Hacker News Reader

Comment by rmc | Hacker News Reader

And you wonder why the European Courts have started to strongly enforce the right to data protection.

Us in the tech world need to be honest, we're bad at privacy.

See, I don't get this. Europe is acting as if it had a duty to protect its people from the bad companies that steal your privacy while you sleep, whereas in reality nothing happens if you don't explicitly give consent first. Don't want Facebook to use your personal data to sell you ads? Don't put it on Facebook. Don't want YayView to access your location at all times? Then don't give it access to it, it's asking you right there, even if it's being shady about it.

It's a little bit like if people had trouble using forks without stabbing themselves, and the proposed solution was to ban all forks in the country. Well perhaps more work should go towards teaching people how to use a fork, since they can be useful for meals, rather than banning them?

Don't get me wrong, it's a shame that companies like YayView exploit dark patterns to trick people into doing things they don't fully understand, but let's not ban all the things because of it.

That's totally wrong headed. They have deliberately deceived people into accepting prompts and neglected to give them all the facts. That's deception through omission, clear and simple.

I'm not saying they are not to blame, just that more work should be done in teaching the end user that they cannot trust everything they are told, much like in real life.

Then I don't get your original point, and I don't get how intentionally deceiving through ommission is not "real life".

Your original point was that you gave explicit consent for them to use your data. But you didn't, you accepted they would only use it for the stated reasons given to you. You didn't consent for them to use it for anything else!

In England the need for data protection laws was partly driven by employers keeping blacklists of "agitators". This was mostly construction industry keeping a list of union members who were engaged in legal union activity, often around safety. (UK construction at the time was pretty risky, one of the most dangerous industries in the country.)

Those employees had no choice whether their names were added to this black list. There was no appeal. No due process.

And when a company abuses it's data gathering and mining powers it's unhelpful to blame the user.

> This was mostly construction industry keeping a list of union members who were engaged in legal union activity, often around safety. (UK construction at the time was pretty risky, one of the most dangerous industries in the country.)

There was also (AFAIR) blacklists of suspects IRA terrorists, also in the construction industry. (Many Irish emmigrants to the UK were poor and worked in manual labour jobs like construction.)

Another example of data protection issues and "terrorists"

>Don't want Facebook to use your personal data to sell you ads? Don't put it on Facebook.

The problem is that simply using Facebook gives them tons of personal information. They know who your friends are, who you talk to, what articles interest you from what you click, what websites you visit from the embedded Like buttons, and on and on. And this is without adding a single bit of explicit information about yourself to your profile. Facebook probably already knows what school you went to anyway, based on your friends.

The other problem is that using Facebook and the US Government/NSA/FBI has access to it too, without requiring a warrent. I don't think anyone agreed to that.

I tend to fall on this same side of "people should be responsible for their actions" and, yes, it would be great if easy-to-understand education was readily available re: protecting one's privacy in the digital age. But I shouldn't have to become a part-time lawyer just to use Facebook (for example) to post baby updates. Who has time to keep up with all the little tricks these companies pull? I think the middle ground is 1) apps/sites need to be way more explicit and direct with the intentions they have for your information and 2) the every day user of apps/sites needs to start acknowledging his role in protecting his own assets.

This has always been my take on the privacy issue as well as the related advertising issue. People freely connect to and send data to companies servers and then get mad that the company has and uses the data? What? People send requests to servers saying "send me whatever it is you have sitting in this location" then get mad when the company dared have a link to an advertisement sitting on their own damn server? What? You're the one that asked for it! You didn't even have to do anything with it! You could be running an ad blocker, left the ad link as a link, and consumed the content you want which the company still sent you simply because you asked for it! How cool is that? Free fucking data from someone's computer when they don't even know or have business with you.

But no! Apparently if you blindly connect to other people's servers, send them all of your personal details, ask them to send you effectively whatever they feel like, and then you executive that code indiscriminately, it's on them! Fucking ridiculous.

I want to live in a world where I don't need to worry about my information being disclosed by a third party. The world you propose is one where there is a chilling effect on sharing anything with anyone.

> See, I don't get this. Europe is acting as if it had a duty to protect its people from the bad companies that steal your privacy while you sleep, whereas in reality nothing happens if you don't explicitly give consent first.

Platform is on within FB per default AFAIK. Users are exporting their friendslist without permission of their friends and bring it to apps like these. Defaults like these _are_ bad - and don't blame Europe for it.

Consent shouldn't necessarily be regarded as transitive. The problem in this case isn't Facebook sending you ads, it is Facebook and other data sources allowing others to correlate all data about you.

In the Schrems case which overturned the Safe Habour agreement, one of the problems was that US law required/allowed Facebook to give up EU personal data, and there being no real way for EU citizens to challenge it. (Remember the US 4th Amendment doesn't apply to EU citizens in the EU).

> Consent shouldn't necessarily be regarded as transitive

I think you're on to something with this statement.

I'd feel much better if selling/transferring customer data was disallowed with explicit consent from the user for each company the data will be transferred to.

[] I consent to Facebook storing and using my personal data

[] I consent to Facebook transferring/selling my personal data to people and companies I add to my "friends list"

[ ] I consent to Facebook transferring/selling my personal data to Ad Tracker Network Inc

[ ] I consent to Facebook transferring/selling my personal data to User Data Broker Limited

With personal data being broadly defined to include anything that could correlate activity with an individual user (tracking ID, session cookie ID, name, location, etc).

I think the average person's understanding of how much they're being tracked would drastically improve if they seen this list of (opt-in) checkboxes when signing up to services.

This is the "if you didn't want to get raped and murdered, you shouldn't have left your house" defense.

But product recalls akin to your fork analogy happen all the time. Products that are more hazardous than they need to be, or that are more hazardous than a reasonable user might expect, are vulnerable to lawsuits and regulations.

The EU are demanding just that. That personal data is only used if it's freely, and unambiguously, given, Which is what EU law requires. Despite the scare stories, it is actually possible to legally work with personal data.

Let's be honest, shadily sneaking people into giving personal data (like YayView) is not "freely given consent". Facebook doesn't tell you that the FBI/NSA can spy on your data, so it's not unambiguously given consent.

Your comment -> "whereas in reality nothing happens if you don't explicitly give consent first"

From the article -> "View scans your Facebook friends and creates fake profiles for them."

Having a profile created, that others can edit, and you've never interacted with the app or company? That doesn't sound the least bit like consent. Closer to social rape.

Can I create an investor app, with fake profiles for all the leading investors, including some of whom invested in this company? I'm pretty sure lawsuits would fly. Although most consumers lack the resources of the investor class, they deserve protection to.

I generally concur, but in this case, this guy agreed to share his information with facebook, not YayView. What if he's in a relationship and a friend of his girlfriend sees his profile on YayView, that could cause a serious issue in that relationship for no good reason.

Well, that is one of the main jobs of a government in the first place. Companies will always try to exploit you as much as they're allowed to, and governments have the responsibility to make sure they aren't allowed to do that too much. European governments are doing their jobs.

I've never created a facebook profile but facebook has a "shadow-profile" on me based on people tagging me in photos and inviting me and what not. So I never put things on facebook but there's still tons of info on me there.

And maybe forks would be banned if they were constructed in a way to make it extremely difficult to use, even for experts, without stabbing yourself? I'm thinking of a fork with some sort of magnetic pull, either towards the plate or towards your own forehead, so you can chose whether it tries to stick to the plate (making food not come to your mouth) or switch to the forehead pull and try to steer it into your mouth without stabbing yourself. That IMHO would be a more adequate comparison to what these dark-pattern infused sites/apps are doing.

Reply on news.ycombinator.com