Hacker News Reader

Comment by Cieplak | Hacker News Reader

I’m curious what sort of due diligence these companies must do to authenticate you as a person prior to satisfying an information retrieval request. Given that the exchange is entirely digital, it seems plausible that there are bad actors who would pose as someone else to gain access to their personal information. What sort of liability does one of these data controllers bear when they fail to properly authenticate a person prior to handing over all their data? Is it limited to tort liability, in which there needs to be proof that the transgression ultimately led to some particular damage? Given that this data is being traded on the free market, what’s to stop abusive employers, ex-spouses and criminals from exploiting this information?

View on HN

I suspect we as a society need new legislation to deal with these sort of issues. Before, much of this was incredibly difficult to impossible so legislation and regulation was entirely avoidable and relatively rare occurence could be dealt with on a case-by-case basis.

At this point, technology has enabled this sort of behavior at mass scale, now revealing far more personal and useful information about individuals.

A feasible model to work from may be go look at the healthcare industry and HIPPA requirements/liabilities and adapt as needed. Certainly not perfect but it's a good starting point for widespread data laws.

The question is, will our representatives actually give teeth to real data protection legislation (not a facade with no teeth only enacted by name) in the US or are they too deeply in bed with industry that they'll protect business rights over real people who suffer real direct damages.

Looking out how the spam act played out, which allows implicit opt in compared to Europe’s explicit opt-in.

I believe US govt will always be at the mercy of corporations.

Now some things are great. Like CCPA, California’s version of GDPR. But getting it accepted throughout the US is a mammoth task.

I have hope though.

I've been wondering: if there was a world government, corporations would probably reach a point in which they are unstoppable from a law point of view. The bigger the machine, the harder to steer it in a good direction.

> I suspect we as a society need new legislation to deal with these sort of issues.

Why not ban targeted advertising altogether?

Because it has value, both to the advertiser and to the target, compared to un-targeted advertising. Advertising is an attempt to transfer information. Targeted ads means that the information is more likely to be relevant, whatever its other downsides. Let's not throw out that baby with the bath water.

"Advertising is an attempt to transfer information" is deeply misguided unless you adjust that to say "transfer very biased information". Advertising is an attempt to influence one party to give their money to another party, generally through manipulation and guile.

Targeted advertising is like the difference between spam and spear phising. The person being advertised to rarely (if ever) benefits.

I benefit if Youtube shows me advertisements for desk chairs and lathes instead of beauty products and kids toys. Targeted advertisements help me discover new products and product categories, while untargeted advertising just wastes my time. This is in essence no different than companies buying advertising time in specific TV shows with a known audience.

Of course the abuses are also plentiful and dangerous. We probably do need a lot of regulation. But in general targeted advertisement is a useful thing to have.

The equivalent of buying advertising time in specific TV shows with a known audience is... buying adverts on specific Youtube channels with a known audience. Funnily, a lot of Youtubers now perform advertising of this sort - I'm sure you've seen the VPN ads.

This, like TV, doesn't require tracking of individual people who haven't consented to such.

> This, like TV, doesn't require tracking of individual people who haven't consented to such.

That's a stretch. How do you think they determine any information about the "known" audience? Obviously, they do all sorts of research to determine more about the audiences watching certain shows and channels, likely by sifting through social media, show reviews (IMDB, etc), and elsewhere to determine who's watching what shows, then looking into their profiles to determine their interests. Aggregate that data, find what they all have mostly in common, and cater to those interests. It's just a more generalized and difficult process of the same thing, and eventually it's going to become more narrowed and specific to individual targets.

The difference is that if I don’t want to let anyone know that I watch My Little Pony... I don’t have to! There’s no little black box connected to my TV that tells an advertiser that I’m watching it without asking me.

I can also have a discussion with my friends about My Little Pony and how amazing the last episode was without an algorithm picking that up, unless I publish it to the world or explicitly send it to the advertiser.

I understand your point, and I agree that it's easier to keep your television viewing habits hidden from your internet viewing habits, for obvious reasons, but I'm just pointing out that there are still ways to aggregate data to the point where they are able to determine, with significant accuracy, which ads are the most effective based on demographics, locality, cross-referencing social media, web traffic, consumer surveys, department store sales information, and probably tons of other details.

They benefit when they use valuable services for free, which is paid by targeted ads.

> The person being advertised to rarely (if ever) benefits.

Instagram has gotten so good at targeting me that I probably click on at least 1/2 the ads because I find them interesting. I've purchased things because of those clicks too, and have enjoyed the purchases. Things I would have never known about were it not for the ads.

