Hacker News Reader

The option to monetize your own data is an amazing idea: a startup that pays you to upload the data you can download from your google, apple, facebook, BIGNAME account, basically renting it daily until you revoke consent, then uses it to do all sort of shit you can with it. You’ll get hypeprofiled and harassed with all sorts of advertising, but you’re actually getting real money for that.

When “you are the product”, you can sell that product.

you would have to find a market for them first. realistically private data is useless outside of a marketing platform like google or facebook. Maybe you can fill up some forms or polls for a few cents, that's it.

The problem with that model is... how much money is a single profile worth, really?

I'd love to be proven wrong and for a company to implement this. But as far as I know, it's not being done because the math doesn't work out. It's too cheap for regular people to be interested, and an incentive for spamtech to mass create fake profiles and get paid pennies for it.

In fact, the one variant I am aware of that works is survey sites, but that's because you get paid per result rather than for your data as a whole. If you're just renting your data daily, you'd get a lot less.

> The problem with that model is... how much money is a single profile worth, really?

I remember some estimates, facebook profile with a few years of history is around 1$, a few profiles from different sites of the same person 5$.

Your data is worth about 21 cents.

The assumption you're making with most of your points is that, currently, data is only safe from governments/hackers because its not readily available to users, and for some reason it being not easily accessible by users means its safer (correct me if I'm reading what you're saying wrong).

I don't think making the data more available to users means it's now inherently less safe - actually, it could be argued that having all the data in one place makes it easier to protect ('Keep all your eggs in one basket, and put that basket in Fort Knox'). Additionally, if PII isn't stored securely enough, as it should, and that data gets breached, the company is at fault - again, which it should. Making these companies more liable incentivises them to take their security more seriously, which I think is good.

(I also trust my government, but that's a separate argument)

You have expanded the surface area for hackers for sure esp. if you have an automated system. If your system is manual, like a phone number, that's not immune to phishing/stolen identity attacks.

On the positive side, it could also reduce product lock-in by increasing data portability. For example if I'm creating a social network startup, and users can export their data from Facebook in a parseable format, then it's trivial for me to offer an "import your data from Facebook" feature. The interesting question then becomes, could Facebook do anything about that? In the past they would be able to sue the startup for appropriating data that Facebook was granted an exclusive license to via TOS. Now it's not so clear. Where are the limits of my control of my own data?

The data belongs to the user. There's nothing Facebook can do to prevent exporting if it's via the data backup. They can just design it in a way that is easy to read by humans but very challenging for parsers.

Yeah, I understand it belongs to the user and they can export it. But does any third party service then have a right to allow the users to import their data from Facebook?

Yes, the user owns the data and can give consent.

>They can just design it in a way that is easy to read by humans but very challenging for parsers.

This is explicitly forbidden in article 20.1

Machine readable only means no images. You can still structure it in a way that it's a pain to import. Or use changing structures. Definitely violates the spirit of the law but don't think Facebook cares about that.

I'd argue that the GDPR is entirely about spirit.

well they can make a big, very readable screenshot of your data, handwritten by an adversarial DNN

What's with generated images (some crap like facebook frames or generated slideshows etc) doesn't have facebook the copyright on those - at least the designs? Should those be included in the export?

I don't understand how a facebook post made by me 'belongs' to me. It was addressed to specific audience that facebook made available to me, it wouldn't have existed in the first place if facebook didn't exist. How does it completely belong to me.

If you make a song on a Gibson guitar, should the song belong to Gibson?

I think your analogy holds true for the documents you write on MS word that you bought. Posting on facebook is equivalent to recoding on a song in Gibson's studio, in which case it doesn't completely belong to you.

Facebook has been offering their data for free for a very long time. in fact that's what they re accused of. They also have export tools since long ago, like twitter IIRC.

I think their terms specifically say that your data belongs to you.

Well, to an extent. They still reserve the right to block apps from using their API if they infringe on Facebook business interests. For example you can’t make an alternative newsfeed app. People have tried to make apps that aggregate multiple social account feeds, and they got sued / C&Ded IIRC.

What do you think changed for governments?

