Hacker News Reader

Comment by avsteele | Hacker News Reader

Interesting line to draw:

- you can record all manner of video in your store...

- but you can't process it in this particular way.

This should be very familiar to people working with data in a lot of jurisdictions. I can speak to Europe but I think similar things exist elsewhere - data is less restricted in how and what you collect than it is how you use it. This makes a lot of sense, you should be able to have a basic record of ip addresses and access times for rate limiting, but that shouldn’t mean you can use it for advertising.

Similarly it seems reasonable that shops should be able to record for some purposes but not all.

You forget store. This depends a lot on the type of data. Duration, specific laws related to it and protection are very different for randomised numbers vs medical as an example.

> This makes a lot of sense

I don't think it does, because it is completely unverifiable. It's like allowing people to buy drugs, but not to use them.

I'm not worried about people collecting IPs, I'm worried about people who collect IPs being able to send those IPs out and get them associated with names, and send those names out and be supplied with dossiers.

When they start putting collecting IPs in the same bag as the rest of this, it's because they're just trying to legitimize this entire process. Collecting dossiers becomes traffic shaping, and of course people should be allowed to traffic shape - you could be getting DDOSed by terrorists!

edit: I'm not sure this comment was quite clear - it's 1) the selling of private, incidentally collected information by service providers, and 2) the accumulation, buying, and selling of dossiers on normal people whom one has no business relationship that is the problem. IPs are just temporary identifiers, unless you can resolve them through what are essentially civilian intelligence organizations.

Don't the industry-imposed rules for handling credit cards work that way (restricting use of data you already have) though?

Like, I thought a big part of why some stores do loyalty cards is because they enable tracking things that they'd get their credit card privileges revoked if they tracked that way.

Retaining credit card numbers is problematic in and of itself. Then you're just operating a skimmer.

>It's like allowing people to buy drugs, but not to use them.

Well, since you mention it: I have prescription drugs that I am allowed to buy, but I am NOT allowed to abuse them. I must take exactly 1 each day.

Having someone else pick up (IE buy) your prescription is legal and commonplace for obvious reasons. https://legalclarity.org/can-someone-else-pick-up-my-prescri...

Thus I’m regularly allowed to buy drugs I’m not legally allowed to use. “Using a prescription medication that was not prescribed to you is illegal under both federal and state laws.” https://legalclarity.org/is-it-illegal-to-use-someone-elses-...

> 1) the selling of private, incidentally collected information by service providers, and 2) the accumulation, buying, and selling of dossiers on normal people whom one has no business relationship that is the problem.

But this is exactly what is covered - incidentally collected information cannot be used for other purposes. That's rather the point - you must collect things for a specific use case and you can't use it without permission for other cases.

> I don't think it does, because it is completely unverifiable.

It's no less verifiable than "don't collect the data", and hiding it requires increasingly larger conspiracies the larger organisation you are looking at. People are capable of committing crimes though, sure.

I don't think "less restricted" is a good framing. How you are using it is the core, and you get to collect and store what's necessary for your legal uses, and use it for those uses. You don't get to have access logs because there is no restriction on logging IPs, you get them because you argue a justified use of them, and thus you can have them to use them for it (and not for anything else).

I know what you mean but read this in context. You're less restricted in what you can collect compared to what you can do with it - any valid use case requiring video footage allows you to get video footage but that doesn't mean you can then do anything you want with it. The key is what are you using the data for.

And less restricted does not mean no restriction.

This is good. It means we have laws and rulings that understand the technology. That balance the need for business to protect their stores with people's privacy.

Free to record data but not free to process data... sounds a lot like books being stored rightfully but not analyzed by machine learning.

I have data on Google. Google has a TOS that says they can use my data. This could cover even future use cases, even though those future use cases I did not anticipate. So does Google have the right to use my data in this particular way?

There are all manner of things you can and cannot do with 'data'. For example, you cannot purchase a Blu-Ray, rip its contents and post them on the internet. This shouldn't be that "interesting".

I noticed that as well, it's a bit frustrating. I personally think if you're allowed to do something legally, you should be allowed to do it using technology.

It's seems silly to me that you can have a human being eyeball someone and claim it's so and so, but you can't use incredibly accurate technology to streamline that process.

I personally don't like the decay of polite society. I don't like asking a worker for a key to buy some deodorant. Rather than treat everyone like a criminal, why don't we just treat criminals like criminals. It's a tiny percentage of people that abuse polite society and we pretend like it's a huge problem that can only be attacked by erecting huge inconveniences for everyone. No, just punish criminals and build systems to target criminals rather than everyone. If you look at arrests, you'll see that among persons admitted to state prison 77% had five or more prior arrests. When do you say enough is enough and we can back off this surveillance state because we're too afraid to just lock up people that don't want to live in society.

https://mleverything.substack.com/p/acceptance-of-crime-is-a...

How does facial recognition reduce the surveillance state there?

If you flag the dozen or so people that come in to your business once a week to steal, you don't have to have as much surveillance in the store otherwise. Just check them out when they enter, very simple.

For instance, Costco has a much lower theft rate (0.11–0.2% of sales) compared to other supermarkets (1-4%) simply because they manage to keep criminal out through membership fees. Control the entrance, target the known criminals and we can go back to a high trust society.

Target the criminals. Yes, the criminals, according to the altruistic government that serves its people and never breaks the constitution or international law. According to its perfectly defined code. Someone who got an abortion in another state after rape, for example. Or said "children shouldn't be murdered"? but said it out loud at a campus. Run the tech of the most powerful trillionaires on the masses, the poor people and find out who is dissenting. Keep the prisons full. One man's prison is another man's pension. Make this system more powerful.

