Contact-tracing data harvested from pubs and restaurants being sold

https://www.thetimes.co.uk/article/contact-tracing-data-harvested-from-pubs-and-restaurants-being-sold-on-s0d85mkrr

199 109 6 years ago

thetimes.co.uk

DPAs really need to step in here and start enforcement actions. GDPR Art. 5 (1) b prohibits abusing data for another purpose, and hiding a "consent" for that somewhere in the T&C is not sufficient.

Also, due to the incredible damage such cases cause (people will provide fake data), there need to be severe penalty for such abuses - not just financial, serious jail time.

Edit to add: Art. 6 GDPR is pretty clear -processing data is legal only to the extent that one of the subclauses applies. a) Something hidden in T&C isn't valid consent, b) selling the data is not necessary to fulfill the contract (serving food), c) collecting the data is but selling the data isn't necessary for compliance with the contact tracing obligation, d) selling the data isn't necessary to protect the interests of the customer, e) there is no public interest in selling the data (quite the opposite!), leaving only f) legitimate interest. Anyone claiming that will likely learn that others disagree with this being a _legitimate_ interest that is not overridden by the data subject's right to privacy.

DyslexicAtheist• 6 years ago

there need to be severe penalty for such abuses - not just financial, serious jail time.

punishment for who? those making the poorly thought out policy or the restaurant / pub owners who suddenly see themselves as the nominated enforcers of these data collection activities? rule #1 should be not to collect data you don't have a safe way to process. GDPR or not this shouldn't even be collected.

dpwm• 6 years ago

rule #1 should be not to collect data you don't have a safe way to process. GDPR or not this shouldn't even be collected.

My understanding was that the law, at least in England, required for this data to be collected and retained.

pydry4• 6 years ago

The UK government doesn't even trust itself with test and trace data privacy: https://www.bbc.com/news/technology-54328644

Without privacy guarantees people don't use it. If people don't use it the whole system fails.

Gibbon12• 6 years ago

I feel like we need to extend the laws we have that govern credit reporting agencies to these other businesses that aggregate personal data. Which hopefully will put them right out of business.

chrismatheson2• 6 years ago

Are credit bureaus any better? I mean I know equifax messed up royally and I have no reason to believe that all the rest aren’t pushing on every conceivable limit of the law to maximise the profit to be made from information they scrape about me without my consent, then pay lip service to protecting it.

chrisseaton8• 6 years ago

Without privacy guarantees people don't use it.

The vast vast majority of people don't know anything about privacy guarantees and this does not factor into their decisions in any way.

pydry4• 6 years ago

It matters at least somewhat to 90% of the general public and is very important to almost 50%:

https://www.instituteforgovernment.org.uk/sites/default/file...

So no, you're extremely wrong.

walterbell4• 6 years ago

To the contrary, contact tracers in many countries have been having a lot of trouble getting people to give up the names of their contacts, or even to answer contact tracers.

"Privacy" is not an abstract generic concept. It is context and consequence dependent.

When "contact data" has the monetary and social value associated with a mandatory 14-day quarantine, people accurately consider restrictions on future movement, not privacy. Those who don't, quickly learn the hard way or from a friend. They don't need the word "privacy", only "don't do that again".

azalemeth• 6 years ago

I work in part for the NHS, and have been told to turn off the app while in the hospital. In part, I think this is because they are scared of the effect that false positives will have on (already precarious) staffing numbers (just like the police -- which, owing to austerity, are horrendously under-manned).

That being said, I haven't installed the app. I know I "should", but I just do not trust it. I've completely and utterly lost all faith in the government, and although I have the .apk executable sitting in my downloads folder just waiting for me to disassemble it and read through it myself, I haven't yet.

It's almost as if decades of sophisticated spying and "dark practices" have conditioned the entirety of the UK to not trust their government, or something. I use a VPN (or three) at home, tor where appropriate, and root my phone and cut out the Google dial-home. It's a very big ask to get me to install a government-developed application. I just have a deep, probably irrational, fear of it watching everything I do.

gerdesj• 6 years ago

"... have been told to turn off the app while in the hospital."

