Stross: Klout violates UK privacy laws.
antipope.org
antipope.org
They also say (in "Profile Settings"):
> Klout only analyzes public data or data that we are given explicit access to. We never share your private information with any third party or brand and you can control the information that we make available on your Klout profile page.
The full sentence from Klout's privacy policy (which cstross 'edited' out to make his point) reads:
> Service Providers. We engage certain trusted third parties to perform functions and provide services to us, including, without limitation, hosting and maintenance, customer relationship, database storage and management, and direct marketing campaigns.
I believe this lets them off the hook for storing/using your PII with service providers like AWS, Rackspace, Salesforce and Mailchimp/CampaignMonitor.
Disclaimer: not affiliated with Klout in any way except as a user.
EDIT: Yeap, from Twitter's privacy policy:
> Twitter may use both session cookies and persistent cookies to better understand how you interact with our Services, to monitor aggregate usage by our users and web traffic routing on our Services, and to improve our Services.
> We engage certain trusted third parties to perform functions and provide services to us. We may share your personal information with these third parties, but only to the extent necessary to perform these functions and provide such services, and only pursuant to obligations mirroring the protections of this privacy policy.
There's a comment over on the post that nails exactly what I'm trying to say, and in a much better way: http://www.antipope.org/charlie/blog-static/2011/11/evil-soc...
I live in the UK. I thought it was quite funny that he tried to compare the privacy policies by saying the UK is better. Now the UK might be better in some regards but with the amount of CCTVs abound I still say they have problems with privacy.
The UK has a large amount of privately owned and operated CCTV cameras. Most are operated by private shop owners etc. They solve countless crimes every day, and deter crime.
There's also CCTV put in place by local councils, to stop anti social behavior and again, prevent crime.
You've been reading reddit too much I expect. There is no conspiracy, no centralized CCTV program where the government spies on us all.
Unlike some countries I could mention, we have a pretty low crime rate. Some of which is due to having various CCTV systems.
The UK does have a problem with speed cameras though. It's a way to generate extra revenue from the population.
I would say you have a low crime rate due to social reasons, you can't just point and say it's because of CCTVs.
I'm sure councils also install CCTV cameras on the streets just for the fun of it, or to spy on people rather than to cut down anti social behavior, muggings, pickpocketing, knife crime etc.
Yes, we have a low crime rate due to our culture. But we have an even lower crime rate due to the private CCTV cameras, and council run CCTV systems.
I don't really understand how your privacy is invaded by shop owners videoing the shop to make sure people aren't stealing stuff. It's not like they make the tapes public or don't erase them after a few days...
How many breaches of trust have you heard of? Have there been cases of shop owners identifying people buying sausages and posting their mugshots online or something?
Don't stretch your assertions too far. From the reports I read (think it might have been a Home Office report) there was no significant change in crime rate, but crimes were less likely to take place where there was a CCTV camera. The criminals move on to unprotected areas, you could say.
n.b. the top comment in the thread is certainly BS. CCTV is installed in public (or quasi-public e.g. shops) areas where nobody has an expectation of privacy. If they made the situation worse, you'd have to define what 'negative privacy' could mean...
As the linked post demonstrates, privacy issues are covered by the Act - but as far as I'm concerned, you have no privacy whether half a dozen strangers are watching you in the street or whether you're being broadcast to the whole world.
Slipping off-topic, I can't stand that line. You break the law, you get fined. Keep within the law, you don't get fined. Quite frankly if you want to hand revenue to the government via speeding go ahead. But you don't like the law campaign to have it changed, don't just ignore it then moan about being fined for ignoring it.
My issue with speed cameras is their location. They are predominantly on high-speed roads which with a few exceptions are not overly dangerous. I think we should be concentrating on residential areas particularly near schools and parks (the road past the school I used to live near is officially a 20mph zone, but I don't think many people took it at less than 30 and there was no camera or other such equipment there except on the few occasions when a motorcycle-mounted cop sat near the blind-ish corner with his radar gun).
You break the law, you get fined.