We are all potential criminals under tomorrow's government. Remember that!

First paragraphs pretty clearly read to me like the issue isn’t “processing it,” it’s the indiscriminate filming of everybody who enters the store without consent that’s the problem.

Everyone who enters almost any store is "filmed" with their implicit consent. Cameras are everywhere, and certainly are everywhere in every Australian court as well.

The root comment is precisely right. Deriving data from filmed content -- the illusory private biometric data that we are leaving everywhere, constantly -- is what the purported transgression was.

Very well could be that I am misreading it.

Is this from the 90s? Who doesn't expect to be recorded when entering a retail chain? How the hell does the government have the right to decide what this private company can do on their private land? If you enter onto someone else's property you should play by their rules.

>Who doesn't expect to be recorded when entering a retail chain?

Me. Unless it's clearly stated outside. It's why I wear a covid mask when shopping.

Wearing a mask alone isn't sufficient anymore.

At best it degrades overall recognition but doesn't fully prevent it

That's why I wear Groucho glasses.

Business opportunity: sell covid masks with patterns designed to thwart facial recognition on them.

Why are they covid masks anyway? Medical personnel wears them during surgery, and there were those photos of ... some asian people i think ... wearing them outdoors to protect themselves from air pollution in their city too.

Because this person never knew they existed until covid and now wearing it has become a core part of their identity.

People here might be interested in Zennioptical's ID Guard technology, if they wear glasses. Evidently it's not perfect, but it does at least partially work: https://youtu.be/HOBdJ6nU03o?si=E_a6rMPAz5AOwytm

So to be clear, you wear a mask even though you don't expect to be recorded?

> How the hell does the government have the right to decide what this private company can do on their private land?

Because the world is bigger than just the wishes of private businesses. I don't think there is anywhere on this planet where you as a private business can do literally whatever you want, there are always regulations about what you can and cannot do. The first thing is usually "zoning" as one example, so regardless if you own the land, if it isn't zoned for industrial/commercial usage, then you cannot use it for industrial/commercial usage.

What libertarian utopia do you live in that would allow land owners to do whatever they want?

We are talking about doing a lawful act, not whatever you want. It isn't illegal to record.

The court didn't find that it was unlawful to record.

The article is literally about that specific thing being illegal, which is exactly what parent is complaining about?

In Australia we expect companies to follow the rule of law, which encodes the expectations of society.

The Australian Privacy Act falls well short of European standards, but it does encode some rights for people that businesses must abide by.

And filming people who walk into a private store is not a violation of any Australian law.

In the US we expect the government to respect private property

Unfortunately often at the expense of virtually every consideration.

hyperbolic

Dismissive

There are obviously things you can't do on your private property though.

> How the hell does the government have the right to decide what this private company can do on their private land?

Unless you think a grocery store should be allowed to grab you and sell your organs then you agree that this private organisation should be subject to some limitations about what it can do on its own land. The question is then where the line should be between its interests and the interests of those who go on the land.

You can be absolutist about this, that’s certainly a position, but it’s extremely far from mainstream.

Grabbing and selling your organs is illegal. This isn't difficult to understand

Ease off the gas man

I agree, it's simple to understand. Running biometric capture & analysis on every customer is also illegal in Australia.

Try to stick to the topic

Exactly. There is a limit to what a private company can do on private land, set by "the government" (here it'd be parliament). You don't seem to be an absolutist about this, so we both agree that the government can and should tell private businesses what they can do on private land. Then the issue is only where the line should be not whether there should be a line at all.

> How the hell does the government have the right to decide

It generally owns more weapons than your average deluded shop owner.

Security filming is common in Australia and not outlawed by this ruling. It is specifically the non-discriminate use of facial recognition technology this ruling applies to.

The specific difference is "sensitive information". General filming with manual review isn't considered to be collecting privacy sensitive information. Automatic facial recognition is.

The blog post makes this point about how the law is applied:

> Is this a technology of convenience - is it being used only because it’s cheaper, or as an alternative to employing staff to do a particular role, and are there other less privacy-intrusive means that could be reasonably used?

https://www.oaic.gov.au/news/blog/is-there-a-place-for-facia...

I don't really understand their reasoning behind the "technology of convenience" point.

Say I implement facial recognition anti-fraud via an army of super-recognizers sitting in an office, watching the camera feeds all day (collecting the sensitive information into their brains rather than into a computer system). It'd be more expensive and involve employing staff (both the "technology of convenience" criteria. From a consumer perspective the privacy impact is very similar, but somehow the privacy commissioner would interpret this differently?

Maybe that is the point the privacy commissioner is trying to make, that collecting this information through an automated computer system is fundamentally different than collecting this information through an analog/human system. But I'm not sure the line is really so clear...

I don’t understand it either, but it’s just one thing she said she will consider. No idea how much of a factor it is.

It's a false equivalence to equate humans (even "super-recognizers") with a computer when it comes to matching large quantities of faces with names/PII.

At some point the numbers get big enough that you wouldn't be able to get the pictures of faces in front of the people who would recognize them fast enough.

In the KMart case, it would not have been interpreted differently if people were doing the facial recognition rather than a computer. The issue was indiscriminate use on everyone who walked in, without permission or proper notification. Which is only cost effective if automated, and a technology of convenience I guess.

But is a non-indiscriminate, privacy friendly solution possible? The problem is people walking in with a valid receipt for a purchased item, grabbing a matching item off the shelf, and wandering over to the returns counter and requesting their money back. The usual solution most shops use is locating the returns counter past the security controls (checkout counter). But more and more of these types of stores are putting their service counters in the middle of the store for some reason.

Reply on news.ycombinator.com