Timeline for Please don't share my e-mail with Amazon without my express consent
Current License: CC BY-SA 4.0
43 events
when toggle format | what | by | license | comment | |
---|---|---|---|---|---|
Feb 18, 2019 at 20:19 | comment | added | user3956566 | related meta.stackexchange.com/questions/323672/… | |
Feb 12, 2019 at 13:33 | comment | added | MSalters | "reach out to the European citizens of the 1500 affected people" - the advice given in this answer is incomplete. The GDPR actually covers non-European citizens as well, when they are in the EU. That shows that once you've gone wrong, you need a proper lawyer to get you back on track. | |
Feb 11, 2019 at 12:19 | comment | added | poke | @ChrisDiver “Amazon can only use the data for the purposes provided” Legally, yes. But that’s the same legally that should have restricted SO to actually pass the data to them. – I agree that some reactions are over the top, but at the same time this is not just a small mishap. Things like this need to be taken seriously. | |
Feb 10, 2019 at 19:31 | comment | added | Chris Diver | @poke it depends how far you want to take it, it doesn’t imply that “doris will create a spreadsheet and email it to dave who will upload to amazon”. Amazon can only use the data for the purposes provided, and can’t process it any further, so no one should be receiving direct marketing from this. It could have been more transparent, but i think the reactions are over the top. Next time SO dont offer gift cards for anyone i suppose. | |
Feb 9, 2019 at 13:46 | comment | added | poke | @ChrisDiver But “we will send you a gift card” does not really imply “we will contact Amazon to send you a gift card”. | |
Feb 9, 2019 at 0:56 | comment | added | jpmc26 | "Thousands of data breaches are reported and don't get any consequences. This is a minor data breach but it will have to reported and instructions on how to handle it or to inform all affected people have to be followed." Having to spend time and money informing users is most certainly a consequence. I don't want to debate about whether that's good or bad here, but it is a consequence. | |
Feb 8, 2019 at 20:15 | comment | added | Chris Diver | IANAL and all that but my interpretation is that the lawful basis for this processing would be contractual necessity, in order to provide what was promised. So consent wouldn’t be required and it’s not a data breach. | |
Feb 8, 2019 at 19:03 | comment | added | Tgr | Also from the definitions sections of GDPR: ‘personal data breach’ means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed. Really, if someone tried to give basic programming advice without understanding what words like "loop" or "procedure" mean, that would be considered bad form here, but apparently somehow the same attitude becomes completely acceptable when people are commenting about laws. | |
Feb 8, 2019 at 18:57 | comment | added | Tgr | @Tschallacka you seem to assume that the user is the data controller and Stackoverflow is the data processor. Actually, the user is the data subject, Stackoverflow is the data controller and Amazon is the data processor. And customers are people who pay Stackoverflow for services, not regular users. It seems like you are just throwing random quotes around without any effort to understand them. | |
Feb 8, 2019 at 18:54 | comment | added | Tgr | @Magisch yeah the section title is wrong (in general the whole document is pretty confusing, although I'm sure it's harder to write a legible privacy policy than to complain about it). Nevertheless it pretty clearly says the company can subcontract other companies to handle the data. (Not that the privacy policy has to say that, mind you. AFAIK the GDPR does require user consent for data processing, but not specifically for passing the data to another organization for processing, as long as there are suitable controls.) | |
Feb 8, 2019 at 15:55 | comment | added | Lightness Races in Orbit | @animuson Ah, fair enough - I for one have been using that term fairly liberally. Whatever specific term this comes under then; doesn't really matter in context. | |
Feb 8, 2019 at 15:28 | comment | added | Ander Biguri | @animuson you may be right here. What you guys did is way more serious than a data breach, indeed. So maybe you do not need to report it as such. That said, its been 3 days and still no news about what have you done to fix it, just an "oops". The solution seems easy, just tell Amazon to delete all that info. It starting to seem that you guys do not want to fix it. I wonder how long until someone actually reports SO to whoever enforces GDPR, if it hasn't happened already.... | |
Feb 8, 2019 at 14:42 | comment | added | animuson StaffMod | @Lightness I didn't claim it didn't violate GDPR. That regulation covers a very wide array of different things a company might do. I simply fail to see how this qualifies as one of those specific things - a data breach. Not every single way a company can violate GDPR is a data breach. One of the core words related to data breaches is accidentally. There are plenty of things a company can do that aren't accidents. | |
Feb 8, 2019 at 10:52 | comment | added | Lightness Races in Orbit | @animuson GDPR isn't limited to breaches caused by third parties breaking into your system. Not at all. Wilfully sharing personal data without good reason and without disclosure is at the core of the regulation. But whether this act meets GDPR legalese specifically is really quite besides the point. | |
