Hacker News Reader

Comment by TedDoesntTalk | Hacker News Reader

"So, what's the worst that could happen with your happy little Subaru Outback? Well, it would really stink to go visit your Mom, go for a ride in her new Subaru with all it's fancy, connected features, have a private conversation with Mom about how you helped your friend drive from state that outlawed abortion to one that does, and then end up have that audio recorded, then shared with law enforcement because Subaru says in their privacy policy they can share or sell that personal information, including to "detect and prevent criminal activity." That is perhaps a far fetched scenario and we really hope Subaru would never do that...but still, it seems like it is something that could happen, based on their privacy policy.

View on HN

As someone who works in privacy I find it really funny and sad that all of the legal requirements to create and display privacy policies result only in this: conjecture about what a company might do based on its vague privacy policy language.

It's crazy, almost like people don't trust corporations to be reasonable when they have such vague abuses of the law to escape into. Maybe we shouldn't have to trust corporations not to spy on us in spaces that carry reasonable expectations of privacy. Maybe we should regulate their greedy data-grubbing into the ground so we don't even have to speculate, and so the miserable people who work at these corporations are stymied from even attempting it. What a splendid utopian ideal.

I work in privacy, too - mine.

I hope you’re just trolling, I’ll bite.

Privacy is not about what someone _might_ do with your data, it’s what they _can_ do with your data.

It’s also that they have your data, which means it can be exposed to staff or the world as the result of a breach.

Disagree on first statement. It's what they do with it that matters, not what the contract says.

On the second point, sure, but so we have knowledge of what, how, and for how long, the carmakers are storing?

Would you sign a paper saying I can come into your house unannounced if I suspect you stole something? If you do not steal you have nothing to worry about

> It's what they do with it that matters, not what the contract says.

What they do with the data changes based on leadership (should we sell to 3rd party data brokers to increase our revenue or not?)

It’s also out of their hands once a subpoena for that data comes from law enforcement.

With respect, I believe that both things are important.

It's important to know what they do with that data today.

It's also important to know what they could do with that data tomorrow.

I respectfully disagree with your initial point regarding "can" versus "what they do."

Even if a company provides assurances and pledges never to mishandle your data or use it for nefarious purposes, there remains a risk that your data could still end up in the wrong hands.

We’re not the ones making these policies far too broad and open ended.

But that's the point of the privacy policy. Why would you have a privacy policy that says you can do a thing if you have no intention of ever doing it. It's plausible that the lawyers were instructed to capture as much as possible with the intention of worrying about what was actually wanted later, but that's precisely the point. Later, they could decide to do anything covered by the policy and there's not only no recourse but no way of knowing what they are doing. That's why you have to take the privacy policy at face value.

What if they are forced by governmental order to hand over their data?

The question is, why are they collecting it in the first place?

Two and a half words: post-purchase monetization

I think the GP's question is more rhetorical, or, to put it as a non-rhetorical question:

"Why is it acceptable on any level for my car to become a spyware device on par with Facebook, when I paid an enormous sum to be its owner and controller for my own benefit, and not to become a residual profit stream for ${CAR_COMPANY}?".

Recurring revenue.

What's a dossier like that with on the market when it includes location, Bluetooth IDs of all occupants and private conversations? $5/mo? $10$?

I guess they collect simply everything and don't want to filter out.

But if data wasn't worth anything, they wouldn't bother, right?

Have you asked your ISP the same question

I think a car has a different position in "internet connectivity" than a ISP...

(not to excuse ISP data collection, but implying that a car is as critical for network access as an ISP is nonsense)

The ISP has technically no business knowing what you visited after they transfer the bits to you

I have been living under a rock the last ten years so I thought the EU still had the data retention directive. Between 2006-2014 all ISPs were required to logg traffic in the EU. I am so glad you are right!

https://en.m.wikipedia.org/wiki/Data_Retention_Directive

Many potential forms of ISP data collection are unlawful in the US thanks to wiretap laws, which is why we don't generally see this level of surveillance from ISPs here.

Pretty sure this isn't true. What wiretapping laws do you have in mind? I think ISPs are exempt from most.

https://www.law.cornell.edu/uscode/text/18/2511 Note the narrowness of (2) (a) and the broadness of (1)(a)/(1)(b).

2a is the exception I was thinking of.

Indeed, but I don't think you can "we spy on our users and sell the results" under 2(a).

Bingo.

Signal for example, is also subject to US law. They can be compelled to reveal everything they have in a person. Which they happily do: they hand over a page with the date of account creation and the day it last connected. Which is all they have.

Don't collect information, and you don't have a problem.

Because there's no law preventing it? Ideally there would be regulations making this illegal unless they get the user's consent at the time of purchase as well as allowing users to opt out at any point thereafter.

Money

You can't hand over data you don't have.

Reply on news.ycombinator.com