Hacker News Reader

Comment by majkinetor | Hacker News Reader

Not sure how this relates to GDPR - the arguments are nonsensical. People tend to bump everything under GDPR now like its some form of gods commandment. If I simply sit in the cafe watching someone continuously near me, I am collecting data, and nobody can do anything about it.

When you leave your home, your privacy is gone.

When you make anything public your privacy is gone. Not sure anything is ethically wrong with the software existence, the problem seems to be data usage, just as if somebody found out his neighbors wife is in porn and went to twitter and said it publicly with few pictures as a proof, and people do that.

It's naive to think that this thing can/will go away, if anything, because of this news alone who knows how many more random programmers are retrying this (or even make business plans) at this very moment.

View on HN

If you sit in a cafe continuously staring at someone you will probably be asked to leave and never come back. Try it some time.

This has everything to do with the GDPR because the GDPR outlines the conditions you need to meet to process data, simply put actually gathering the data and using this tool is not legal within the EU.

>If I simply sit in the cafe watching someone continuously near me, I am collecting data, and nobody can do anything about it.

But the tool is doing more than that as it's also using data gathered from crawling social media profiles and then matching people, you cannot do this without specific consent under the GDPR.

>When you leave your home, your privacy is gone.

>When you make anything public your privacy is gone.

GDPR provides controls on privacy, it does not say you are guaranteed privacy in every situation but that if somebody misuses your data in a way that violates your privacy you have rights to correct this misuse, e.g., the right to opt out and the right to erasure of data among others.

Does GDPR applies to third party users of a website? Does it cover use of public data by other visitors or just use of private data by the site owner?

This is a bit of a vague question, but most importantly the GDPR doesn't make a distinction between public/private data except in some niche contexts, the GDPR is more concerned about personal data which can be anything that can identify a natural person, e.g., names, email addresses, location data, IP addresses (in some circumstances, not all), etc. The GDPR mainly concerns processors and controllers of data where a processor or processing of data can include collecting that data, so in this context can mean third parties to a website, for example a company crawling social media for instance would have to follow the GDPR and have a lawful basis for collecting (processing) that data.

The GDPR also generally applies to everybody (within the EU or serving EU customers) except 'a natural person in the course of a purely personal or household activity', it's important to note that non-profits still have to comply with the GDPR. Generally there's a lot of legal ways to process data as a legitimate business, the law is mostly concerned with giving individuals a means to opt out or to give them some rights with regards to their data, like the 'right to be forgotten' or the right to access the data a company may have on them.

> the right to opt out and the right to erasure of data among others.

Algorythm doesn't have to collect any data on you besides your image which is not considered private data given that you need to carry one. It can have single image and compare it to the porn collection without storing any results anywhere, but just returning 'XXX was a porn star in YYY'.

Tool can also create opt out mechanism which would have to be pretty complex as providing ZZZ in the name blacklist isn't appropriate solution given that many people share this name.

> But the tool is doing more than that as it's also using data gathered from crawling social media profiles and then matching people, you cannot do this without specific consent under

Implementation detail. This can be totally avoided. Tool can accept picture and return the result.

>Algorythm doesn't have to collect any data on you besides your image which is not considered private data given that you need to carry one.

The GDPR doesn't care about 'private' data (for the most part) as it only cares about personal data, and faces absolutely are considered personal data under article 4 point 14. Faces are even in a special category of data which you are prohibited from processing at all unless some conditions are met, although article 9 point 2e allows processing such data if they have been 'manifestly made public'. The GDPR doesn't define what 'manifestly made public' means but the Scottish Parliament[0] suggests that it could mean images purposely uploaded to social media and made public, but note that just because you are not prohibited from processing such images does not mean you have a lawful basis for processing that data in the first place.

>It can have single image and compare it to the porn collection without storing any results anywhere, but just returning 'XXX was a porn star in YYY'.

>Implementation detail. This can be totally avoided. Tool can accept picture and return the result.

