Hacker News Reader

I thought user data was one of the most valuable assets of a business.

When I worked at Company X, one of our competitors was failing and offered us to buy them out. The most expensive part of the buyout was calculated basically by #users*<some price>. And really that's all we wanted, was their userbase, since we already had the product they wanted. We could absorb their users and immediately grow our business.

I think there's a difference between we'll sell you all this data we have on our users, some of which is related to conducting business with them, and here are our paying customers who you can acquire and continue to provide goods and services to.

Can you better explain the difference please?

Amazon buying Newegg customer data from Newegg,

vs

Amazon buying Newegg and rerouting the Newegg website backend through its own network.

I understand the two sides, but what's the difference to the consumer who has a Newegg account but does not want Amazon to have their personal data?

In the end, Amazon would end up with the consumers data, so to the consumer there is no difference. Are you saying that there is a difference? That's what I wanted clarification on, what that difference was.

To continue with the analogy above the difference arises if Newegg says "We don't share your data with third parties" and does #1. That would breach customer expectations because they are outright lying. The #2 case seems much less clear cut because Newegg wouldn't exist as a standalone entity anymore, and most people's reasonable expectation is Amazon would then have access to Newegg's data. It depends on each person's answer to the question: Is Amazon a third party in the second example?

You are assuming that a Privacy Policy is legally binding, it's generally accepted as not being.

In the example, Amazon can do whatever it wants with the data.

Data submitted to almost anyone online (maybe with the exception of large companies or companies specifically designed to not track data) should be considered public unfortunately.

I have seen some states recently put in place laws to protect this data from being made public or sold carelessly, but for the most part it is unregulated as far as I can tell.

While I agree that it's probably not legally binding (I beleive even the standard "Click and connect" contracts have been thrown out of courts in the past), do you have any references to share?

I haven't looked for any precedent cases.

TRUSTe was suppose to do something similar, but it's seal doesn't mean much anymore (not that it ever really did). http://en.wikipedia.org/wiki/TRUSTe

Medical records, children's data, and sensitive financial data is protected under US law. US-EU Safe Harbor has some consumer data protection rules.

http://en.wikipedia.org/wiki/Personally_identifiable_informa...

http://en.wikipedia.org/wiki/Privacy_policy#Applicable_law

In a discussion about policy, you should never use terms like "generally accepted" and "should be considered" to refer to the reality that is already under question. It's extremely confusing.

The fact that your data isn't protected can't be used as an argument that it shouldn't be. Just because something is legal doesn't make it right, either.

> You are assuming that a Privacy Policy is legally binding, it's generally accepted as not being.

I'm not claiming privacy policies are legally binding, just that they can be an indicator of trustworthiness and integrity. That's what I really meant when I said "[Option #1] would breach customer expectations because they are outright lying."

The way I read mc32's "I think there's a difference" is moral difference, because I share the same sentiment as him or her ("I hope the FTC wins its case...") which would turn that moral difference into a legally binding one.

I think it's more of the following:

NewEgg selling customer data to Amazon, AND EBay, AND LinkedIn, AND Joe Schmoe's Tech Emporium. Each have their own data sharing policies.

vs.

NewEgg selling the entire business and assets to Amazon (and only Amazon). In this case, everything; hardware, product stock, servers, and data too.

The second case is different, and less directly harmful, but still bad for the "free market".

You end up in a situation where you have a few huge companies that have shitty expensive products and huge amounts of money. If anyone ever does better, they use some of the money to acquire the customers. No one ends up with something better or more cost effective; the 800lb gorilla just pays a tax to remain the only choice, and that cost is easily passed right back to the customers.

>but still bad for the "free market".

Yet another case whereby a natural consequence of a free market is "bad" for the free market.

In reality it's only bad for the consumer, and certainly not the businesses.

And that second case really annoys me, but I'd still rather not take the alternative to a free market, which is that idiots and douchebags decide what's good for me, and leave me with even less choice.

