Hacker News Reader

Comment by yoaviram | Hacker News Reader

I'm one of the creators of YourDigitalRights.org, a service which automates the process of sending data requests (it's free, open source and were a registered charity). What is described in this article is, unfortunately, a common case with some big tech companies.

I've recently started an experiment to send data deletion requests to 600 data brokers and document what happens. It's dark patterns all the way down.

The solution is to escalate your request to the local data protection agency (attorney general in case of California). I believe that if enough of us do this it will make a difference, even in the case of Amazon.

Following this realization we've recently added an optional features which will follow up with you some time after a request is made, and depending on the outcome, offer to automate the escalation process.

View on HN

"I've recently started an experiment to send data deletion requests to 600 data brokers and document what happens."

Another idea for an experiment is to send 600 data deletion requests from 600 unique computer users simultaneously to a single data broker and see what happens. If the escalation process is automated when the data broker fails to respond, the most interesting results IMO will be from the data protection agency. It is difficult to ignore 600 cases. It also tests the broker's and agency's systems. In theory these systems should be able to scale. If they cannot, then it is arguable the broker and/or agency is making an assumption that privacy is something that only some people, a relatively small number, care about. At the very least there would be a question of whether these systems are adequate for what they are supposed to do.

This experiment might be thought of like a petition that requires a minimum number of signatures. What is the purpose behind having petitions and minimums for the number of people who sign them. Here, a minimum number of people must sign on to make a data deletion request before the bundle of requests are actually sent.

> I've recently started an experiment to send data deletion requests to 600 data brokers and document what happens. It's dark patterns all the way down.

I would love to read a long form piece on your findings!

It sounds like it would a great way to advertise YourDigitalRights as well.

We're going to be speaking about this at Good Tech Fest 2022 [1], and will also write it up post it to HN.

https://www.goodtechfest.com/good-tech-fest-2022

> The solution is to escalate your request to the local data protection agency

In many countries in Europe, you can expect a response within 30-90 days acknowledging receipt, and an actual response that they'll look into it and request a statement from the company after a year or so.

Sometimes you get lucky, but then only hear back that the company has now changed that one specific bad behavior (after profiting from it for a year or two) and thus the case is closed.

Zero meaningful enforcement.

Until NGOs start suing at scale, nothing will change.

In Europe the GDPR states that businesses have a single calendar month to respond to you, either with the data, how to easily get them, or a damn good reason why they couldn't comply in time.

It happened to me once that a business hasn't responded in time, but after I sent them a follow up that they are breaking the law by ignoring my request, they responded right away the next day.

I also only sent the requests to the biggest offenders, so the sample is small.

30-90 days is therefore possibly the period one should expect to wait to get a response, even though more than approx. 30 days is illegal.

I have been asking a broker to remove my data for weeks and they are giving me the runaround. However, I’m not in CA (another US state). Anything I can do?

Please send me an email with the details (it's on the website).

You're doing privacy a great service, you're charity is awesome!

Are your services also work outside of the US, like, say, Canada?

Thank you! We are about to launch support for the Brazilian LGPD, and have 17 other regulations we want to support this year, including Canada.

What is the process of getting all my data collected by GOOGLE and MICROSOFT?

https://yourdigitalrights.org/d/google.com https://yourdigitalrights.org/d/microsoft.com https://yourdigitalrights.org/d/apple.com https://yourdigitalrights.org/d/walmart.com

and APPLE?

and WALMART

Can we have a non profit for this? I think one of the issues for getting tax exempt status is designating a “charitable class” of people that it would be helping

Um, they are a charity?

> Conscious Digital MTÜ is a registered Estonian non-profit organization number 80600079.

Ah they are, wonder about the US version

The tax deductibility for us tax residents is a working major incentive

That's so great. I wish there was something like this for Germany.

A similar service for German users is Datenanfragen.de

We support the GDPR, so it will work in Germany.

When I went to the German site and tried to generate a data request, the generated email was in English. Is that intended? I think I'm Germany you're much more likely to get a response if you write in German.

Does the GDPR mandate usage of English? I know orgs that will allow antispam eat any communication not in the local language.

I really do hope our politicians in Canada pass something like this

Perhaps not quite what you’re looking for but this may be of interest: https://accessmyinfo.ca

Reply on news.ycombinator.com