Hacker News Reader

Comment by est31 | Hacker News Reader

The prior generation of surveillance based on programs where you had to sign up first, got some card or something, and you scanned it during each purchase. These programs were opt in, and I never did. This new generation is on by default and doesn't let you opt out. That's a very troubling development.

View on HN

The prior attempt was the iBeacon fad of 2013-2014, with Bluetooth turned on by default on iOS. Then BLE-enabled loyalty apps, now some smart ML to "optimise" your shopping experience. It will continue to evolve unless we introduce heavy taxation and regulation on marketing.

> This new generation is on by default and doesn't let you opt out.

I imagine that it would be possible to cover the camera when you're using the cooler.

My plan is to avoid buying anything from these things in the first place (there's always another store), but if/when the day comes when that is impossible, my backup plan is to cover the camera.

I also really hate the idea of replacing the glass with a display. If that happens, I'll have to stand there with the door open while I decide.

I'm sure it will not pass GDPR in the EU, so we Europeans got that going for ourselves, which is nice.

what does gdpr have to do with this? think cctv with added AI. all running locally.

Running locally has nothing to do with GDPR. GDPR would also be applicable if you hire persons to recognize faces and put down notes on paper.

It's all about storing or working with data about other people. No matter how it's done.

CCTV is for government consumption, no?

GDPR contains nothing that will prevent this.

It contains everything that will prevent this.

Please show me what part of GDPR that will prevent this.

A picture of a person is personal data (Art. 4, (1)). Applying an algorithm to it in order to guess age/sex is processing it (Art. 4, (2)). Therefore, the GDPR applies and you need a lawful basis, per Article 6.

If you reply it doesn't apply because the stored information is anonymized, I quote UK's ICO:

"You should also note that when you do anonymise personal data, you are still processing the data at that point."

Although I believe you're likely right, this is snarky and doesn't actually present an argument. Are you expecting to educate anyone with this comment?

As an American who isn't too familiar with GDPR, I'd like to know: Why does GDPR prevent this? Can you, being charitable in your assumptions, guess why the above commenter believes GDPR does not prevent this? Why is that argument wrong?

If the article is correct then this is not using any personally identifiable information (the cameras will apparently report "40 year old man, very grumpy" instead of "onion2k"), so the GDPR legislation won't help.

If the stores tie the facial data to a credit card or store rewards card then the GDPR might stop them retaining or sharing the information.

But they certainly are gathering personally identifiable information, namely your face. I don't know the details of the GDPR, but doesn't it cover data collection as well as use?

Yes, it covers all "processing", meaning "any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction".

Applying some ML algorithm to personal data certainly fits.

...Where is this notion that a picture isn't personally identifiable information coming from?

I get it in the sense it's just a picture, but when you run credit cards in a store, and can temporally associate cards to faces via temporal proximity, you're just elevating the "not that personally identifiable" to "definitely so".

My opt-out will be an automatic center-punch.

Reply on news.ycombinator.com