4 ms·

It hardly even matters if the company is put up for sale. Assume a kitten-loving company that will rather die than let your data be abused. They take VC fundin

by RyanZAG 11y ago

It hardly even matters if the company is put up for sale. Assume a kitten-loving company that will rather die than let your data be abused. They take VC funding, hit a bad turn, take more VC funding. Now the board is controlled by VCs. You're now trusting the VCs with your data and not the company itself. Assume a second kitten-loving company that will rather die than let your data be abused, and is run by only two co-founders. You give them all your data. The two co-founders end up in a plane crash. Their company is transferred to... who knows really? Your data is now sold off in liquidation to.. who knows really?

mcv 11y ago
This is why we need data protection laws. No matter how trustworthy a company is, you can never really trust them.
- tempodox 11y ago
  The most important point here is that the company that originally collected the data isn't that relevant. If other laws don't support privacy protection, you must assume your data may end up just about anywhere & everywhere.
  - icebraining 11y ago
    We do have laws that support privacy protection around here, and I still assume it may end up just about anywhere. Data is just too easy to copy around. What these laws give me is the power to tell those companies to delete it, and to get our National Commission for Data Protection to fine them if I ever get evidence that they didn't. But I would never assume the data is actually protected.
JoshTriplett 11y ago
> Assume a second kitten-loving company that will rather die than let your data be abused, and is run by only two co-founders. You give them all your data. The two co-founders end up in a plane crash. Their company is transferred to... who knows really? Your data is now sold off in liquidation to.. who knows really? At least in theory, that's possible to avoid. If you accepted the data only under a specific set of terms, and ensured either that the original terms under which data was obtained are those that apply, or that specific privacy and usage terms were required to survive into any successor agreement, then in doing so you'd bind any future owner of the company by the same terms. You can't sell (or liquidate) something you don't have the rights to yourself.
- RyanZAG 11y ago
  Assume the only surviving beneficiary of the company is a Chinese nationalist. All of the company and servers are transferred over to him. He quickly moves all the data over to mainland China and uses it for.. who knows? Even if you had laws, I'm not sure they would help in this case. Besides, even if you have perfectly written self-binding contracts, there's nothing stopping the next owner from being a scumbag and finding clever or illegal ways around the deal. eg, he could 'find' a million dollars on the pavement in the surprising position where he happened to 'lose' a hard drive with all the data. Exaggeration obviously, but if the data is in someones possession there are a lot of things that can be done with it without overtly breaching any agreement. Eg, he could start a new company himself that 'leverages' the data to provide all previous customers with 'incredible deals and benefits'.
  - JoshTriplett 11y ago
    You're now assuming the new owners are willing to commit illegal acts, or at the very least breach a contract. (And the newly started company would be breaching the contract as well, if it was written to exclude that.) That's at least a significantly higher bar than "the highest bidder can do whatever they want with the data", which is the current state of things. But yes, even better protection would be never collecting data you don't need in the first place.
    - pgeorgi 11y ago
      > But yes, even better protection would be never collecting data you don't need in the first place. "Germans even have a word for it: Datensparsamkeit, the principle of only collecting the bare minimum of data necessary." (http://qz.com/390988/germans-are-paranoid-that-the-us-is-spying-on-their-data/ http://qz.com/390988/germans-are-paranoid-that-the-us-is-spy...) Since the concept was established in 1983 by the constitutional court, there's probably a body of knowledge around that, just in the 'wrong' language and hence less known in the anglo-saxon culture.
      - icebraining 11y ago

by RyanZAG 11y ago

mcv 11y ago

This is why we need data protection laws. No matter how trustworthy a company is, you can never really trust them.

tempodox 11y ago
The most important point here is that the company that originally collected the data isn't that relevant. If other laws don't support privacy protection, you must assume your data may end up just about anywhere & everywhere.
- icebraining 11y ago
  We do have laws that support privacy protection around here, and I still assume it may end up just about anywhere. Data is just too easy to copy around. What these laws give me is the power to tell those companies to delete it, and to get our National Commission for Data Protection to fine them if I ever get evidence that they didn't. But I would never assume the data is actually protected.

JoshTriplett 11y ago

> Assume a second kitten-loving company that will rather die than let your data be abused, and is run by only two co-founders. You give them all your data. The two co-founders end up in a plane crash. Their company is transferred to... who knows really? Your data is now sold off in liquidation to.. who knows really? At least in theory, that's possible to avoid. If you accepted the data only under a specific set of terms, and ensured either that the original terms under which data was obtained are those that apply, or that specific privacy and usage terms were required to survive into any successor agreement, then in doing so you'd bind any future owner of the company by the same terms. You can't sell (or liquidate) something you don't have the rights to yourself.

RyanZAG 11y ago
Assume the only surviving beneficiary of the company is a Chinese nationalist. All of the company and servers are transferred over to him. He quickly moves all the data over to mainland China and uses it for.. who knows? Even if you had laws, I'm not sure they would help in this case. Besides, even if you have perfectly written self-binding contracts, there's nothing stopping the next owner from being a scumbag and finding clever or illegal ways around the deal. eg, he could 'find' a million dollars on the pavement in the surprising position where he happened to 'lose' a hard drive with all the data. Exaggeration obviously, but if the data is in someones possession there are a lot of things that can be done with it without overtly breaching any agreement. Eg, he could start a new company himself that 'leverages' the data to provide all previous customers with 'incredible deals and benefits'.
- JoshTriplett 11y ago
  You're now assuming the new owners are willing to commit illegal acts, or at the very least breach a contract. (And the newly started company would be breaching the contract as well, if it was written to exclude that.) That's at least a significantly higher bar than "the highest bidder can do whatever they want with the data", which is the current state of things. But yes, even better protection would be never collecting data you don't need in the first place.
  - pgeorgi 11y ago
    > But yes, even better protection would be never collecting data you don't need in the first place. "Germans even have a word for it: Datensparsamkeit, the principle of only collecting the bare minimum of data necessary." (http://qz.com/390988/germans-are-paranoid-that-the-us-is-spying-on-their-data/ http://qz.com/390988/germans-are-paranoid-that-the-us-is-spy...) Since the concept was established in 1983 by the constitutional court, there's probably a body of knowledge around that, just in the 'wrong' language and hence less known in the anglo-saxon culture.
    - icebraining 11y ago