Comment by law | Hacker News Reader

Comment by law | Hacker News Reader

It's wonderful to see the EU upgrade its 1995 Directive to give users even more control over how data they voluntarily contribute is used. From the source, "This is why in our view, EU law should require that consumers give their explicit consent before their data are used. And consumers generally should have the right to delete their data at any time, especially the data they post on the Internet themselves."[1]

I hope that this language portends a paradigm shift where users are no longer kept in the dark concerning the inferences made by analyzing and correlating data that they, and others, submit. By incorporating language that protects users from unauthorized "use" of their data, I hope that this Directive will encourage industry self-regulation to the extent that unforeseeable inferences become a relic of the Internet's "wild west" days.

By unforeseeable inferences, I'm specifically referring to situations where a company like Amazon might tacitly suggest to your girlfriend to open a wedding gift registry. Its algorithm might to do this based on information gleaned from chat transcripts it licensed from Facebook. While certain laws might protect the actual transcripts from being transmitted to Amazon, nothing to my knowledge prevents Facebook from unforeseeably inferring that you intend to get married, based on complex natural language processing algorithms that it most certainly already employs. The EU's proposed Directive would, I hope, protect people from just that.

[1]: http://europa.eu/rapid/pressReleasesAction.do?reference=MEMO...

> And consumers generally should have the right to delete their data at any time, especially the data they post on the Internet themselves

I'm all for that, but where does it leave community collaborated work when one author wishes to delete their contribution totally?

i.e. wikipedia

One way around this might be to disassociate contributions form the public, to anonymise those contributions. But then... how do you stop spammers and trolls?

If a person has made a contribution under a perpetual licence, then that licence should trump. But if that were the case then everyone would just sidestep this law such that all user contributions were under a for-commercial, shared-forever licence.

Does the law win? Yes.

How would it apply to collaborative works in which data contributed is clearly identified as coming from an author who wants to delete their data? Unknown.

I say if you post anonymously you should get no privacy protection and removal measures are to be decided by the data host. I'd be happy to go with that.

On the other hand, use your real name, and you get the privacy protections.

IANAL, but your Wikipedia contributions wouldn't count as personal information (unless it is explicitly about yourself). However the logging of when and which page you edited are, so those could potentially be affected.

This is about personal information not about creative works.

Besides if you contribute to Wikipedia you have to agree to a license which would obviously trump any privacy measures.

Not obvious.

The data protection laws in Europe are enforcement laws and provide detailed instruction on the enforcement of the treaties that make up the "European Convention for the Protection of Human Rights and Fundamental Freedoms"... basically what is referred to as just "Human Rights".

As governments and companies in Europe keep finding, no laws trump that EU treaty.

A wikipedia licence won't cut it.

Further the 1995 data protection laws already stated that any data which could identify the person is covered. That definitely includes meta data, hence my comment about needing to disassociate the data to anonymise it. A person can request any identifying information be deleted, including pseudonyms as it's conceivable that a pseudonym used on multiple services is identifying.

Which leaves anonymous contributions to a project... then how can you continue to enforce anti-spam/troll policies when most of the existing methods rely on spotting the spammers/trolls based on signals from IP, user-agent, emails, usage... if you can identify a spammer, then you can identify a person (given access to enough data), and therefore it's identifying.

These new proposals strengthen the existing laws, which are actually already pretty good. I'm basically saying that there is an edge case here, and it could lead to problems. The law being black and white needs exceptions clarified in writing and not left to assumption.

I don't think a reasonable person would ever claim the technological equivalent of a right of rescission for data contributed to a community-collaborated document. Rather, people are taking exception to unconscionable clauses in the terms of service of Facebook, Google, etc. that effectively grant to each respective corporation a non-exclusive, transferable, sub-licensable, royalty-free, worldwide license to "use" any content posted on or in connection with each service. It's the overbreadth of the term "use" that people balk at.

Are you saying selling this kind of data would be less acceptable if it was indirectly inferred from chat logs rather than taken directly from the "relationship status" most people enter into Facebook?

Yes, I'm saying that inferring the information from the chat transcripts is unforeseeable to the users generating those transcripts. It's obviously foreseeable that if you change your relationship status to "engaged," you might begin to see advertisements for wedding-related stuff.

Perhaps a better situation to illustrate the point is where a girlfriend is talking with her friends that she's hoping her boyfriend will propose to her soon. That boyfriend, based on the information in the chat logs, might begin seeing advertisements for engagement rings. Those are the types of inferences that I consider unforeseeable.

Reply on news.ycombinator.com