The value of my data is not that it can train a statistical model about preferences of developers in their 30s - that's absolutely marginal. My personal data is useful in itself as a proxy for my own life, my preferences, my buying habits, it's a map on how to influence and predict my behavior, possibly against my will.
A company having exclusive access to all my personal data, emails, etc. can for example, infer that I have an urgent need to buy an airline ticket to visit my sick father, and extract my reserve price for that ticket, as opposed to an average price for all passengers. Or it can deduce the minimal paycheck I am willing to accept for a job.
So even in the unlikely case I can recover the full value of my data from the market, I haven't really earned anything. My information differential is a competitive advantage in the market, and selling it is self defeating, companies are not selling or giving their data back to me. So the more data you sell or give, the larger the asymmetry grows until the only deals you can make are bad deals.
Edit: I can neither confirm nor deny I am developer and/or in my 30s
In your example you're assuming that there is monopoly control over whatever product you're trying to buy. But that's usually not the case: there is more than one airline, for example.
If it were possible to market products exclusively to people who wanted that exact product, companies would no longer need to waste money on broadly targeted advertising and compete more directly on price and product features and not on marketing budget. You would get "paid" in cost savings.
Of course that's generally not really possible no matter how much of your data marketers could reasonably know about. A grab bag of "data" from an individual person barely predicts much of anything, which is the real reason there isn't much of a market for it.
Indeed - but markets are rarely perfectly competitive, to negate any advantage price discrimination can bring. For example, it's often the case a route/date combo is offered by a single airline.
I also agree that information can be beneficial for me, helping companies finding me easier without spending on advertising etc. But in that case, I would simply give that information away and share it as broadly as possible (for example, by searching multiple sites for the products I am interested in); so that side of the coin is not relevant for someone selling his information.
You can buy the ticket anonymously. There doesn't have to be any link between data about your grandfather and your identity you're using to buy the ticket. Why would you even give anyone data about your grandparents?
Company Y is a data broker (several of these exist already).
Company Z sells airline tickets.
Company X scrapes your email and sells information about you to Company Y to boost their bottom line. Company Z buys information from company Y to target their marketing efforts. Much of the adtech industry is based around interchange like this (but often with even more, and more confusing, layers).
Currently Google and Facebook are a bit different - they sell targeting profiles and serve the ads themselves, instead of directly selling your data - but it's worth thinking about how much you trust them to stay that way.
Just use secure e-mail. No company is selling my e-mail to anyone. Anyone can make this choice, and anyone can also host their own - either you get an unlimited mailbox for free, but of course your data is sold (they need to pay for it somehow), or you pay a few dollars and your data stays yours. It's your choice, we don't need regulations for that. I want to have that choice in my hands.
I don't think this solution works in the current economy - you would also have to refuse to ever exchange email with anyone using a monetized-data email service, i.e. Facebook, Google, etc. Given the wide market control these players have, most people would find it difficult to communicate. I think controls have to be legislated, as the EU has just done.
Or just use a secondary address. But yeah, you have to make a decision, either you really do care about your data, or you don't, just like the people who don't use FB today.
You shouldn't put the burden of your decision on others, others might not care about things you care as is apparent from GDPR. Anecdote: People on sites where I can see the numbers don't care about their data, they want the GDPR thingy away ASAP and will click on anything that makes it disappear, selling even more data than before in the process.
Including me. I despise the popups, it's extremely annoying. I protect myself technologically and with common sense, like my parents teached me to - I don't put personal information in places where I don't believe it's safe. It's that easy.
Agree with you for the most part, but the GDPR extends much further than that.
Even if you've accepted the default consent popup from a website, you can also revoke that consent in the future and request you be forgotten (either your data deleted or completely anonymised). Then there's the obligation of data breaches to be reported quickly, as well as being able to claim damages that result from said breaches.
That last bit will also incentivise companies to be more careful about how much data they can collect, and whether they'll even want to store it longer than absolutely necessary.
> Then there's the obligation of data breaches to be reported quickly, as well as being able to claim damages that result from said breaches.
Yes, this is the only part of GDPR that I support. The rest of what you wrote: Imagine that you're providing a service in exchange for money. Would it be fair for someone to demand money back after they consumed the service? If you do not wish someone to have your data, don't sell it to them.
> Imagine that you're providing a service in exchange for money. Would it be fair for someone to demand money back after they consumed the service?
Note I said delete or anonymise. The point is that the information shouldn't be personally identifiable once the person has asked to be forgotten (within reason of course - you still have to hold as much info as the law mandates whether that person likes it or not).
You're welcome to keep the anonymised data and do whatever ML or other analytics with it.
> If you do not wish someone to have your data, don't sell it to them.
There are plenty of services that gather far more information about you against your will than ordinary folk imagine, IIRC Google and Facebook's tracking of your activity via their ad networks even when you're not visiting pages on their domain. This isn't acceptable, and lots of ordinary people aren't savvy enough to use adblockers or script blockers, yet they never consented to that type of data collection.
