Hacker News

points by DSpinellis 21 hours ago | 0 comments

My understanding is that collecting these data and constructing the knowledge graph violates the European General Data Protection Directive (GDPR). According to the GDPR, personal data (such as an email's sender name and email address) are provided for a specific purpose (in the case of sending an email, for identifying the sender and facilitating email replies). Similarly, a calendar invitation is provided to organize a meeting. Processing that data for a different purpose (as described here, for constructing a knowledge graph) without the subject's explicit consent is unlawful.

[–] mimotomo2009 21 hours ago

I'm not sure. IMO when you buy a Mac (or use Windows or an Android phone) you have accepted so much that there is nothing which is not allowed.

But nevertheless: as far as I have understood it everything is built on your computer and is still used on your computer. You - as the user of the Mac - has took and saved the information. Your Mac is then only working for you - if Apple doesn't load the information in their enviroment.

[–] harvey9 20 hours ago

As a general rule you cannot override national law by accepting service terms.

[–] Sharlin 21 hours ago

Unlike Americans seem to think, terms of use don’t override law.

[–] bel8 20 hours ago

Someone should start a company with terms mentioning that whoever agrees to it will live forever.

If we are overriding federal laws, might as well make people immortal too.

[–] yubblegum 21 hours ago

https://news.ycombinator.com/item?id=47873517

[–] jadamson 21 hours ago

This is going to depend on the holder's relationship with the data subject.

If you send a friend an email, they may add you to their address book and set a reminder for your birthday while they're at it. They don't need your permission to do that, so why would a device acting on their behalf?

On the other hand, if a customer of mine asks for the data I have on them, do I have to send them my Personal Knowledge Graph facts about them? That's less obvious, and I'd lean towards Apple's helpful database being a liability even if it's local.

[–] eastbound 21 hours ago

It's on the person's Mac so it is a little more complicated. The person you send your data to is the Data Controller, and fails you by not publishing their privacy policy. But Apple isn't a Sub-Processor here, because they aren't sending the data to Apple.

I'm saying that because I wish the GDPR also covered the software providers who perform Data Processing against the will of all parties, but it isn't the case. Lastly, they're a person and not a business.

It is however clear that building a database of people which may contain race, religion or political opinions is illegal, even if it's just a person doing it.

[–] DSpinellis 15 hours ago

GDPR applies to persons and businesses. The fact that you're violating GDPR, because without your knowledge Apple has deployed software on your computer that compiles this knowledge graph makes Apple complicit. Imagine violating a speed limit, because your car's speed indicator has a software flaw that causes it to show a lower speed.

[–] saagarjha 3 hours ago

This is not equivalent at all. You don’t need to create a GDPR notice because the user types their personal info into their own documents for example, despite you being on the path of it going to disk.