LWN.net Logo

Notes on the Viacom ruling

By Jonathan Corbet
July 4, 2008
Google's purchase of YouTube always seemed questionable to some observers: it looked as if Google were buying itself a whole new source of copyright lawsuits. One of the benefits of that purchase came through on July 2, when a U.S. District Court ordered Google to hand over its complete set of YouTube traffic logs, containing information about every video viewed on the service. See Groklaw for the full text of the order. If this order stands (and it appears that Google will not appeal it), millions of users worldwide will have their viewing data handed over to a litigious entertainment industry company. There's a couple of important implications to draw from this turn of events, so LWN will venture a little far afield and take a look.

The data involved includes, for each video viewed, the time, which video was involved, which YouTube user account was used, and the IP address the request came from. Viacom claimed that the privacy of YouTube users is not threatened by this release of data, and the court agreed. But account names can be correlated across sites, and IP addresses (especially time-correlated IP addresses) can easily identify exactly who was watching a particular video. Viacom promises it would never use this data to launch enforcement actions against individuals; the fact that the company feels the need to make that promise suggests that Viacom feels it could use this data to that end.

One other interesting aspect of the ruling which has been commented upon less is this: Google has also been ordered to hand over every video which has been removed from the site. Once again, that is a great deal of data. It also drives home the point that, on a site like YouTube, nothing is really removed: all of those "removed" videos are still there, waiting for some company with enough lawyers to go after it.

All of this data is to be handed over regardless of what jurisdiction the users thought they were in. Nobody's privacy or data retention laws apply here. This is a worldwide compromise of personal data.

So lesson number one is obvious: attending to one's personal security requires being very careful about the data tracks that one leaves on other peoples' servers. Regardless of any site's privacy policy or any country's data sharing laws, that data is there for the grabbing. The course of events which led to the compromise of vast amounts of video-viewing data can also lead to the disclosure of electronic mail, accounting data, online chat sessions, purchase histories, software downloads, or which edgy Second Life neighborhood one likes to hang out in. Indeed, records of video viewing activity are more strongly protected in the U.S. than many other types of data; other types of information may well prove easier to get. What we leave on remote machines seems to stay there indefinitely, and it's an open book for those with sufficient legal power on their side.

If you gather together that much information on the behavior of many millions of people, somebody, somewhere, is going to try to get their hands on it. The second lesson is for anybody running a publicly-available server, as many LWN readers do. The video activity database being grabbed by Viacom is said to be about 12 terabytes deep - before getting into the "removed" videos. It should not be surprising that a data stash of that size would attract this kind of action. If you gather together that much information on the behavior of many millions of people, somebody, somewhere, is going to try to get their hands on it. How could it possibly be any other way?

Not enough people are asking this question: why does Google/YouTube hold that much data about its users? Why does it retain the ability to replay their actions years after the fact? And why do "removed" videos not go away? If that data did not exist in the first place, there would be no question of disclosing it to an attacking corporation. A company which keeps that amount of data around is prioritizing whatever commercial value it sees in that data over the privacy and security of its users. And, by inviting raids from corporations (which we hear about) and governments (which we might not hear about), such companies are not helping their own security either.

So there are strong arguments for simply not retaining all that data in the first place. Naturally, some governments are doing their best to force that kind of retention, but that's a different battle. In the absence of legal constraints, a standard policy mandating short data retention periods makes a lot of sense. It behooves all of us to think about what kind of data we leave lying around - either through our activities or by facilitating the activities of others - and to keep it to a minimum. The most secure data is data which does not exist.


(Log in to post comments)

Notes on the Viacom ruling

Posted Jul 4, 2008 18:01 UTC (Fri) by rfunk (subscriber, #4054) [Link]

"why does Google/YouTube hold that much data about its users? Why does it 
retain the ability to replay their actions years after the fact?"

Google's entire business model is to gather as much data as it can, then 
mine it to figure out how to make money from it (usually with targeted 
advertising).  Their whole business model would fall apart if they dropped 
the data quickly.