Targeting doesn't work. There is no baby.

I recently bought a set of clamps on Amazon to join two shipping containers together. Since then I've seen a bunch of related ads, such as for shipping container vents, shelving, etc. I clicked on a couple of those ads, and while I didn't buy anything, I did learn some useful information. I probably would have learned less, if anything, from untargeted ads in those same slots.

> while I didn't buy anything

And so targeting didn't work!

Yes, "targeting" can put stuff in front of your eyeballs that may occasionally have marginal utility, but for sales? Nu uh.

In the baby/bathwater metaphor, you saw some ads for strollers. Still no baby.

It didn't work for the advertiser, but it did for me. I learned about options and prices for container accessories, which will help me make future choices. I would not have been better off if those ads had been less interesting to me.

“Targeted advertising” is just a euphemism for the secretive creation and sale of dossiers on unwitting Internet users. It should already be illegal under existing laws.

In most cases, this isn't true. The dossiers and maintained very closely by Facebook, Google, etc in order to leverage their knowledge on a target to produce the most effective targeted ads. If they sold the dossiers, they would lose the continued revenue.

Most things has value by some definition. Question is if the sum is positive. I'm not sure that is the case for targeted advertising.

No advertising is really untargeted. Even billboards tend to carry ads for the type of driver that passes by them and broadcast TV has ads for the type of person that watches that show.

Ads targeted to an individual without that individual's consent should probably be banned. In addition, the law should make it clear that when a company does hold data about individuals, the individual should have some rights to that data including the ability to block the sharing or transfer of that data.

So, when Google buys FitBit, every user of FitBit should have to explicitly opt-in to their data being transferred to Google.

> Advertising is an attempt to transfer information.

If you want to inform me, just give me a website I can visit where I can enter my needs and provide perhaps some context information, and which deletes/forgets this information when I leave. There is no need AT ALL to figure this info out behind my back.

The use-case isn’t advertising, it’s QoS. So you collect the data and give your best customers fast access, or maybe you balance it out: your most complaining customers get preferential treatment and the most reasonable wait a little longer on the line because you know they won’t complain.

Or, framing it more broadly: mass personalization implies a worse deal on average for everyone on the atomized/consumer/low-power (individual) side, because the high-power participants (companies) will optimize their outcomes at the expense of individuals.

So I originally studied chemical engineering, and one of the common catchphrases is, "regulations are written in blood." The reason there's a requirement to put a pressure relief valve on that tank is because at some point a tank like it didn't have one and it blew up and killed people. However, safety in chemical engineering has been evolving over centuries as we have understood more about the dangers and consequences of dealing with chemical manufacturing.

For software, it feels like we're only at the beginning of understanding the dangers and consequences of the software, business models, and technology our industry has created. Unfortunately, if it follows the same path as other engineering disciplines, we likely will experience decades or centuries of bloodshed before it is regulated appropriately.

>will our representatives actually give teeth to real data protection legislation

No. The majority of them don't even understand what data is being collected, how it can be used, or the technology behind any of it. Until the people in office change, the idea that our representatives can or will protect us is toothless and spineless.

What trouble Congress is in! They have to be experts in law, warfare, every industry from oil refining to adtech, science (at least as far as funding it goes), ecology, economics, medicine...

In fact I would say that it's impossible to expect anyone to understand enough to know what they're legislating. Aside from being a powerful libertarian argument against the excessive involvement of government, I think it shows that we have to figure out a way to work around the fact that congressmen don't understand everything that they're in charge of, rather than trying to remedy it.

Congress used to have an office which would inform them of how things work, but unsurprisingly, proceeded to dismantle it. https://en.wikipedia.org/wiki/Office_of_Technology_Assessmen...

This is why members of Congress have staffers and various groups like http://www.loc.gov/crsinfo/ which have subject-matter experts on staff to offer advice and research arbitrary topics of legislative interest.

A quick refresher on the details of how congress actually goes about their day-to-day plus the roles of the various permanent government and de facto government organs, shows "expertise doesn't scale" isn't really a problem. If it was, the whole thing would have come toppling down ages ago. So the libertarian argument is only "it's hard to do well", not "it's impossible".

