Hacker News Reader

Comment by _jal | Hacker News Reader

My company started offering one of these, and wanted permission to disclose... something (never figured out if it was just name/email, or more) to them to onboard me.

I asked about data use, including disclosure back to my employer, and never got more than a pointer to their (predictably useless) privacy policy. They (the vendor) deliberately avoided answering anything related to disclosure.

How many different angles have we seen on, "...and if we hoover up enough data, profit!"

So, thanks, but no thanks.

View on HN

Google has been known to offer (on-site) therapy to employees, then go on to obtain records from therapy sessions to use in litigation against them: https://www.nytimes.com/2021/07/28/us/google-workplace-compl...

This is why I've never used any EAP or any other form of mental health service in any way connected to my employer.

holy shit that... is insane. Also how is this not illegal?

Exactly, why would a court permit that? Isn't it standard that evidence obtained illegally is not permissible in court?

The article is talking about subpoenas – court orders for disclosure of relevant records, which override ethical and contractual confidentiality obligations, unless the person holding the confidential documents persuades the court to quash or limit the scope of the order. https://www.apa.org/monitor/2016/07-08/ce-corner

> How many different angles have we seen on, "...and if we hoover up enough data, profit!"

Something I see happen all the time:

1. Organization hoovers up data incidentally as they build a product.

2. Privacy concerns are raised internally, but the organization genuinely has no intention of misusing the data so concerns aren't taken seriously and they're not addressed.

3. Some years pass (sometimes only one or two).

4. Newcomers to the organization now start misusing the data because, hey, it's there. If you have it, why not use it?

I witnessed 1, 2, and 3 at my previous job (not mental health data but the data I was concerned about was just as personal and vulnerable to abuse), praying 4 never happens but given the company’s been acquired, I’m not optimistic things will get better.

Glad to have moved on from that company.

Yep.

When I point this pattern out in other contexts (like talking about how instrumentation can become surveillance after collection), people get upset with me.

We have had potential employers who wanted employee data back to them and our answer has been a flat out no to them.

We have also had legal consultation on this due to the continuous pressure and can confirm it is not legally required to share your data to the employer at-least in the EU.

Question: With all the industry wide bad practices, how do we convince you that we don't share your data with your employer?

>how do we convince you that we don't share your data with your employer?

On the top of your privacy policy, put a big fucking banner that plainly indicates that you don't now and never will.

But seriously, we now live in an era where the only rational assumption is Zero Trust: that everything about you that can be gleaned, can and will be sold.

Specifically though, isn't this considered HIPPA "protected" data?

> how do we convince you that we don't share your data with your employer?

Short of signing a contract with me I can sue over, I don't think you can. The incentives here look like they're all pointing in the wrong directions.

> How many different angles have we seen on, "...and if we hoover up enough data, profit!"

Even doctor's offices do this now. I've been to a few that ask you to sign away your rights to privacy so that they can sell your medical information to their partners. It's gross.

Reply on news.ycombinator.com