Comment by casca | Hacker News Reader

Comment by casca | Hacker News Reader

This has some interesting legal implications. The UK has a Data Protection Act that requires organisations to register with the ICO (Information Commissioners Office) and comply with a number of requirements.

Renew London is not registered with the ICO, nor is any company with a similar name at their postcode [1].

So either they believe that they're exempt, or that it's under a different name.

The ICO has a self-assessment tool [2] to work out whether an organisation is required to register. I'd suggest that the big question is: "Are you processing personal information?". The definition is:

‘Processing’ means doing any of the following with the information:

    obtaining it
    recording it
    storing it
    updating it
    sharing it

‘Personal information’ means any detail about a living individual that can be used on its own, or with other data, to identify them.

So based on that, they're processing personal information and are legally required to register and comply. The ICO is not seen as an overly strong regulator, but they might be convinced to investigate after the inevitable headlines in the papers.

[1] http://www.ico.org.uk/esdwebpages/search. Postcode is E1 6DY from their website in the press release [2] http://www.ico.org.uk/for_organisations/data_protection/regi...

It's not clear that a MAC address is personal information. The ICO's own guidance [1] gives the example of telephone number being personal information if the number is in the telephone directory, making a reverse lookup to identify the owner possible. Is such a directory available for MAC addresses possible? Given a hypothetical MAC address 0c:fd:c3:de:00:d5, could you identify a person with that alone?

[1] http://www.ico.org.uk/upload/documents/library/data_protecti...

Not in a public directory similar to a telephone book, no. At most you could learn the make/model of their nic.

The makers of the bins have a video showing a named person walking around, and the bin collecting information on that person's likes and dislikes.

The video makes a comparison between their bins and cookies, describing this as "cookies in real life".

It seems difficult to compare their tech to cookies (which have EU wide regulation) and to show information collected about an individual and to then claim exemption from UK data protection laws.

(https://news.ycombinator.com/item?id=6194160)

It is not possible unless the user voluntarily associates his personal information with that mac address.

It is possible to harvest this information covertly. Up until iOS 7, it's possible for any iphone app to get your mac address. So if you also provide your personal information, an app could covertly associate them.

It doesn't have to be voluntary. If I have a list of all the MAC addresses/timestamps and can cross reference that against a different known list of people times (ex: credit card transactions, rewards card, even face recognition) then you can associate them. With enough data it can be very exact.

If you had face recognition and rewards cards, you wouldn't even need a MAC address to track someone.

The rewards card would be in one location, you could then know that person's identity at all stores via cell phone connections or cameras.

It can be feasible if the enough credit card or reward card usage data is gathered for you, across all the stores you visit. Hard, but possible. Still for a lot of users the entropy will be too high.

https://news.ycombinator.com/item?id=2942967 87% of the U.S. Population are uniquely identified by {DOB, gender, zip} (latanyasweeney.org) (278 points, 712 days ago, 101 ocmments)

Yes but you'd have to uniquely identify by store visit patterns, and assuming you use a trackable method like credit card, loyalty card (universal one), AND have your wifi turned on.

You listed a lot of dimensions, whereas to make the correlation between mac address and customer info, you only have 1 dimension (visits/location) to do the correlation with.

Personally, I heavily use credit cards[0], loyalty cards[1], and I leave my wifi turned on all day because Google Maps gets grumpy when I turn it off.

In practice, I find that I've needed a lot fewer dimensions than I'd expect to find people; when I was in grade school one time I cross-referenced the attendance list (for a last name), the reverse phone lookup in the white pages, and a map of the school district boundaries to figure out where a classmate lived.

I think that repeated visits to a grocery store like a Safeway would be a really good proxy for home ZIP code. Every Safeway I've visited in the SF bay area has a wifi access point, and I wouldn't be surprised if it was logging the MAC addresses of phones that pass by. Maybe some hackers will try to optimize their route home and pick a grocery store that's half way between work and home, but I hypothesize that a large enough number of people choose to run to the nearest grocery store for that "one item they forgot to buy for dinner" or for dedicated weekly shopping trips that you could draw reasonable conclusions about aggregate behaviour.

[0] I like buying stuff online; it's kind of unavoidable there.

[1] I always get this weird sense of power when I buy peaches at the Safeway at full price during off-peak and then the next week they go on sale for "Safeway Club" cardholders at the store I usually shop at.

I think it would be easy to link either your credit card or your image (if they were doing that) to your MAC if you only made two trips to the same franchise with wi-fi on.

For example, imagine they have cameras that can image your license plate. You go there twice -- they have one MAC and two sets of possible plates. The odds that you and another person were both shopping at those times is pretty low. Now they have license plate, make/model of the car, can probably triangulate the wi-fi to know what you bought each time with reasonable fidelity...

How many samples? All you need to do is wait until they tell you who they are by associating that MAC addr with a hotspot.

Share "anonymous" data with vendors who provide wifi access, and suddenly Sephora knows where you live and where you work and can remind you that you're almost out of La Prairie Crème Cellulaire Platine Rare when you bin your cup of coffee outside the office.

Reply on news.ycombinator.com