Comment by danpalmer | Hacker News Reader

Comment by danpalmer | Hacker News Reader

Parent Full thread

Personal (not work related opinion): This basically can’t happen with things like DMA and GDPR. DMA in particular means you can’t share data across “products” without explicit consent. So you could for example collect websites that don’t work for the purposes of improving Chrome, but not then share that with the Ads/Search orgs for personalisation or targeting, as far as I understand the legislation.

Personal opinion about work at Google (still not googles opinion) I’m consistently impressed with how seriously this stuff is taken and the amount of work that goes into making sure that things like this sharing can’t happen accidentally, and that user choice is respected. The engineers on the ground are absolutely making sure this all works, and most of us care deeply about user privacy. I have personally worked both on implementing new features that significantly push forward privacy, and on implementing privacy controls for regulatory purposes.

The thing is that preventing "sharing" isn't sufficient. People who are concerned about privacy don't want any such data collected or stored in the first place, ever. The implicit "sharing" of my data with Google (or whatever company) is a problem in itself. Regardless of how "seriously" Google (or whatever company) takes it, for a lot of the data I don't want them to ever have it in the first place.

Yes and:

Require opt-in by default. In all cases.

All PII data at rest must be encrypted at the field level. Like how passwords should be stored. aka Translucent Database techniques. Not just in transit. Not just encrypting the whole database. But encrypt the actual fields within a database.

Constitutional privacy means personal sovereignty over oneself. (A superset of the folk definition of keeping secrets.) Meaning any and all data about me is owned by me. Any one using my data for any purpose has to pay me. (See opt-in by default above.)

> The thing is that preventing "sharing" isn't sufficient.

Exactly this. It doesn't matter that google doesn't "share" what they gather if they own so many conversion funnels from top to bottom anyway.

This is a fair position to take, but assuming good faith all round, one that I think will typically be a minority. If you ask a user if they're willing to share crash reports only to improve the reliability of the software, I'd bet most people would be ok with this. In fact it's sufficiently reasonable that I believe GDPR allows this to be opt-out, something I broadly agree with. I do think opt-outs should be available, I do think there should be configuration available for those who do not wish to share anything, but if the laws are being met, in the right spirit, then I would hope it would provide little actual benefit.

> assuming good faith all round

But why would anyone assume that? I think the position of many privacy advocates is that we're long past the point where it's reasonable to assume Google is acting in good faith in the best interests of its users. (Again, to be fair, this is true of more companies than just Google.)

Assuming good faith from a corporation is absurd.

Corporations measure success by one metric and one metric alone: shareholder value. Under our current system, a corporation that doesn't increase shareholder value is considered a bad company. Such a company is punished.

If Google can increase shareholder value by violating user privacy, and the consequences of getting caught won't reduce shareholder value too much, it's a bad company if it doesn't violate user privacy.

Of course there are mechanisms that slow this down, like laws and employees trying to follow laws, employee ethics, old guard culture, etc, but all will be defeated one by one for shareholder value.

> If you ask a user if they're willing to share crash reports only to improve the reliability of the software, I'd bet most people would be ok with this.

You do realize the majority of people are completely oblivious as to why privacy matters as it relates to their data collection.

It's not that they're willing to do anything. It's that they're passive/apathetic when faced with vague prompts telling them about a matter they don't have insight on, after being bombarded by terms of service agreements, cookie pop ups, etc for years and years.

> This is a fair position to take, but assuming good faith all round, one that I think will typically be a minority.

If they were aware of privacy implications / exactly what's being collected on them and how that data is being used, then it's safe to say that they'd be the majority. Can't blame them for not taking the time to read into the matter either, as most outside of tech are wrapped up with a million other hostilities in their daily lives.

Defend it all you want, but it's just one more unethical thing screwing people over.

You know most of the data Google collect are not crash reports. Most and all are not the same. And you would get most of the data you wanted if you asked according to you.

In fact your opinion is not a fact.

The right spirit is informed consent.

That analogy doesn't seem like a match. If you ask a user if they're willing to share every action they ever take "only to improve the reliability of the software", a lot of them are going to say "wait, why would you even need that?"

If I'm letting you scrape crash dumps and my browser happens to crash in the request where I send my credit card information to xhamster, that's one thing. Odds are that's never happened to anyone. It's another thing for you to guarantee that you're planning to record that information.

> I’m consistently impressed with how seriously this stuff is taken and the amount of work that goes into making sure that things like this sharing can’t happen accidentally

I believe the law is violated when it's sufficiently profitable -- it just requires VP permission.

No public sources for this except Jedi Blue, the old anti-poaching case, etc.

> This basically can’t happen with things like DMA and GDPR

I'm sorry but this is just wishful thinking. It might be what the spirit of the DMA & GDPR want but definitely not the reality thanks to inadequate or outright non-existent enforcement.

There are businesses out there whose entire business model and revenue stream are based on violating the GDPR. Not some kind of internal conspiracy or rogue employee, but the entire company is doing it in the open and the result of its doings (targeted ads or spam) are visible out there in the open for all to see.

Facebook, credit bureaus, data brokers, "consent management platforms", etc. All these companies' business models are big, obvious breaches of the GDPR. Yet, they are... still alive and kicking?

There is no chance that a concealed GDPR breach (whether intentional or accidental) will get addressed when the biggest intentional breaches are still allowed to continue out there in the open.

I suspect something very similar is going to happen with the DMA - Apple is already acting in bad faith but have yet to see any consequences.

Reply on news.ycombinator.com