Hacker News Reader

Comment by cdubzzz | Hacker News Reader

I like to believe this person’s email thread is at least partly to thank — https://news.ycombinator.com/item?id=24764371

View on HN

Thank You for pointing this out. I was about to write a comment believing they reacted in Good Faith. Acting in line with their Time to Play Fair ( Against Apple App Store ) Campaign.

So it looks like actually has nothing to do with Good Faith. And people often tell me I am cynical, turns out I am still too naive.

Company that does things for profit does not operate in Good Faith. Especially if it facilitates the exit of clients.

If it wasn't for GDPR in Europe, they would fight this tooth and nail. I would not be surprised if they enable this ONLY for Europe, because they absolutely-have-to and ignore in other locations.

I am in EU, so I cannot test, I would like to ask someone from Africa, America(s), Asia, Oceania to let us know if this is also enabled/available in their country/regions.

All companies do things for profit, that's their primary raison d'être.

In this case, "profit" being an accurate euphemism for "avoid GDPR fines".

Keeping customers satisfied leads to a good name. A good name leads to more customers, and both that and satisfied customers leads to long term profit. It appears some companies focus too much on short term profit.

In this case shareholders and investors are the main customers, with short term profits keeping them happy, execs get good bonuses, more money is poured in from market/vc to keep the gravy flowing. No incentive for the deicision makers to keep the product users(sometimes called just the products) happy, for the giants atleast.

An accurate description of the toxicity of publicly owned companies, accelerated by VC and startup culture.

In this case, users are both product and paying customer. Ads is one thing, but GDPR request showed they log every action related to the account.

>Ads is one thing, but GDPR request showed they log every action related to the account.

People praise Spotify for how good their recommendations are, where do you think they get data for things like that?

Execs might get good bonuses in the short term, but may be left in the lurch over time. Global wealth and population has been rapidly increasing for a long time which has propped up a lot of terrible decisions.

Some people eat to live and some people live to eat.

And it is the same with companies. Some companies carry out their business in order to profit from it, and some companies generate profits in order to sustain their business.

Maybe for private companies, but public companies sole purpose is to generate profit. If they are not doing it to the best of their ability shareholders will replace the executive team.

And this is why I think public companies are a terrible model.

This is a myth. Stop perpetuating it.

https://www.lawschool.cornell.edu/academics/clarke_business_...

>Usually maximizing shareholder value is not a legal obligation, but the product of the pressure that activist shareholders, stock-based compensation schemes and financial markets impose on corporate directors.

Your link agrees with me. If shareholders believe decisions are being made which lead to less profits leadership will be removed.

Your conclusion that the "sole purpose" is profit is erroneous. See sibling comment regarding Ben & Jerry's, for example.

Why then does Ben and Jerry's get involved in advocating for any number of political positions? (https://www.benjerry.com/values) They're a division of Unilever, a public company... an international conglomerate no less...

Certainly it can't be profit motive. Some of their positions would reduce profitability and alienating a substantial number of your potential customers can't be helpful for business either.

Maybe Unilever management or it's board are asleep at the wheel. Who knows, but there are plenty of counter-examples that demonstrate that no company is necessarily about financial profits alone. I'm pretty sure that investors know this, and invest for some of these non-financial motives as well... again, may not be the norm, but probably not rare for these companies either.

Ben and Jerrys is a luxury product. Being politically conscious is part of their brand and a reason they are able to charge high margins. They believe that differentiating themselves leads to long term profits. Critically, it's not just short term profits that are being maximizing. Creating a strong brand is the only way to ensure your product won't be undercut which is why firms are willing to engage in activities which build goodwill among their customers even if there are no immediately obvious profit motives. Political donations are part of Ben and Jerrys marketing budget.

What evidence do you have that such political activity is not intrinsically motivated?

The fact that every decision public companies make is done to maximize profits. If Ben and Jerrys didn't cultivate this image they'd just be another company selling overpriced ice cream. Instead I think it's fair to say they're an institution. That's not to say the people running B+J don't believe in the cause they're donating to, I'm sure they do, they just also believe it's good for business.

Google has had takeout for many, many years.

Takeout doesn't allow you to take your email directly from one service to the other.