If there is a search warrant, police could and still can access data. GDPR didn't change anything in this regard.

My feeling is that in the EU there is a different view of government: it's not a third adversarial entity.

Many other remarks you've made don't have anything to do with GDPR, for example fake accounts and takeovers.

> My feeling is that in the EU there is a different view of government: it's not a third adversarial entity.

That should be the de facto stance regarding government in democratic countries, in my opinion.

The government is a third party that intermediates, fundamentally, between:

* individuals/groups of individuals and other individuals/groups of individuals, all inside the same country

* itself and the governments of other countries

The first point is very important, a society of a big enough scale, in the absence of hierarchy invariably degenerates into an anarchy where the only law is the law of the jungle: the strongest survive. That's why we add this third party that can intervene for the weak. This third party can be corrupted by various interests, but the hope is that these interests balance themselves out.

And even a corrupt state is better than no state at all (or even a very weak state). Look at current day Somalia, Iraq post 2001, Libya post 2011.

> EU there is a different view of government: it's not a third adversarial entity.

We are not from another planet. EU likes to portray itself as trustworthy - it largely is - but that doesn't mean there are no problems. EU governments can vastly differ in quality , you just happen to hear from the most accountable ones.

> If any user can see their data on any service than any government can quickly plug-in to access all user data on any service. This is like NSA Prism for everything.

This could streamline processing of warrants, but beyond that, not much changes. If company's infrastructure was vulnerable to governments, it probably still will be. Maybe less so, given that GDPR also adds extra motivation for keeping users' data secure.

> If a user can export their data easily from any service, they can easily resell their own data for money to services that seek to monetize that data. They could even rent out their data by the day for model training using the right to delete.

As it should be? They own it, so they can sell it.

> Account takeovers by hackers will lead to much more severe data breaches, since all data on that user in the system is easily accessible.

Not necessarily. GDPR isn't about storing all user data in one big table named PII. It's about knowing, via company procedures, what data you store and what the lifecycle of that data is. Also, with rights to delete data and revoke consents, there'll likely be less data available for an attacker to exfiltrate.

> The information apocalypse is made all that more easy because acount takeover + deep fakes + lyrebird plus all that easily accessible juicy data = impersonate anyone.

Not sure how this is relevant to GDPR. Could you elaborate?

> Data renting will create a way to monetize account takeover. The account takeover will include all possible information used to identify a person so how are the data brokers supposed to know it isn't you and how are you supposed to get your data back once it's out there getting monetized?

How was this different before GDPR? I don't see anything changing in that regard; what you wrote is already the case. Again, if anything, GDPR will reduce the amount of information an attacker can extract from a compromised account, because companies are incentivized to reduce the amount of data they store.

Nothing in the directive requires the access to personal data to be done "in band" through the normal login only. It's a valid interpretation of GDPR to only accept "give me all my data" requests by post, and require additional ID to confirm that you're giving it to the right person.

"The controller shall take appropriate measures to provide any information referred to in Articles 13 and 14 and any communication under Articles 15 to 22 and 34 relating to processing to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a child. The information shall be provided in writing, or by other means, including, where appropriate, by electronic means. When requested by the data subject, the information may be provided orally, provided that the identity of the data subject is proven by other means."

"Without prejudice to Article 11, where the controller has reasonable doubts concerning the identity of the natural person making the request referred to in Articles 15 to 21, the controller may request the provision of additional information necessary to confirm the identity of the data subject."

(article 12)

> If a user can export their data easily from any service, they can easily resell their own data for money to services that seek to monetize that data. They could even rent out their data by the day for model training using the right to delete.

This has been tried infinitely. It doesn't work. Say your service can extract $5/year/user from advertisers. At 25million users, you can pull a $125m revenue. That's huge. But if users were to sell their data, it'd only give $2-3 if you take commissions into questions.

As people realize that their data does not bring much cash, and the invasiveness of the procedure (will you agree to share your weekly grocery purchases for one year with 202 advertiser, and you get paid $2?).

Most people will disagree as they realize how a horrible on an equation it is. Only bots and kids with no disposable income will remain.