I'll leave you to find your own references to get a detailed picture, but in short two basic forms of organizing do a lot of the work: big teams/staff for each congressman to help out, and special interest committees and caucuses. On top of that at least some take the idea of "representation" somewhat seriously, so if they need to know about a topic they're not experienced in, they tend to meet with supposed experts in those topics (which can come from a dedicated pool, lobbyists, state university department, and occasionally private industry owners or high level employees) for information and sometimes policy recommendations.

That's a cop-out. Data use and technology are major issues that are required understanding going forward. Understanding the oil industry is not at all the same as having a basic understanding of technology. Technology usage is only going to grow in scale.

Yes, because that's what they are - representatives. Of a general public.

The only way to make these chameleons (pretend to) care about an issue is to make the general public (aka voters, source of their wellbeing) care about the issue.

Isn't GDPR enforcing on this vein? You could build something similar in North America.

This is already a big (and largely unaddressed) problem with the big 3 credit CRAs, if you know enough about a person you can very easily request their credit report and get the keys to the kingdom (so-to-speak) - everything you didn't already know.

I mean, I already request credit reports for my husband without issue, for example (with his permission! - he finds it much easier to just ask me to do those things for him rather than doing them himself).

In this case, since email address is part of the report they could only send the report to the email address on file for "security," which would be a big improvement over what the big three CRAs are doing with annualcreditreport.com.

I wonder what the additional risk is though given that, iirc from the times I've requested credit reports, the amount of info needed to retrieve it is enough to have already stolen my identity. So in that case it seems the additional risk is low.

CRAs are a scam from top to bottom.

A bank makes a lot of money, but in theory, it's doing an important job which benefits society. That job is independently assessing creditworthiness. Of course, it's hard to assess creditworthiness if you don't know if someone is making a lot of loans at different places. So, there needs to be a system for credit monitoring. But credit monitoring is not credit rating. Credit rating is the one job a bank is supposed to do. Letting someone else do it undermines the whole purposes of the independent financial system. We might as well just dissolve the banks and move to a centralized planned economy if that's what we're doing, so that at least the centralized rating agencies will be democratically controlled.

So, to begin with, CRAs shouldn't exist and undermine the basic purpose of the financial system. On top of that, they are incredibly incompetent and corrupt as seen by the Equifax breach. It was clear in the early 2000s that the old system in which people would present a few pieces of relatively obscure personal identity to open a line of credit was no longer workable because the data was now subject to trivial duplication. Instead of fixing this, the industry created the concept of "identity theft" in order to falsely shift blame onto an unrelated third party.

I "had my identity stolen" a few years ago. The event had nothing to do with me, so all of the language around this is wrong. What actually happened was first a criminal learned some information about me, then Verizon chose to give the criminal a line of credit on a cellphone, then the CRAs reported that I was profligate to anyone who asked. Saying "my identity" was stolen makes it seem like I was somehow a party to any of this. "My identity" is not a property of mine; it is a property of the reliability of the CRAs' data. What actually happened was the CRAs had their data polluted by the combination of a criminal and lax identity checking at Verizon, and then the various guilty parties forced me to do their data cleanup for them.

What should have happened in the mid-00s was that the credit monitoring agencies, created systems where you can prove your identity to a notary public and get some sort of signed certificate gizmo that you can use to get a cellphone or make a car loan. But because the whole US financial system is corrupt, it instead outsourced all of the liability onto consumers.

Agreed. The whole idea of "identity theft" stinks of PR lubrication. Your identity cannot be stolen, but "identity theft" is a clever, cynical sleight of hand that obscures what really happened: credit fraud, specifically fraud that is the responsibility of the party issuing credit and the criminal propagating it.

I agree with this idea in principle, but I am unsure of how it would work in practice.

Say you open a credit card, then try to say it wasn't you..... what would a bank need to do to prove it was you? The things they would provide are already the things they have... your signature, your information, etc. What EXTRA bit would they start collecting that would prevent fraud?

Currently, banks ARE on the hook for fraud.... if you dispute fraudulent credit opened on your behalf, they have to eat the cost.

I don't quite see what the difference would be in this alternative world... currently, someone applies for credit, the credit issuer decides it is legit, and issues the credit. That would still be the same. Say it was fraudulent; the fraudster doesn't pay it off, so the issuer tries to collect... at that point, you say "hey, I didn't open this credit!"

Well, the issuer is going to say "yes you did, here is the information I have saying it was you"... how would that be different in your alternative world? Maybe you would require more verification steps... but what? Picture of you holding a sign saying you signed up for the credit? Video? What could you possibly provide that couldn't be faked for fraud? What could the issuer require?