"Acquiring the customers" seems to be a business strategy with a high failure rate, else we'd be yahooing instead of googling or facebooking. It's hard to predict what competitors are going to blow up, and as soon as they get traction the price goes high - Facebook may have bought WhatsApp, but apparently SnapChat is holding out for more.

I actually think the "free market" works pretty well at this, even if it's not perfect. Nothing is.

That's a good point. I suppose this thing is a natural driver of the recent focus on user-traction over profitability.

"data" is a valuable asset, however, in many jurisdictions 'user' data is considered property of the user, not the agency that collected it.

Think of it like software, your data is not the property of Facebook, but rather, they have a license to use it.

Well sure, but when the license is perpetual and royalty-free, what's the difference?

> For content that is covered by intellectual property rights, like photos and videos (IP content), you [...] grant us a non-exclusive, transferable, sub-licensable, royalty-free, worldwide license to use any IP content that you post on or in connection with Facebook (IP License).

https://www.facebook.com/legal/terms

The main difference is that "non-exclusive" part: you retain the right to license it out to other entities, or to use it for your own purposes.

Not sure if you meant "you" or "they" there, but the "you" case is more interesting.

No, "you" generally do not effectively retain the right to license your data collected by a third party out to other entities, because (as far as I know) there are no laws which require that third party to provide you with the data they've collected.

Examples here would be 23andMe vs. Fitbit.

23andMe is in the business of collecting data from you (in essence), then providing it to you and using it for their own purposes.

Fitbit is in the business of collecting data from you, then processing it and performing a number of black box calculations, then providing you summarized results. (Caveat: yes, I am aware that most activity trackers have API / export functionality. However, in all the instances I looked at that's limited and generally crap compared to the raw take the main party has access to)

>Well sure, but when the license is perpetual and royalty-free, what's the difference?

There would be a difference if the license is non-transferable. Then Facebook wouldn't be able to give or sell that data to 3rd parties as part of a bankruptcy sale.

Edit: in the case of RadioShack's user data, I doubt that they got customers' agreement for a transferable license to the data.

> expensive part of the buyout was calculated basically by #users<some price>
I bet this had nothing to do with user data, but with user acquisition cost.

if company spends $10 on marketing and $15 on R&D per new user every quarter, then paying #users$10 when buying a dying competitor is a bargain.

Suppose one company buys another company outright. Should that company keep its customer list (effectively transferring it to the new owner), or throw it away, ditch all its customers, and start from square 1? Would you be happy as a customer if you were told that because your cellphone company had been bought, your contract is cancelled and they can't offer you another one, you have to go to the store and start over? Would you be happy as an employee of this company being bought?

Now, suppose the purchasing company isn't buying the entire business, but (say) half of it? What's changed? (This is roughly what is being proposed here)

Nothing has changed. In both cases, you should be able to continue using that customer data to provide a service they've asked you to provide (not what is being proposed here). You should not, in either case, be allowed to sell that data to marketers who will turn around and use it to either build profiles on people, or to spam/harass them with unwanted advertising(what IS being proposed here).

There is no gray area here.

Even if the FTC wins, this case will not establish a general precedent that consumer data is not transferable.

The issue here is whether RadioShack may sell the consumer data when its privacy policy said it would never do so.

Whatever the result of this case, it won't apply where the privacy policy permits transfer in bankruptcy (as most now do).

> Consumer data should be one of those things which most companies consider something toxic but necessary so they handle it with care and use the least amount possible ….

This is a beautiful slogan. I think that it is far from something by which that businesses will ever abide, or laws will ever try to force them to abide, but I would love to live in a world in which it was true.

I do agree but there are some huge flaws with this that need to be worked out first.

How would you sell one company to another? There isn't much difference between a company being sold because it's being acquired and a company's assets being sold because it's bankrupt and needs to pay creditors.

Perh a start would be strict ToS inheritance and much richer consumer data regulation. Any change on tos after an acquisition would have to be opted into by the user. So if Verizon buys experia, they don't suddenly do all kinds of things with that data I didn't expect.