Hacker News Reader

Comment by pm215 | Hacker News Reader

I see from the court PDF that the process here involves Spirit giving the data to a "Deidentification Agent" (a third party firm that Google selects and pays for) who is responsible for stripping out things that would link data to any particular person before passing the data on to Google. Is that a standard thing, such that everybody in this transaction would have said "yes, put in the usual clauses about deidentifying the data" and multiple firms offer this service, or is it something that they custom-specified for this "we want the data for AI" transaction?

(The PDF mentions "the standard for deidentification set forth under the California Consumer Privacy Act", which suggests this is all pretty well legislatively understood.)

View on HN

Chances the third party is uploading it to Claude to do the deidentification?

Considering that the buyer is Google, it's more likely to be a Gemini customer with a Google Cloud plan.

Seems the answer is “no” to the first part of your question. From the filing:

> For example, one initial bid requested certain customer list information; however, by the first round of the Auction, the most competitive bidders had agreed to bid on an asset schedule that expressly excluded PII.

That's interesting that the name of this 3rd party's company is anonymous.

You wouldn't want to hard-wire the deidentification company's name into the contract between Google and Spirit. Otherwise, if the deident-company happens to go bankrupt or otherwise be unable to do the work then you'd need to re-do the Google-Spirit contract, which would be a massive pain. And you don't want to make "we can sign this with Spirit now" be dependent on "we have first signed the deal with the deident-company". So I think it's reasonable that the contract says "one or more third parties acceptable to or designated by Buyer" rather than being specific here.

It'll be a little startup from San Francisco called "El Goog".

it's one regex. if you detect name, DoB, ssn, credit card, email... you remove it. done

there's zero concern if you can associate N flights can only match one person when looked in aggregate, etc.

it's mostly pro forma to pretend you're following some regulation when you're obviously not.

if anyone has a data company and legal connections to demand that a higher level of care be applied, i can charge my hours very cheaply to helpe you make this deal truly anonymous for passengers.

There are deïdentification firms that service primarily the medical industry. Over here they call them trusted third parties.

They will definitely be selecting the lowest bidder for this. Or perhaps a more expensive bidder if they can find one whose proprietary scrubbing technology is “a half dozen regexes our intern thought up”.

Reply on news.ycombinator.com