Live data from Hacker News

Getting my personal data from Amazon was weeks of confusion and tedium

theintercept.com

91–100 of 193 posts

Re: Getting my personal data from Amazon was weeks of confusion and tedium

#91

I've been trying for over two years to get my data from Amazon. I eventually got to a point where Amazon provided a web-page, which has no less than sixty-two download links on, each of which would have to be manually operated. It's properly tantamount to obstruction. After finally reaching this point, Support were arrogant and high-handed - "We will not do any more than we have. We look forward to seeing you on Amaz…

> I eventually got to a point where Amazon provided a web-page, which has no less than sixty-two download links on, each of which would have to be manually operated.

> I still do not have my data.

> I want to get my personal data

Is there a good reason why you don't take the three minutes to click the 62 download links?

Re: Getting my personal data from Amazon was weeks of confusion and tedium

#92
I'm one of the creators of YourDigitalRights.org, a service which automates the process of sending data requests (it's free, open source and were a registered charity). What is described in this article is, unfortunately, a common case with some big tech companies.

I've recently started an experiment to send data deletion requests to 600 data brokers and document what happens. It's dark patterns all the way down.

The solution is to escalate your request to the local data protection agency (attorney general in case of California). I believe that if enough of us do this it will make a difference, even in the case of Amazon.

Following this realization we've recently added an optional features which will follow up with you some time after a request is made, and depending on the outcome, offer to automate the escalation process.

Re: Getting my personal data from Amazon was weeks of confusion and tedium

#93

I'm one of the creators of YourDigitalRights.org, a service which automates the process of sending data requests (it's free, open source and were a registered charity). What is described in this article is, unfortunately, a common case with some big tech companies. I've recently started an experiment to send data deletion requests to 600 data brokers and document what happens. It's dark patterns all the way down. The…

> I've recently started an experiment to send data deletion requests to 600 data brokers and document what happens. It's dark patterns all the way down.

I would love to read a long form piece on your findings!

It sounds like it would a great way to advertise YourDigitalRights as well.

Re: Getting my personal data from Amazon was weeks of confusion and tedium

#94
post #42

Earlier quoted context omitted.

GDPR requests are handled, at least in part, manually. I have direct knowledge of how GDPR is handled within the product/service I support. And yes, it's manual.

Thanks! That's my mind blown, then :) I can believe that the volume is low enough that manual work is acceptable, but even then I'd have thought that you'd want things entirely automated to eliminate the chance of human error.

I'm not sure how low in volume the requests are. It's really hard to automate because you have to gather data from many internal teams and products, and the data is intentionally siloed to enhance customer privacy and data security.

Manual work isn't the best way to handle it, but the costs of automating (in terms of security, intricacy regarding different storage systems, etc.) is too high to really automate it on a grand scale.

Where I work, which is low traffic generally, we process around 10 requests or so a week (from what I've seen).

Re: Getting my personal data from Amazon was weeks of confusion and tedium

#95
> It ultimately took about 19 days for Amazon to fulfill my data request, in stark contrast to its reported median time of 1.5 days to process a data request, as per the company’s California Consumer Privacy Act disclosure for 2020.

That's interesting but not particularly surprising. I bet the median request isn't for all data. An all-data request may involve pulling data from cold-storage, which I'm not surprised would take 2+ weeks (it's quite possibly a relatively manual process).

Re: Getting my personal data from Amazon was weeks of confusion and tedium

#96

Earlier quoted context omitted.

> each and every point in an article just feels "fabricated" or over the top. What I thought were valid points from the article: - Unclear data: "cryptic strings of numbers like '26,444,740,832,600,000” for various search queries." This is easily the worst offender IMO. - A wait time of 19 days - Separating the download into 74 buttons

Yup. I agree. The wait time doesn't make sense. They should be able to spin up extra servers from the spot market in seconds. Even if they're using Glacier, that should only be a few hours. I wonder if they execute the 74 data queries in serial to drag it out. And the multiple downloads is just bogus. That being said, I agree with the general point that the article is a bit overly dramatic. Amazon does a pretty good…

I've worked at an organization with a similar timeframe for some types of data requests (B2B, not GDPR-style ones). There were many parts of the organization which were mismanaged, but that wasn't one of them. That type of data request ("get all my data") involved walking through all the data we had. It wasn't indexed in a way which made it easy to grab.

