Hacker News Reader

Comment by oefrha | Hacker News Reader

Step 1: Mega Corp buys small company A most of its users don’t give a shit about.

Step 2: Mega Corp shares all its user account info with small company A.

Step 3: Mega Corp sells small company A to ethically questionable company B (yes, I find the entire business model of Scribd very questionable), along with user info of all its users. Now the vast majority of those users who never gave a shit about A nor B are on B’s spam list.

Yes, the casual sales of user info may not mean jack shit to Mega Corp, but it does mean something to B, and users who are completely unrelated to A nor B have a right to be incensed.

(Btw, I haven’t received this as a LinkedIn user, so can’t attest to the accuracy of TFA. Maybe they don’t even have the courtesy to notify non-EU users?)

View on HN

There's some excellent points in your comment that are not served by the breathless conspiratorial tone of the parent article.

It's also possible that LI didn't share extra info at all with Scribd. The author takes a huge leap and assumes that all 500m LI emails have been transferred to Scribd because he got an email he doesn't recall ever signing up for.

Oh it's absolutely the case, from someone who:

  * Never deleted an email from archive
  * Don't recall ever registering on either ScribD or Slideshare
  * Got the same email as the author, which is the first from either Slideshare or ScribD
  * Could log in using my LinkedIn account and saw all my personal information from LinkedIn there

I didn't even receive a LI email, checked my spam as well, yet I can login to slideshare and see my account with full name and profile scraped from my LI account. Great!

By the way, my email is marked private on my linkedin account, but now it's on slideshare. So selling information you marked as private!

But how can you be sure you data didn't fit shared the moment you did login with linkedln?

I can't quite parse your sentence (typo?) but I think you mean to ask whether it's possible that LinkedIn shared the PII when the user used their LinkedIn account to login to Scribd?

Doing so would in any case (I assume) violate the GDPR if LinkedIn doesn't doesn't have your informed consent for that. Perhaps their trying to weasel this under the "technically necessary" exception, but that strikes me as unlikely to hold water - at best they'd need to share some minimal token (e.g. if you sign in via google or some other auth provider, you get told what data google will share in advance, and it's possible to share fairly little).

Yes that is what I meant, to late to edit.

The problem is that you might have "force opt. in" into a TOS agreement which states you allow the data transfer. So depending on the sign up with linkedln dialog it might have been legal...

Consent must specifically be freely given; it's not a valid basis if it's "forced opt in" in a TOS. I'm not sure if there's any jurisprudence here (on exactly what freely given means). Even if consent with a TOS were to be considered freely given (I don't think so, but IANAL), it would still need to be clear, and most TOS fail to clear that hurdle. At best it would be a push, and in principle if the legal basis in invalid, punishments can be just as severe as if you hadn't bothered trying at all (although clearly the enforcement at the moment still appears to give violators a lot of chances to repair any issues; so in practice a seemingly reasonable if invalid attempt might at least buy some temporary reprieve if every enforcement comes knocking).

Reply on news.ycombinator.com