Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Getting my personal data from Amazon was weeks of confusion and tedium

theintercept.com

Post reply on HN
Print view View original

41–50 of 193 posts

Re: Getting my personal data from Amazon was weeks of confusion and tedium

#41

Post by pacaro »

whoknew1122 wrote: post #23
pacaro wrote: post #7

Earlier quoted context omitted.

I very much doubt that there is any human interaction on the Amazon end of this workflow. What seems more likely is that because this doesn't generate revenue it gets the minimum resources necessary to complete the request within some legally mandated time frame. The request probably sits in queues for most of its life. If a court order requests these same data, I suspect that it can be produced in under 24 hours

And you'd be wrong. There are humans involved at every level of GDPR requests. Signed, Someone who has handled such requests for AWS

That feels like an untenable solution, it wouldn't take much to create a denial of service...

Re: Getting my personal data from Amazon was weeks of confusion and tedium

#42

Post by jsnell »

whoknew1122 wrote: post #34
jsnell wrote: post #30

Earlier quoted context omitted.

> Distributed systems are hard. It takes time to determine where all possible information could live. And you have to make sure you're providing the correct information. And do this flawlessly, every single time lest you open yourself up to bad press and potential fines. This all takes time in systems as large and distributed as Amazon. This implies that Amazon is serving GDPR data requests manually, rather than the…

GDPR requests are handled, at least in part, manually. I have direct knowledge of how GDPR is handled within the product/service I support. And yes, it's manual.

Thanks! That's my mind blown, then :) I can believe that the volume is low enough that manual work is acceptable, but even then I'd have thought that you'd want things entirely automated to eliminate the chance of human error.

Re: Getting my personal data from Amazon was weeks of confusion and tedium

#43

Post by jen20 »

Sujan wrote: post #25
jen20 wrote: post #24

Earlier quoted context omitted.

> But there is no reason for them to do that. If that is not their business goal, perhaps the GDPR needs to be strengthened and strongly enforced until it is.

That is certainly a political decision that can be made, I agree and would actually be happy about that. If that happens, I am sure Amazon will invest the time and money to comply with that. At the same time it will put many smaller business out of business though, as they do not have the resources to do that. Even the current state of having to fulfill data requests is quite a problem for mayn of them.

> they do not have the resources to do that.

Good - the aim is for them to not store personal data in the first place, much less build business models that rely upon it. Rather than allowing the population to take on the negative externality of surveillance capitalism, it is absolutely right that the burden must fall on those creating the problem.

I don't see this as any different to the complain that small restaurants cannot afford to pay their workers - if they can't afford to comply, they can't afford to be in business at all. It's simply a margin problem.

Re: Getting my personal data from Amazon was weeks of confusion and tedium

#44

Post by lelandfe »

Sujan wrote: post #21

It's not very often that each and every point in an article just feels "fabricated" or over the top. It starts with finding the page: Amazon -> Customer Service -> Search for "personal data" -> Search result #1 is "Request Your Personal Information" which nicely explains what to do and links directly to that page. The need to verify or activate a data request via clicking a link? Of course required so some third part…

> each and every point in an article just feels "fabricated" or over the top.

What I thought were valid points from the article:

- Unclear data: "cryptic strings of numbers like '26,444,740,832,600,000” for various search queries." This is easily the worst offender IMO.

- A wait time of 19 days

- Separating the download into 74 buttons

Re: Getting my personal data from Amazon was weeks of confusion and tedium

#45

Post by mirntyfirty »

Sujan wrote: post #10
noasaservice wrote: post #5

> It’s a bit like if you have a stalker who’s been shadowing you around, meticulously documenting everywhere you go, everyone you talk to, and everything you do, who’s now handing you a form to fill out if you want to see the boxes of files they’ve been keeping on you. This has me thinking. I can get an injunction for a human stalker who's going after me at home, my workplace, following me wherever I go, etc. Accordi…

The difference between a stalker and Amazon is that Amazon does not get any data from you (or at least 99% of what this author could request from Amazon, some ad tracking stuff might be an exception) if you do not willingy give it to them. Don't have an Amazon account and use it do order things or search, talk to Alexa, etc - and they will have no data.

