Hacker News Reader

Comment by johngladtj | Hacker News Reader

How in the world is it legal for that dataset to be freely available for anyone to download when it clearly contains uniquely identifiable personal information?

I can literally identify multiple people!

Why hasn't this data at the very least been aggregated in such a way that any random idiot like me can't just take a quick look and identify at least 2 people in less than 5 minutes?

How is this in line with GDPR? Certainly the exceptions for statistics don't totally eliminate the requirement for them to minimize the data collection and publication to only fulfill the requirements.

What legal basis do they have to make personal information of thousands of people freely available with no anonymization at all?

What public benefit is there in making public the data for specific people, instead of non-uniquely identifiable buckets of people?

View on HN

>.. identify at least 2 people in less than 5 minutes?

How did you identify two people from that data? have I missed something, I only see the following:

HOMEINSTITUTION;COUNTRYCODEOFHOMEINSTITUTION;AGE;GENDER;NATIONALITY;SUBJECTAREA;LEVELSTUDY;YEARSPRIOR;MOBILITYTYPE;HOSTINSTITUTION;COUNTRYCODEOFHOSTINSTITUTION;PLACEMENTENTERPRISE;COUNTRYOFPLACEMENT;ENTERPRISESIZE;TYPEPLACEMENTSECTOR;LENGTHSTUDYPERIOD;LENGTHPLACEMENT;SHORTDURATION;STUDYSTARTDATE;PLACEMENTSTARTDATE;CONSORTIUMAGREEMENTNUMBER;ECTSCREDITSSTUDY;ECTSCREDITSPLACEMENT;TOTALECTSCREDITS;SNSUPPLEMENT;TAUGHTHOSTLANG;LANGUAGETAUGHT;LINGPREPARATION;STUDYGRANT;PLACEMENTGRANT;PREVIOUSPARTICIPATION;QUALIFICATIONATHOST

Some universities have very low number of students going to other specific universities.

Based on that alone I now know the unique ID of the people who went, and subsequently their start and end date, their gender, the courses they took, etc... Data that I would otherwise not know about them.

This isn't a theoretical risk either, i legitimately identified someone else, and learned information I did no know about them from that dataset.

Now we're friends and I'm sure they wouldn't mind me knowing what I learned, but it's nonetheless a violation.

> Based on that alone I now know the unique ID of the people who went

What unique ID do you mean? I can't find any unique ID type of column in any of the files published.

> the courses they took

In what file can you see the list of courses they took? I don't think it's shared anywhere.

> and subsequently their start and end date, their gender

> now we're friends and I'm sure they wouldn't mind me knowing what I learned

You're friends and you just learned their gender? Sorry to be nitpicking like this. You had known their gender previously and that helped you identify them in the dataset, not the other way round?

> Sorry to be nitpicking like this.

I don't think you are. I'm guessing that for an institution with a small number of people on the Erasmus program you can match people by gender/approximate age/start date to someone in the Erasmus data and hence what, when and where they studied on their Erasmus year.

This looks like information that would be on LinkedIn. I'm not sure many people would find this to be an invasion of privacy and isn't covered by the the GDPR

It's not identifying if you already knew they went from city A to city B.

Yes, you might know which specific person took that journey, but you have prior knowledge.

How is that an excuse? GDPR doesn't make that distinction.

The fact is I learned new personal information about someone else from this dataset. The fact that I already had some information about that person is no excuse.

You need to explain it a bit further.

What could you possible learn from the map you didn't already know before? The time they went and if they taught their native language their and similar stuff. Yeah, okay i see your point.

And the course they went to.

All of those things are personal information subject to GDPR. I would certainly get in trouble if I collected information on the location of specific people and made it available, why don't they?

Probably because that survey scheme predates the GDPR and nobody thought about it's conformity since.

Sounds like it's time for a fine then.

What's 4% of the turnover of the EU?

The map is not loading for me (I assume it's a map) but how is it letting you identify multiple people?

The map doesn't seem to work for me. What's the identifiable data like? Are there names? From the article it seemed it's just publicly-available city-to-city connection data.

They (the students) probably accepted it, and signed an informed consent.

Then it would still be odd for the EU to publish the raw data.

I can assure you I didn't! The only forms I signed were the ones that I was required to sign in order to even go on Erasmus

I studied in the Netherlands as Czech Erasmus student about 12 years ago and I recall that one had to fill out a questionnaire about their experience and study during the exchange, and that the results were public for anyone to see[1], which included information about home and receiving institution, courses and so on. And people often consulted this database before submitting an application for their stay, so I would not say that they didn't know about it.

And while it's likely that local legal conditions differs a bit and that it changed over time, I'm not surprised that such high level data are public.

[1] https://erasmus-databaze.naep.cz/modules/erasmus/

Reply on news.ycombinator.com