Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Getting my personal data from Amazon was weeks of confusion and tedium

theintercept.com

Post reply on HN
Print view View original

21–30 of 193 posts

Re: Getting my personal data from Amazon was weeks of confusion and tedium

#21

Post by Sujan »

It's not very often that each and every point in an article just feels "fabricated" or over the top.

It starts with finding the page: Amazon -> Customer Service -> Search for "personal data" -> Search result #1 is "Request Your Personal Information" which nicely explains what to do and links directly to that page.

The need to verify or activate a data request via clicking a link? Of course required so some third party can not just request your data to your inbox (and process it along the way) without you actually wanting to do that.

All the mentions that most of the data is available in your Amazon account? Well, what many people are looking for (order history etc) is and even nicely formatted, searchable and cross linked to make it much more convenient.

Clicking "Remove address" only removes it from the list of addresses? Of course, addresses you ordered to in the past can not be deleted as they have to legally be stored together with other order information.

And the list goes on and on.

I get that it is scary that a big company keeps all the data you gave to them. And it is also unfortunate for you that it is not their business goal to make it instant and pretty for you to look at all the data. But there is no reason for them to do that.

If you don't want Amazon to have your data, don't user Amazon. When you use Amazon, the way you can get a lot of data from them is actually pretty good (also compared to other companies which pretent search history does not exist and so on).

(And bye to some Hacker News points. This will get nicely downvoted I suspect.)

Re: Getting my personal data from Amazon was weeks of confusion and tedium

#22

Post by 7373737373 »

eranation wrote: post #6

The multiple download buttons is not a dark pattern to prevent you from downloading your data, it’s just bad UX, it’s a feature you add to check a legal box and it doesn’t get priority for usability. Probably someone just shrugged, this is good enough and moved on. They should definitely give you it all in one zip file but “Never attribute to malice that which is adequately explained by a developer rushing to get som…

Even if this were the case, it'd still be customer time neglicience. This is one of the largest companies in the world

Re: Getting my personal data from Amazon was weeks of confusion and tedium

#23

Post by whoknew1122 »

pacaro wrote: post #7
SpicyLemonZest wrote: post #3

The full, complete set of tedium the author describes is: * Navigate through a handful of pages. * Scroll to the bottom of a menu. * Click an email confirmation link. * Wait 19 days. * Click 74 download links. That last part is pretty dumb! But it's also the only thing that seems remotely tedious, and I'm not sure where at any point he'd be confused. The author implies some sort of issue with the 19 day waiting perio…

I very much doubt that there is any human interaction on the Amazon end of this workflow. What seems more likely is that because this doesn't generate revenue it gets the minimum resources necessary to complete the request within some legally mandated time frame. The request probably sits in queues for most of its life. If a court order requests these same data, I suspect that it can be produced in under 24 hours

And you'd be wrong. There are humans involved at every level of GDPR requests.

Signed,

Someone who has handled such requests for AWS

Re: Getting my personal data from Amazon was weeks of confusion and tedium

#24

Post by jen20 »

Sujan wrote: post #21

It's not very often that each and every point in an article just feels "fabricated" or over the top. It starts with finding the page: Amazon -> Customer Service -> Search for "personal data" -> Search result #1 is "Request Your Personal Information" which nicely explains what to do and links directly to that page. The need to verify or activate a data request via clicking a link? Of course required so some third part…

> But there is no reason for them to do that.

If that is not their business goal, perhaps the GDPR needs to be strengthened and strongly enforced until it is.

Re: Getting my personal data from Amazon was weeks of confusion and tedium

#25

Post by Sujan »

jen20 wrote: post #24
Sujan wrote: post #21

It's not very often that each and every point in an article just feels "fabricated" or over the top. It starts with finding the page: Amazon -> Customer Service -> Search for "personal data" -> Search result #1 is "Request Your Personal Information" which nicely explains what to do and links directly to that page. The need to verify or activate a data request via clicking a link? Of course required so some third part…

> But there is no reason for them to do that. If that is not their business goal, perhaps the GDPR needs to be strengthened and strongly enforced until it is.

That is certainly a political decision that can be made, I agree and would actually be happy about that.

If that happens, I am sure Amazon will invest the time and money to comply with that. At the same time it will put many smaller business out of business though, as they do not have the resources to do that. Even the current state of having to fulfill data requests is quite a problem for mayn of them.

Re: Getting my personal data from Amazon was weeks of confusion and tedium

#28

Post by y04nn »

I had to click through more than 100 links to download all the data, how can this be acceptable? Specially coming from Amazon. How hard is it for them to create an archive with all the data? This is ridiculous, I can't imagine how was the meeting when they decided to produce purposefully such garbage UX.

Re: Getting my personal data from Amazon was weeks of confusion and tedium

#30

Post by jsnell »

whoknew1122 wrote: post #19

Clicking on the author's byline, it says the author is a 'security researcher focusing on privacy issues revolving around source protection, counter-forensics, and privacy assurance.' I would assume, therefore, the author would have at least passing knowledge of security and web applications. > Amazon at this point makes some intonations about how this email verification step is necessary because your privacy and sec…

> Distributed systems are hard. It takes time to determine where all possible information could live. And you have to make sure you're providing the correct information. And do this flawlessly, every single time lest you open yourself up to bad press and potential fines. This all takes time in systems as large and distributed as Amazon.

This implies that Amazon is serving GDPR data requests manually, rather than the whole process being automated. Surely that can't be true?

I agree that identifying where data can be stored, and extracting it correctly, is a difficult problem. But that problem is identical for every user, and it should only need to be solved once. You aren't determining from scratch which databases contain user data on every request, right? Nor are you re-defining your export schema for each user, or re-implementing the identity authentication, or deciding which pieces of data don't need to be in the data export for some legal reason, or any of these other systematic difficulties.

And if this automated, why suggest that the difficulty applies to serving each individual data access request rather than just to defining and implemeting a repeatable process?

Post reply on HN