Feb 8, 2019 at 9:50 | comment | added | Tschallacka | If the data processor wishes to sub-contract any processing, they must obtain written authorisation from the controller. This can be provided in general terms in advance, but the processor must tell the controller the identity of any new sub-processor and any other changes. This allows you to ensure control over the data you hold and to advise the data subjects where their data is and what is happening to it, ensuring fair processing. I don't see amazon mentioned in the privacy policy. And I doubt there was permission asked at the end of the survey that met above requirements? | |
Feb 8, 2019 at 9:49 | comment | added | Tschallacka | is permissible with the data,and does Stack Overflow retrain full control over the data and can instruct Amazon to delete the data? There should be a contract for that.From lawscot a nice summary of expectations, lawscot.org.uk/members/business-support/… and I'm curious if Stack Overflow has fullfilled all those legal requirements. | |
Feb 8, 2019 at 9:47 | comment | added | Tschallacka | @Tgr that same privacy policy says: Stack Overflow will not disclose Customer Data to a third-party except as Customer directs or unless required by law. so it seems you should have an explicit consent from the people(a checkbox would suffice) that it is ok for Stack Overflow to share the email with Amazon, causing Amazon to breach email marketing laws as a consequence, since I doubt Stack Overflow has asked for automatic emails permission by third party Amazon. Also, does Stack Overflow have a written contract as required between processor and processor about the scope and permissions what | |
Feb 8, 2019 at 8:52 | comment | added | Magisch | @Tgr That is from a section "Information from third parties" in the supersection "How we collect information about you" the only other mention of payment processors I could find was wrt. Enterprise / Teams billing information. | |
Feb 8, 2019 at 6:43 | comment | added | Davy M | @Tgr Oh would you look at that... I think you're completely right, this isn't a breach since this behavior is explicitly outlined in the Privacy Policy. What did I say about being wrong all the time? Hehehe... How embarrassing, I definitely didn't read the privacy policy thoroughly. | |
Feb 8, 2019 at 6:37 | comment | added | Tgr | Per the privacy policy, We may share personal information with third parties who provide services to Stack Overflow, such as payment processors, email delivery services, and advertising providers. So this is clearly not a data breach (probably not even a GDPR violation, just bad form). | |
Feb 8, 2019 at 6:25 | comment | added | Davy M | @Animuson Well, yeah, I would think that would be kind of obvious that the company having untrained people in place who think it's okay to sell personal information is absolutely a security breach, and a very major one. Social Engineering attacks are all about getting people to do things they shouldn't, and they're easiest if they people don't understand that they shouldn't do those things. (The 'attack' is Amazon offering to ship the giftcards) But you're right, the attorney can give a real answer that's worth following, I'm just a random voice on the internet, and I'm wrong all the time. | |
Feb 8, 2019 at 6:12 | comment | added | animuson StaffMod | @DavyM That seems like a far reach. As a counterexample, if a company sold a bunch of personal information to another company, would you also consider that a data breach because their "security" should have prevented the sale? Either way, I'm not gonna argue further. If our attorney thinks this merits reporting then it will be reported. There's not any harm in reporting anyways. So they might just reply back that it doesn't need to be reported, whatever. | |
Feb 8, 2019 at 5:50 | comment | added | Davy M | @Animuson The security issue is that people aren't trained to protect personal data like they should. No matter how many firewalls you have in place that don't get breached, if you have an employee consciously giving out client personal information, that's your security problem. Would you have considered it a secuirty breach if the person had given out usernames and passwords instead of emails, or still not because the information was explicitly and knowingly provided? | |
Feb 8, 2019 at 5:31 | comment | added | TT. | @DavyM True. IANAL, obviously, and the GDPR legislation is quite a few articles long. In any case, probably a good idea for SO to contact a lawyer specialized in GDPR to give his views. | |
Feb 8, 2019 at 5:22 | comment | added | animuson StaffMod | I fail to see how this comes close to qualifying as a data breach per GDPR, which specifically defines a data breach as a breach of security that led to personal information being revealed accidentally. While that's no excuse for the carelessness here, what happened here was a concious decision - we explicitly and knowingly provided the information. Our security was not breached in any way. The simple fact that it was a poor decision on our part doesn't make it a data breach. | |
Feb 8, 2019 at 4:51 | comment | added | Davy M | @TT I'm sure it could be argued that the right to not be contacted by Amazon without giving prior consent makes the "unless" clause not apply in this case, the breach still needs to be reported. | |
Feb 8, 2019 at 4:07 | comment | added | TT. |
Relevant GDPR legislation article 33: 1. In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, **unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons.** [...] (emphasis mine).