Notes on the Viacom ruling

Posted Jul 5, 2008 7:29 UTC (Sat) by Wummel (subscriber, #7591) [Link]

It seems Google stores more privacy data than they really need to detect user behaviour.

If you have logged in users with unique login names you don't need to store IP numbers.
For non-logged in users you can replace IPs with hashed values, and the hash function can vary over time. This way you can still detect click behaviour from a single IP address over time (until the hash function changes).

Notes on the Viacom ruling

Posted Jul 10, 2008 23:21 UTC (Thu) by salimma (subscriber, #34460) [Link]

As the GP said, though, Google collects data first and then think up use cases later. Storing
IP address would be useful for, say, finding correlation between physical location and items
watched. Though Google could have just kept the network part of the address, or at least drop
the last byte, with no less of effectiveness but much better privacy for its users.

Notes on the Viacom ruling

Posted Jul 4, 2008 18:46 UTC (Fri) by kirkengaard (subscriber, #15022) [Link]

Makes you wonder why users viewing those videos are in any danger.

What law has been broken by a viewer of copyrighted material which has been posted for public
access by someone else?  I can see that the information would be useful for proving what the
RIAA has thus far had trouble with, if you can call YouTube-watching "distribution," and
therefore proving harm to Viacom under the statute.  I guess the question is how you analogize
the act in question.  The audience of an unauthorized public performance is in no trouble;
what about people who buy unauthorized duplicates of a CD or DVD?

"Viacom promises it would never use this data to launch enforcement actions against
individuals" -- as you say, it obviously crossed somebody's mind.

--> PJ has a quote that's useful.  (Her rights reserved in accordance w/ CC license; I believe
that the quoted statement is used as fair use commentary, on which she's giving free lessons
lately.)
http://www.groklaw.net/article.php?story=20080703111013598

"Viacom General Counsel Michael Fricklas said yesterday that Viacom has no intention of going
after individual users. "Even if they uploaded pirated clips, we're not going to use the data
to find them. We're not going to use it to sue them. We're not going to use it to look at who
they are."

Rather, the company has argued, the data could be used to measure the popularity of
copyrighted video against non-copyrighted video.

Yesterday, lawyers for Google said they would not appeal the ruling. They sent Viacom a letter
requesting that the company allow YouTube to redact user names and IP addresses from the
data."

Which even she thinks is a red herring.  Sue Google to get the ability to improve their
popularity metrics?  Appears that Google has dropped a line back to the judge asking for
reconsideration on the relevance of identifiables to Viacom's stated purpose.

Notes on the Viacom ruling

Posted Jul 4, 2008 22:16 UTC (Fri) by grahammm (subscriber, #773) [Link]

If it just to be used to measure the popularity of copyright vs non-copyright video, then why
does it need Viacom to do it. I am sure that google itself has more facilities for doing this.

Anyway, what is a non-copyright video? Unless it is specifically placed in the public domain
or (very unlikely in the case of videos) the copyright has expired then every video, whether a
clip from a movie or TV show or one recorded on a camcorder or mobile phone, is copyright. So
as there will be almost no non-copyright videos on youtube (or anywhere else on the net), the
popularity of copyright videos must be almost infinitely higher than that of non-copyright
ones.

Notes on the Viacom ruling

Posted Jul 4, 2008 23:31 UTC (Fri) by nix (subscriber, #2304) [Link]

Well, what they mean is obviously 'stuff owned by big media companies' 
because of course it's not *really* copyrighted unless you can afford an 
army of lawyers.

(Actually they probably mean 'stuff owned by Viacom companies so we can 
try to sue everyone who ever went near it pour discourager les autres', 
but we all knew that.)

Notes on the Viacom ruling

Posted Jul 5, 2008 1:27 UTC (Sat) by mjr (subscriber, #6979) [Link]

What law has been broken by a viewer of copyrighted material which has been posted for public access by someone else?

The Finnish copyright law, for one. Downloaders are responsible for downloading only legal material by a literal reading of the law. No, there's no way to know. Yes, it's insane, but so is the totality of the copyright law, so it's merely business as usual. I don't know if other countries have similar nuggets in their legislation, but wouldn't be the least bit surprised.