At this point, things are no different than now. The issuer says it was you, you say it wasn't, and then someone has to arbitrate and decide who was correct.

I guess I just don't see how we can do it better (although I would LOVE to do it better!)

The issuer and arbitrator are, if not the same entity outright, are so far in bed together they should be common-law spouses. Let me explain one of 2 possible outcomes based on socioeconomic factors.

A) you have money to keep a lawyer on it; No problem.

B) you don't have money for a lawyer; Tough shit.

Nothing beyond real unilateral enforcement of the system already in place is required.

It has been done better in other countries and could be done better in the US if there were political will to do it. There's a whole universe of cryptographically signed certificates that we in the US don't use. The hard part is not signing a cert; it's making sure the certs are given to the correct people and having a procedure for when a cert is lost. Estonia has done this well; Korea has done this poorly. But it's quite doable if you have political will for it.

Does that then make the cert a high value target? How do you get people to protect it and use it properly? If it is stolen, does it actually make it HARDER to prove you didn't open the credit line?

This is not a theoretical topic. Other countries have electronic signature system and you can evaluate how well or poorly they are implemented: https://en.wikipedia.org/wiki/Electronic_signatures_and_law

> We might as well just dissolve the banks and move to a centralized planned economy if that's what we're doing, so that at least the centralized rating agencies will be democratically controlled.

In the history of central planned economies, never have they been “democratically controlled.” Despite the name, places like the Democratic Peoples Republic of Where-ever are never democratic nor are they republics.

> because the whole US financial system is corrupt

Is that actually true or just hyperbole?

It's actually true. If you don't believe me, go try to start a bank. Here's a handy link to get you started:

https://www.federalreserve.gov/faqs/banking_12779.htm

How does your link support your assertion of corruption?

The link doesn't. The experience you will have if you actually go try to start a bank will. I only provided the link to point you to the entrance of the rabbit hole.

I don't see how the fact that the process of becoming a bank is strictly regulated means that it's corrupt?

It doesn't. What makes it corrupt is that banks are not in fact strictly regulated, it only appears that way. But there is no way I can prove that to you in an HN comment. I would have to write a book. I can point you to a lot of circumstantial evidence but there is nothing probative in the public record (see below). The only definitive evidence I have of the corruption in the system is my personal experience, some accounts of which I have published on my blog. But if you don't put credence in my conclusion, then you will likely not put credence in my evidence either, because I can't prove any of it. The only way I can prove it is to invite you to undertake the same journey I did. If you do that, I predict you will learn first-hand the same thing I did: the system is corrupt, and whether or not you succeed in penetrating it will ultimately depend entirely on whether you have the right connections and whether they decide that you can be trusted to toe the line on the unwritten rules, the first of which is that you never talk about the unwritten rules to anyone who is not a member of the club.

Note that I never joined the club, so my theory of the unwritten rules is pure speculation. No one ever sat me down and said, "Look, son, this is how it is..." But I did spend ten years of my life on this, and during that time I accumulated a lot of evidence that I have a very hard time explaining in any other way. It eventually led me to a serious existential crisis.

BTW, it's not just the financial system. Academia is corrupt in much the same way, and in that case I did join the club so I can speak to that with some authority. That experience is one of the things that allowed me to recognize what I was seeing in the financial industry. But both academia and finance are centuries-old industries. They have become very skilled at hiding their corruption from prying eyes, and a big part of the strategy is making it appear that anyone who accuses them of corruption is a crackpot. (Which is, of course, exactly what a crackpot would say, and that, too, is part of the strategy. It's a horrible catch-22.)

So you have to decide whether to believe me or not, whether you think I'm a crackpot or not. Before you jump to a conclusion I invite you to look up my record. My life is pretty well documented on the web.

I think this might come down to how you define corruption.

I define it the way the dictionary does: dishonest or fraudulent conduct by those in power in order to advance their own interests over those of others.

How would you define it?

the magnitude of it matters.

Order a Big Mac - does it look like the ad? Probably not. Drink a Cola, does it feel like your life has turned around, probably not. is advertising dishonest - of course, but we all know that and we learned to deal with it. Is advertising corrupt, I would not say that.

Thus for something to be truly corrupt it needs to go beyond a certain level of illegality.

There are plenty of small banks and credit unions out there thus the point that you cannot open a bank is not quite valid. Are some of the rules onerous, probably. Are some of the rules unfair and ridiculous, probably ... does it mean it is corrupt I don't think so.

> the magnitude of it matters.

The cost to consumers of financial corruption runs into the many billions of dollars.

