Grindr Sued in UK for Sharing Users' HIV Data with Ad Firms | Hacker News Reader

Grindr Sued in UK for Sharing Users' HIV Data with Ad Firms

msn.com

51 pointsgreenyoda19 comments

"I don't need privacy, I don't have anything to hide."

Waiting for a good argument I can use to demolish that far too common sentiment, this will do for the time being. Disgraceful behaviour for a company to sell out its customers for pennies.

Regardless of what you might think of Snowden, he has a good quip on this: "Arguing that you don't care about the right to privacy because you have nothing to hide is no different than saying you don't care about free speech because you have nothing to say."

Also, I invite anyone who thinks they have "nothing to hide" to put a publicly accessible webcam in their home bathroom. Everyone has things they'd prefer to hide, and that doesn't imply anything nefarious is going on.

I wonder if the point might be better made as "things you'd prefer not to share" - e.g. I don't think of myself as "hiding" when I'm in the bathroom.

You have nothing to hide from the current government (maybe). You don't know who will be in charge in 1, 10, 50 years. You might not need an Ahnenpaß right now, but do you really want evidence on record that will deny you one in 20 years time?

And the people buying your data could be criminals

"I don't have anything to hide."

"Domestic abuse victims do. Or do you want their psycho ex's to find them and kill them?"

Alternatively, “I don’t have anything to hide.”

“I’m sure it was the same for people who wanted to get an abortion before Roe v Wade was overturned.”

Not very effective, IMHO. All that's going to do is get you into an argument about Roe v Wade.

Are the ad firms who buy this data immune to prosecution? Is legal to buy or own data if it's illegal to sell? I'd hope that it's equally dangerous for both the buyers and sellers of this kind of data.

It's broadly illegal to hold personal data without an consented purpose under GDPR and DPA.

The only excuse the ad firm could have is if they have sought and received consent in the past and the user has ignored the wall of text and clicked agree. Which is entirely possible.

That said, the law revolves around the idea of legitimate use of data. DPA 2018 also has restrictions and extra hurdles for the processing and storing of medical data.

I don't think Grindr will have a legitimate cause to pass on that data to advertisers, even if they do need to store it and pass it onto prospective matches. I don't think the advertiser will have cause to collect the data (even if they asked) but I don't think any of this is as clear cut as it first seems.

The article was a bit vague, do the users enter the data in their profile or were they mining chats or something like that?

I hate that Grindr is useful. There are alternatives, but if you live outside a bit city where there aren’t gay bars or LGBT events it’s pretty much the only option for easily meeting other gay guys within reasonable travel distance. They’ve got ABYSMAL privacy practices, and I also don’t like how they used RTO as a bludgeon to interrupt their employees’ attempt to unionize, but it’s where the people are. Network effects are a bitch.

A big problem with dating apps (IMHO), is how they serve as data collections mechanism for advertisers. It's almost impossible to use them effectively without giving them tons of info (who you are, how old, where, what you like and don't, social networks), and for the use case that makes sense for the most part. But I'm not aware of any privacy protecting service that doesn't funnel your data to data brokers.

So you're telling me that this whole time people on grindr were getting screwed.

I would love to know what % of gains from selling PII are the fines. The MO of breaking the law and paying the fines is never going to change with these laughable fines.

Point 6.4 discusses the justification in Norway, although their annual turnover data is blacked out. It looks like the authorities actually take this into account and try to make the fine really hurt.

https://www.datatilsynet.no/contentassets/8ad827efefcb489ab1...

That's a nice find! I didn't know what the process for determining fines works.

I had an employer refuse to provide me a return statement with the full amount they paid me. (That is, the amount on the checks they gave me).

If it is for a W-2 the IRS can get your form without much issue, but for ANY other type of income the IRS refuses to intervene until AFTER you have decided what form it should be. (1099-*, et al)

This is an odd, though seemingly reasonable (within the view of the insane system of US tax) position. The IRS told me they were unable to determine what the form should be because “we are just people who work at the IRS, what you need is a tax professional”.

Once you determine what the form should be you can leverage the IRS to demand that form from the employer.

Here’s the relevant bit. The fine for failing to provide the form is $60. <1> (mind you that is money paid to the IRS. Financial compensation for being the victim? Ha, go kick sand pal, we got ours.)

The cost to hire an accountant to determine what the correct form is $175-$275.<2>

So why provide the correct form?

It’s literally cheaper for them to be negligible and force me to spend the money to hire the accountant to determine the correct form than to hire one themselves.

<1> https://www.irs.gov/payments/information-return-penalties

<2> https://connect.nsacct.org/blogs/nsa-blogger/2017/01/27/nati...

Reply on news.ycombinator.com