Hacker News Reader

Comment by golergka | Hacker News Reader

Yes, if you use software to work on some sort of information, this software will have access to this information.

Yes, if you use SAAS software, this information will be processed by remote servers.

Yes, if you use proprietary software, you will not know exactly how is this information processed.

And finally, if you have someone who is willing to work as school clerk, given how much do these jobs pay and how interesting they are, this person will likely not understand the complexity of these issues and will be a little bit lazy with their job, so she probably will not present parents with all the relevant information.

Now, every single one of these facts seem obvious; how is combination of these facts warrant an article in one of the biggest newspapers all of a sudden?

View on HN

I think that is naive -- the general population understands perfectly that Google tracks users and uses that information to display ads. The GAFE apps are covered by different terms of service that restrict the collection of information, but Google draws the line in plain English in their GAFE/GAFW copy:

We do not scan for advertising purposes in Gmail or other Google Apps services. Google does not collect or use data in Google Apps services for advertising purposes. The situation is different for our free offerings and the consumer space.

I think the reason why schools go for GAFE is clear and simple: the choice is between having personnel on staff for maintaining servers, computer labs, and troubleshooting students' devices; or outsource it nearly for free to Google.

> for advertising purposes

Which neatly leaves out non-advertising purposes. The statement even admits to collecting data for other purposes in the negative - otherwise the would simply say they "scan ... collect or use" the data at all.

This is just like the word-games the NSA likes to play when they insist they aren't collecting data "under this phone records program".

Both Google (for collecting and aggregating data) and the schools (for giving the data to a 3rd party) should be held liable for anything that happens from this data collection.

What is "anything that happens"? Has something happened?

Well, presumably Google scans the e-mails for search indexing, for virus detection, and for spam filtering; and collect the e-mails for when the user asks to search or retrieve them.

Exactly! I want to support stronger privacy but this just smells like someone wants one big payout for themselves. IF it were found that Google were sharing student information with anyone, including the government, things might be different (well not the government anymore thanks CISA) but I could understand if they were caught selling the information to others or snooping on their users' emails and using that in a court case (looking at you, Microsoft you can't undo that).

Articles like these hurts privacy because they cause noise where none is deserved and people just get tired of hearing things like this that they ignore legitimate worries like CISA.

> IF it were found that Google were sharing student information with anyone, including the government

Well, Snowden has shown us exactly that. Google participating voluntarily in PRISM.

>The statement even admits to collecting data for other purposes in the negative - otherwise the would simply say they "scan ... collect or use" the data at all.

OTOH, this is obvious. If you drop an analytics tag on GAFW or you track data for purpose of bug collection, or you are even keeping server access logs, then you are de facto collecting data.

In which case they could say "we collect the following data for the following purposes". By leaving a big vague hole into which unspecified data is poured for unspecified purposes, they are bound to arouse suspicion.

I don't mean to defend Google, but only to sympathize that it could be very difficult for a well meaning actor to come up with a tightly worded TOS the way you are describing.

For example, consider "we collect the following data" - because everything is hosted in GAFE, isn't Google technically collecting your email data? And your calendar data? And your students research papers? The list of "following purposes" could be very long to just even describe the list of features the client is expecting - and may even have to be updated every time a new feature is deployed - imagine you had to go through legal every time you wanted to push a change prod.

To paraphrase 'extraordinary data collection requires an extraordinary privacy policy'.

I would absolutely want every change by Google to jump through lots of hoops. Facebook-style "Move fast and break things" and "Ask for forgiveness instead of permission" is fine when you're allowing people to share photos of their cats, but not when you're managing the education data of nearly every child in the country.

This article is actually far less helpful an overview then the earlier article mentioned at the top "Google is tracking students as it sells more products to schools, privacy advocates warn"[0]. It is really only introducing one new angle to the debate which is interesting enough, but I recommend reading the earlier one first.

It raises the far more interesting point that Google's Apps For Education policies are very granular and services such as Google Search and YouTube are allegedly not covered under the primary agreement - they carry completely different T&C's and may be used for advertising and data harvesting. It is highly likely that students logged in to GMail or Google Docs and doing schoolwork will be doing searches and watching (hopefully) educational videos to learn more about a subject. Those activities may not be covered by the educational use privacy policy.

What percentage of parents know this, even among those that bothered to check the T&C's? Did they notice the exception? What percentage of teachers or school administrators take the initiative and disable all non-core Google Apps For Education services like Google Search (which are enabled by default)? This is the conversation parents and school administrators need to be having.

I don't begrudge a advertising giant like Google from relentlessly collecting and data mining users to manipulate them, that's what ad companies do after all. Savvy users and regulators know this and can take appropriate action to guide the less-technical with safe defaults. I do think the defaults here are not safe from a privacy perspective, and I wonder if the time has come to re-examine whether the non-core services not covered by the educational privacy terms should be disabled by default.

[0]https://www.washingtonpost.com/news/the-switch/wp/2015/12/28...

Now, every single one of these facts seem obvious; how is combination of these facts warrant an article in one of the biggest newspapers all of a sudden?

Obvious or not, will this combination of circumstances result in what can widely be perceived as improper? Is that not worth note, just because your insight to the mechanisms means you understand the state of affairs?

Reply on news.ycombinator.com