Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I wrote to Flock's privacy contact to opt out of their domestic spying program

honeypot.net

Post reply on HN
Print view View original

61–70 of 276 posts

Re: I wrote to Flock's privacy contact to opt out of their domestic spying program

#61

Post by Aaargh20318 »

deepsun wrote: post #58

If Flock collects and processes PII data, then all their customers are "subprocessors". Flock should really have a Data Processing Agreement with their subprocessors, to legally ensure they follow the same PII handling controls as Flock does. For example, if Flock receives a legitimate request to delete some data, then Flock must forward that request to all their Data Processors (e.g. including AWS/GCP/Cloudflare) an…

It’s the other way around. Flock is the subprocessor for whoever hired them to collect data. If they are collecting data on behalf a city or municipality, those are the entities you need to address.

Re: I wrote to Flock's privacy contact to opt out of their domestic spying program

#62

Post by thaumaturgy »

ldoughty wrote: post #24
fudgy73 wrote: post #15

Earlier quoted context omitted.

AFAIK Flock owns the cameras and leases them out [0]. [0] https://www.flocksafety.com/blog/flock-safety-does-my-neighb...

But the data collected is property of the government and flock is not allowed to use that data for additional business gain (according to their statements)... So they can't sell the fact that you're at Target at 8:00 p.m. on Thursday to anybody... Nor build profiles to sell to advertisers... And if that's the case that's very similar to cloud storage vendors. If I access hacker news, and the record of my visit is sto…

Except that Flock very clearly benefits financially from having direct access to this data: owning (and in their own documentation, they very clearly do own it) a network of 80,000 surveillance devices across the country, and owning every single transit point for the data they collect, is what gets them to a $7.5 billion valuation from investors.

The fact of the matter is that Flock is playing two-step with the concept of "ownership" of data. They disclaim ownership as a way to leave local agencies holding the bag for liabilities, but they fight tenaciously to retain complete and unfettered access to that data.

(After organizing a community group that won Flock contract cancellations in multiple jurisdictions in Oregon, I went on to coauthor state legislation regulating ALPRs. I am very well familiar with all the dirty ball they play.)

Also, Flock's cameras collect more data than is provided to police agencies. Who owns that data, I wonder?

Re: I wrote to Flock's privacy contact to opt out of their domestic spying program

#64

Post by kube-system »

singleshot_ wrote: post #59
kube-system wrote: post #32

Earlier quoted context omitted.

Why? The response is predictable. No company is going to give you a customer list.

I’ve been in the lobby of hundreds of different technology companies and my understanding is that all companies are going to give you a customer list, you just have to look in the right place.

Ha -- you know what I meant: explicitly.

Re: I wrote to Flock's privacy contact to opt out of their domestic spying program

#65

Post by kstrauser »

snowwrestler wrote: post #56
kstrauser wrote: post #40

Earlier quoted context omitted.

Did you put up a Ring camera on a stand in front of your house for the specific purpose of selling that I drove past at this specific timestamp? If so, yes. The CCPA[0] gives me explicit legal rights: * The right to know about the personal information a business collects about them and how it is used and shared; * The right to delete personal information collected from them (with some exceptions); * The right to opt-…

“Personal information” has a legal definition and photos of you in a public street might not satisfy it, regardless of the photographer’s intent.

I think it'd be challenging to rule that a license plate number is not personally identifiable information, when the same regulations often state that an IP address is.

Re: I wrote to Flock's privacy contact to opt out of their domestic spying program

#66

Post by necovek »

kstrauser wrote: post #2

I wrote this. I had/have absolutely no expectation that Flock would comply with my request, but figured I should try anyway For Science. Their reply rubbed me wrong, though. They seem to claim that there are no restrictions on their collection and processing of PII because other people pay them for it. They say: > Flock Safety’s customers own the data and make all decisions around how such data is used and shared. wh…

This answer is relevant: https://oag.ca.gov/privacy/ccpa#collapse6d

In short, Flock is a "service provider" and not the entity doing the recording.

Perhaps you can make a case that they are a "data broker" instead (https://oag.ca.gov/privacy/ccpa#collapse1i), but that is a separate law, and what you are really looking at is a combination of license plate, time and location being collected as data being collected and sold without your consent.

Obviously, I am not a lawyer (and not even US-based), but I like when privacy is respected :)

Re: I wrote to Flock's privacy contact to opt out of their domestic spying program

#67

Post by necovek »

thaumaturgy wrote: post #62
ldoughty wrote: post #24

Earlier quoted context omitted.

But the data collected is property of the government and flock is not allowed to use that data for additional business gain (according to their statements)... So they can't sell the fact that you're at Target at 8:00 p.m. on Thursday to anybody... Nor build profiles to sell to advertisers... And if that's the case that's very similar to cloud storage vendors. If I access hacker news, and the record of my visit is sto…

Except that Flock very clearly benefits financially from having direct access to this data: owning (and in their own documentation, they very clearly do own it) a network of 80,000 surveillance devices across the country, and owning every single transit point for the data they collect, is what gets them to a $7.5 billion valuation from investors. The fact of the matter is that Flock is playing two-step with the conce…

That makes them a data broker in my reading, and at least in California, Data Broker legislation should apply. CA Data Broker registry gives me access denied, but that could be because I am outside US.

Re: I wrote to Flock's privacy contact to opt out of their domestic spying program

#68

Post by [deleted] »

tptacek wrote: post #38
yabutlivnWoods wrote: post #29

Earlier quoted context omitted.

Your example is apples and oranges. Flock maintains private infrastructure that stores data. If the DSLR uploaded them to Rent-A-Center owned/leased servers it would in fact require Rent-A-Center to take the necessary steps. As Rent-A-Center would be the only group with proper access to data storage they would have inserted themselves into the chain of custody, and thereby have such obligation to ensure others data i…

AWS also maintains private infrastructure that stores data. Go write them asking to purge data pertaining to you from S3 and see how that goes.

[deleted]

Re: I wrote to Flock's privacy contact to opt out of their domestic spying program

#69

Post by annoyingnoob »

I've had the same kind of response from Email providers like Sendgrid, they claim its not their data. There is no way to have Sendgrid block you in their entire network, you have to play whack-a-mole with their customers. Seems like a flaw in these privacy laws when you can't ask the actual record holder to remove the records.

Re: I wrote to Flock's privacy contact to opt out of their domestic spying program

#70

Post by bjt »

snowwrestler wrote: post #50
kstrauser wrote: post #2

I wrote this. I had/have absolutely no expectation that Flock would comply with my request, but figured I should try anyway For Science. Their reply rubbed me wrong, though. They seem to claim that there are no restrictions on their collection and processing of PII because other people pay them for it. They say: > Flock Safety’s customers own the data and make all decisions around how such data is used and shared. wh…

It’s not clear to me that it is actually your data. If I take a picture of you in a public place, I own the picture, not you. But maybe I am unclear on how Flock works.

Setting aside Flock, the "ownership" situation is not as clear as you say above.

What you own is the image copyright. But the right to copy is only one of the rights at issue.

Under various state laws (California in particular), you might not be entitled to do all the things with that picture that you could do of one that doesn't have my likeness. Privacy laws like the CCPA are one possible carve-out. A "right of publicity" is another.

There's an old saying about property law that "property is a bundle of sticks". The bundle can be subdivided.

https://www.law.cornell.edu/wex/publicity

Post reply on HN