Case Proposal: :blocker: Your personal data may be purchased by this service from third parties

Phoenix Case Discussions
, , , , ,
1

Description

NOTE: The wording is not final, just a first draft.

Field Value
Name Your personal data may be purchased by this service from third parties
Rating :blocker: or :bad: (SEE THE POLL BELOW)
Weight 55
Topic Personal Data
Description This service actively purchases your personal data, usually by purchasing it from data brokers. This makes the service a participant in the business of selling your personal information, since without demand, there is no supply.
DDG Checkbox
  • I know Case 382 exists — This proposed Case would indeed be a subset of Case 382, but I’ll argue this is a way more alarming and unique case for user privacy
  • I know Case 492 exists — I’ll argue this proposal is even less related given the description of Case 492, which does not mention the purchase of data

Reasoning

PLEASE, VIEW THIS AS IF YOU WERE A NORMAL USER USING OUR EXTENSION / VISITING OUR WEBSITE (WHICH IS ARGUABLY MOST OF OUR AUDIENCE)!

- Dr_Jeff

I am of the opinion that “gathering data” does not necessarily entail “purchasing data”, at least not in a GENERAL sense. Having this case would be a clear and concise warning for users and their privacy.

Also, I’ve reviewed a bunch of services that mention this explicitly, including Slashdot Media (formerly Sourceforge), as an example. There are more of them, but I can’t remember which ones specifically. It’s more than 5 as far as I’ve reviewed, and I only expect this number to increase as we review.

What are your thoughts?

2

do you mean that the service purchases data about you from data brokers or that it sells data to databrokers?

For the second option all cases that I have seen would be covered by this Terms of Service; Didn't Read - Phoenix

If you did find a service that sells data without having the option to opt-out then I would be for a blocker with the title “This service may sell your personal data and you can not opt-out”

Topic is personal data imo

3

slashdot for example does offer an opt-out Terms of Service; Didn't Read - Phoenix

4

Purchsing, not selling.

For example this line from Slashdot Media’s Privacy Policy would be a case:

We collect Personal Data from publicly available sources and from third parties (such as data brokers), which we may combine with Personal Data you have provided to us or that we have collected automatically.

In this case there’s no specific mention of selling but, as far as my limited knowledge goes, data brokers SELL data.

I believe we have the selling part somewhat covered (though I have some issues with our current cases that describe the selling of data, but that’s out of scope).

5

I’m 80% sure I have read one ToS that would qualify, but I can’t remember. Out of scope though.

6

I agree, but I have this itch… Wouldn’t data brokers count as third parties?

7

@shadowwwind What if instead we changed “though” to “from”, to be more concise?

“Your personal data may be purchased from data brokers”

8

Yes that’s better.

Then the description of 382 needs also to be updated to exclude purchasing.

I agree for a new case as 382 also applies on basic “sign in with" buttons and having something separate is a good idea.

Actually not so sure about that. The selling part is the bigger Privacy breaching part in my opinion.

9

I get your point, but I’m of the opinion that both selling and purchasing are equally bad. They’re part of the same business of trading personal data from users, in the end.

10

@shadowwwind Perhaps we could make it a negative. I have my disagreements but I can agree with your points if needed. That being said, because this is regarding user data being purchased, I’d saythe penalty should be high (within reason).

That being said, I’d prefer it to be a blocker.

11

actually that is still confusing, it could also be read as the service offering data to brokers ;D

Title: “Your personal data may be purchased by this service from third parties.”

12

Sure, looks good to me.

13

having read the descriptions of both topics I agree that it should be under “third parties” just like https://edit.tosdr.org/topics/48

Personal Data seems less about how it was collected and more about how you can control it now that they have it.

14

Good point, without demand there wouldn’t be an offer.

On the other hand, I think it is important that blockers stand out, that there are not to many of them.

Maybe we should do a one week poll about that here, what do you think?

15

Looks like a good solution to me.

16

@shadowwwind Here’s the Poll, three months later…

Should the rating be “Blocker” (:blocker:) or “Bad” (:bad:)?
  • Blocker
  • Bad
  • Other (comment below why)
0 voters