> There are plenty of small banks and credit unions out there thus the point that you cannot open a bank is not quite valid.

I did not say that you couldn't open a bank. I said that if you tried you would see firsthand evidence of the corruption of the system.

The problem is not that the rules are onerous. The problem is that the rules are not applied evenly and transparently.

> The problem is that the rules are not applied evenly and transparently.

Of course not. Never are, again you are not saying much here. Also with the billions of wasted dollars. Of course, but that is a natural consequence of dealing with immense scope - it is going to be very inefficient and stupid. Still a far cry from actual corruption.

I feel that people tossing around the word corruption don't really understand what it means and it is a hyperbole - only undercuts the message.

A bit like the Soup Nazi in Seinfeld - he is not really a nazi in any shape or form - don't even mention real nazis in the same context.

> I feel that people tossing around the word corruption don't really understand what it means

I see. So your position is: I "don't really understand what [corruption] means" -- but you do. And because you possess the true understanding and I don't, nothing in my personal experience can possibly be evidence of corruption because you alone possess the true understanding.

Have I got that right?

> > The problem is that the rules are not applied evenly and transparently.

> Of course not. Never are

This is normalization of deviance. It might be true that the rules are never applied evenly and transparently anywhere and never have been, but it is one thing to posit this as a fact, and quite another to dismiss it as being inevitable (and hence acceptable) by saying, "Of course it's that way." No, it's not "of course." It's corruption, not just because the rules are not applied evenly and transparently, but because this is done by a group of powerful people for their own benefit at the expense of everyone else. Its inevitability is a self-fulfilling prophecy. By accepting it, you have made yourself part of the problem.

You can claim that people tossing around corruption don't understand it... but you in the first place don't understand the scenario OP is even describing (as they're unable to provide details, you couldn't possibly be making an accurate judgment). So it is far fetched for you to confidently claim OP is misusing corruption etc. here.

I am simply responding to what others also called out, that none of the evidences the poster claimed to exist were indicative of corruption,

hence the logical and reasonable assumption that the poster is misusing the term, obviously I can only comment on what is stated here,

Having joined academia at one point and seen "how the sausage is made," and subsequently left for ethical reasons that I have no way of using to hold anyone to account, I totally understand this comment.

It is so hard to put into words how these systems are corrupt, because these systems create an enculturation / religion around themselves. By the time you see how the entire system works, you are powerless to simplify the mechnications that make that system corrupt (if you even choose to recognize the corruption). You can't "just start an alternative," because the system exists at a local maxima and will crush your alternative or assimilate it into the existing system.

When people are taken advantage of by these secular religions, it is so normal and engrained in the societal fabric that we almost don't have the language to expose the fundamental dishonesty and fraud of these systems. Victims will say that there may be some bad actors at the edges, but on the whole, "this is the way it's supposed to be."

Yes. Exactly.

> What actually happened was first a criminal learned some information about me, then Verizon chose to give the criminal a line of credit on a cellphone, then the CRAs reported that I was profligate to anyone who asked. Saying "my identity" was stolen makes it seem like I was somehow a party to any of this. "My identity" is not a property of mine; it is a property of the reliability of the CRAs' data. What actually happened was the CRAs had their data polluted by the combination of a criminal and lax identity checking at Verizon, and then the various guilty parties forced me to do their data cleanup for them.

Right -- and really, that should be some class of negligent libel on behalf of the CRAs.

> Letting someone else do it undermines the whole purposes of the independent financial system.

Even small regional banks have their own internal credit rating algorithms. Credit ratings from CRAs are generally consumed either in aggregates (a buyer on the secondary markets wants a traunch with an average credit rating of X) or by less sophisticated parties such as landlords.

> since email address is part of the report

I don't have a business relationship with any CRA. If they have my e-mail it isn't because I gave it to them intentionally. Nor is it guaranteed that they have a valid email that I still control.

I meant the Sift reports, not the big three CRAs. The Sift reports will contain your email address since it's reporting mostly on online services (that require an email address to use)

This problem is much bigger than just the CRAs. The fundamental problem is that the information that is used to authorize transactions (including financial transactions) is not bound to the transactions. It's re-usable. That makes phishing trivial and hence inevitable.

The situation has gotten slightly better recently because of the widespread deployment of chip cards, but these only protect POS transactions. They don't help with e-commerce or non-financial transactions like credit report requests.