Around 90% of the population break the speed limit. If you drive on a motorway, doing only the speed limit, you'll be holding up traffic.
When 90% of people break a law, that's a pretty sure sign that the law is bad and should be changed.
Thankfully, the law is soon to be changed, increasing the speed limit on motorways from 70 to 80. It's a start. Politicians have taken notice, and seen that the current speed laws (Put in place decades ago when cars had crappy brakes etc), are out dated.
The mobile speed cameras I see most often are hidden behind trees in areas that have a stupid speed limit (eg a stretch of road with no houses, pavements or people, but 30mph limit).
I'm not moaning about being fined - I take a lot of care not to be. I'm moaning that firstly, they are there to generate revenue, not save lives, and secondly, they actually make our roads more dangerous, with people paying attention to their speed, rather than real dangers/people/etc.
The Guardian is like The Daily Mail but for the other side of the political spectrum.
The daily mail etc scare the public into thinking that immigrants/the poor/terrorists etc are going to kill them. The guardian scares the public into thinking that the government and corporations are going to kill them.
Obviously neither is true, but both sell newspapers/get readers.
Bruce Schneier? https://www.schneier.com/blog/archives/2008/06/cctv_cameras....
The BBC? http://news.bbc.co.uk/2/hi/uk_news/england/london/8219022.st...
A meta-study on the effectiveness of CCTVs in the UK? http://ipvideomarket.info/report/is_public_cctv_effective
An opposite example is Rovio in Finland are being sued under US patent law by some bunch of patent trolls or other (and it's the Finnish Rovio office rather than any US subsidy named in the suit).
From this side of the pond, these laws look like they're only very sporadically enforced, and only against large entities like Facebook who've got the legal resources to deal with the hassle. When viewed with typical American attitudes, that barely makes them laws at all - they're the equivalent of jaywalking in NYC.
"there are many people who don’t wish to be a part of a non-regulated system, and one that can (rightly or wrongly) be used as a third-party validator for expertise."
http://dannybrown.me/2011/10/25/a-letter-to-joe-fernandez-of...
"People are emotionally attached to their score. It is tied to their ego"
It seems mean to go around telling people they suck, especially when those people never asked Klout's opinion. This is like Zynga-style dark gamification.
"Just as an SAT score is used to judge students and a credit score is used to judge financial standing, Fernandez hopes that the Klout score will become an ingredient in job interviews."
So not only does Klout tell everyone that you suck, but they want to hurt your career, too.
http://latino.foxnews.com/latino/community/2011/11/03/klout-...
Counterpoint: http://techcrunch.com/2011/10/26/nobody-gives-a-damn-about-y...
They are different from search engines because they try to link data to a real person (which is mostly what privacy laws try to prevent).
And, contrary to most other social networks, they act without having consent from the user.
If you sign in to Klout, you'll get fairly in-your-face pitches to invite friends to it. Should you choose to send such an invite, the friend you sent it to would have to respond to this and manually OAuth their account. Similarly, sharing an action taken on Klout to Facebook or Twitter is a manual process. I don't remember seeing any "dark patterns"* at work at all here - nothing is sent automatically, there's no sneaky small print or prefilled checkbox, etc.
It seems the author is also confusing account creation with the service requesting and storing public data from Twitter. Twitter's own privacy policy (https://twitter.com/privacy) is clear re: content being available to search engines and via API. If people do not want their Tweets to be available to search engines and third-party sites that comply with Twitter's policies, they can set their Twitter profiles to private, or can use a service that does not have such an open ecosystem.
So my understanding is what klout does is 'fine' for US users, but gathering data on UK/EU users is subject to EU data protection laws.
And of course, IANAL
Using that analogy, then it would be Stross the one committing the offense, not Klout?
So my understanding is what klout does is 'fine' for US users, but gathering data on UK/EU users is subject to EU data protection laws.
That would be the same as it being illegal for a US site to distribute pornography to a person in a country where it was illegal.
The fact is, unless Klout is hosted or incorporated in the UK or EU, the latter have no jurisdiction over the company, and such their laws don't apply.