The GDPR at least gives them some say in what happens to the data that was collected about them.
> Note I said delete or anonymise. The point is that the information shouldn't be personally identifiable once the person has asked to be forgotten (within reason of course - you still have to hold as much info as the law mandates whether that person likes it or not).
> You're welcome to keep the anonymised data and do whatever ML or other analytics with it.
Oh yeah, I saw the or, but one of the major points of collecting data is to better target ads to the person that created these data, and with this, this use case is eliminated. Yes, in some cases, it'd work, but I'm sure that there are many free services that depend on data about the person, not data in general. I agree that people should be informed, but if I build a service that is paid with data, the data should be mine. If I record you on camera while shopping in my shop, I should be free to do whatever I want with that. Given that you've been informed about recording before entering the shop, you had a choice to not use my services.
About FB/Google tracking on other sites - I think this should be responsibility of the site owner (ensuring you're informed), but other than that, it's the same - you are providing data to the site owner and the site owner is sending them to others; if you don't like it, you don't have to use their services.
We could've spent 10% of what we spent on GDPR on education about tracking and the result (if the goal was to reduce tracking) would be much better. Right now people are tracked more, from my personal experience.
> We could've spent 10% of what we spent on GDPR on education about tracking and the result (if the goal was to reduce tracking) would be much better. How do you know it would be much better?
How would you implement this exactly? The GDPR effectively has global reach as it doesn't apply only to EU citizens, and it's easier to implement one compliant system than have a separate one for non-EU data subjects.
What sort of timeframe and expenditure are we looking at for worldwide education surrounding tracking on the web and privacy? How do you plan to keep people up-to-date with the latest techniques Ad network deploy to defeat past best-practices?
In your example, what sort of recourse would exist for people who are currently privacy-minded, but not savvy enough to know someone's collecting more data than they'd actually have consented to (in your analogy, the equivalent of the Ad network sticking its fingers in people's wallets, taking what they're not entitled to)?
About half of the people I exchange email with are @gmail.com It means that Google reads and possibly sell half of my email conversations even if I don't use Google as email provider. The same probably happens to you. Our choice is limited to not to send email to people with some addresses. Tough luck.
My email address ends with @dotancohen.com, I'm known to be a privacy advocate (no facebook, twitter, whatsapp, etc), but if you send me an email Google _still_ will be able to access:
$ dig MX dotancohen.com | grep MX
; <<>> DiG 9.10.6 <<>> MX dotancohen.com
;dotancohen.com. IN MX
dotancohen.com. 86381 IN MX 5 alt2.aspmx.l.google.com.
dotancohen.com. 86381 IN MX 10 aspmx3.googlemail.com.
dotancohen.com. 86381 IN MX 10 aspmx2.googlemail.com.
dotancohen.com. 86381 IN MX 1 aspmx.l.google.com.
dotancohen.com. 86381 IN MX 5 alt1.aspmx.l.google.com.
Google's services are so far superior to almost anything else that I cannot avoid them behind the scenes without severely undermining my ability to communicate reliably. Of course I'm familiar with Protonmail and Fastmail and I've run Debian web and mail servers and configured everything from qmail to sendmail, hand-writing SPF records, blacklists, etc etc.
And it's a constant battle. I need to be productive, I need to actually work, and I need time to be with the kids. Google handles my MX, Amazon my SMTP. And I'm done with it.
And even people who think that their data isn't going through Google when communicating with me, are having their data going through Google.
Well I think that the solution here would be to convince people to use encryption and make it easier for them, instead of giving them false hope like in your case.
Yeah, I know. However I'm pretty sure that you're not sending your personal identifying information to them. But yeah, minding your privacy often means discomfort, that's just how it is - again, same with people that don't like FB, but their friends use FB messenger. You can use encryption, btw.
Easy solution: sell the tickets at an inflated price normally, then give discounts to people who you think wouldn't buy otherwise. Require these people show their ID at check-in. This will cause people to willingly give over their data/identity in order to receive discounts - not realizing that if they acted as a class and bought anonomously they would recieve (on average) lower prices. Of course such class action is impossible because it will always benefit some segment to defect, which will inflate the price for the rest, causing more to defect.
I still don't get how they would get your data that you never entered into any system that sells them, or how they connect the two identities together.
> You can buy the ticket anonymously. There doesn't have to be any link between data about your grandfather and your identity you're using to buy the ticket.
How do you propose buying an airplane ticket anonymously?
I've noticed tracking that can track across browsers and their incognito modes even with ublock origin enabled. It may have tracked me by ip, I don't know but I feel like we're getting to the point where the existing incognito modes are useless.
So would the store inflate the price after you entered your name, or not show any price before entering a name? Neither is probably that good for business
And you entered your legal name and birth to your email provider? You provided your email company that you know is selling this data with all this? Why?
> But that's usually not the case: there is more than one airline, for example.