Notes on the Viacom ruling

Posted Jul 5, 2008 15:20 UTC (Sat) by kirkengaard (subscriber, #15022) [Link]

Which of course depends on the court's reading of "download".  Geek logic argues that
temporary browser copies are qualitatively different from intentional copy-to-the-hard-drive
downloading, especially considering the streaming nature of YouTube.  The user intends to view
the material, not to make a copy, in the former, and intends to acquire a copy of it in the
latter.  Of course, I already know that ephemeral copies have been cited in copyright
decisions, several ways in several jurisdictions.  Law logic, to paraphrase PJ, is different
from geek logic.

Notes on the Viacom ruling

Posted Jul 4, 2008 20:14 UTC (Fri) by bboissin (subscriber, #29506) [Link]

I wish there were more countries who considers IP addresses to be private data (like in
Europe). In some country almost everybody has a static IP address so it really easy to
identify someone with it.

Notes on the Viacom ruling

Posted Jul 5, 2008 2:44 UTC (Sat) by drag (subscriber, #31333) [Link]

Well it's _not_ private data. By definition it's always public, you have to let people know
what your IP address is to do anything. 

You can pass laws to try to make it 'private', but frankly it's completely irrelevant. Passing
laws can't change reality. Trying to do otherwise is just going cause all sorts of completely
inane laws and regulations surrounding everything to do with the internet and routing
information.

It won't do anything to protect people. 

Notes on the Viacom ruling

Posted Jul 5, 2008 12:00 UTC (Sat) by NAR (subscriber, #1313) [Link]

IP address is just like regular address in a sense - it's public, because you have to give it
to others in order to communicate with them, but it's private, because one can't store your
name and address without your permission. At least in Hungarian law, the definition for
private data is "data related to a person or data that could be used to draw a conclusion
about a person" (my translation from Hungarian legalese to English is probably not that good).
According to the Hungarian privacy ombudsman, the IP address is private data and according to
the law, private data can be transfered only if the person, whose data is affected, permits
this. 

However, I wouldn't draw the conclusion that this transfer of TBs of Google data would be
illegal under Hungarian law, because I'm not a lawyer.

Notes on the Viacom ruling

Posted Jul 5, 2008 15:51 UTC (Sat) by kirkengaard (subscriber, #15022) [Link]

The grey area is private as in secret, private as in personally-identifying and individual,
public as in not secret, public as in un-owned, public as in generally available.  I'm sure
there are more.  Which do you mean when you say "private" or "public"?  More, how do you
define secret?

Fingerprints: not secret -- left everywhere; private as in uniquely identifying and linked to
the person.  Personal in a permanent sense.  Not logged in a database by default, because the
assigning authority is unregulated.

Street address: not secret.  Anyone can find out addresses.  Temporarily linked to a
person/family (presumably for longer time values).  Not personal like fingerprints,  but a
unique identifier for the given domicile, and by extension the people living in it.  One might
argue a distinction between the address as such, public data, and the private association of
that address with a person, but in practice it is public-register information.

Telephone number: not secret.  Oh, you can unlist your number, making it harder to find, but
just like fingerprints, you leave it everywhere you call.  Besides which, the phone companies
and the government know it.  US courts have ruled, for competitive business reasons, that a
phone number, once assigned, is property of a sort, and may be retained across carriers.
However, while more personal because of that, it is still like the street address in being
hardware-defined, not user-defined.  In practice, it is still personally-identifying
information, with variable granularity in the case of landlines.

IP address: not secret.  More capable of being secured than street or phone system addresses,
provided tight routes and recipient and assigning authority are both secure and not talking to
anyone else.  However, most of the time you leave it everywhere you visit, and at every point
in between.  Assigned, just like the phone number, but with more variability.  For its
assigned span of time, unique to the hardware, not the user.  Just like street and phone, may
generally be assumed to be under the control of the person who is accounted owner of the
hardware or contracts for the service.

