregon.
- BobaFloutist 6mo ago
  > But we do sue American gun makers for deaths caused by lunatics. No we don't, there's a federal law explicitly protecting gun manufacturers from liability for gun crime. https://en.wikipedia.org/wiki/Protection_of_Lawful_Commerce_in_Arms_Act# https://en.wikipedia.org/wiki/Protection_of_Lawful_Commerce_...
justinclift 6mo ago
Wonder if Flock could be DMCA'd to remove the data they're hosting then? :)
dozerly 6mo ago
I don’t think you’re informed on the topic. They do not just manufacture cameras.
deleted 6mo ago
[deleted]
deleted 6mo ago
[deleted]
robot-wrangler 6mo ago
> They were saying "don't write to us, talk to the people who own the cameras and ask them to delete the data". The response to this should just be, "Yes, very well, please divulge a complete list of your customers, their contact information, and information about camera locations so I will be able to pursue this per instructions". When that obviously doesn't work either then we can all agree the law as written is completely useless, and feel great about rewriting it in a way that's calculated for maximum damage to both the vendor and their customers, and collateral damage to the whole panopticon. Or, just spitballing here, we can just skip to the punchline here and do all that anyway
- MaxikCZ 6mo ago
  > we can all agree the law as written is completely useless But they wont agree, they find the law very nice in its current form, and have more brib.. ehm, lobying money for it to stay that way.
beambot 6mo ago
Isn't this the equivalent of asking Google to delete your image off every Android phone (not just yours)?

themafia 6mo ago

These laws get complicated quickly. There's a specific ALPR law in the CA civil code which seems to carve out several exceptions for a business like Flock: https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&title=1.81.23.&part=4.&chapter=&article= https://leginfo.legislature.ca.gov/faces/codes_displayText.x... The enforcement provisions are rather bleak as well and afford no opportunity to directly bring a case against the agency that operates the system but instead just the individual who misuses it. I think one of the more direct attacks would be going after jurisdictions that chronically have officers misusing the system. I think you're going to have to create precedent in this way to foment actual change.

everdrive 6mo ago

Nice work all the same. These systems need to be prodded and tested. Even unsuccessful results such as this tell us something about the situation we're in.

nainachirps_ 6mo ago

I am not a lawyer myself but can't one argue that this company has duty to ensure that data it is processing for client is legally obtained. If they are processing data after being told it was not obtained with consent do they not have any liability?

Glyptodon 6mo ago

I think you should write them back and ask that they provide you with a customer list and continually update you as they get new customers so that you may follow the advice they've given you.

kstrauser 6mo ago
Ooh. I like this.
- kube-system 6mo ago
  Why? The response is predictable. No company is going to give you a customer list.
  - kstrauser 6mo ago
    I wouldn't be so sure. In this specific case, they told me to ask their customers to comply with my CCPA rights. Without that information, it's impossible for me to exercise those rights. IANAL, but that sounds like a pursuable path.
    - kube-system 6mo ago
      I don't see any provision in CCPA that requires that. And outside of an explicit requirement to do so, nobody is required to help you. Edit: from https://oag.ca.gov/privacy/ccpa https://oag.ca.gov/privacy/ccpa > If a service provider has said that it does not or cannot act on your request because it is a service provider, you may follow up to ask who the business is. However, sometimes the service provider will not be able to provide that information. You may be able to determine who the business is based on the services that the service provider provides, although sometimes this may be difficult or impossible.
      - bloppe 6mo ago
        Perhaps the next step is writing to your state representative, or to Alastair Mactaggart, and complain about this hole in the legislation.

deleted 6mo ago

[deleted]

ratdragon 6mo ago

maybe eff.org would be able to help you lawyer up or otherwise to push this forward. good luck!

kstrauser 6mo ago
I've reached out, albeit very informally. I'll completely understand if this isn't something they have the time and energy to help with. If I accidentally caught them at a weak moment when they're looking for something to do, though, I'm all in.

tptacek 6mo ago

Wait, is it your data? If you drive your car in front of a Ring camera on my house (I don't have a Ring camera don't @ me), is it your claim that you own the data on that camera?

kstrauser 6mo ago
Did you put up a Ring camera on a stand in front of your house for the specific purpose of selling that I drove past at this specific timestamp? If so, yes. The CCPA[0] gives me explicit legal rights: * The right to know about the personal information a business collects about them and how it is used and shared; * The right to delete personal information collected from them (with some exceptions); * The right to opt-out of the sale or sharing of their personal information including via the GPC; This isn't someone incidentally taking pictures of license plates in an otherwise noncommercial setting. It's a company literally created to collect and sell PII. Laws are different for them than for us. [0]https://oag.ca.gov/privacy/ccpa https://oag.ca.gov/privacy/ccpa
- snowwrestler 6mo ago
  “Personal information” has a legal definition and photos of you in a public street might not satisfy it, regardless of the photographer’s intent.
  - kstrauser 6mo ago
    I think it'd be challenging to rule that a license plate number is not personally identifiable information, when the same regulations often state that an IP address is.
    - uoaei 6mo ago
      "Anyone could have been driving my car, you can't positively identify me in the driver's seat with the evidence you have submitted" is routinely used to toss out cases involving traffic violations. It's not necessarily common but it does happen. By this logic a license plate does not personally identify the person driving, only the person the car is registered to.