All I can say is as a UK resident I feel like UK data protection laws should protect me from a company like this no matter where they are based.
Try telling that to the US government, which hounds internet gambling sites wherever they're based.
The issue of territorial jurisdiction and law on the internet is a really complex one, and much more so when you deal with a fundamental mis-match between legal systems (the EU constitutional-level right to privacy vs. the US lack of same).
So, in effect, you're arguing that it's perfectly legitimate for the US government to do this?
Law gets really complicated when you cross international boundaries, and usually everyone involved will assert their right to impose laws on you, and whether they actually do this mostly depends on how easy it would be for them to do it.
If you base legal decisions about your business on abstract principles, you might just get detained the next time you route through an airport that belongs to someone you've mightily pissed off. Generally, it's smarter to strive for not offending anyone, or if you cannot manage that, strictly not visiting or in any way depending on countries whose laws you might have broken. For example, if your site is not strictly legal under US law, don't host in under .com.
Jurisdiction is up for the court and legislative to decide.
I do believe that UK courts will assert jurisdiction in cases such as this. UK courts certainly do assert worldwide jurisdiction in other situations - one of several reasons why UK courts are so popular for people who wish to sue for libel, for example.
Entirely untrue. Jurisdiction is a legal term. If a matter directly affects UK citizens in the UK it's very clear that a UK court will consider itself to have jurisdiction over that matter.
The actual reach of the court's power is a different matter. If the offender has absolutely no assets in the UK, and no intention of ever having them, and lives in a country with no extradition treaty with the UK, then perhaps the UK has no ability to punish them. I do not think that is true for the company in question.
If Klout are collecting and storing data on UK individuals, they are subject to UK data protecction law. The ease of enforcing that if they don't have a UK operation is another matter, but they are still interacting with UK users in a way which triggers UK rights under UK laws, with which UK courts could require them to comply.
I don't know. When were they forced to?
The reason Facebook is being hounded is because they have an EU incorporated company.
While it is true that holocaust denial is legal in the UK, that doesn't stop the UK authorities detaining people for it -- http://en.wikipedia.org/wiki/Gerald_Fredrick_T%C3%B6ben#2008...
Setting that aside: http://www.out-law.com/page-479 provides some advice on the Brussels Regulation 2001 concerning e-commerce. The B2C provisions in particular seem weighted to protect consumers, even when the supplier business is outside the EU.
However ... "In the case of disputes involving countries which are outside the scope of European law, there are a number of issues which must be considered. There are a number of international conventions dealing with choice of law, and consumer rights. If these do not set out the relevant position it is then worth checking whether the UK has entered into an agreement with the foreign jurisdiction. Any such agreement would set out the basis on which jurisdiction is determined between the countries. Failing this it would be necessary to consider the legal position under UK law, and what the courts consider to be the appropriate forum for hearing legal issues."
So it's basically a horrendous hairball of treaty law and interlocking legal systems. (And to make matters worse, the USA has a fundamentally different approach to determining jurisdiction in e-commerce, established via case law rather than a regulation aimed at defining consumer protections.)
My apologies, I regret any harm caused.
As far as I know, Klout has no UK/EU presence so it's not subject to these laws.
Further, even if they were subject to EU law on this, how would any action for a breach be enforced?
That's wrong.
This is the UK's Crown Prosecution Service advice on the matter:
http://www.cps.gov.uk/legal/h_to_k/jurisdiction/
As you can see, it sets out a long range of situations where UK jurisdiction extends outside the UK, in many cases even if the criminal behavior happened entirely outside of the UK.
I'm not a lawyer, and I don't know all the details and whether or not it'd be likely to be possible to get a court in the UK to accept jurisdiction in a case against Klout, but courts in the UK have a lot of flexibility and the fact that they are in the US by no means automatically means UK courts won't or can't claim jurisdiction.
This is a bit clumsy. If all of my friends are on a social network, it doesn't much matter who else is on it. The utility of a social network is proportional to the number of users I care about.