Live data from Hacker News

I Got Access to My Secret Consumer Score

nytimes.com

31–40 of 341 posts

Re: I Got Access to My Secret Consumer Score

#31
post #26

I’m curious what sort of due diligence these companies must do to authenticate you as a person prior to satisfying an information retrieval request. Given that the exchange is entirely digital, it seems plausible that there are bad actors who would pose as someone else to gain access to their personal information. What sort of liability does one of these data controllers bear when they fail to properly authenticate a…

[deleted]

Re: I Got Access to My Secret Consumer Score

#32
post #26

I’m curious what sort of due diligence these companies must do to authenticate you as a person prior to satisfying an information retrieval request. Given that the exchange is entirely digital, it seems plausible that there are bad actors who would pose as someone else to gain access to their personal information. What sort of liability does one of these data controllers bear when they fail to properly authenticate a…

There is a pretty great talk about how companies fail at this - https://www.youtube.com/watch?v=gd3DiRuvr8A ("SOUPS 2019 - Personal Information Leakage by Abusing the GDPR 'Right of Access'")

Re: I Got Access to My Secret Consumer Score

#33
post #14

So Airbnb was sharing all your messages to hosts with Sift? Food ordering apps were sharing all information about every order with them?

Selling is probably the correct word... as in "They are selling the information like facebook sold user's private messages."

Re: I Got Access to My Secret Consumer Score

#34
post #20

Earlier quoted context omitted.

So can Europeans send a GDRP right-to-be-forgotten request to all of these?

don't take my word for it, but I believe that you can only if they have opened a subsidiary in EU. The fine is percent of global sales (not profit).

As far as I understand it, if they are processing EU citizens' data then they are liable for GDPR regardless of where they run their business from.

https://www.techrepublic.com/article/the-eu-general-data-pro...

Re: I Got Access to My Secret Consumer Score

#35
For all of these linkages there needs to be a key that associates data from disparate services together. So what’s the key? Email address? IP addresses? Credit cards? Is it implausible to try to take steps to circumvent these firms’ abilities to connect our dots?

Re: I Got Access to My Secret Consumer Score

#36
post #3

Earlier quoted context omitted.

Sure, five companies you can reach out to and ask for your consumer trustworthiness records - privacy@sift.com - returnactivityreport@theretailequation.com. - privacy@riskified.com. - privacy@kustomer.com. - https://zetaglobal.com/ is a form.

So can Europeans send a GDRP right-to-be-forgotten request to all of these?

I don't believe the right to be forgotten here is at all relevant. It only covers the indexing of data. For example if I commit a crime a media organisation will write a story about it, google will index it, after a number of years I have the right to ask google to unlink those stories, however I don't believe it covers removal of the original story.

Certainly it's hard to believe some of this would be completely compatible with the GDPR. Perhaps you could make the argument that there is a legitimate business need to prevent fraud but from what's included in the article the data goes far beyond what anyone would consider minimal.

Re: I Got Access to My Secret Consumer Score

#37

Will these systems be prone to false data? I.e. if an organization fighting for free speech would create software generating false personas who create false messages, and other events, would they know any better? For example, it wouldn't be too hard to generate hundreds if not thousands of fake Facebook, Instragram, Airbnb, Coinbase, Uber, Gmail, Amazon, etc. accounts doing "stupid things". Like ordering stuff and ca…

Data from Google Pay and Apple Pay must be extremely valuable as it links your user account to actual physical purchases - expensive to fake those en masse.

Re: I Got Access to My Secret Consumer Score

#39
post #35

For all of these linkages there needs to be a key that associates data from disparate services together. So what’s the key? Email address? IP addresses? Credit cards? Is it implausible to try to take steps to circumvent these firms’ abilities to connect our dots?

Quite possibly a composite key comprising name, gender, age and locale.

"87% of the U.S. population is uniquely identified by date of birth, gender, postal code." [0]

[0] https://dataprivacylab.org/projects/identifiability/paper1.p...

Re: I Got Access to My Secret Consumer Score

#40
post #35

For all of these linkages there needs to be a key that associates data from disparate services together. So what’s the key? Email address? IP addresses? Credit cards? Is it implausible to try to take steps to circumvent these firms’ abilities to connect our dots?

[deleted]
Post reply on HN