Interesting thanks for the link. However, seems like you need to be able to cross-correlate with another database in order to de-anonymize. If netflix made a good faith effort to protect privacy, how are they liable?
If I am your bank and I make a "good faith" effort to protect your money from robbery, how am I liable if I am robbed of your money?
For certain types of agreements, good faith is not enough. Netflix chooses to go into a business where it is privy to private information about its customers. The onus is on Netflix to protect that information.
I would say the same thing had hackers cracked their security and made off with the data. Good faith efforts that fail to secure the data are not enough, they must succeed in protecting the privacy of their customers.
> Banks take the precautions ahead of time (deposit insurance) against robbery
Are you arguing in support of my point? Banks insure themselves against robbery precisely because they are held 100% accountable for it to the customer.
Insuring the deposits is not a good-faith effort to prevent the robbery. It is a guarantee that the customer will not be affected by a robbery. The difference is that the insurance guarantee is 100% solid--regardless of what occurs to the bank, the customers can get back the money in their account.
Netflix's attempt to anonymize the data is not a guarantee that the data will remain secure. It is merely an attempt to secure it, not a guarantee that the customer will not lose control of their data. In your example, this is comparable to locking the vault, not to buying deposit insurance. Note that banks are required to get FDIC insurance regardless of how tightly they lock their vault.
Again, I reiterate: the bank robbery example is irrelevant. Netflix anomyized the data from within their own db. You need to cross-correlate with another db to de-anonymize.
A better example: a customer loses their drivers license/bank card and a thief finds it calls a bank to do transactions, using the info on the card to verify identity.
A bank can only do so much to protect their customers. If someone is willing to leave their info lying around, there isnt much that can be done.
> A better example: a customer loses their drivers license/bank card and a thief finds it calls a bank to do transactions, using the info on the card to verify identity... A bank can only do so much to protect their customers. If someone is willing to leave their info lying around, there isnt much that can be done.
I don't understand this argument at all. Are we talking about customers leaving their information "lying around" or customers entrusting it to Netflix? I entrust my money to a bank: I give it to them. Customers entrust their transaction history to Netflix. Nobody is talking about customers leaking their private information to third parties, we are talking about the equivalent of the bank publishing the customer's driver's license information in a newspaper with their name obscured.
p.s. Now that I've established that I don't think this example is particularly relevant, I will share a story: Several years ago I returned from vacation to find a phone message from my bank. Someone had used what appeared to be my ATM card to withdraw $1,000 from my account while I was in Honduras. Of course I was the victim of some kind of skimming and cloning operation. The bank reimbursed me in full.
>> we are talking about the equivalent of the bank publishing the customer's driver's license information in a newspaper with their name obscured.
Its more like the DMV publishing driving record history with any identifying info removed, and then these people putting up some info on their driving record (along with identifying info) on a second website/db. Then someone can uses this second website (and the cross correlation algorithm) to id their record in the DMV publication and get more info on their driving record. Had those people not put any info on the second website their record could not be identified in the DMV publication.
Im not saying Netflix is innocent if they knew that such a cross-correlation algorithm existed. Im just saying that I dont want to live in society where a company can be sued for
everything that can go wrong, atleast when that company is taking every precaution using state of the art knowledge. If netflix failed to hire db security experts to notify them on this possibility, then yes sue them. I dont know enough about db security to say if this hole was known when netflix launched the contest.
> I dont want to live in society where a company can be sued for everything that can go wrong
Well, it isn't for me to argue with what kind of world you want to live in. Those are your authentic feelings and you're entitled to them.
> If netflix failed to hire db security experts to notify them on this possibility, then yes sue them.
I don't know how lawsuits actually go, but in principle at least the idea of a lawsuit is for Netflix to stand up and say "We did this and this and this" and for the plaintiffs or whomever we call them to say "yes but you failed to do this and this" and for a judge and/or jury to decide the case on its merits.
That's a nice fantasy, of course. In reality there's all sorts of backroom wrangling and juries baited into hating the big bad company and what-not. But in principle, a civil suit provides both sides and opportunity to make their case just as you say.
Car manufacturers have to make sure the brakes and air-bags work. Elevators makers have to make sure they won't fall. Parachutes can't have holes. Lots of examples.
Heck, imagine if companies could do things wrong and get away with: "Hey at least I was, like, trying reeeeally hard. I thought it was ok to do this".
Acting in good faith would become the excuse to use when the shit hits the fan.
PS: "Acting in good faith" in the real world means following the standard, industry adopted, government mandated: policies, process, regulations, laws, etc... That's what let you get away from problems. Not happy thoughts.
ditto my above comment. If netflix says data will be collected and then anonymized in its TOS, and it does so, then it acted in good faith. If a hacker reveals a weakness and Netflix pulls the plug, should they be sued?
