Hacker News Reader

Comment by mattmanser | Hacker News Reader

As an aside from the interesting article, does any one else find it pretty scary and privacy invading that stackoverflow think it's ok to match our IP addresses to the company we work in?

It seems like a massive invasion of privacy (which I guess lots of websites are doing).

But to me that SO can so casually mention the mass surveillance and privacy invasion they're doing without thinking that there's anything wrong with it is the worst part of it.

I certainly never knowingly agreed that they could check my IP address and then try and figure out what company I work at from it.

EDIT: Once GDPR is live in the EU, I think it might be interesting to see if I can challenge this privacy invasion and inappropriate use of personally identifying data. I guess we'll see if GDPR has any actual teeth in this instance.

View on HN

Your IP is public, so you can't hide it; privacy invasion is a non-argument there.

IP data retention, on the other hand, will be interesting. On the one hand, law enforcement wants to have ISPs and companies to track and remember those, for future investigations. But on the other hand, privacy advocates want that kind of data to not be stored at all.

It's not the IP address that's the problem, it's that they're processing personally identifiable information about their users in a way they haven't asked permission for and is not related to the service they're providing.

Here's the UK's ICO guidance for what you can process, as far as I can tell they've got no lawful basis for trying to match a user's IP address to a company without the user asking them to.

https://ico.org.uk/for-organisations/guide-to-the-general-da...

I skimmed that link and couldn't figure out what they mean by "processing". (It's related to compliance with a law, so I assume that the common sense meaning of a word isn't necessarily what is meant.) Do you understand what they mean by "processing" in this context?

It seems like you're saying that analyzing IP addresses a user connected from in order to determine their likely employer is against the UK's GDPR guidance, even if the data is released only in aggregate (but that it might be fine to keep that IP data since perhaps there are other uses for it which would be legitimate). Is that your understanding?

It's not about what you release to the public, if you're processing this data in private it's still culpable.

This page gives it some context:

https://ico.org.uk/for-organisations/guide-to-the-general-da...

Further down are the 6 reasons for processing.

We know the first 5 don't apply:

    consent - there's no consent
    contract - it's not necessary to provide the Q&A answer site
    Legal obligation - there's no legal obligation
    Vital interests - nope
    Public task - nope

So what it falls under is "Legitimate interests", SO want to use a user's IP address, process it to add company name, store that and then use that data for profiling their customers to serve them ads.

One of the problems for SO is that further down they go into this a bit more and there's a few key questions:

    Would individuals expect this processing to take place?
    Are some of the individuals concerned likely to object?
    Are you able to stop the processing at any time on request?

Which I would think would be answer No, Yes, No. Which seems to indicate that there's some problems with SO's approach.

Since these provisions are most likely based on EU directives I would assume that this definition is also reflected in UK law:

> (b) 'processing of personal data' ('processing') shall mean any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction;

(Directive 95/46/EC)

All IPs are personal data (even if they are dynamicly assigned) if I read [1] correctly (Not a lawyer and there is most likely something I miss).

[1] http://curia.europa.eu/juris/celex.jsf?celex=62014CJ0582&lan...

In skimming through the StackOverflow privacy statement it certainly appears that they disclose the collection of IP addresses and use of that information to report aggregated data ("we may publicly display information that is not personally identifying in the aggregate").

Much of the industry Stack Overflow serves is based on collecting, aggregating, and selling access to exactly this sort of data. I'm not sure what to think of this specific example, but it's just one small manifestation of whatever it is, bad thing or not.

They said they only did this for US based IP addresses. (Not that it makes it OK...)

Not explicitly, they might have been just using US data as an example in this blog post.

Even if they aren't, I still wonder that if they're checking everyones IP addresses against that database, essentially sharing our access of SO with a third-party, would it still be an inappropriate use of personally identifiable information?

It seems they're using data from a company called MaxMind https://www.maxmind.com/en/geoip2-isp-database#features .

Quoting their website, "The organization name is available for about 40% of corporate, government, and educational networks."

Does SO operate in the EU?

They don't block EU users, so they do business in the EU.

As it offers goods and services to EU citizens, it has to operate according to GDPR as far as I understand it.

And it does do sales in the EU, there are plenty of SO jobs being advertized (and paid for) in the EU.

I know GDPR is written this way, the question is how it will be enforced? If SO has no operations in the EU, and it's literally just take EUR payments, and the volume is relatively small (or they figure out some offshore processing hack) then they could make the decision to stop processing EUR and give GDPR the middle finger. That's a lot of ifs, but it's not a foregone conclusion that European markets are worth the GDPR headache.

No, they'd have to block the whole of the EU from accessing the site.

Reply on news.ycombinator.com