(This is for England only, I have no idea what the rest of the UK is up to)

The algorithm the app uses is pretty simple and in your case would be going off like a siren nearly daily. It announces itself in the vicinity via bluetooth and listens for similar announcements. Each device has a random, self generated ID and this is changed regularly. If someone gets a positive test and reports via the app then their ID at the time is sent out. Apps will compare their list of known IDs and times they were seen with the positive list. Basically if your app decides that it saw a "positive" ID for something like 15 minutes or more then it will flag it to you. Then it is up to you whether to isolate, get tested etc. It is not an offence to ignore the app but it is if you ignore an official Check and Trace operative.

This is why you are told not to use it at work. The algorithm is designed to work for people going about "normal" life and your life in the NHS is not normal. It can't possibly work for you or my cousin working as a matron in a hospital. The algorithm basically measures exposure and the current thinking is that 15 mins is long enough to flag a warning. So don't stop and chat for ages in the supermarket/park/pub or whatever to your mates - say hi and use a phone later. If you do go to a pub or restaurant then you have to accept that there is a risk.

If you are worried about the sign in QR code thing not having a sign out until midnight, you can create your own home "sign in" to do the same job. See https://www.gov.uk/create-coronavirus-qr-poster .

There is no need for conspiracy theories! The source code is on Github so no need to mess with the apk. You may want to check that the source generates the .apk though. I'm not a fan of some things that have been done here but the new app is the right way to do it in my opinion. It's very, very simple and has no personally identifiable data involved. It's basically one simple rule of thumb that is good enough to semi-automate part of the C&T function. It is not good enough for your trade though and you should not use it at work.

Stay safe.

nicbou2• 6 years ago

This is also the case in Germany. It's why you have all sorts of different ID numbers, and need to sign documents to allow different offices to communicate.

wdb• 6 years ago

Good reason not to visit pubs and restaurants which require reservations beforehand. This is not were my contact details are being collected fore. I think they private watchdog should look into this.

dustinmoris• 6 years ago

I’m proud to say that so far I have refused to give any data away and when forced I used a fake name and fake phone number. Nobody should participate in this idiotic attempt of trying to control a virus. It’s impossible. The only way back to normality is herd immunity. It will have to happen sooner or later, through natural immunity, a vaccine or most likely a combination of both. I have it rather sooner than later. Only way back to normality is to start acting normal now. Everything else is madness. Also the people who make 100% of the sacrifices are working age adults and children, basically those who are virtually at no risk of dying from this virus. Feels plain wrong that people have to give up everything for nothing in return.

untog2• 6 years ago

The only way back to normality is herd immunity.

Contract tracing seems to have worked out great in many countries. And you’re entirely discounting the possibility of a vaccine here. Given that a lot of people will have to die in order to achieve herd immunity (and the science isn’t even clear on exactly how many yet, nor on the long term implications for those that survive a COVID infection) I’m not sure blanket assertions are the wisest choice right now.

MattGaiser• 6 years ago

Only way back to normality is to start acting normal now.

You can do that if you wish. Nobody is really stopping you in most countries.

I’m not joining you though. And I would bet that I am joined by enough people that normal cannot be achieved.

ulisesrmzroche3• 6 years ago

You already lost the bet judging by last six months. Will you still pay up?

richrichardsson2• 6 years ago

Correct: working age adults and children, basically those who are virtually at no risk of dying from this virus.

Also correct and much more important: this virus can have incredibly deleterious effects on otherwise healthy people beyond killing them.

Just because it probably won't kill you doesn't mean it can't fuck you up. In fact I think I'd rather the virus kill me than leave me with permanent damage that destroys any quality of life.

nradov5• 6 years ago

What percentage of patients will have permanent damage that destroys any quality of life?

ookblah2• 6 years ago

yeah, keep acting normal, that's sure to bring back tourism and economies. broadway just cancelled all their shows until may of next year, a pure business decision, nothing to do with gov't policy.

i understand we're anxious and angry to return to a sense of normalcy, but make no mistake, it has nothing to do with sheer will. business cannot survive on the select few "choosing" to be reckless.

it will return when we get it under control and people's perceive risk (whether valid) goes down.

josephcsible2• 6 years ago

nothing to do with gov't policy

Not true. If they were allowed to fill their theaters up, they'd probably have reopened already. The business decision to not reopen is because they can't be profitable with the vastly reduced capacity that the government is currently mandating.

just-juan-post• 6 years ago

We now know for a fact that the world-wide IFR is 0.13%.[1]

It's time to give choice back to the people.