I am afraid we are moving to a world where that is somewhat the case. Not that there's a single airline, but where there's a single place to book an airline ticket, a single place to book accommodation, or a single place to book a taxi, for instance. The intermediary (e.g. Airbnb, Uber, etc.) can then jack up their commission as far as possible based on your profile. Users can't move because all suppliers are using that intermediary, and suppliers are forced to use that intermediary because that's where the clients are. Meanwhile, intermediary's are able to extract everything that's currently going into people's savings accounts.
There may be more than one airline, but quite often there is just a single airline that meets the criteria for the flight and service quality you require.
Even when there are competing companies, being able to accurately quantify how much are you willing to pay, would allow companies to always charge max price, just by setting their "normal prices" much higher and then offering you personalized "discounts".
With multiple companies buying your data from intermediary brokers, it would effectively become a way of per-customer price fixing, while at the same time reducing competition when only a single company gets your data and presents you with an offer you can (barely) accept.
This is an economically well informed response so thanks for writing it.
The economist in me shakes my fist grumpily and says: You're contributing to an inefficient market by being opaque with your explicit preferences.
Your point however I think about companies not giving data back to you is an important one, because I think it's true in some ways and false in others. True in the sense that - lets use google for example - you don't know the exact composition for how they make decisions internally. However, I would guess that Google doesn't even know that.
Further, Google puts out a lot of information to shareholders and in their Annual reports, more data certainly about their finances than you send to Google - so it's not exactly the case that you aren't getting really good information on them. Not to mention the hundreds of articles daily on their current and future operations and products. I'd say you probably have more access to data about Google - in aggregate, if you want it - than they have on you.
The economist's dream is that we all know our own pricing sensitivities and desires for goods and services, share that with the market, and the market responds by providing those goods and services at marginal cost for a supremely efficient market. That's kind of the goal of economics - perfectly predict human desires and build systems to facilitate those.
You're response proves what we know however that individuals, companies or otherwise, are incentivised to not create efficient markets, but rather maintain information assymetries so that they can individually extract the most out of the market.
I guess that is to say, I had never thought about that from the perspective of the consumer wanting to maintain the information asymmetry, I had only ever thought about firms trying to maintain the information power. It's an interesting and different way to think about it. Thanks.
> You're contributing to an inefficient market by being opaque with your explicit preferences.
You don't make your preferences explicit in a market by selling them as data. You make your preferences explicit in a market by making trades. The prices at which you make the trades, and what you trade for, are the only information the market needs to be efficient. Which in itself makes the "let's pay customers for their data" line suspicious.
Why are you assuming it will be used nefariously to price gouge? What if an air-plane taxi startup bought the data and offered you a ticket for cheaper than a normal airline ticket?
Then someone else would be price-gouged. No company is putting effort into harvesting or mining personal data without an expectation of ROI, and that comes by increasing revenue and decreasing costs. Perhaps costs would go down for some individuals, but there would be an increase in others’ costs to more than compensate.
The economy is not zero-sum. If you're getting offered airplane tickets for cheaper than what everyone paid, it's probably because the airline has extra seats available on the plane that would otherwise go unused. No airline would bump a passenger paying a higher fare in favor of a passenger paying a lower fare (barring PR disasters and such) - they'd be strictly losing money on that deal.
Offering an unused seat for less money because they have knowledge that you would buy it at a discount price makes everybody strictly better off - you gain a discount vacation at a price you otherwise couldn't get, they sell a seat that would they would otherwise waste, and the data broker who arranges the transaction takes a cut of the value generated by this transaction.
If you operate on the assumption that it's immortal if any profit isn't perfectly distributed according to your own personal sense of how much each person deserves to pay, you can't have a functioning market. Any system with non-zero overhead can't possibly price things purely on a cost+% basis.
On the other hand, if some company have all my data and knows what I would need when I need it, it'd help me save tons of time browsing irrelevant information. I hope they can get better doing that. e.g. Yelp has tons of information about what restaurants I like and what I dislike, they still gives me tons of useless recommendations.
Sure, there are cases of price discrimination - why would you sell a piece of data for $1 which allows a company to charge you $2 more for something you're going to buy.
But there's increases in efficiencies:
1) Get me to buy a similar product from competitor B instead of A since it's a better fit for my needs wherein I wouldn't have been aware of B
2) Show me fewer ads by showing me more relevant ads
But the bottom line is that it will always bias towards their interest in making money. It's just nice when it so happens to align with your interests in buying neat stuff.
You do realize that the collection and mining of data exponentially increases the chances that advertisers with your interests will be shown to you? That is exactly the point.
A company having exclusive access to all my personal data, emails, etc. can for example, infer that I have an urgent need to buy an airline ticket to visit my sick father, and extract my reserve price for that ticket, as opposed to an average price for all passengers. Or it can deduce the minimal paycheck I am willing to accept for a job.
So even in the unlikely case I can recover the full value of my data from the market, I haven't really earned anything. My information differential is a competitive advantage in the market, and selling it is self defeating, companies are not selling or giving their data back to me. So the more data you sell or give, the larger the asymmetry grows until the only deals you can make are bad deals.
Edit: I can neither confirm nor deny I am developer and/or in my 30s