7 ms·

This has some interesting legal implications. The UK has a Data Protection Act that requires organisations to register with the ICO (Information Commissioners O

by casca 13y ago

This has some interesting legal implications. The UK has a Data Protection Act that requires organisations to register with the ICO (Information Commissioners Office) and comply with a number of requirements. Renew London is not registered with the ICO, nor is any company with a similar name at their postcode [1]. So either they believe that they're exempt, or that it's under a different name. The ICO has a self-assessment tool [2] to work out whether an organisation is required to register. I'd suggest that the big question is: "Are you processing personal information?". The definition is: ‘Processing’ means doing any of the following with the information: obtaining it recording it storing it updating it sharing it ‘Personal information’ means any detail about a living individual that can be used on its own, or with other data, to identify them. So based on that, they're processing personal information and are legally required to register and comply. The ICO is not seen as an overly strong regulator, but they might be convinced to investigate after the inevitable headlines in the papers. [1] http://www.ico.org.uk/esdwebpages/search http://www.ico.org.uk/esdwebpages/search. Postcode is E1 6DY from their website in the press release [2] http://www.ico.org.uk/for_organisations/data_protection/registration/self-assessment http://www.ico.org.uk/for_organisations/data_protection/regi...

sjtgraham 13y ago
It's not clear that a MAC address is personal information. The ICO's own guidance [1] gives the example of telephone number being personal information if the number is in the telephone directory, making a reverse lookup to identify the owner possible. Is such a directory available for MAC addresses possible? Given a hypothetical MAC address 0c:fd:c3:de:00:d5, could you identify a person with that alone? [1] http://www.ico.org.uk/upload/documents/library/data_protection/detailed_specialist_guides/personal_data_flowchart_v1_with_preface001.pdf http://www.ico.org.uk/upload/documents/library/data_protecti...
- knowaveragejoe 13y ago
  Not in a public directory similar to a telephone book, no. At most you could learn the make/model of their nic.
- DanBC 13y ago
  The makers of the bins have a video showing a named person walking around, and the bin collecting information on that person's likes and dislikes. The video makes a comparison between their bins and cookies, describing this as "cookies in real life". It seems difficult to compare their tech to cookies (which have EU wide regulation) and to show information collected about an individual and to then claim exemption from UK data protection laws. (https://news.ycombinator.com/item?id=6194160 https://news.ycombinator.com/item?id=6194160)
- chrischen 13y ago
  It is not possible unless the user voluntarily associates his personal information with that mac address. It is possible to harvest this information covertly. Up until iOS 7, it's possible for any iphone app to get your mac address. So if you also provide your personal information, an app could covertly associate them.
  - sehrope 13y ago
    It doesn't have to be voluntary. If I have a list of all the MAC addresses/timestamps and can cross reference that against a different known list of people times (ex: credit card transactions, rewards card, even face recognition) then you can associate them. With enough data it can be very exact.
    - chrischen 13y ago
      If you had face recognition and rewards cards, you wouldn't even need a MAC address to track someone.
      - krichman 13y ago
        The rewards card would be in one location, you could then know that person's identity at all stores via cell phone connections or cameras.
        chrischen 13y ago
        It can be feasible if the enough credit card or reward card usage data is gathered for you, across all the stores you visit. Hard, but possible. Still for a lot of users the entropy will be too high.
        cbhl 13y ago
        https://news.ycombinator.com/item?id=2942967 https://news.ycombinator.com/item?id=2942967 87% of the U.S. Population are uniquely identified by {DOB, gender, zip} (latanyasweeney.org) (278 points, 712 days ago, 101 ocmments)
- reeses 13y ago
  How many samples? All you need to do is wait until they tell you who they are by associating that MAC addr with a hotspot. Share "anonymous" data with vendors who provide wifi access, and suddenly Sephora knows where you live and where you work and can remind you that you're almost out of La Prairie Crème Cellulaire Platine Rare when you bin your cup of coffee outside the office.

by casca 13y ago

sjtgraham 13y ago

It's not clear that a MAC address is personal information. The ICO's own guidance [1] gives the example of telephone number being personal information if the number is in the telephone directory, making a reverse lookup to identify the owner possible. Is such a directory available for MAC addresses possible? Given a hypothetical MAC address 0c:fd:c3:de:00:d5, could you identify a person with that alone? [1] http://www.ico.org.uk/upload/documents/library/data_protection/detailed_specialist_guides/personal_data_flowchart_v1_with_preface001.pdf http://www.ico.org.uk/upload/documents/library/data_protecti...

knowaveragejoe 13y ago
Not in a public directory similar to a telephone book, no. At most you could learn the make/model of their nic.
DanBC 13y ago
The makers of the bins have a video showing a named person walking around, and the bin collecting information on that person's likes and dislikes. The video makes a comparison between their bins and cookies, describing this as "cookies in real life". It seems difficult to compare their tech to cookies (which have EU wide regulation) and to show information collected about an individual and to then claim exemption from UK data protection laws. (https://news.ycombinator.com/item?id=6194160 https://news.ycombinator.com/item?id=6194160)
chrischen 13y ago
It is not possible unless the user voluntarily associates his personal information with that mac address. It is possible to harvest this information covertly. Up until iOS 7, it's possible for any iphone app to get your mac address. So if you also provide your personal information, an app could covertly associate them.
- sehrope 13y ago
  It doesn't have to be voluntary. If I have a list of all the MAC addresses/timestamps and can cross reference that against a different known list of people times (ex: credit card transactions, rewards card, even face recognition) then you can associate them. With enough data it can be very exact.
  - chrischen 13y ago
    If you had face recognition and rewards cards, you wouldn't even need a MAC address to track someone.
    - krichman 13y ago
      The rewards card would be in one location, you could then know that person's identity at all stores via cell phone connections or cameras.
      - chrischen 13y ago
        It can be feasible if the enough credit card or reward card usage data is gathered for you, across all the stores you visit. Hard, but possible. Still for a lot of users the entropy will be too high.
        cbhl 13y ago
        https://news.ycombinator.com/item?id=2942967 https://news.ycombinator.com/item?id=2942967 87% of the U.S. Population are uniquely identified by {DOB, gender, zip} (latanyasweeney.org) (278 points, 712 days ago, 101 ocmments)
reeses 13y ago
How many samples? All you need to do is wait until they tell you who they are by associating that MAC addr with a hotspot. Share "anonymous" data with vendors who provide wifi access, and suddenly Sephora knows where you live and where you work and can remind you that you're almost out of La Prairie Crème Cellulaire Platine Rare when you bin your cup of coffee outside the office.