Hacker News Reader

Comment by blibble | Hacker News Reader

their GDPR dump utility contains all of the information here , admittedly in annoying format... seems to be the database table directly as json)

View on HN

> their GDPR dump utility

link?

Wow, IIRC that link used to be much easier to find but it seems like they don't want it to be found... :o

"Request Your Personal Information" help article: https://www.amazon.com/gp/help/customer/display.html?nodeId=...

amazon.com link: https://www.amazon.com/gp/privacycentral/dsar/preview.html

amazon.de link: https://www.amazon.de/gp/privacycentral/dsar/preview.html

(They don't even mention "GDPR" on that page but that should be GDPR compliant.)

I really wish that GDPR had gone a step further and imposed some requirements over the shape of the data that companies are required to expose. For domains like ecommerce, or banking, or social media, companies should be required to export their GDPR data in the same format as each other.

Bonus points if companies are also required to allow users to import data in those formats. That would make it easier to avoid being locked into a specific platform: export your data from the old one, import it into the new one.

Before you say that this is impractical -- Google requires that other companies submit data to it in very specific formats (eg, product listings), so I don't see why governments can't impose similar requirements on companies, too.

It probably wouldn't be applicable for companies with highly-specific data models, though.

GDPR is about privacy and security, not interoperability. It was (and still is) a very controversial set of regulations, so shoehorning in more requirements would have made it even more unpopular.

Please check article 20 https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...

It only concerns file format right? I interpreted the preceding conversation as talking about format in the sense of data having the same schema and maybe being interoperable, and not just file format. Nothing I read seems to indicate that seamless interoperability is a requirement [0] [1].

Interoperability seems a little difficult to enforce, like brokers that don't support fractional shares might need to start supporting them to import data from other brokers. Edit: I guess this example is poor but I just wanted to point out that schema/interop also involves data domain, validation, etc.

[0] https://ec.europa.eu/info/law/law-topic/data-protection/refo...

[1] https://www2.deloitte.com/ch/en/pages/risk/articles/gdpr-dat...

> GDPR is about privacy and security, not interoperability.

    Article 20 [RIGHT TO DATA PORTABILITY]

    1.   The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where: ...

Right, and Amazon is providing the data in a commonly used format.

yes, I'm sure the dump of Amazon's 120 column table (with no details on what those columns are) can be easily imported into other firms software

There is no requirement in that law for a specific format, it just has to be something common like csv and not a random EDI file or binary blob with no schema.

It's about data protection, and giving users some means of control over how their data is used online. Privacy and security just happen to be the two very salient dimensions of that. If you read the GDPR wording, you'll see the phrase "data subject empowerment" pop up in various places, which is exactly what I'm after: more empowerment over what we can do with our data.

GDPR has its warts, absolutely. But I don't think that's a reason not to strive for even greater data protection measures for citizens going forward, especially if we amend the existing regulations to fix some of its unintended consequences.

[edit: typo]

Reading the first paragraph I was wondering if the data portability right (part of GDPR) might be helpful, and then you went on to say "Bonus points if companies are also required to allow users to import data in those formats". Dude, that is exactly what GDPR requires! You are describing article 20 literally :). I'm not sure about ecommerce, no idea why I'd want to import invoices into another web shop, but

> Article 20 \n Right to data portability \n 1. The data subject [you] shall have the right to receive the personal data concerning him or her, which he or she has provided to [the company], in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance

https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...

Right, but for the average user, it's not really feasible for them to receive a megabytes-large CSV of data in whatever format Amazon decides to provide, and then transform that into the necessary format for import into <Etsy/Ebay/Shopify>. We could make tools to do so, but then Amazon could just change what format they use for export, so we'd need to update the tools...

Regarding importing: you as a user have the right to provide your downloaded data to a different party, but there's nothing in GDPR that says that party must offer the necessary import capability.

> it's not really feasible for them to receive a megabytes-large CSV of data in whatever format Amazon decides to provide, and then transform that into the necessary format

okay yeah you're still describing Article 20:

> the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible

Reply on news.ycombinator.com