Fingerprints are the new cookies

Thanks for replying with your expertise. Very useful!

It's coming to the end of the year and my accounts are a mess, so I engage a bookkeeper to work through my paperwork. I give them access to my Stripe account so they can reconcile incomings. Have I breached the law? Do I need to ask all my customers first, and do I need to disclose the identity of my bookkeeper? My code is also quite the mess, so I'm going to invest in it by engaging Thoughtworks to tell me what's up. I give them prod access to evaluate and help improve things, and they incidentally observe user data in our database. Have I breached the law? I keep a database backup unencrypted in Backblaze B2, with appropriate permissions so it's not publicly exposed. Does this mean I've disclosed private information to Backblaze? Do I have to get every user's consent at the time I make every database backup?

None of those are keeping the data or coying it. They are subcontractors in that case. They cannot copy and/or use the data outside of the work they do for you. I’m not a lawyer but I’ve worked with sensible customers data and this was managed straightly.

Europol reaches out and says someone has been using ZomboCom to plan terrorist activity. They issue me with a request for user information, giving the first and last name of the user they suspect. I go to my lawyer to ask them to look at the request. Do I need to ask the target before sharing their personal information with my lawyer? What about with Europol? Does it matter if I'm not subject to Europol jurisdiction? Does it matter if it's the Iranian Revolutionary Guard instead?

If I’m not mistaken, this is already an issue with services such as ProtonMail. There’s absolutely nothing new here.

Meanwhile there's only one Zombo user in US zip code 90210, and they sent private message on the site containing a photo of their very unusual belly button. Since I'm the owner, I scan through photos on the site from time to time. I go to a local bar and talk in detail about their belly button. I never use their name, but mention the zip code. Someone overhearing our conversation happens to live in 90210, and their neighbor has talked about being the only Zombon in the area. Did I breach the law?

Yes, probably. And, having managed email servers and seen during debugging stuff I should not have seen, it is nothing new. Same applies for lot of jobs: professional secret.

But, in this case, you didn’t copy the data, so you simply breach professional secret.

I have about a hundred thousand users in New York. Exactly one user paid by money order, and I write a blog post about how we're proud to support that one unnamed user. Have I disclosed information about an individual? Does this differ from the belly button example?

No, it is not different. That’s also straight violation of professional secret.

Our current privacy regime sucks big fat donkey balls, but that doesn't mean there's an easy solution waiting just around the corner. In my opinion the very idea of user consent in this space is a mistake; users can't meaningfully consent, and data processors can't meaningfully predict all the interactions that may necessitate data use or disclosure. The only outcome of a consent-based regime is what we have: people clicking through and being upset later.

Wait, you cannot find more? I mean all your hypothetical cases are straightforward to answer.

You basically convinced me that my idea is good.

The point of consent is that it has been abused on purpose by people doing malicious compliance with GDPR (well, in fact, those cookie banner are not even GDPR compliant).

But if, by default, non-consent was assumed and consent had to be given when the data was used, I guarantee that nobody would give consent, that those emails would go straight in spam. And that will be the very end of the privacy invading industry.

The problem with my solution is that it would work too well and there are too many financial interest against it. It is too late. (basically, that was the kind of law that was supposed to take place in USA in 2001 but then 9/11 happened and secret services suddenly thought that spying their own citizens was a good idea and it would be cheaper to let Google do that for them)

Thank you for the lovely examples! I did fairly deliberately say "sell" not "share" with my original statement, for some of these reasons, though it's a much weaker statement than what /u/ploum. I think it'd be a lot easier to mop up the ecosystem of the more abusive bottom-feeders a bit than solve the problem in one fell swoop, though I can already think of ways to wriggle around such a thing. "Oh we're not selling the data we scrape, we're sharing it with our strategic partners who we happen to have a consulting contract with."

That does also suggest that even if it mostly works as intended, we'd just get left with the big sophisticated predators like Google, as /u/mxey points out. Still maybe an improvement?

Ah, but fingerprint calculation is specifically designed to reduce the clashes.

There are other websites that calculate how many people share your hash. It's usually from 20 to 100 if you have 100% normie setup, but about 1 to 5 if you have anything specific. The tech is awfully potent.

The original message I was replying to has been edited, so my answer seems a bit off now.

I was replying to the parent message, because I thought that the interpretation in the original message of the text passage that I quote was maybe incorrect.

I agree with you, multiple people sharing the same fingerprints makes them a bit useless. But that was not the point I was trying to address.

Unfortunately, fingerprinting scripts are quite often first-party. Moreover, popular CDNs offer the service of embedding these type of scripts directly into the served HTML :/