Now, any of these four may commonly be considered personal (YMMV based on jurisdiction and
laws), but your value of public ("you have to let people know what your IP address is to do
anything") is more properly "non-secret".  So, for that value of "private"="secret", nothing
truly is private.  Fingerprints are the only ones not logged on issue, and even that can be
changed, if your government decides to log your issue as they are born.  Someone else knows
your "private" information, if it is identifying, because true secrets have remarkably limited
ID potential by nature.

The fact that multiple users may be assigned to a piece of hardware, be it telephone/NID,
residence, or computer, makes those UIDs problematic as definite personal identifiers.  For
that purpose we have, in the US, SSN/taxpayer ID numbers and driver's license numbers, which
are user specific, not hardware specific.  Those the government has, and you have, and may be
secured by relatively simple expedients (on the user end -- your government screwing up should
not be discounted).

Be more specific, please, in discussions like this, and encourage your lawmakers to do the
same.

Notes on the Viacom ruling

Posted Jul 7, 2008 7:40 UTC (Mon) by kleptog (subscriber, #1183) [Link]

The term I tend to prefer is "personal data". Whether its secret or not is irrelevent. An IP
address could be used to identify you which makes it perfectly reasonable to place legal
limits on the distribution of that information.

It's on a need to know basis, and you don't need to know...

Notes on the Viacom ruling

Posted Jul 7, 2008 19:18 UTC (Mon) by martinfick (subscriber, #4455) [Link]

  So, if you punch me in the face I shouldn't be allowed to tell my friends about it?
Personal data retention is not evil and it is here to stay no matter how hard you or any
government tries to prevent it.  Get over it and adapt your behavior accordingly or forever be
sulking in your misguided (but probably well meaning) view of how things should be.  Once you
do, you will be much happier and you might eventually realize that you are better off because
of it too.

Notes on the Viacom ruling

Posted Jul 7, 2008 19:51 UTC (Mon) by kleptog (subscriber, #1183) [Link]

I'm afraid you'll have to explain this a bit more. Since an action (in this case punching) is
by definition not personally identifying information it has nothing to do with this at all.
Attributes might be, actions never.

Also, the point is not that the data is retained, ofcourse it is, by those who need it. The
point is that it should not be sold or distributed to companies for whom it is not relevant.
In this case there is nothing wrong since a judge apparently decided it's relevent information
to Viacom. You might disapprove that Google kept the data, but they broke no laws.

Notes on the Viacom ruling

Posted Jul 7, 2008 21:22 UTC (Mon) by martinfick (subscriber, #4455) [Link]

"I'm afraid you'll have to explain this a bit more. Since an action (in this case punching) is by definition not personally identifying information it has nothing to do with this at all. Attributes might be, actions never."

What would be the point of saving actions if I cannot relate them to a person? For every action that I log I need to log personal information. Why else would you be worried about your personal information being logged, because it will be associated with your actions right?

"Also, the point is not that the data is retained, of course it is, by those who need it. The point is that it should not be sold or distributed to companies for whom it is not relevant."

Well, your opinion of relevance is not related to mine if I am the one keeping the data. You may decide that it is not relevant that you "punched me in the face" and feel that I should expunge such data, but my friends (or business associates) may appreciate me keeping AND sharing that data, both the action and the personal identifying data. Surely you should see that in these cases my right to share (your personal) data (which does not directly affect you) is more important to and less imposing on society than your desired right to privacy (which if it could be enforced, would unjustly directly affect me).

Notes on the Viacom ruling

Posted Jul 8, 2008 9:33 UTC (Tue) by kleptog (subscriber, #1183) [Link]

I think you're making this unnecessarily complicated. Names are personal but not private and
the accepted means of referring to a person, so if you feel like telling all your friends, go
right ahead. You just don't have a reason to tell them his tax file number, bank account
details or credit card number. There may be restrictions on publishing his name in the
newspaper also.

I think you're referring to the idea that personal data should never be shared (which I never
said), which is obviously absurd... It's just not a free-for-all either. Like most of the real
world it's a nice shade of grey.