If yes, then how can companies innovate, when they will constantly fear liability?
You think the amount of effort by Netflix to protect the identities of its costumers was enough. It was not. They intentionally released an amount of information, thinking none of its costumers could be traced, but guess what? They were.
Yes, it had to be used with other datasets to discover individuals, but Netflix ignored (you say acted in good faith) this possibility and decided to go ahead.
They were ignorant of the implications of the data they released. They didn't saw the possibilities that their costumers could be found. They were stupid and reckless.
The problem is that you're thinking about this situation as the researcher, the person who wants the data set to play with. Put yourself into the company's shoes. You want to improve the recommendation algorithm. You hold a contest, which needs the costumer data to work. But you know that your costumers won't be happy to have their info released, so you go and anonymize the data.
See where I am going? You had an idea, executed, but the consequences were bad. Imagine if car companies acted this way, one morning an engineer comes to work and puts a new brake system in the company's car already in production thinking it'll be awesome and work ten times better than the previous brakes. Without rigorous, government and industry trials, experiments and tests.
Good idea, poor execution. Netflix doesn't have "good faith", they wanted to improve their recommendation algorithm. They wanted to profit. Now, I don't have anything against profits. But it's naive to think Netflix did this for the benefit of mankind. They had their own reasons, and to achieve that, they've broken a promise to their costumers. They said: Hey, we'll keep on our database this information, but don't worry, none will ever know it.
But then they go and _relase_ costumer data, _thinking_ it's sufficiently anonymized. They were wrong. Double mistake there. The "hacker" wasn't alone in this, "he" had a direct help of the company which was supposed to not let this happen.
I agree that if Netflix knew the data could be de-anonymized then they are liable. Just like if I bank knows that an identity thief is the emptying a customers bank account and does not stop it, they are liable.
The same way they do now. (Successful) companies don't fear liability: they prepare for it but realize that they will never be 100% insulated.
You weigh your options: if the benefits of doing something outweigh the costs (including lawsuit outcomes, poor public perception, etc) by enough of a margin, then you forge ahead.
It's a balancing act. You can take away the right of people to hold companies accountable for their actions, and this would really free up businesses to innovate without fear of reprisal. This would also open it up for businesses to 'innovate' in 'cost-savings' where 100% of the risks are borne by their customers. Do you advocate living in a world where corporations are free from fear, allowing them to do whatever they want? Do you really believe that corporations always operate in the best interests of their customers? Do you really think that the general population are the customers for most businesses (i.e. most people feel that they are 'customers' of the cable/television companies, but in reality the advertisers are the customers and the general population is the product)?
>> Are you arguing in support of my point? Banks insure themselves against robbery precisely because they are held 100% accountable for it to the customer.
No, Im saying that your example was irrelevant. If netflix said in its terms of service that it would dutifully anonymize the collected data, then are they liable? If some hacker reveals a weakness and Netflix pulls the plug should they be sued?
I never heard of a bank that got robbed and passed the loss on to their customers. If a bank is robbed, they know exactly how much was the damage, and how much they will be in trouble when they have to repay their customers.
Netflix can't "repay" their users privacy, can they?
>>If they know that the information can be de-anonymized using publicly available information, have they really made a good-faith effort?
If your premise that Netflix knew the db could be de-anonymized is correct, then its not "good faith". Otherwise, Netflix could argue it did everything it said it would do in its TOS, and didnt foresee the hackers exploit.
Whether that makes them liable or not is what Im asking. Im not a lawyer.
The reason the bank robbery example is irrelevant is banks say in their TOS that your money is 100% protected up to the FDIC limit. So, Netflix TOS said it would make its db internally anonymized, which it did. Clever cross-correlating made this not enough.
True, but then the question becomes: What does Netflix do now? Once they know that their efforts are not enough, what is their reaction? IIRC, they were warned about the fact that the second prize was revealing too much information, but went forward with it anyways.
>>IIRC, they were warned about the fact that the second prize was revealing too much information, but went forward with it anyways.
I did not know that. That changes my opinion about Netflix acting in "good faith".
The argument I was making is rooted in my belief that in order to have a healthy environment for business enterprise, your legal system cannot be setup to punish innovation whenever something doesnt go as planned. There needs to be balance, i.e. for medical innovation the bar is higher than for movie ratings.
Sometimes you release people (sometimes murders) because of a thing called a constitution...a case where there is liability for NOT releasing the murderer.
You weren't meant to take that literally. It's just to illustrate a point, not necessarily describe a real-world scenario. Notice how you're arguing my metaphor's accuracy rather than actually defending your original point.
