Hacker News Reader

Comment by jlgaddis | Hacker News Reader

Don't bother reading through the responses -- it's mostly others arguing about what GDPR is or isn't. Ubiquiti's official response [0] is near the bottom of the thread:

> We have started to gather crashes and other critical events strictly for the purpose of improving our products. Any data collected is completely anonymized, GDPR compliant, transmitted using end-to-end encryption and encrypted at rest. There is no on/off switch but there also are no penalties for blocking Internet access to the device, dropping traffic to this host, and/or blocking it via DNS.

> ...

> The memory leak that you reference above was a bug specific to release 4.0.60 which was fixed as of 4.0.61.

[0]: https://community.ui.com/questions/UI-official-urgent-please...

View on HN

We specifically invested in UI equipment because it respected the boundaries of our networks.

If this is their final position we will no longer be purchasing UI hardware moving forward.

“You can block the traffic, but we’re counting on 99% of users not doing that, so.”

> There is no on/off switch but there also are no penalties for blocking Internet access to the device, dropping traffic to this host, and/or blocking it via DNS.

Sigh. More junk that requires micro-management.

Is it even possible for this to be GDPR-compliant without even a way to opt out? I’m not very well-read in the subject, but I thought stuff like this had to be opt-in under GDPR?

As far as I know, GDPR only applies to data that somehow relates to a person. If telemetry e.g. only sent build number + backtrace for crashes and the IP address wasn't logged, it seems like that would be allowed under GDPR.

How does it sent back data without revealing the source IP address? :)

I don't think GDPR attaches to every piece of data that one could hypothetically observe.

It attaches to date you actually observe. I am sure the IP address is part of that. Enough to make the thing GDPR relevant.

If someone complains they're going to have a bad time.

it's impossible to verify as we don't know what data is actually being sent. But there's a hint in the ToS and that doesn't sound very anonymized.

-----------------------

From their privacy policy: https://www.ui.com/legal/privacypolicy/#c1

The Usage Data that we collect may include information such as your device data, including your mobile devices, sensor data, device signals, device parameters, device identifiers that may uniquely identify your devices, including your mobile device, web request, Internet Protocol address, browser type, browser language, referring/exit pages and URLs, platform type, the date and time of your request, and one or more cookies that may uniquely identify your devices or browser. IN ADDITION, WE MAY AUTOMATICALLY COLLECT LOCATION INFORMATION (INCLUDING LATITUDE AND LONGITUDE), PERFORMANCE DATA, MOTION DATA, TEMPERATURE DATA, POWER USAGE DATA, AND ANY DATA OR SIGNALS COLLECTED BY THE DEVICES AS PART OF THE USAGE DATA. WE DO NOT COLLECT THE CONTENTS OF ANY COMMUNICATIONS THAT PASS THROUGH OUR DEVICES OR SERVICES.

-----------------------

By this desription, it certainly isn't GDPR compliant. device identifiers/data etc.. is PII in GDPR context and requires a legal basis for processing.

Reply on news.ycombinator.com