mindslight 6mo ago

Isn't this just the routine fascist playbook at this point? Start by declaring that the law doesn't even apply to them, on whatever flimsiest of bases. Personally I would really like to see torts for attorneys who willfully promulgate blatantly incorrect legal interpretations - they're effectively providing incorrect legal advice. A non-attorney is likely to believe such advice coming from a member of the Bar, and the net goal is to discourage the target from seeking further legal advice.

SoftTalker 6mo ago
An attorney whom you have not engaged in counsel is not providing legal advice.
- mindslight 6mo ago
  I'm well aware of how it's currently legally defined - hence "effectively". My comment is in the context of what ought, not what is.
- efreak 6mo ago
  An expert in any subject matter should not be allowed to provide misleading statements, regardless of whether they're speaking in an official/paid capacity. It doesn't matter if it's considered legal advice or not, the fact that you've got a license and know better should be enough.

snowwrestler 6mo ago

It’s not clear to me that it is actually your data. If I take a picture of you in a public place, I own the picture, not you. But maybe I am unclear on how Flock works.

bjt 6mo ago
Setting aside Flock, the "ownership" situation is not as clear as you say above. What you own is the image copyright. But the right to copy is only one of the rights at issue. Under various state laws (California in particular), you might not be entitled to do all the things with that picture that you could do of one that doesn't have my likeness. Privacy laws like the CCPA are one possible carve-out. A "right of publicity" is another. There's an old saying about property law that "property is a bundle of sticks". The bundle can be subdivided. https://www.law.cornell.edu/wex/publicity https://www.law.cornell.edu/wex/publicity
pksebben 6mo ago
Isn't flock's whole thing that they extract information from the pictures they have? Like, say I have an interview in your office and you step out for coffee. I take a picture of the applicant list on your desk. That doesn't make the list of applicants "my data".
- lotsofpulp 6mo ago
  >I take a picture of the applicant list on your desk. That doesn't make the list of applicants "my data". If the list is sitting there out in the open, then yes, it does make it your data.
  - throwway120385 6mo ago
    Well, maybe not. A reasonable person might not think that about that applicant list. I bet you could make a different argument for taking a picture versus memorizing the list too. The legal system thrives on specifics of a situation, so simply asserting that the list of applicants is or is not "yours" because you can see it seems like a gross oversimplification. The specifics of how you came to be there, what your relationship with the officeholder is, and so on probably matters a lot in that situation and I think there might be some unwritten rules or social norms that you'd be expected to follow as well.

goodluckchuck 6mo ago

The CCPA clearly violates the 1st Amendment. If you're out in public, then people are allowed to see you, to remember it, to communicate that it happened, etc.

2bitencryption 6mo ago
Not exactly. One can be charged with stalking, even though the offender only went to places in public that the victim also went to. If combined with a pattern of behavior that, in aggregate, infringes upon the rights of the target, it can become a crime.
efreak 6mo ago
> Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble, and to petition the Government for a redress of grievances. This is the entire text of the first amendment. Congress did not make the CCPA. The first amendment is irrelevant. Technically the first amendment also does not prevent Congress from saying you're not allowed to remember or see things, either, though likely there's other laws about this and/or an assumption that Congress will not make laws against thought crime and reality.

necovek 6mo ago

This answer is relevant: https://oag.ca.gov/privacy/ccpa#collapse6d https://oag.ca.gov/privacy/ccpa#collapse6d In short, Flock is a "service provider" and not the entity doing the recording. Perhaps you can make a case that they are a "data broker" instead (https://oag.ca.gov/privacy/ccpa#collapse1i https://oag.ca.gov/privacy/ccpa#collapse1i), but that is a separate law, and what you are really looking at is a combination of license plate, time and location being collected as data being collected and sold without your consent. Obviously, I am not a lawyer (and not even US-based), but I like when privacy is respected :)

zbrozek 6mo ago

I tried the same, got a similar response, and complained to the AG. Nothing.

wakamoleguy 6mo ago

The data ownership is really interesting, as many threads here are going into. I wonder if it's possible to sidestep that entirely, though! Under the CCPA, "personal information" is defined as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked — directly or indirectly — with a particular consumer or household. That says nothing about ownership. To the extent that Flock is only storing the data on behalf of their customers, I'd understand they wouldn't be required to delete it. But to the extent that they are indexing it, deriving from it, aggregating it across customers, and sharing it via their platform, it seems they should be required to remove that data from those services. But then again, I am not a lawyer!