I’d think that like fb, they collect data on individuals regardless of accounts. One example of this is their facial recognition services. Given that they force higher pricing of products not on their page, it becomes challenging to simply “go somewhere else.” It’s also been shown that they extract business data from their aws customers.

Re: Getting my personal data from Amazon was weeks of confusion and tedium

#46

Post by QuikAccount »

legitster wrote: post #37

I run a part of the data request process at our company. This article is an example where people expect anything technology related to be magic. We have to go through EVERY tech stack we own and look for that person's data. It's amazingly manual and tedious and takes about 6 people about an hour per request. We're working to automate it, but needless to say we try not to broadcast it too broadly. I hate that everyone…

I understand what you mean and I agree about everyone whining that the "sky is falling" but in my opinion, you shouldn't collect what you can't easily give me.

Re: Getting my personal data from Amazon was weeks of confusion and tedium

#47

Post by alex_young »

whoknew1122 wrote: post #19

Clicking on the author's byline, it says the author is a 'security researcher focusing on privacy issues revolving around source protection, counter-forensics, and privacy assurance.' I would assume, therefore, the author would have at least passing knowledge of security and web applications. > Amazon at this point makes some intonations about how this email verification step is necessary because your privacy and sec…

Perhaps all of this would be a lot easier if you actually built some simple automation to process requests. What could possibly take 3 days to process? The only plausible reason is that you’re wasting developers time on what really belongs in one of the myriad tools AWS itself provides for such tasks.

Re: Getting my personal data from Amazon was weeks of confusion and tedium

#48

Post by alex_young »

whoknew1122 wrote: post #38
jsnell wrote: post #30

Earlier quoted context omitted.

> Distributed systems are hard. It takes time to determine where all possible information could live. And you have to make sure you're providing the correct information. And do this flawlessly, every single time lest you open yourself up to bad press and potential fines. This all takes time in systems as large and distributed as Amazon. This implies that Amazon is serving GDPR data requests manually, rather than the…

To create a script/bot/application/whatever that can access all potential data, you have to give something read privileges to possibly hundreds of backend systems and products. This is horrendously bad idea security wise. If that service account gets compromised (either from an external or internal threat), you have a single account that has access to everything Amazon stores. This is bad for the company and bad for…

The automation would be a bigger risk than granting humans carte blanche access to customer data? That seems like an odd security conclusion.

Re: Getting my personal data from Amazon was weeks of confusion and tedium

#49

Post by lelandfe »

legitster wrote: post #37

I run a part of the data request process at our company. This article is an example where people expect anything technology related to be magic. We have to go through EVERY tech stack we own and look for that person's data. It's amazingly manual and tedious and takes about 6 people about an hour per request. We're working to automate it, but needless to say we try not to broadcast it too broadly. I hate that everyone…

It's revealing how hard this stuff is when Google's Data Liberation Front needed 4 years to release Google Takeout – which I consider to be best-in-class for personal data access.

Re: Getting my personal data from Amazon was weeks of confusion and tedium

#50

Post by plandis »

mschuster91 wrote: post #12
SpicyLemonZest wrote: post #3

The full, complete set of tedium the author describes is: * Navigate through a handful of pages. * Scroll to the bottom of a menu. * Click an email confirmation link. * Wait 19 days. * Click 74 download links. That last part is pretty dumb! But it's also the only thing that seems remotely tedious, and I'm not sure where at any point he'd be confused. The author implies some sort of issue with the 19 day waiting perio…

> That last part is pretty dumb! It's not just dumb, the whole process is at the edges of the law. Art. 12 GDPR mandates "intelligible and easily accessible form", which navigating through a number of pages, wait times and finally a 74-link download is certainly not fulfilling. The gold standard, for what it's worth, is a direct link from the privacy policy page in the section that details GDPR subject rights to the…

Clicking a bunch of links is pretty accessible, perhaps you’re translating accessible to convenient?
Post reply on HN