This is an implementation detail that I had not considered. The original tool and article talks about crawling both porn sites as well as social media and both are fraught with legal issues, not every video or image on porn sites is going to be legal in the first place (revenge porn, stolen images) never mind the copyright issues involved, and crawling social media for this information is simply not acceptable under the GDPR.

>Tool can also create opt out mechanism

Such a tool would almost certainly need to be opt in from the data subject, article 6 makes this clear, you need specific consent from the data subject or some other conditionals which aren't applicable here. Best case scenario if you want to operate such a tool in Europe is that you argue (in court, mind) that you have a legitimate interest to run such a tool which does not override the fundamental rights and freedoms of the data subject, which does not seem like it would go in your favour at all.

[0] Page 6: https://www.parliament.scot/S5ChamberOffice/2018_06_01_Motio...

Great comments

Consider however the variant I proposed (picture 2 result). Would that be penalty according to GDPR and if photo is already public and not used for personal identification ?

Perhaps it could be said that the any algorithm that makes person identifiable is problematic. However, random photo of you doesn't identify you AFAIK and porn star names are also made up, so you are connecting 2 non-identifying things and the end result most also be non-id ?

>Consider however the variant I proposed (picture 2 result). Would that be penalty according to GDPR and if photo is already public and not used for personal identification ?

>However, random photo of you doesn't identify you AFAIK and porn star names are also made up, so you are connecting 2 non-identifying things and the end result most also be non-id ?

I'd say this would still be against the GDPR. The porn image (assuming a professional production and not revenge porn/stolen images) and an image from social media would both be public images of course, but under the GDPR you still need a lawful basis for processing data as defined by article 6 [0], one such basis for this is that the data subject concerned (i.e., the person in the photo being uploaded) gives specific consent for this purpose. The only way I can see such a site being legal is if you're providing a service to allow people to upload their own images to see if porn of them is being uploaded without consent, however you would need to ensure that the person in the image is the one consenting to that use as you would be liable if other people were uploading those images. It may also be legal to run such a tool for purely personal reasons as the GDPR does not apply to personal activities [1], but it would be illegal to make this available to other people and you would still have other legal issues with such a tool (like copyright).

[0] https://gdpr-info.eu/art-6-gdpr/

[1] https://gdpr-info.eu/art-2-gdpr/

> When you leave your home, your privacy is gone

This is not true in Europe.

> Not sure how this relates to GDPR

GDPR states that the lawful basis for processing of data depends, among other things, on:

* the individual's explicit consent to the processing of his or her personal data.

* protecting the vital interests of a data subject or another individual

This violates both criteria, thus is indirect violation of the GDPR.

* Face is not considered personal data AFAIK

* What the heck is vital interest ? For person playing in a movie it may as well be that everybody watch it.

* Photos of a person is personal data, particularly those that are scraped from social networks. This is pretty much the whole point of GDPR.

* Screwing up someone's life, as it is extensively desribed in the article, fits well into the definition of "vital interest".

I find it quite baffling how someone posting on HN is oblivious to the link between GDPR and the need to punish those who abuse data collected from social networks against the wishes and best interests of the users to screw up their lives.

We are talking here about the law, not about ideal world to live in.

The question is if photograph is personal data according to GDPR. Here is what I found [1]:

Under GDPR Article 9, biometric data is among the special categories of personal data that is prohibited from being processed at all unless certain exceptional circumstances apply, and the definition of biometric data specifically refers to "facial images".

Any images collected, whether via photos or videos, will only constitute biometric data if “specific technical means” are used to uniquely identify or authenticate an individual.

GDPR makes an important distinction between facial-recognition data and photographs. Recital 51 of the GDPR states the distinction as follows:

The processing of photographs should not systematically be considered to be processing of special categories of personal data as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person.

[1]: https://iapp.org/news/a/how-should-we-regulate-facial-recogn...

Reply on news.ycombinator.com