tgsovlerkhgsel 6mo ago

Under GDPR, I believe that would be accurate. I think CCPA was to some extent inspired by GDPR so I wouldn't be surprised if they copied this point too. Which, hilariously, means that under GDPR, you only need to contact the web site, and they have to go talk to their 1207 partners that value your privacy to fulfill your request (I'm sure that in practice they'll say "sorry it's all 'anonymous' so we can't" or "we can't be sure that it's you even though you provided the identifier from your cookies"). I'm really disappointed that NOYB hasn't started going after web sites like that - that's quickly put a damper on the whole web surveillance economy.

charcircuit 6mo ago

>It's my data, not their customers'. Just because data is about you, that doesn't mean it is your data.

john_strinlai 6mo ago
you may be minunderstanding the california consumer privacy act (ccpa). in the ccpa, personal data is defined as: "Personal information is information that identifies, relates to, or could reasonably be linked with you or your household." and, you do have the rights set forth in the ccpa (know, delete, correct, limit exposure, etc.) regarding that data.

lmkg 6mo ago

> which seems to directly oppose the CCPA. I have some background in data privacy compliance. It sounds like they are claiming to be a Service Provider under CCPA, which is similar to a Processor under GDPR. Long story short, a Controller is the one legally responsible for ensuring the rights of the data subject, and a service provider/processor is a "dumb pipe" for a Controller that does what they're told. So IF they are actually a Service Provider, they're correct that the legal responsibility for CCPA belongs to their customers and not them. That's a big IF, though. Being a Processor/Service Providor means trade-offs. The data you collect isn't yours, you're not allowed to benefit from it. If Flock aggregates data from one customer and sells that aggregate to a different customer, they're no longer just a service provider. They're using data for their own purposes, and cannot claim to be "just" a service provider.

jsw97 6mo ago

You might reach out to the California AG. I suspect they are itching for this kind of thing right now.

kstrauser 6mo ago
Because life is weird, my kid played little league baseball against his. I might have to do that.
- orthecreedence 6mo ago
  So maybe your kid throws some softball pitches to his kid, and in exchange he opens a quick and easy lawsuit dismantling the surveillance state's ability to operate within CA. Quid pro quo...

deleted 6mo ago

[deleted]

AlBugdy 6mo ago

Read a few of your posts. Just wanted to comment on how I like your to-the-point succinct style and how you care about privacy. :) As a suggestion, I saw you have RSS: https://honeypot.net/feed.xml https://honeypot.net/feed.xml I didn't see it mentioned in the main page or About or Archive. Maybe add it to a more visible place?

kstrauser 6mo ago
Aww, thanks! I appreciate that. And that's a good point. I'll look at that when I get home.

rkagerer 6mo ago

It would be revealing to see a judge scrutinize the degree of control Flock maintains over the system and deliberate on whether the company truly is as hands-off as it claims when it comes to privacy obligations. Personally I feel if you're going to build so turnkey a system to facilitate collection of personal data by your customers at the scale Flock seeks, then at a minimum you should build an equally turnkey method to handle requests like the one you made. It would be a service both to their customers and to consumers at large who wish to exercise their rights under legislation to opt out. The fundamental reason we ended up in a world where companies just pay lip service to privacy and don't take it seriously is because consumers / voters put up with it. I'm heartened when I see individuals keyed into the issue. Is there some way to contribute funds toward your legal fees?

woodydesign 6mo ago
[dead]
mixdup 6mo ago
it is distinctly against Flock's interests to offer a turnkey system to help people opt out of data collection from among Flock's many customers. It might be a service to the general public, but it certainly would not be a service that Flock's actual customers would generally be interested in, at all

MrDrMcCoy 6mo ago

You know... you might have some success getting LeaglEagle involved, especially since they'd make money on the attention it would bring. Benn Jordan would probably love to be an expert witness.

pdpi 6mo ago

In GDPR terms, the point they're making is that people who own Flock hardware are the Data Controllers, and Flock act only as Data Processors. I'm not sure how (whether?) those roles map to the CCPA, and whether any court of law would agree with them is up for discussion, but at least the concept is not completely absurd. Of course, the word "owner" is almost rage baiting on their part.

FireBeyond 6mo ago
Except under Flock's own contracts and their own website, Flock are the people who own Flock hardware. And this correlates with my understanding from when I was an employee.

cebert 6mo ago

Police departments, courts, and similar entities are not subject to CCPA in the same way companies are.

gowld 6mo ago

Lawsuit challenging Flock's illegal data brokerage: https://www.courthousenews.com/california-drivers-accuse-flock-safety-of-sharing-data-with-federal-and-out-of-state-agencies/ https://www.courthousenews.com/california-drivers-accuse-flo...

laylower 6mo ago

Send it to EFF - they are big in California..