Notes on the Viacom ruling

Posted Jul 10, 2008 10:30 UTC (Thu) by lysse (subscriber, #3190) [Link]

Someday everyone will know what it is to love Big Brother.

Love Big Brother

Posted Jul 10, 2008 16:58 UTC (Thu) by pr1268 (subscriber, #24648) [Link]

> Someday everyone will know what it is to love Big Brother.

Agreed. George Orwell was a visionary and a prophet. :-\

Back to the topic, I'm genuinely curious about privacy (or lack thereof) in a historical context: When the telephone became commonplace and the phone companies started publishing directories with subscribers' phone numbers, was there an uproar over privacy concerns?

Love Big Brother

Posted Jul 11, 2008 0:45 UTC (Fri) by giraffedata (subscriber, #1954) [Link]

When the telephone became commonplace and the phone companies started publishing directories with subscribers' phone numbers, was there an uproar over privacy concerns?

No. It was so normal that phone companies sold the "unlisted number" as a product. Today, most people would consider that blackmail. And before telephones, there was a practice that people today would find even more shocking: cities published directories with everyone's home address.

Even in my lifetime, driver licensing information was considered public and anyone could get my address, birth date, and driving record. I can also remember when everyone in a doctor's office could easily overhear other patients' health problems. When reverse-charge telephone service was invented (1970's?) no one questioned for a minute that the company you called got to know your phone number. By the 1990s, that was a huge issue with Caller ID.

Information privacy per se (as opposed to keeping certain things secret because of specific threats) is a recent phenomenon. Part of the reason may be that there is more power available now to process and exploit that information. But I think a lot of it just might be social evolution, like you see attitudes toward sex change with the times.

No thanks

Posted Jul 15, 2008 14:00 UTC (Tue) by job (subscriber, #670) [Link]

If your router discards my packets, I need to contact you out of band to rectify the problem.
Areas where contact information is sparse, such as Taiwan and parts of Russia, is a constant
problem source.

Best humorous angle on the story

Posted Jul 4, 2008 22:50 UTC (Fri) by smitty_one_each (subscriber, #28989) [Link]

Looks like legitimate discovery to me

Posted Jul 5, 2008 10:25 UTC (Sat) by tialaramex (subscriber, #21167) [Link]

This still looks like ordinary discovery to me.

The fact that it's "the bad guys" suing is utterly irrelevant. Any relevant information is
available during discovery unless it is privileged for one of a narrow range of specific
reasons (e.g. attorney-client), if you were allowed to arbitrarily say "No, that's private"
then it defeats the purpose of discovery altogether. The fact that some third party doesn't
want it released is worse than useless as an objection to discovery.

Viacom will take all this data and analyse it. They are hoping to find results that will
convince a court that relatively few uploads are "legitimate" (in the sense that the uploader
had copyright, or good faith reasons to believe they were licensed to upload), and that
legitimate videos represented a small (preferably tiny) fraction of content actually viewed.
They are prohibited under law from treating this data as "theirs" rather than Google's, it is
made available only to prove their case.

Google on the other hand will want to emphasise the unique user generated content and the
facilities to remove or restrict access to copyright content that has been uploaded without
permission. They'll probably also emphasise the use of Youtube by other companies, to
illustrate that it's not anti-commercial per se. From "Will it Blend?" to video game trailers,
uploading your copyright material onto Youtube is now a marketing strategy.

We have no way to know the results of such analysis in advance, the logs and to a lesser
extent deleted videos are clearly relevant to the case, and the IP addresses far from being
meaningless and easily screened are considered (rightly or wrongly) an adequate way to
determine the geographic origin of the connection, which is relevant for a US lawsuit too.

I think Google's case is a lot better than Napster's was. The legitimacy arguments for Napster
tended to be rather theoretical. Google has hours of video of people claiming George W Bush is
a Reptilian or that there's poison in the drinking water, which is the sort of speech that
courts know they're supposed to protect. Americans may not have the right to make and
distribute copies of Viacom's TV shows, but they're definitely allowed to tell people their
insane conspiracy theories.