I'm not anti-anything. I'm pro-choice. I'm with you.

[1] - Monday Oct 05 the WHO announced there were 750 million cases of Covid worldwide (see tons of news sources). According to the official WHO tracker there have been 1 million deaths. 1 million divided by 750 million is 0.00133333 or 0.13% IFR.

lwansbrough2• 6 years ago

The rest of us are pro-choice, too. We’re choosing to follow the guidance of our well respected public health officials. Even if you are totally free to choose (you are where I live in Vancouver) this doesn’t prevent businesses from being impacted by the majority decision to reduce virus spread by limiting dining out, etc.

The solution, and the inevitable return to normalcy will come when people feel protected. That can come with herd immunity, which is nearly impossible (NYC had excess deaths in the same range as the Spanish flu and only has 20% immunity in the population to show for it) or it can come with advanced treatment, therapeutics and at some point a vaccine.

This is a multi year process but the result will be a return to normalcy, as happened with the Spanish flu.

neonate• 6 years ago

https://archive.is/QEm2D

nixpulvis• 6 years ago

I honestly don't know much about Apple/Android implementations of QR code readers... Is there any fundamental issue with using one of these things to share a link to a menu or something? Many restaurants are trying to avoid menus it seems (which makes sense) and I could see a QR code making this easier for people.

I don't like the idea that my OS/browser history basically knows everything about me, but I don't really see how visiting a menu is a serious problem, given that the same systems also generally have my location data too... Is the concern that people who visit restaurants are much more likely to be spreaders of COVID? Could just looking at a menu (implying visiting the restaurant) be enough to implicate me of something?

I'm just left wondering in all this mess. Who watches the watchmen?

RL_Quine• 6 years ago

One of the reasons QR codes don't get used much is people simply don't know how to scan them.

fennecfoxen• 6 years ago

Indeed, and this is one classic problem of QR code adoption (in the US, at least), so it'll be interesting to see whether this trend of QR-code menus actually drives adoption.

Nextgrid• 6 years ago

Is there any fundamental issue with using one of these things to share a link to a menu or something?

There is no problem with making a QR code that links to a menu in PDF format and that would be private & secure. The problem is that the majority of those QR codes would link to a page on the restaurant's website where various trackers are embedded and Zuckerberg is not far away, and most people browse without private mode nor ad-blockers so their browser is known by those trackers.

Closi2• 6 years ago

The QR codes need to send you to a name & address form for contact tracing - that's why.

Scanning a code and putting in your name & address is mandatory at all eat-in places in the UK (or writing it down on a list).

jjgreen• 6 years ago

Not quite, the restaurant is required to demand a QR scan or name & address, you are not required to tell the truth in responding (i.e., it is not a criminal offence to do so).

pjmlp• 6 years ago

Except unless one is an happy iPhone owner, chances are they don't have any means to scan QR codes on their phones.

Specially elderly people with their feature phones, or plain classic ones

benhurmarcel• 6 years ago

In Spain most restaurants now have replaced menus by a QR code on the table. It just takes you to a static page or pdf with the menu, usually on their own website. There's no issue.

But also there's no contact tracing done that way.

recursivedoubts2• 6 years ago

The fact that the notion of contact-tracing wasn't immediately met with howls of laughter and/or outrage is perhaps the most depressing aspect of 2020, a year with some extremely stiff competition in the "well, now, that's depressing" category.

andybak• 6 years ago

No. The fact that we didn't enforce proper privacy controls with harsh penalties is the scandal.

