Re:My Data Request: Request your data from over 100 companies
by dangold on Sunday June 17, 2018 @11:08AM
(#17332667)
It concerns me that the site providing information about privacy policies, data subject rights, and privacy laws has a privacy policy that doesn’t even comply with the law. The policy states that they collect “non-identifiable information... which is collected passively using various technologies.” But that’s an incorrect statement of law. Information collected passively generally includes IP addresses, which falls within the definition of personally identifiable information under the GDPR and certain US privacy laws. Also missing a lot of other stuff...
Re:My Data Request: Request your data from over 100 companies
by usr1106 on Sunday June 17, 2018 @12:00PM
(#17332911)
> Information collected passively generally includes IP addresses, which falls within the definition of personally identifiable information under the GDPR and certain US privacy laws.
Your argument is at least formally wrong, the GDPR does not contain any such concept as personally identifiable information. It covers personal data.
An IP address can be personal data under some circumstances.
IANAL, but I would be more than surprised if the interpretation of personally identifiable information and personal data ends up to be identical in legal practice. I'd assume that even lawyers are not sure yet, because there isn't any practice yet.
Re:My Data Request: Request your data from over 100 companies
by dangold on Sunday June 17, 2018 @12:42PM
(#17333094)
I used a broad term to encompass laws of various jurisdictions, but my statement is correct. Personal data is any information relating to an identified or identifiable natural person. Thus, personal data by its definition includes PII. But not all personal data is PII. Personal data also includes other data such as pseudonymized data (such as hashed IDs). In any event, the company needs to revisit its privacy policy.
Re:My Data Request: Request your data from over 100 companies
by toxicFork on Sunday June 17, 2018 @10:25AM
(#17332487)
I was initially expecting to enter my email for it to make requests, but it instead gives info on how I can request for information from sites individually. A bit more effort but makes me feel a bit safer as a result.
I see that there's a way to suggest it to "request for me" as well, so that covers all bases!
Re:My Data Request: Request your data from over 100 companies
by a_imho on Sunday June 17, 2018 @10:42AM
(#17332547)
While it is great, there are many instances where you can't make a data request without making an account first including facebook and google services (Alphabet is not on the list btw) which quickly brings up the question, especially if you are European, how to report GDPR violations[1]?
Re:My Data Request: Request your data from over 100 companies
by Gasp0de on Sunday June 17, 2018 @10:48AM
(#17332570)
I have actually written to facebook (without having an account) and requested my personal data, worked fine. I believe the adress I used was [email protected]. They replied that they do not have any data on me. They requested a copy of my ID though, if I remember correctly.
Re:My Data Request: Request your data from over 100 companies
by hedora on Sunday June 17, 2018 @01:12PM
(#17333225)
They certainly did lie.
When I created a new (my only) facebook account a few years back, it was clear they already knew that about 90% of my friends knew me.
They probably interpreted “what information do you have” as “give me a copy of my account”. If they still do this, someone in a GPDR country (but without a FB account) should go through this exercise, then report the violation.
Re:My Data Request: Request your data from over 100 companies
by a_imho on Sunday June 17, 2018 @01:46PM
(#17333380)
They requested a copy of my ID though
I saw this practice in the wild, however I don't quite agree with supplying of any more information. Emails and phone numbers are most often used for identification on the web. What can they even do with an ID? Surely most sites don't store ID numbers.
Re:My Data Request: Request your data from over 100 companies
by toxicFork on Sunday June 17, 2018 @04:43PM
(#17334233)
They still need to defend against malicious requests; for example how do you know that it's not someone's potential enemy requesting for that information?
Re:My Data Request: Request your data from over 100 companies
by Rjevski on Monday June 18, 2018 @02:53AM
(#17336398)
But unless they had your ID before, how can they tell it’s the ID of the account owner and not a homonym?
Also how would they defend against fake IDs? If the purpose is to prevent malicious access then they better expect that attackers will try and use fakes.