Looks like legitimate discovery to me

Posted Jul 5, 2008 16:59 UTC (Sat) by jwb (subscriber, #15467) [Link]

I do tend to agree that this discovery action is not disturbing.  But I wonder how Viacom
thinks they are going to make their case.  They must be true believers in the "long tail"
theory, because if you look at the all-time most popular videos on YouTube, nearly all of them
were uploaded by the copyright owner.

http://www.youtube.com/browse?s=mp&t=a&c=0&l=

There's a video of Judson Laipply uploaded by "judsonlaipply", a bunch of music videos
uploaded by "rcarecords" and "universalmusicgroup", some Alicia Keys videos uploaded by
"aliciakeys", and so forth.  Just the top 20 vidoes account for a billion views.  The long
tail would need to be long indeed to make up the difference.

What would seems easier to prove is that YouTube viewers have bad taste in music ;)

Looks like legitimate discovery to me

Posted Jul 6, 2008 7:04 UTC (Sun) by JoeBuck (subscriber, #2330) [Link]

Evidently Viacom thinks it will be helped if it can prove that most of YouTube's business in the early days was based on copyright violation. But that doesn't seem to address the "safe harbor" provision of the DMCA, which puts the burden on the copyright owner to issue takedown requests.

Notes on the Viacom ruling

Posted Jul 5, 2008 13:03 UTC (Sat) by ikm (subscriber, #493) [Link]

I always wished all those 'Online Desktops' of the future would never gain any popularity;
this news only reaffirm it. One can certainly believe in all sorts of privacy policies, but
would they do any good when the court overrides them? The article says it right, the data is
only secure when it's not there at all.

This base is covered too

Posted Jul 6, 2008 16:22 UTC (Sun) by khim (subscriber, #9252) [Link]

For a business difference is not so big: you must keep a lot of logs anyway (or else you can be sued) so it does not matter who and where keeps the logs. And it's done for the cases like that so you can be sure court will come to get your logs...

This base is covered too

Posted Jul 14, 2008 10:51 UTC (Mon) by paulj (subscriber, #341) [Link]

For a business difference is not so big: you must keep a lot of logs anyway (or else you can be sued) so it does not matter who and where keeps the logs.

That's contrary to my experience of medium to large scale corporates: Smart business keep as *few* logs as are required by either legislation or business needs precisely to avoid problems if they're sued.

Perhaps you havn't yet worked for a company that's been subject to a "dumpster diving" order, allowing a 3rd party to trawl through all recorded memos, documents and emails looking for evidence. Such companies may, on legal advice, institute policies to *minimise* records kept (e.g. requiring employees to delete emails upon certain conditions, e.g. time since arrival). A lot of the SarBox work in companies has been precisely about that, despite one of the purposes of SarBox being to require good, corporate, record-keeping.

On the personally identifiablity of IP addresses

Posted Jul 6, 2008 19:43 UTC (Sun) by dps (subscriber, #5725) [Link]

Most IP address can be linked to a person, or group of people, given a time. If this was not
true then it would be impossible to get spammer's accounts nuked by sending the appropriate
information to their ISP. Some ISPs policies include penalties like hefty clean up fees or
your telephone[*] not working if your account is nuked for internet abuse.

Provided you do it soon enough the data logged by ISPs can turn an IP address and time into an
account name, which almost certainly constitutes protected personal information. At least in
the EU when one does get a reply to a spam report you never learn any names but do get the
account nuked.

FYI 80.176.136.7 is reserved for my use and use thereof is strong evidence I was responsible.
Fortunately I have a strong (dedicated linux IP tables) firewall box and mail server which
does not support third party relaying.

Duncan (-:

[*] BT broadband customers are liable to lose their BT telephone service in addition to their
broadband connection.

Notes on the Viacom ruling

Posted Jul 7, 2008 18:34 UTC (Mon) by madcoder (subscriber, #30027) [Link]

Why does it retain the ability to replay their actions years after the fact? And why do "removed" videos not go away?
Because (unlike many competitors) they can ?