Unless you're arguing we are innately incapable of doing that? That feels like defeatism.

recursivedoubts2• 6 years ago

Even if I thought that the corporate world could be controlled, which I don't, I admit complete defeat in expecting the intelligence community to obey any privacy requirements.

dividedbyzero• 6 years ago

It's a tried and tested tool in fighting disease outbreaks. What else would we do?

chrismatheson2• 6 years ago

It works if I’m just a number to the system though right?

untog2• 6 years ago

Eh? Contract tracing has been effective in a bunch of countries. And the framework Apple and Google worked together on works great and protects privacy.

The problem is the government incompetence and/or malfeasance, not contract tracing itself.

HugeAcumen• 6 years ago

The framework Apple and Google worked together on works great and protects privacy.

Not so.

https://www.scss.tcd.ie/Doug.Leith/pubs/contact_tracing_app_...

mns• 6 years ago

Story from Germany. In the last 2 months I have been getting weekly something like 1-2 calls in the beginning and now, this week almost 10 calls from all kinds of numbers from various german numbers. Looking into them (online, people reporting these calls, all are ads and all kind of bullsh*t).

I don't share my number, it was quite private, I never got these calls, maybe I had 5 calls in 5 YEARS, now I get more than that in one day. Why is this, I think? A lot of restaurants use lists and then just pass them to guests at the tables or make them visible for everyone writing on them. Recently there are places that offer QR codes and individual forms, and it gets better, but having these lists visible, anyone that is at the restaurant can just take a picture of the whole list.

I could say that I entered a different name some time ago and I got a spam call asking "Is this different name?", but that would be illegal and I would get a fine. :)

Fnoord2• 6 years ago

Provide a disposable number and e-mail address. For example, use a pre-paid 2nd SIM for this purpose and discard it after a year (mine gets cancelled after 6 months of no use). With regards to e-mail there's various solutions for that.

toyg• 6 years ago

I’m exhausted just thinking about that.

When one has to become an OPSEC professional just to get a goddamn burger without getting haunted afterwards, something is deeply wrong.

hexbinencoded2• 6 years ago

That's a complete waste of time, energy, and money. You can do the same thing with Twilio for cheaper.

hexbinencoded2• 6 years ago

Welcome to America. I get 20 calls per day on my cell phone with spoofed numbers. I don't even answer the phone if I don't know the number anymore.

stock_toaster• 6 years ago

Indeed. In addition to that (if that wasn't enough!), I've started getting an increasing amount of spam texts in the last couple of months too.

missedthecue• 6 years ago

20 per day? I maybe get 2 per week!

godelski• 6 years ago

I suggest signing up for the DNC list[0]. It will at least stop legally operations which sometimes sell their list to more shady operations. It at least helps. I often report calls too.

Maybe one of you all that is good at phone apps could make one to fill out the forum automatically. I'm not sure why this already isn't a feature in Google considering they screen calls.

[0] https://www.donotcall.gov/

BLKNSLVR• 6 years ago

Paraphrasing TuringNYC[0] from another recent HN thread[1]:

Just a decade ago, SMS messages in the US cost 10 to 25 cents per SMS. You also got charged for spam SMS. Prices were completely disjointed from the reality of underlying costs (zero for the telcos).
In the following ten years, the tech giants sweeped in, competed, provided a better service, with better cross-platform support, for zero dollar immediate cost to the end customer -- gained a massive following (think whatsapp), and are now vilified for their "monopoly" and the "harm" it has caused.)

The only thing holding back a messaging-style disruption of voice services is the universal inter-operability of phone numbers. Various apps can be used for voice calls within the apps themselves but they're not compatible with a phone call from a landline for restaurant booking confirmations and such.

Google Voice achieves this and Twilio got a mention in the other thread, but I'm not sure what else is out there (I'm not in the US so it's not a problem I need to solve for myself). Seems that US telco's are still asleep at the wheel in regards to their consumer-level services and will devolve into providing purely network connectivity and losing entirely any of the services that sit atop the network.

What's ridiculous is that such things have become necessary. That there's no (enforced) legislation to prevent selling any and all contact information that passes a receptionists desk.

[0]https://news.ycombinator.com/user?id=TuringNYC

[1]https://news.ycombinator.com/item?id=24749971

nicbou2• 6 years ago

I live in Germany. That has not happened to me. I was never contacted after sharing my email and phone number on those lists.

