Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ban the sale of precise geolocation

lawfaremedia.org

Post reply on HN
Print view View original

131–140 of 205 posts

Re: Ban the sale of precise geolocation

#131

Post by nzach »

Johnbot wrote: post #9

A lot of geolocation data on the market is anonymized, following medium-lived unique IDs that aren't able to be mapped to other identifiers. The problem with that is that if you have precise locations, or enough samples that you can apply statistics to find precise locations, in many cases you can de-anonymize the IDs. You can purchase address and resident listings from a number of different data vendors, and by chec…

> enough samples that you can apply statistics to find precise locations, in many cases you can de-anonymize the IDs

I think a lot of people don't realize the power of a big enough sample size. With enough samples even something pretty innocent looking like your daily step counter could make you identifiable.

As far as I know we don't have large enough databases to make this happen in practice, but I don't think this is impossible in the future.

Re: Ban the sale of precise geolocation

#132

Post by ButlerianJihad »

When I had the opportunity to peer into public records, I found some extremely intriguing stuff.

There was one person with a feminine name who showed up with a “home address” that would correspond to being my “neighbor” at home, at my clinic, at church, when I went to college, etc. All the years corresponded correctly, and the addresses were some residential place about a block or less away from the places where I went.

For all I know, this person was either fictional or an innocent bystander. She did appear to have a Facebook account or two. I was never able to directly contact her. But I found it very strange and I wondered what would be gained by doxxxing me in this manner?

Of course this has nothing directly to do with GPS coordinates, but imagine if the GPS began to be part of your public record as well, or on your credit report. Imagine if it was entered into the public record what coffee house you visited every morning, or if there were errors in this record.

Re: Ban the sale of precise geolocation

#133

Post by Terr_ »

"Get consent first" hasn't worked because the average consumer can't give informed consent to the kind of stuff going on behind the scenes.

What about: "If something bad happens because of the data your company shared or lost, it is criminally and financially liable?"

Re: Ban the sale of precise geolocation

#134

Post by jandrewrogers »

nzach wrote: post #131
Johnbot wrote: post #9

A lot of geolocation data on the market is anonymized, following medium-lived unique IDs that aren't able to be mapped to other identifiers. The problem with that is that if you have precise locations, or enough samples that you can apply statistics to find precise locations, in many cases you can de-anonymize the IDs. You can purchase address and resident listings from a number of different data vendors, and by chec…

> enough samples that you can apply statistics to find precise locations, in many cases you can de-anonymize the IDs I think a lot of people don't realize the power of a big enough sample size. With enough samples even something pretty innocent looking like your daily step counter could make you identifiable. As far as I know we don't have large enough databases to make this happen in practice, but I don't think this…

How large are you estimating is "large enough"?

Re: Ban the sale of precise geolocation

#136

Post by lionkor »

eptcyka wrote: post #135

I want geolocation to not be sold. Yet, I do not believe we have been successful in banning the sale of cocaine and elephant tusks. What makes us think this will be an easier problem to solve?

People get arrested for running large cocaine operations, that's the difference.

Re: Ban the sale of precise geolocation

#137

Post by buzer »

ch4s3 wrote: post #35
troupo wrote: post #20

Earlier quoted context omitted.

You can literally read the entire "complicated" regulation in one sitting in an afternoon. There's literally nothing complex or complicated about it. Congrats on gullibly believing the ad tech narrative.

Being able to read something in one sitting doesn't make it simple or obvious. The law establishes a board that gets to set new requirements.

What new requirements can be set by the board? As far as I understand EDPB can only issue guidelines, recommendations and best practices. All of these are just guidelines on how to interpret GDPR. Courts are the ones who ultimately decide if are complying with GDPR. Local DPA likely won't harshly punish you if you follow EDPB's recommendations if they end up getting overturned by court.

DPA won't punish you for not following EDPB's recommendations, they will punish you for breaking GDPR. You are free to ignore EDPB if you think your legal position is strong, but you carry the risk if you are wrong.

Re: Ban the sale of precise geolocation

#138

Post by crummy »

treebeard901 wrote: post #125

Once wealthy and powerful people realize how this can be used to track them they will start cracking down. One of many examples for how underrated access to location data is for unauthorized people, it is a primary way that the military locates and kills targets in foreign countries. It is surprising all of the data is so freely available with data brokers. Or in some cases from the app companies themselves, if you'r…

Seems there’s an opening for an ElonJet-like tracker that operates on this data.

Re: Ban the sale of precise geolocation

#139

Post by gwerbin »

jandrewrogers wrote: post #100
gwerbin wrote: post #91

Earlier quoted context omitted.

What do you mean by "industrial" in this case?

Telemetry from machines and data from environmental sensors that is collected for operational purposes (safety, efficiency, reliability) in industrial applications. Old school engineering systems that in modern times have expansive network-connected sensors that may even have onboard classifiers to reduce the quantity of data. The trouble started when lawyers correctly noticed that these are incidentally capable surv…

Interesting. What are your obligations under GDPR in that case? It's not like a packing machine can request data deletion.

Re: Ban the sale of precise geolocation

#140

Post by atmosx »

Terr_ wrote: post #133

"Get consent first" hasn't worked because the average consumer can't give informed consent to the kind of stuff going on behind the scenes. What about: "If something bad happens because of the data your company shared or lost, it is criminally and financially liable?"

Both make sense. Depends on who you want to protect.
Post reply on HN