Run a loop on all the takeout e-mail and send them to your new e-mail address, spoofing the headers for each e-mail?

If you do it yourself it's not service to service. You could have done that with the Spotify json takeout.

> If it wasn't for GDPR in Europe, they would fight this tooth and nail. I would not be surprised if they enable this ONLY for Europe, because they absolutely-have-to and ignore in other locations.

They have to follow GDPR everywhere in the universe except possibly the United States, because they are in an EU country.

GDPR applies if either the user is in the EU or the processor or controller is in the EU.

According to their site, Spotify service in the USA is supplied by Spotify USA, Inc. and Spotify service everywhere else is provided by Spotify AB, so I can’t tell if GDPR applies to US users of their service.

The CCPA in California is similar in thrust.

>And people often tell me I am cynical, turns out I am still too naive.

The final stage of cynicism is understanding that to fit in socially you have to indulge other people's desires for cute narratives over simpler and more roust explanations of behavior.

No you don’t. You just have to be better at delivering medicine.

c'mon mate, even a wisecrack that the lawyers made them do it can be enough to ruin flow and be a total buzzkill. Nobody wants to be the weird guy correcting banter.

Who said anything about correcting banter

Who is Good Faith?

I cannot upvote this person enough. Such clear expression, and insistence on their right. Love everything about this thread, even if we'll never know whether this was actually what made the difference.

<3 <3 <3

That entire email exchange is a thing of beauty.

Massive, massive gratitude and goodwill toward u/confiks. You, sir/madam, have executed a brilliant maneuver.

Thank you, original linker, for pointing this out.

I suppose it could act as inspiration for others to tackle other companies to task to provide personal data portability and simple integration with third parties.

I think it was key to the argument that the integration with third parties had previously worked.

Without that others could probably engineer a defense around technical infeasibility.

Wow! Big ups to Confiks, they achieved something great here. I'll be sure to emulate this in the future.

What a legend. I love seeing people be so adamant in getting through bullshit corporate talk, and seeing it actually result in something for once is even more incredible.

Really need to save this one for the future "GDPR is useless bureaucracy" naysayers. (Hi you, I know you're here reading this thread and mentally blocking this out already)

GDPR has created fertile grounds for the rights of users to their data. This is exactly the sort of interaction where laws are putting power in the hands of citizens they can use when companies either don't give a shit, or don't realize what they're doing is immoral.

It's amazing what you can do with some persistence and threats of legal action - especially when you mention using a lawyer and recouping costs.

Which service/software works well for moving playlists between Music Services?

I'm trying to move from Google Music to Spotify. Moving my playlists has been my greatest pain. They usually don't find a lot of my musics, or worse, choose a different version of the music. Usually a live version of the music is chosen, full with annoying cheers of the audience.

I gave up on that, when I realized that Google's spin-down of the music service has meant MOST of the songs in my playlists are now gone. When Google de-licenses the music, it vanishes from playlists. I'm still amazed Spotify never built enough of a Google Music client to help users login and gather their playlists.

I stopped paying for Google Play Music years ago, once I found out about this behavior. Playlists carefully built over time, suddenly changing and shifting. Music is huge to me, and here was Google, playing with my memories. Not being able to listen to some songs is bad enough, but entirely remoing them from the lists felt like gaslighting. My memories were being played with, and Google was telling me "here's your playlist", but that wasn't my playlist anymore.

I've never noticed it. Another great reason to uploading my own music.

I've used tunemymusic.com for a few different migrations (Spotify to Apple Music, Apple Music to the trial of Youtube Music). It pretty good although you need to do some manual verification because it messes up around 1% of the time, especially with the more obscure stuff. Sometimes it'll transfer the song as a live version or even someone else's cover so a bit of manual verification is helpful.

I don't understand GDPR too well -- does this mean every company must build APIs that would be sufficient to allow competitors to import user data from them?

It does seem onerous. I wonder if, "so, we will email SongShift directly" etc., would do.

I guess the law doesn't say "for free" ? So perhaps they could charge a fee for each API use...

It otherwise seems unreasonable to require data-holders (/"controllers") to pay the costs of this "direct transfer", esp. re building and maintaining an API.

They have in their possession an object which the user owns -- their data -- would we, in analogous cases, require stores to do anything other than "hand it back" ?