Traubenfuchs• 6 years ago

I just fill in made up data. I have no interest to participate in contact tracing.

s5ma6n• 6 years ago

Unfortunately, this is now illegal in Germany and has a monetary fine attached to it.

Godel_unicode2• 6 years ago

And you believe your interest in privacy is more important than others interest in stopping the spread of a pandemic? Be aware, this is the same argument anti-maskers are making.

junon2• 6 years ago

Unfortunately those lists are mandated by law. We had an idea to pitch to the government to introduce a better system but they won't hear it after RKI's/SAP's super-magic contact tracing app they spent 15 million euro on...

Godel_unicode2• 6 years ago

I think it's important to remember how March-us was thinking. It was much more important back then to have a working system than the best possible system, and frankly if this is the price of good contact tracing it's probably worth it.

aidos2• 6 years ago

Is this about the new digital menus? (Paywalled for me)

Unbelievably, we went to a restaurant last weekend where there was absolutely no service so we had to use their WiFi to even see the drinks menu. Once connected, we had to go through a convoluted process to order and before even being able to place an order, I had to sign up for an account with the online service. This was before we could even order tap water. Food orders were done the regular way, with regular people, in person. They refused to take drink orders (including for water) any other way than online.

Last night my wife and I went out to dinner and neither of us brought our phones (for the first time in forever). It was great. They had to give us regular menus, like the good old days.

benlumen2• 6 years ago

You're lucky they let you in. Many places I've seen have made the NHS one mandatory on the door now.

aidos2• 6 years ago

To clarify, it was at a small hotel where we were staying and we were tagged in generally (the restaurant only had a few diners all of whom were staying there too).

walterbell4• 6 years ago

Don't use/carry phone in restaurants. Request paper menus, they almost always have them somewhere, or posted on a wall, no matter what the policy says. Reward a different restaurant if they don't. Voting with your feet has market power.

benlumen2• 6 years ago

I was staggered by how quickly these QR solutions were stood up. They aren't standardised and just take you to a webform and maybe a PDF of the drinks menu, but the speed was impressive.

Not surprised but still disappointed to learn that they're done by opportunist cowboys. Most things like this in Britain are.

zepearl• 6 years ago

I created during the last ~10 years ~80 email aliases for stuff that I bought on ~80 different websites (usually in the form of <my1stname_remotecompanyname@mydomain>) and I never even once received a single spam email on those addresses/aliases.

On the other hand, I received tons of spam email on my single generic email address (sometimes I'm "weak" because I don't want to login into my email admin GUI etc.. and I just use that generic/main address).

I therefore guess that whoever sells addresses and/or whoever generates spam does care about the email not being traceable to a single source? (they therefore do filter the lists that they have/get?)

Tarq0n• 6 years ago

I do the same thing with emails, I just wish there was a similar solution for phone numbers.

It's would be ideal for privacy as well, as phone numbers are frequently used to combine datasets across companies.

WalterGR• 6 years ago

I use a similar technique. Both VMware and New Relic have sold/lost email lists to spammers in the past couple years.

wildpeaks• 6 years ago

It's likely contact tracing in public spaces will remain in place long after the virus: every time a new source of tracking data exist, they don't want to relinquish it because they find additional uses for it and this is especially useful for building social graphs.

xtiansimon• 6 years ago

Well, paywalled. But not reading an article has never stopped me from commenting before! Haha!

I’m going to file this story:

third-party/corporate contract tracing apps sitting on mountains of valuable contact information ask themselves, what should we do with all this free milk?

...together with common _business_ practice from some US companies such as Walgreens and Target who require you to show ID for any purchase of alcohol or tobacco products no matter how old you are (prev age was less than 35). Of course they want to scan your ID for this, which gives them all this State processed and verified PII with extra data not related to age verification—-for free.

Recall in 2013 Target had a data breach of 40m user cc and debit card info.

There is some responsibility for protecting payment data (quick search says it cost Target $300m).

Data on your DL, AFAIK, is unregulated, so what is the consequences of mishandling your contact info?

Contact-tracing data harvested from pubs and restaurants being sold

Related Stories