This was an expensive batched job we ran monthly. We spun up a cluster of cloud machines. A map-reduce style operation would organize the data by customer. We'd ship it off to all the customers who requested it that month.

Adding appropriate indexes or similar would have been man-years of engineering work. This involved, for example, walking through server logs line-by-line and seeing which ones were associated with which customer.

There wasn't a compelling business case to do that. For normal operations, once a month was fine. If a customer had a particular need,, we could hypothetically do a one-off request out-of-line, but customers used the data for types of analytics where a one-month delay wasn't an issue.

I know of other pipelines with similar delays, for example, due to lack of automation. A person runs a task once a month, and automation would cost more than a person.

I won't chalk this up to dark patterns, so much as speeding things up having zero business value to Amazon. I just walked through the process, and at least the first two steps seemed very normal. Amazon sometimes does outrageous things, but here, I saw nothing to get outraged about.

Re: Getting my personal data from Amazon was weeks of confusion and tedium

#97
One the things people can ask for is who data is shared with. Its a massive paper trail but so many entities dont want to comply with data protection laws, its not just big tech its any large entity because interpretation of the laws is so vague, but thats the beauty of legislation, its vague.

Re: Getting my personal data from Amazon was weeks of confusion and tedium

#98

The full, complete set of tedium the author describes is: * Navigate through a handful of pages. * Scroll to the bottom of a menu. * Click an email confirmation link. * Wait 19 days. * Click 74 download links. That last part is pretty dumb! But it's also the only thing that seems remotely tedious, and I'm not sure where at any point he'd be confused. The author implies some sort of issue with the 19 day waiting perio…

Distributed systems store information in different databases and warehouses. You don't want your Amazon.com retail data co-mingled with Alexa data for multiple reasons. Two of the preeminent security concepts is least privilege and data segregation. Your data exists in different files and databases. That's why you get multiple files containing your data. And let's ignore that the zip archives contain files of differe…

> what would you prefer, that Amazon edit these files and combine them into a single file

This, additionally, adds the complication that they could be accused of making the data onerous to access by providing it as a monolithic zip, too big for some users to download over unreliable connections.

Re: Getting my personal data from Amazon was weeks of confusion and tedium

#99

I run a part of the data request process at our company. This article is an example where people expect anything technology related to be magic. We have to go through EVERY tech stack we own and look for that person's data. It's amazingly manual and tedious and takes about 6 people about an hour per request. We're working to automate it, but needless to say we try not to broadcast it too broadly. I hate that everyone…

It's revealing how hard this stuff is when Google's Data Liberation Front needed 4 years to release Google Takeout – which I consider to be best-in-class for personal data access.

I disagree. Google Takeout is a sham. It doesn't have all the data they collect about you. It's almost adequate for data portability, but not quite. It's useless for data transparency.

Google Docs keeps keystroke-level logs of everything you type, for example. That's not in Takeout. Neither are things needed to conduct a security audit (that's a paid service for Workspace customers). Neither is a lot of advertising profiling data.

Re: Getting my personal data from Amazon was weeks of confusion and tedium

#100

The full, complete set of tedium the author describes is: * Navigate through a handful of pages. * Scroll to the bottom of a menu. * Click an email confirmation link. * Wait 19 days. * Click 74 download links. That last part is pretty dumb! But it's also the only thing that seems remotely tedious, and I'm not sure where at any point he'd be confused. The author implies some sort of issue with the 19 day waiting perio…

> That last part is pretty dumb! It's not just dumb, the whole process is at the edges of the law. Art. 12 GDPR mandates "intelligible and easily accessible form", which navigating through a number of pages, wait times and finally a 74-link download is certainly not fulfilling. The gold standard, for what it's worth, is a direct link from the privacy policy page in the section that details GDPR subject rights to the…

This is yet another example of how the GDPR is bad law. "Intelligible and easily accessible" is way too vague.

Are 74 zip files intelligible and easily accessible? Of course not! I don't want to pull 74 links!

Is 1 zip file intelligible and easily accessible? Of course not! Way too big to pull in over my low-bandwidth connection.

Are zip files intelligible and easily accessible? Of course not! Not everyone understands compression.

...etc., etc. I'd have a lot more respect for that law if it spelled out concretes instead of handwaving technical details and leaving it up to regulators to decide what passes and what doesn't.

Post reply on HN