Re:My Data Request: Request your data from over 100 companies
by ocdtrekkie on Sunday June 17, 2018 @02:53PM
(#17333690)
I love the idea here, but I submitted some feedback before: Specifically, I think they should provide a clear notation of which have automated export tools and which do not, and a news feed for when the methods of data access become available. The site would be much more useful if I could quickly use it to locate export tools.
Re:My Data Request: Request your data from over 100 companies
by davisr on Sunday June 17, 2018 @12:03PM
(#17332923)
I really like the idea, but a part of your program should check the links for contact forms to ensure they remain up-to-date. The one for IKEA didn't work for me.
Re:My Data Request: Request your data from over 100 companies
by toxicFork on Sunday June 17, 2018 @04:52PM
(#17334272)
See:
[1] "So Your Startup Received the Nightmare GDPR Letter " which contains
[2] "Is there amy regulation about how the data has to be formatted? Say I send a json string like "this is LITERALLY the data we use", but the avergae Joe is left irritated and annoyed, am I in trouble?"
---
From the ICO: (the UK regulator)
How should we provide the data to individuals?
If an individual makes a request electronically, you should provide the information in a commonly used electronic format, unless the individual requests otherwise.
The GDPR includes a best practice recommendation that, where possible, organisations should be able to provide remote access to a secure self-service system which would provide the individual with direct access to his or her information (Recital 63). This will not be appropriate for all organisations, but there are some sectors where this may work well.
However, providing remote access should not adversely affect the rights and freedoms of others – including trade secrets or intellectual property.
Your argument is at least formally wrong, the GDPR does not contain any such concept as personally identifiable information. It covers personal data.
An IP address can be personal data under some circumstances.
IANAL, but I would be more than surprised if the interpretation of personally identifiable information and personal data ends up to be identical in legal practice. I'd assume that even lawyers are not sure yet, because there isn't any practice yet.
I see that there's a way to suggest it to "request for me" as well, so that covers all bases!
[1]https://news.ycombinator.com/item?id=17318773
When I created a new (my only) facebook account a few years back, it was clear they already knew that about 90% of my friends knew me.
They probably interpreted “what information do you have” as “give me a copy of my account”. If they still do this, someone in a GPDR country (but without a FB account) should go through this exercise, then report the violation.
I saw this practice in the wild, however I don't quite agree with supplying of any more information. Emails and phone numbers are most often used for identification on the web. What can they even do with an ID? Surely most sites don't store ID numbers.
Also how would they defend against fake IDs? If the purpose is to prevent malicious access then they better expect that attackers will try and use fakes.
At this point I see this practice mostly as deterrance with a little cya mixed in, possibly with a pinch of data fishing in some rare cases.
However in the future I'm all for providing IDs as a requirement to use webservices if that makes people more conscious about what data they share.
How could they transmit that info? They at least have stored your mail address.
If not why would you send them on a wild goose chase?
[1] "So Your Startup Received the Nightmare GDPR Letter " which contains
[2] "Is there amy regulation about how the data has to be formatted? Say I send a json string like "this is LITERALLY the data we use", but the avergae Joe is left irritated and annoyed, am I in trouble?"
---
From the ICO: (the UK regulator)
How should we provide the data to individuals?
If an individual makes a request electronically, you should provide the information in a commonly used electronic format, unless the individual requests otherwise.
The GDPR includes a best practice recommendation that, where possible, organisations should be able to provide remote access to a secure self-service system which would provide the individual with direct access to his or her information (Recital 63). This will not be appropriate for all organisations, but there are some sectors where this may work well.
However, providing remote access should not adversely affect the rights and freedoms of others – including trade secrets or intellectual property.
Ref: https://ico.org.uk/for-organisations/guide-to-the-general-da...
---
[1] https://news.ycombinator.com/item?id=17177817
[2] https://news.ycombinator.com/item?id=17178125