Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I Got Access to My Secret Consumer Score

nytimes.com

Post reply on HN
Print view View original

61–70 of 341 posts

Re: I Got Access to My Secret Consumer Score

#61

Post by Majromax »

Canada wrote: post #55
ChaosDegenerate wrote: post #28

Will these systems be prone to false data? I.e. if an organization fighting for free speech would create software generating false personas who create false messages, and other events, would they know any better? For example, it wouldn't be too hard to generate hundreds if not thousands of fake Facebook, Instragram, Airbnb, Coinbase, Uber, Gmail, Amazon, etc. accounts doing "stupid things". Like ordering stuff and ca…

That wouldn't matter. These companies would still have real data for actual people. And it's not easy to create tons of fake accounts for services like Coinbase because they have strict identity verification. Any account that doesn't complete it obviously isn't really a real account.

> Any account that doesn't complete it obviously isn't really a real account.

Without very careful system design, that itself could be used to corrupt data.

Suppose a thousand obviously fake accounts are made and use the phrase "giraffe-eater" (to coin something random-looking) in messages.

If the system is designed as a fancy nonlinear regressor, then it doesn't have to obey causality -- observing P("giraffe-eater"|fake) = 100% will increase the modeled prediction of P(fake|"giraffe-eater").

Worse yet, if the system is in fact being built in a non-interpretable way (throwing everything into a random forest or deep neural network), then it will be impossible to prove anything about how the system makes its judgement. Ultimately, these models are at risk from anti-discrimination statutes if (for example) they can key on use of dialect or other protected-ground-correlates.

Re: I Got Access to My Secret Consumer Score

#62

Post by CPLX »

lftl wrote: post #46
CPLX wrote: post #12

I am surprised these guys are able to operate outside the normal credit reporting laws. He’s referencing things that happened in 2009, which is well outside the usual 7 year limit for credit report data. Clearly, these companies are going to make the argument that this is not credit report data subject to consumer credit laws, but I’m curious if that has been tested at all. I would think an enterprising lawyer could…

Aren't the credit reporting laws pretty strictly scoped to making decisions about loans? I imagine these companies are pretty explicit with their clients that scores can't be used for those purposes.

They’re definitely used for rental applications and tenant evaluations, which seems like a very short hop to Airbnb.

Re: I Got Access to My Secret Consumer Score

#63

Post by philpem »

Cieplak wrote: post #26

I’m curious what sort of due diligence these companies must do to authenticate you as a person prior to satisfying an information retrieval request. Given that the exchange is entirely digital, it seems plausible that there are bad actors who would pose as someone else to gain access to their personal information. What sort of liability does one of these data controllers bear when they fail to properly authenticate a…

I've sent a couple of GDPR Subject Access Requests out of sheer curiosity. The answer is - in my experience - 'it varies'.

One requested a copy of a photo ID or passport and were happy to accept a partly redacted copy with 'FOR PROOF OF ID ONLY - (company), (date)' over-typed on the scan in red.

Another requested I email them from an email address they had in their records, or log in to change it and resubmit the request.

Most of the others sent the data without any ID checks whatsoever.

Curiously the one who did the most ID checking used an exemption (I forget the specific GDPR Article number) to redact nearly everything which wasn't shown on their web portal. Their position was that "revealing this data (specifically messages on trouble-tickets and their staff's internal notes) would adversely affect the privacy of our staff".

Amusingly I could just log into their portal and view the trouble-ticket history (but of course, not the internal notes). I can only assume their refusal was because there were comments in the internal notes (on my or other tickets) they weren't comfortable disclosing.

Re: I Got Access to My Secret Consumer Score

#64

Post by uptown »

kombucha11 wrote: post #49
uptown wrote: post #38

Earlier quoted context omitted.

How did you submit your government ID securely? Email?

The only company to request proof thus far in the process is Zeta Global which presents a secure portal to upload your ID. However, to be honest, I'm not that concerned about emailing my ID if necessary.

On the Sift Google Form:

"In order to process your rights request, Sift’s Privacy Team needs to collect the below information about you. We are unable to process your request without complete submission of this form and a copy of your valid government ID for verification purposes."

