Hacker News Reader

Comment by kweingar | Hacker News Reader

I've been banned-for-life from a handful of services after I lied about my age as a kid.

I can see both (all?) sides of this:

- As a society we ought to be forgiving of harmless youthful indiscretions

- As a business you shouldn't have to give second chances to people who blatantly defraud you

- There is a big can of worms when it comes to doing business with minors on the internet. I don't think there's a solution as easy as "well when they're 18, let them log into their account and update their age to acknowledge that they were using the service as a minor" or "just let people open multiple accounts (with wildly different ages) under their name."

View on HN

Well, the law is usually on the side of the young. Younger you are lighter is the punishment, here it seems to be the reverse.

> As a business you shouldn't have to give second chances to people who blatantly defraud you

Just to point the obvious, but corporations do not have any inherent right, and this specific one is already denied on some circumstances.

Corporations are people too

People who can’t be put in prison as a deterrent, who can be dissolved, sold, etc

It's not just corporations who can be dissolved. Any person can, for example by entering an acicid hot spring in Yellowstone.

Yep, imaginary people. They have as many inherent rights as Garfield.

What does that mean? Because they very much are not in the literal sense.

In which circumstances are companies not allowed to ban people for fraud? Power and water utilities I guess?

Yes, the ones people deem essential enough and monopolistic, so they get required to serve everybody.

Regulated utilities, companies representing the government, companies handling infrastructure, etc.

Water, electricity, and advertising...

If we were talking about gmail that would be one thing, but internet advertising as a utility is too far by far.

You say that as if Google was only an advertising agency...

> As a business you shouldn't have to give second chances to people who blatantly defraud you

Says who? Society can easily make it so they have to. Besides, "fraud" is a bit too strong a word for a kid that simply didn't care about some company's idiotic "you have to be 13 to post here" message on the sign up screen.

I think the solution is "the right to fucking delete your account forver".

Google keeping "limbo" accounts is dystopian, and seems like a GDPR violation to me.

I'm all for grace and forgiveness, but it seems excessive to require businesses to delete all records of people who defrauded them.

If a liquor store had caught me with a fake ID, I wouldn't consider it dystopian if they put my name on a list and kept it in the back.

I guess it would make sense for them to keep it until you have the actual legal age.

It wouldn’t make sense to refuse to sell you liquor when you’re in your 80s though.

This is a hard edge case in my opinion, because unless you unregister that email everywhere you used it, someone else will gain access to all your old accounts which would leak potentially much worse things than a record saying this email is not available anymore.

It's not a GDPR violation.

https://gdpr.eu/recital-47-overriding-legitimate-interest/

> The processing of personal data strictly necessary for the purposes of preventing fraud also constitutes a legitimate interest of the data controller concerned.

"legitimate" is doing a lot of work here.

I wonder if you could argue that it isn't "strictly necessary" after a certain point though. Does ToS abuse by minors in this way really predict fraud 15 years later? If the SNR of a signal decays over time, at a certain point do the interests of liberty exceed the interests of preventing fraud?

I have absolutely no idea and am not a lawyer, it just seems to me that the word "strictly" is meant to indicate that it isn't pixie dust companies can sprinkle on any piece of information as they choose. The rest of the language here seems to stress that there has to be some sort of test which demonstrates that the interests of the controller overrides the interest of the data subject.

At least the GPDR should allow you to correct the age. I don't think it has any provisions that say that if you entered incorrect data yourself, you waive your right to have data corrected.

They'd be required to correct the age, but they wouldn't be required to delete the "this person defrauded us by giving a false age" flag/note on your internal profile.

I think they’d have a hard time justifying the legitimate interest assessment to keep that data forever.

I agree with your statement though, but the GDPR issue is the retention time, not a DSAR issue.

"I have a legitimate interest in never doing business with someone who defrauded me" seems like a reasonably easy argument to make.

It’s an easy argument, but that doesn’t make it correct. Within law “crimes” have a statue of limitations and almost never infinite long punishment. A strong argument is needed to override someones rights for an unlimited time like that.

If you work in the EU, have a chat with your DPO/Privacy team cause I bet they would actually find this an interesting conversation too.

As part of our privacy team, I'm glad it's someone else's argument to have in court someday.

The problem is the company is in a privileged position. And there have to be limits. If not, they could stretch the definition of "defrauded me" to whatever they want, for example including discrimination of any kind.

How would deleting the account in question help anyone, though? Or are you saying that after deleting, they would then be allowed to re-register after a ban? Isn't that just isomorphic to demanding Free Ban Evasion for All?

>How would deleting the account in question help anyone, though? Or are you saying that after deleting, they would then be allowed to re-register after a ban?

The problem described in the post is that the user has a shadow, inaccessible disabled account that they can't do anything about, forever, and that's a problem.

>Isn't that just isomorphic to demanding Free Ban Evasion for All?

I think it would be isomorphic to Google implementing verification on account creation, thereby preventing this scenario from happening in the first place.

> I think it would be isomorphic to Google implementing verification on account creation, thereby preventing this scenario from happening in the first place.

They did, though. They straight up asked the kid if he was 18, and he lied and said "yes". I don't know what you want here, you want Google to... protect it's customers from their own fraud? Does any other industry do that?

(full disclosure: I work there, but on open source firmware and know nothing about Adsense)

Reply on news.ycombinator.com