This article begs the question. Why does "Public not equal consent"?
There is a ton of grey area about public not equaling consent, where it seems like usually the argument is about something that's legal, but probably immoral. Most people wouldn't want someone making a billboard that said "look at this guy," with an arrow pointing to their facebook profile picture. People also generally don't like people filming them in public (case in point: https://www.youtube.com/watch?v=jzysxHGZCAU).
It's a really tough question that's been made a lot harder by the internet. I'd love to hear a good explanation about what crosses the line of inappropriate use of public information.
Putting your dating profile on a dating site, with preferences for matches, means explicitly "I want these specific people to look at my dating profile - FOR DATING". That is the obvious purpose of the site and the profile, and the "preferred matches" only reinforce that, not to mention the internal filters OkC allows you to use to block people who don't match a certain %.
There is not any explicit purpose or intent that says "I want this personal information to be used by researchers in a large group study". There was no explicit agreement between the user and these researchers. Hence, no consent.
However. The question then becomes, "Do they need consent?"
The answer is: Check the Terms Of Service on the website. If the website explicitly forbids using the data for research purposes, they can probably be sued by the website for breach of TOS. If the TOS does not explicitly prohibit research use, then no, they don't need consent.
Oh - and if it wasn't already obvious, the users don't own the data, so they have no say in how it is used.
Informal systems and agreements are hard to navigate, and I don't think this one falls on the side of "should have known better", which is what the writer of this Wired article implies with his/her tone.
That statement requires proof, preferably in form of recent case law.
In either case, the TOS states: “You further agree that you will not use personal information about other users of this Website for any reason without the express prior consent of the user that has provided such information to you.”
Uh, i'm pretty sure the company collected and possesses the data. It's on their hard drives and they allow you to view it by connecting to their servers using their software. A user, as an outside party, has no claim to someone else's property. (But you're right, IANAL, so maybe there's some freaky justification for being able to tell someone else what they can do with their own data on their own servers?)
Well the TOS seems to spell it out! Unfortunately, as it is [probably] the company's property, it is probably the company that would have to issue any lawsuit. Then it's up to the courts to judge whatever legal argument is made.
For example, two people talking on the street are clearly in public. However, if they look around and see that there isn't anybody near them, nor are there any recording devices[1], they may choose to speak in confidence. While they are technically "in public", they are de facto private, at least temporarily. Pivacy isn't a Boolean property, and it can change all the time.
Expanding on the same example, if there are three people in the same situation, something said between Alice and Bob is obviously not "private" because Carol can overhear it, but there may be an expectation that it is public within that group, but private with respect to everyone else.
For OkCupid, I would guess that most people have an expectation that the data they share "publicly" will be used in the expected features of the site. Their data won't be public in the general sense, but it will be public to people with OkCupid accounts. Many people also expect that they data will be used[2] as the site presents the data being used. Searches done manually are different than a program that walks the entire database.
Anybody that wants to work with technically public data in a way that is outside the usual user-available features should really be getting informed consent first. This has nothing to do with legal restrictions (which may also exist in some situations); failure to ask first will simply earn you a reputation of being a "peeping tom" that shouldn't be trusted.
[1] see the recent situation in Oakland with the FBI hiding microphones
[2] modulo minor administrative uses done by OkCupid itself
I understand that some OKCupid users may have an expectation that their data is used for dating purposes, but if that's not written anywhere, then how am I supposed to know that's what they expect? How is a researcher supposed to know what's in the user's heads when they put that data out there?
It's up to OKCupid to define boundaries. Write down these expectations, formalize them, and then it'll be clear what the boundaries are on this pseudopublic information.
Please read articles at least a few paragraphs in before commenting.
Making something public comes with the possibility that it might go "viral" or some other form of popularity. That's what "public" means, after all.
This article presupposes the reader considers what happened to be wrong, and does nothing to explain why it's wrong.
I do agree that there are uncontrollable outcomes that need to be understood - your viral example is a great one. But the viral outcome is inherently uncontrollable and fully decentralized. A study done by a select group of person(s) is controllable.
Thoughts?
It boils down to expectation vs. reality, right? It doesn't make sense to me to prohibit research institutions from pulling data if they can in a way that doesn't violate any usage agreements or user expectation. Do people get upset if OKCupid uses their data for their blog posts? What's the significant difference?
To me, the action/lesson here is for OKCupid to implement something in their usage agreement preventing data scraping by end users (the bot the researcher wrote is probably not what OKC wants people doing). Then it becomes an ethical violation, but without it, I'd consider this data fair game.
OkCupid's data has to be identifiable because of the nature of their service. Reddit accounts don't need real data. I doubt they are similarly identifiable in the common case.
However, this isn't very important. Regardless of how personally identifiable the data is, it is extremely rude to use it without specific consent.
> What's the significant difference?
They data was provided for dating purposes, not research. Context and intent matter. Maybe someone doesn't want to give data to that research, for any reason. Or maybe they do and would be willing to provide more data to the research if asked.
> prohibit research institutions
The same would apply to anybody using the data for a different purpose. The data was provided under a certain context, for a purpose.
> pulling data if they can in a way that doesn't violate any usage agreements or user expectation.
Why isn't asking permission the first step? Just take the data because nobody has legally prohibited that specific situation? That's how bad regulation happens. Just because something is technically legal doesn't mean it's a good idea. When enough people get pissed off about bad behavior, they tend to pass laws or regulations (which may or may not actually fix the problem).
TL;DR - "This is why we can't have nice things."
https://en.wikipedia.org/wiki/Right_to_be_forgotten#Current_...