Not only that, but so much "consumer data" is probabilistic - they believe it's you who's doing something, but it could have been your ex logging into Pinterest on your phone one time, which then linked across her other devices and now "your data" is actually leaking her private data from the rest of her life.

The one that offered an online form requested a copy of a government issued id to confirm identity. How long til someone poses as one of these agencies to collect data too?

I've sent a couple of GDPR Subject Access Requests out of sheer curiosity. The answer is - in my experience - 'it varies'.

One requested a copy of a photo ID or passport and were happy to accept a partly redacted copy with 'FOR PROOF OF ID ONLY - (company), (date)' over-typed on the scan in red.

Another requested I email them from an email address they had in their records, or log in to change it and resubmit the request.

Most of the others sent the data without any ID checks whatsoever.

Curiously the one who did the most ID checking used an exemption (I forget the specific GDPR Article number) to redact nearly everything which wasn't shown on their web portal. Their position was that "revealing this data (specifically messages on trouble-tickets and their staff's internal notes) would adversely affect the privacy of our staff".

Amusingly I could just log into their portal and view the trouble-ticket history (but of course, not the internal notes). I can only assume their refusal was because there were comments in the internal notes (on my or other tickets) they weren't comfortable disclosing.

What items did you redact from your ID/passport?

I sent a driving licence and redacted the licence number, then overtyped the whole thing with the text in my previous post.

My goal was to make certain that if it leaked, the overtyped expiry date should make it useless after a certain point, and the company name should make any company other than that one question the source.

As a side effect, it'd also clearly identify the source of any leaks - but that wasn't my primary goal.

I moved the text so the name and address (which they already had) and date of birth (which isn't really a secret) were clearly readable.

>My goal was to make certain that if it leaked, the overtyped expiry date should make it useless after a certain point, and the company name should make any company other than that one question the source.

>As a side effect, it'd also clearly identify the source of any leaks - but that wasn't my primary goal.

Wouldn't a malicious actor just add block text over your text saying "only for identity verification for SomeOtherCompany" ?

They could do the same for the expiration date, although I wonder if any company actually bothers to check the expiration date

I don't know how GP did it, but I would have made the text translucent and make sure it covered the entire image so that there's no easy way to obfuscated the watermark without also obfuscating the license itself.

Ahh, of course - I didn't think of that. Thanks, obvious now that you mention it :-)

translucent text is nearly trivial to remove

> Another requested I email them from an email address they had in their records

Wow. They didn't mail it and require confirmation of receipt, they just required a (trivially forged) mail with that email address in From?

> I can only assume their refusal was because there were comments in the internal notes (on my or other tickets) they weren't comfortable disclosing.

more likely just following an established policy that applies to all such information, to take personal judgement out of the equation. almost certainly absolutely nothing to do with your “file” in particular.

>Another requested I email them from an email address they had in their records

so our email providers can get all this data? They can DKIM sign such a mail and simply never have the relevant emails show up in your emails.

Great questions! This conversation is already pretty mature I think. Take a look at Bruce Schneier to see some great synthesized commentary on the questions you're posing.

There is a pretty great talk about how companies fail at this - https://www.youtube.com/watch?v=gd3DiRuvr8A ("SOUPS 2019 - Personal Information Leakage by Abusing the GDPR 'Right of Access'")

"Of the responses, 24 per cent simply accepted an email address and phone number as proof of identity and sent over any files they had on his fiancée. A further 16 per cent requested easily forged ID information and 3 per cent took the rather extreme step of simply deleting her accounts."

https://www.theregister.co.uk/2019/08/09/gdpr_identity_thief...

Examples that I've seen with GDPR requests are:

* Scan of ID

* WebID - video call where they take screenshots of ID and your face

* Cookie - kind of makes sense since 3rd party web trackers Quantcast rely on cookies to identify

If your a company you can buy the data. Just need name and address.

The liability would be the same as a GDPR dataleak, or comparable. If the data leaked is sensitive enough, you might get fines and punishments by other regulatory bodies or industry bodies (PCI audit might be failed next time, so no card processing anymore).

The victim might be able to sue for damages incurred by the identity theft.

In my experience, some companies place high dilligence on the process. A bank I requested information from sent a postal letter containing a code to my mailing address. The Germany Postal Service has a special service to allow identifying people, so the letter contained the code and then I had to bring part of the letter back to the next postal station along with my ID card.

Once they got the confirmation of the ID card along with the code sent to me, they sent a CD-ROM with the information encrypted and the password via mail.

Wow, that's a good point.

Reply on news.ycombinator.com