|
|
Feb 8, 2019 at 2:59 | comment | added | Davy M | @Tschallacka Your point about Ignorance is exactly what annoys me most about this whole breach. It's absurd that people don't know what personal information they need to protect in accordance with GDPR if they are going to be working directly with personal information. I'm just a college intern at a company in the western United States, and I never directly touch any client information that I could violate the European privacy laws with, however I still was required to take a 20 minute online course which went over GDPR and company privacy policy. It's SO's fault the employees are ignorant. | |
Feb 8, 2019 at 0:34 | comment | added | Sarah G | @Tschallacka I'm not sure about EU law, but in the US, only non-transactional commercial email is required to provide unsubscribe options. You don't have to offer a way to unsubscribe from specific transactional events like "you made a purchase" or "here's your gift certificate." See the FTC CAN-SPAM site for more details. | |
Feb 7, 2019 at 22:25 | comment | added | Tschallacka | Any sort of automated email is required to provide unsubscribe options. Also there needs to be a conscious documented opt in to receive automated emails on a certain address. Neither is the case. So its spam by default, no matter how well intentioned. The first email would have been ok ish, borderline, by dutch standards if it would have mentioned that the email adress had been supplied by Stack Overflow. Commercial Email to consumers is troublesome. | |
Feb 7, 2019 at 22:14 | comment | added | Chris Diver | @Tschallacka I'm not sure what happened entirely but is amazon emailing marketing / spam, or just sending a gift card and a reminder in case you didn't see the first one? | |
Feb 7, 2019 at 22:11 | comment | added | Tschallacka | The problem is that it breached. Amazon started emailing spam. Not only was amazon in violation of several anti spam laws, it was a direct result of stackoverflows actions. If for example good lose an encrypted flashdrive, thats bad but unlikely to pose a risk. | |
Feb 7, 2019 at 22:06 | comment | added | Chris Diver | they need to be reported "unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons" - whatever that means | |
Feb 7, 2019 at 18:18 | comment | added | Ian Kemp | @LightnessRacesinOrbit Monetize ALL THE THINGS! aka Spolsky wants a gold-plated bathtub. | |
Feb 7, 2019 at 17:39 | comment | added | Lightness Races in Orbit | @g00glen00b Eesh, that passed me by. So this is already a pattern. The dev responsible says they have to "[send the emails] manually from our personal inboxes", e.g. "from GMail". What the actual $£@! is going on at Stack Overflow? | |
Feb 7, 2019 at 17:36 | comment | added | Lightness Races in Orbit | @Gimby Stack Overflow does not "have to be aware that [you're] from Europe". They merely have to follow what are already blindingly obvious privacy best practices, in order not to come a-cropper against the increased enforcement present in European markets. That being said, at least a token familiarity with the markets in which you're doing business probably wouldn't go amiss. | |
Feb 7, 2019 at 17:02 | comment | added | Tschallacka | @Gimby if this was a mistake, like the cc in the email i would agree. With an intentional breach of privacy I have no feelings of sympathy. Ignorance doesn't qualify as an accident. | |
Feb 7, 2019 at 16:16 | comment | added | Gimby | As a European (and Dutch too), GPDR makes me feel like a huge burden. Stack Overflow shouldn't have to be aware that I'm from Europe. Except with such things as GPDR in place they basically have to, if it is true that they have a reporting duty even being a company not housed in Europe. | |
Feb 7, 2019 at 14:44 | comment | added | Dimitri Mestdagh | Considering they shared the e-mail addresses of more than 100 members a month ago, and another ~1500 now, I think they (Stack Overflow) should really be investing more time and energy to be GDPR compliant. | |
Feb 7, 2019 at 14:34 | history | edited | TylerH | CC BY-SA 4.0 |
deleted 5 characters in body
|
Feb 7, 2019 at 14:31 | comment | added | Luca Kiebel | Here is a list of all GDPR Supervisory Authorities of the EU: varonis.com/blog/… | |
Feb 7, 2019 at 14:26 | history | edited | Luca Kiebel | CC BY-SA 4.0 |
edited body
|
Feb 7, 2019 at 14:24 | history | answered | Tschallacka | CC BY-SA 4.0 |