Libraries get it

Posted Jul 10, 2008 3:27 UTC (Thu) by denials (subscriber, #3413) [Link]

It's worth noting that most public and academic libraries go to great pains to try to obscure
any data that could link users to the items that they have borrowed or videos they have
watched or games they have played or sites they have visited on public workstations [1]. Even
though this means that we end up throwing away some data on which we could build useful
services - like recommendations ("You liked book X and video Y - you should check out this
podcast") - the protection of our users' privacy tends to trump new features. [2]

As a result, libraries might not be seen as sexy as, or gain as many new users as,
organizations willing to compile massive amounts of personal data, but then, we're in this for
the long haul.

1. http://www.ala.org/ala/lita/litaresources/taskforceonpriv...
2. http://www.dlib.org/dlib/december06/whitney/12whitney.html

Libraries get it

Posted Jul 10, 2008 5:47 UTC (Thu) by boudewijn (subscriber, #14185) [Link]

Not in the Netherlands, unfortunately, where the local library gleefully 
keeps track of everything I've ever made use of, to give better customer 
service, but also to be able to oblige the police in their 
investigations. We handed in our cards and have started to buy more and 
more books second-hand instead.

Libraries get it

Posted Jul 10, 2008 13:49 UTC (Thu) by davecb (subscriber, #1574) [Link]

  They're not using the Geac library system, then, as it
only keeps book/patron linkages until the book
is returned and fines paid. And yes, Geac is
very active in the Netherlands, despite the
local pronunciation of its nme.

--dave

Lack of data protection / privacy in the USA

Posted Jul 10, 2008 9:59 UTC (Thu) by morhippo (subscriber, #334) [Link]

It is unfortunate that the USA do not have an adequate level of privacy. Consumer data is free
game, can be used for any purpose without consent and material business decisions (think
credit decisions) are based on flimsy information, freely available to anyone without any
justification or controls.

It is also noteworthy that under European law any transfer of personal data by companies into
the USA is prohibited per se, unless individual consent is obtained or other exceptions apply
(e.g. participation of the US data recipient in the so-called "safe harbour" programme).

As a European lawyer, I try very hard not to share any personal data with companies based in
the USA for this very reason. 

Unfortunately most people do not care about there privacy at all (watch TV shows to see the
lack of decency in most people), or companies may feel more pain for abusing personal data.

Lack of data protection / privacy in the USA

Posted Jul 10, 2008 12:45 UTC (Thu) by cortana (subscriber, #24596) [Link]

So can I, as a citizen of the UK, prevent my personal data from being turned over to Viacom in
this way? Or did I already cede it to the USA when I accessed Youtube in the first place
(which is presumably hosted in the USA).

Lack of data protection / privacy in the USA

Posted Jul 10, 2008 12:50 UTC (Thu) by aanno (subscriber, #6082) [Link]

Well, USA is a bad place for privacy, but the EU with its new data retention policies (aka 'Vorratsdatenspeicherung') is hardly better. The internet was never made to protect your privacy, and the among of email spam is only one proof of this.

However, you could make legal use of anonymisation services like Jondos, Tor, or I2P .

But at present this is for nerds only and very slow...

Why does it retain the ability to replay their actions years after the fact? And why do "removed" videos not go away?

Posted Jul 11, 2008 20:35 UTC (Fri) by smoogen (subscriber, #97) [Link]

It depends on what kind of 'removed' video they are talking about. If the video is taken down
due to a "take-down" notice from a copyright holder, you get a subpoena which says you have to
keep and store that data. In that case, every copy of the Family Guy that has been taken down
has to be stored until some date in the future. There is also the fact that other data may not
be deleted because they want to do research on it in the future.

Google is a vast money making enterprise because it does constant data research. To do that
with old data, they must store everything even if they do not know what they are looking for
currently. [Of course there is the other problem that occurs in acquisitions.. group A may
store more or less than group B.. and everyone gets smeared when it comes to light].

Copyright © 2008, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds