Having the law say your personal data is owned by you and not some company just because it's on their server may turn out to be a landmark in consumer friendly legislation!
You will note that GDPR does not use "ownership" terminology anywhere. The closest it has is Data Controller, but GDPR makes that nowhere near the same as ownership.
GDPR establishes that data subjects are stakeholders in their data. It doesn't mean that they own the data, but it also doesn't mean that they don't own the data. They have rights to the data, which the Controller has to respect, while the Controller also has their own rights.
It's probably possible to model this situation as ownership (property law is complicated), but I think it's easier not to. Data is not owned, it is controlled and processed. Activities related to data are restricted.
Needless to say, such accurate recommendations of music, which even close personal friends have trouble doing, is based on building as complete of a psychological profile of the user as possible. There wouldn't be any way to do it without gathering lots of information about your very personality.
Surveillance isn't always bad -- after all, what is a baby monitor?
And then an innovative "security contractor" or "data research agency" makes a backroom deal with Spotify and copies their database of complete psychological profiles. Win-win?
If someone wants to avail themselves of Spotify's recommendations they have to opt in by sharing their data. So they make an active, informed, decision about what data Spotify gets to use. They also have legal recourse if it turns out Spotify is misusing the data (selling it to record labels, let's say).
We have had an analogous law here in Sweden for ages: if you apply for a permit you're allowed to set up security cameras pretty much anywhere on your property but you have to put up signs informing people that they're being filmed. This is so people can opt into surveillance. 99% of the time it's no big deal that you're being filmed, but it's never secret.
That's a good thing.
(Three kids here, and no, we never used a baby monitor...)
> It’s not clear why everyone enables a floodgate of tracking just ‘cause.
Have you worked in marketing, product development, or customer support? There are plenty of services that are used to help people generally do their jobs, identify problems, figure out what to build, improve the product, and to enable support folks to support customers.
But yes, there are all sorts of other, third-party trackers and cookies that are not as directly relevant.
It takes two. Perhaps if these companies had taken that tact (mutual ownership), then there'd have been no need for a law to specifically allow users to get the data created with their own effort.
Who owns what Party A recorded, and who owns what Party B recorded?
I get that they feel different, but every distinction I come up with feels like it either doesn't make sense applied uniformly. If I tracked songs in Excel, Spotify doesn't own that. If I automated tracking the songs I play, Spotify still doesn't own my recording. If I wrote down all my Spotify songs AND all my Skype messages AND all my texts, Spotify, Skype, and Verizon don't suddenly gain an ownership stake in what I've done.
Bringing up actual communication content is where you start to get onto shaky ground, though, especially considering, for example, the existence of "2 party consent" for recording of communications in some US jurisdictions.
Although I believe that context is entirely for criminal, not civil matters, my point is that there's already a precedent, and a long-standing one predating "data", for the idea that all parties being recorded do, automatically, have a legal ("ownership" may not be the best word, as pointed out upthread) stake in that recording, regardless of which party did the recording or holds the record.
I suspect you used Skype and Verizon, specifically, because, as mere carriers of the communication, they're not really parties to the content that they carry. That doesn't really compare, though, since we're not talking about taping the Spotify songs themselves, and the "ownership" situation there is relatively much clearer, if only because the songs existed previously and aren't being created by the interaction itself.
You can make a subject access request for CCTV footage.
> The data controller may charge up to €6.35 for responding to such a request and must respond within 40 days.
> This normally involves providing a copy of the footage in video format. ... Where stills are supplied, it would be necessary to supply a still for every second of the recording in which the requester's image appears in order to comply with the obligation to supply a copy of all personal data held.
> Where images of parties other than the requesting data subject appear on the CCTV footage the onus lies on the data controller to pixelate or otherwise redact or darken out the images of those other parties before supplying a copy of the footage or stills from the footage to the requestor. Alternatively, the data controller may seek the consent of those other parties whose images appear in the footage to release an unedited copy containing their images to the requester
I wouldn't be surprised if some video workflow products pop up to help companies comply with requests like this. For example, select the target person on video, automatically pixelate the rest, stitch together and export all clips of the target, securely mail it and log the task completion, etc.
Stop trying to VC-fund everything single idea that pops into your head.
Even if had suggested VC funding (I didn't), were an investor (I'm not), lived in the UK (I don't), and had experience with video automation (I don't), why would you care? The background info was helpful enough.
Why not? Data is everywhere these days. You won't be able just quit e.g. social media in the future to avoid being tracked. One of your friends will tag you, your face will be indexed, your name will be correlated to your phone number, your phone number to your ip address and now they know everything you read anyway. If that isn't the future you want you can either come up with all sorts of rules for when and where you can and can't take pictures and collect data, which all the companies will try to avoid anyways. Or you can say that people own their own data and only reasonable usage is granted automatically.
Presumably reasonable usage of a security camera would be to, you know, ensure security. Maybe you can opt in to some consumer behavior survey. But they shouldn't just be able to sell the data to a data mining company for face recognition, location tracking and consumer intelligence.