Re: I Got Access to My Secret Consumer Score

#65

Post by captainmuon »

Simulacra wrote: post #56

Two points: First, the very act of requesting your data is in a way confirming and verifying the accuracy of the data. Second: Every prescription you've ever filled with insurance - and even some without - is recorded by companies like Milliman.[0] When you want to buy life insurance, health insurance, etc. they can request to see what medications you're on, have been on, etc. [0]. https://clark.com/insurance/how-to-…

How is that even legal? Isn't patient data specially protected?

Re: I Got Access to My Secret Consumer Score

#66

Post by ENOTTY »

Simulacra wrote: post #56

Two points: First, the very act of requesting your data is in a way confirming and verifying the accuracy of the data. Second: Every prescription you've ever filled with insurance - and even some without - is recorded by companies like Milliman.[0] When you want to buy life insurance, health insurance, etc. they can request to see what medications you're on, have been on, etc. [0]. https://clark.com/insurance/how-to-…

> First, the very act of requesting your data is in a way confirming and verifying the accuracy of the data.

Could you explain what you mean by that? And also hypothesize some implications of 'confirming and verifying the accuracy of the data'?

Re: I Got Access to My Secret Consumer Score

#67

Post by creaghpatr »

zzzeek wrote: post #60
Simulacra wrote: post #56

Two points: First, the very act of requesting your data is in a way confirming and verifying the accuracy of the data. Second: Every prescription you've ever filled with insurance - and even some without - is recorded by companies like Milliman.[0] When you want to buy life insurance, health insurance, etc. they can request to see what medications you're on, have been on, etc. [0]. https://clark.com/insurance/how-to-…

how does that not violate HIPAA ? I see it talking about "you can proactively opt out with hipaa" but everything I've ever seen about HIPAA is that all "opting in" needs to be explicitly granted by the patient.

I'm guessing you opt-in when you request a quote.

Re: I Got Access to My Secret Consumer Score

#68

Post by ENOTTY »

philpem wrote: post #63
Cieplak wrote: post #26

I’m curious what sort of due diligence these companies must do to authenticate you as a person prior to satisfying an information retrieval request. Given that the exchange is entirely digital, it seems plausible that there are bad actors who would pose as someone else to gain access to their personal information. What sort of liability does one of these data controllers bear when they fail to properly authenticate a…

I've sent a couple of GDPR Subject Access Requests out of sheer curiosity. The answer is - in my experience - 'it varies'. One requested a copy of a photo ID or passport and were happy to accept a partly redacted copy with 'FOR PROOF OF ID ONLY - (company), (date)' over-typed on the scan in red. Another requested I email them from an email address they had in their records, or log in to change it and resubmit the req…

What items did you redact from your ID/passport?

Re: I Got Access to My Secret Consumer Score

#69

Post by mschuster91 »

ENOTTY wrote: post #66
Simulacra wrote: post #56

Two points: First, the very act of requesting your data is in a way confirming and verifying the accuracy of the data. Second: Every prescription you've ever filled with insurance - and even some without - is recorded by companies like Milliman.[0] When you want to buy life insurance, health insurance, etc. they can request to see what medications you're on, have been on, etc. [0]. https://clark.com/insurance/how-to-…

> First, the very act of requesting your data is in a way confirming and verifying the accuracy of the data. Could you explain what you mean by that? And also hypothesize some implications of 'confirming and verifying the accuracy of the data'?

For example, checking if you ever had an account at companies mentioned in your data takeout - to spot if someone does shit while using your name/personal information, or some incompetent/malicious clerk mixed up data.

Re: I Got Access to My Secret Consumer Score

#70

Post by mschuster91 »

GoToRO wrote: post #53
mattlondon wrote: post #34

Earlier quoted context omitted.

As far as I understand it, if they are processing EU citizens' data then they are liable for GDPR regardless of where they run their business from. https://www.techrepublic.com/article/the-eu-general-data-pro...

Then I'm curious how do they enforce it. Maybe with US there are some treaties signed, but what about a foreign country that has no treaties with the EU?

Go for the payment processors - seize any funds destined for the target company, for example.
Post reply on HN