This seems quite an odd law.

EDIT: given downvotes, let me clarify: I like the law. It is useful. I just want to understand the moral/legal/economic logic.

This law imposes costs somewhere, and prevents some services being offered.

> It otherwise seems unreasonable to require data-holders (/"controllers") to pay the costs of this "direct transfer", esp. re building and maintaining an API.

Consider it a cost of collecting the data in the first place.

You're assuming that they are deriving additional value from it. That isn't universal, but the law is.

Eg., consider me uploading some image files for processing and then downloading them. The website keeps those images only insofar as I wish, and never analyses them or derives value from them beyond what I permit -- and suppose the default is to permit nothing.

Then it seems odd. Since this is more like taking my shoes to be repaired. It would be onerous to require repair shops to send them elsehwere.

I think the theory is if the data controller does not derive value from storing the data they should not do so. In spotify's case they plainly do. Without user created playlists they would be up a creek.

If they get no value from it they're free to delete it

An alternative is to think of data as dangerous chemicals.

You can acquire it and store it, but you have to follow some procedures : - do not expose your employees to it - do not leak it in the environment

It then falls to the company to make the cost/benefit analysis : is this chemical important enough to our process to justify these hasles.

The data export also does not need to be a perfect API, dump a huge json and let third party handle changes.

I guess the relevant section also quoted in the original post by Confiks ("the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible") may be up for interpretation, and as a result not everyone might have provide such an API. But this specific case, we can be sure that it most definitely was technically feasible, as the feature used to work before their ToS change and it merely stopped working because they wanted to block SongShift.

You don't have to provide an API to transfer between accounts on the same platform, but you do need to provide a way to get all your data off the service, which another service can use to import.

read the emails this person sent to spotify.

The API was already implemented and shut off. He did not as them to implement the API, he asked them to turn it back on and there is a large difference.

Am I alone in thinking he isn't entirely correct? To my understanding with GDPR (I'm no expert, just on the developer end trying to adhere to it), he has all the right to get a copy of the data, as well as have that data be transferred to another controller.

He does, however have no say in the exact data transfer protocol used for the transfer. If Spotify wants to disable an api and shut down production resources, I don't see how a GDPR request can compel them otherwise. As long as they prepare all the data, and allow for the transfer, then they are complying with GDPR. Even if the API at some point existed, it doesn't mean they are required to maintain it.

The other side of this is that Spotify's answers were perhaps too earnest in detailing why. When arguing it is against their ToS, it doesn't really fly with GDPR anymore, because that implies they have everything in place, but they don't want to. They could have just said "we'll compile all the data and facilitate a transfer on your behalf", and the user really wouldn't have the slightest case.

So to sum up, my take is that both are wrong. Spotify in arguing its against their ToS (it doesn't fly). And the emailer arguing that they are entitled to Spotify enabling their api (they aren't).

Afaik GDPR says where it's technically feasible. The interpretation of technically feasible may vary, but given that the API was live for some time, it could be said it is feasible.

That being said I am no lawyer and I don't know what I'm talking about.

That is more or less why I wrote the things I wrote. By arguing it was against their ToS, they implied it was technically feasible. It however doesn't mean it isn't also technically infeasible, so I still believe Spotify could take a big fat dump of the data in any format they chose, zip it up and send it to the other controller, and it would be within the GDPR requirements.

If people think that GDPR grants consumers the right on which services exist and how data should represented etc, then I think they are misinformed.

Spotify could have answered with "That API is no longer available, but we will facilitate the transfer of an archived version of the data", and... I mean, what clause of GDPR does he have to complain or demand they do anything different?

No: the root of the matter is that it has to be "technically feasible", which with proprietary software you can't ever prove. This was a special case because they already showed it was possible (it was working), then they took it away.

Even here, if they reaaaaalllly cared (and had good reasons to, other than "we want to lock in customers"), they probably could take the feature away - they'd just need to play the CYA game much better, and be willing to risk a hefty fine based on whether a court believes your reasons for technical infeasibility. After all, not everything that was technically feasible stays so in a changing environment.

Another think they can do is just try occasionally, and see if people give up.

Reply on news.ycombinator.com