Likewise, if you didn't exist, then the interaction data wouldn't exist either. I agree that the ownership is more complex in this case and is hard to attribute solely to one party. One party provides a system where interactions can take place, another party provides the interactions. Who owns the interactions? Clearly both parties are required for them to exist.
It's more like watching security footage (or having machines watch it and let you know what they've observed) and then making decisions with that information.
I recently visited the main station in Cologne, Germany. They literally had notices posted next to the time tables about CCTV being conducted and about your GDPR rights concerning CCTV footage taken from you.
While this wasn't a straight "you own the footage", they did acknowledge you have certain rights regarding the footage.
Taking your thought one more step, what happens to the data the store creates thru a facial recognition system tied to the footage? Is that covered? I don’t know, but there are thousands of further permutations on his thought. Another reason I hate the GDPR (great intent, horrible execution).
So my (IANAL) understanding is: If the data is somehow tied to your real life identity, it's protected. E.g., the headphone brand might be protected because it's uniquely associated with your user account which is uniquely tied to a real-life identity.
I guess, whether or not the facial recognition output is protected, might depend on whether you want to use it to identify the person behind it - e.g., if it's an identifier to a database, it might be protected. If it's an emotion score or eye tracking analysis, it might not be protected, unless it's associated with your identity by some other process.
Don't use logic though. Logic is cold and hateful. ;)
A better analogy is this: if i install a video camera in my home and pay a service to store and process that data (think nest cam), but that i'm paying monthly for, then that data should be mine. Stuff going on in my living room (aka my music listening habits) should be mine and i should have access to my habits and restrict others from using it if i want to.
Update: more importantly, without having access to data stored by any service, i can't make an informed decision as to whether the service is storing dubious information about myself that it shouldn't. Services can no longer hide the data they store about people.
The fact that they have to legally release this kind of thing is really twisted, at least to me. If you want to have logs of your listening data --- if you want to have logs of what your computer is doing --- how about you log it yourself? If that's too much work for you, whose fault is that? Don't use it if you don't like it.
Music services are a dime a dozen nowadays. The biggest reason that any given consumer stays with a given service has to do with recommendations and playlists and the profile that they've built on you. The fact that these companies now have to give that data back to consumers, which they could presumably feed into another (cheaper) service, disincentivizes companies from building better recommendation engines and down the line it ultimately makes for a worse experience for music listeners.
Nothing is as simple as a quip can make it sound.
I'm obviously not a lawyer or anything but I think that this would be more compeling if Spotify was open source. "You don't want to share this? Well just remove the code then."
Here not only can't I do that but I've been a paying customer of Spotify for years and I had no idea that they even collected 90% of that stuff. In these conditions how can it be argued that I gave them ownership of data I didn't even know existed?
Would you be willing to unpack this statement a bit, please? I'm not quite sure I understand.
The big social networks have amassed their huge databases not only through information volunteered by individual members, but also by co-opting people who know those individuals (or just happened to be nearby) to provide more. For example, every time a social network's mobile app uploads an address book from someone I know when they install on their new phone, and consequently that social network knows my name and contact details, they have potentially violated my privacy with neither my knowledge nor consent. With the advent of ubiquitous devices with cameras, microphones, network connectivity, GPS and other sensors, and at the same time the developments in automatic recognition technologies based on photos, audio or video footage, the risks of exploiting network effects to gather data on unwilling subjects have increased dramatically.
I'm not sure it's reasonable to expect every person I've ever shared my contact details with or anyone who ever took a photo with me in the background to understand the implications of their devices and the software they run on them. In any case, there are going to be difficult ethical questions about balancing the rights and freedoms of multiple parties.
However, I am quite sure it's fair to require businesses on the scale of Facebook to understand the basic situation and at least not to retain or use personal data for any longer than is necessary. The GDPR and similar proposals starting to appear elsewhere are clearly trying to enshrine something like that principle in law, but everything I have seen so far suggests that the biggest data hoarders are paying lip service but still trying to get away with anything they can.
The issue being that if you text me, and I give that to Facebook, does facebook have the right to ask me for permission to give it to a 4th party? Should facebook be required to give you that information if you don't have a facebook account and request it?
You have rights to your personal data, you do not need to own it to have those.
Can they still sell it if it's owned by you?
They are collecting and storing it, for sure. What limitations do they have from there?
Also, how would the government patrol this without having access to all companies databases, servers, and policies?
I feel most sites don't comply with the latter half of your statement (conditioning based on acceptance).
( not being sarcastic )
You can see a list of previous enforcement action and adjudication decisions by the British Information Commissioner's Office at the link below. These are all under the old Data Protection Directive, which was broadly similar to GDPR but somewhat lacking in teeth. You'll see everything from a slap on the wrist to six-figure fines.
https://ico.org.uk/action-weve-taken/enforcement/
https://icosearch.ico.org.uk/s/search.html?collection=ico-me...
As in many other cases you assume the companies are not doing illegal stuff and you act when someone reports them. A developer that is asked to do something illegal like hiding something from the exported data can report it .