Slashdot Mirror
The 600+ Companies PayPal Shares Your Data With (schneier.com)
AmiMoJo shares a report from Schneier on Security: One of the effects of GDPR -- the new EU General Data Protection Regulation -- is that we're all going to be learning a lot more about who collects our data and what they do with it. Consider PayPal, that just released a list of over 600 companies they share customer data with. Here's a good visualization of that data. Is 600 companies unusual? Is it more than average? Less? We'll soon know.
This looks alarmist, but really the only surprising thing is how many companies they partner with under marketing is almost the same number as they partner with for anti-fraud.
Despite that, one legal link.
A good many of these seem legit: companies to which PayPal has outsourced work, or partners such as banks, which all form an integral part of PayPal's actual operation. The shady ones are the companies listed under "marketing and communications". But all in all there aren't many shocking revelations in there. The sheer number seems high until you look at the list, and realise that this is what comes with running a global service.
What we see there in some cases that "shared data" also includes data collected by embedded crap from 3rd parties such as FaceBook (which pretty much every site has these days). "Advertising ID and device ID to segment user groups based on app behaviour, encrypted e-mail address associated with PayPal users (without indicating account relationship), IP Address, Anonymous ID generated by cookies, pixel tags or similar technologies embedded in webpages, ads and emails delivered to users. Mobile advertiser ID, IP Address and other metadata via Facebook SDK in mobile apps." Yeah, just about what we expected, and it's good that they actually include this sort of stuff on the list.
Here's an odd entry: Carrenza Limited (UK) | To hose a marketing database | Name, address, email address, business name, domain name, account status, account preferences, type and nature of the PayPal services offered or used, and relevant transaction information. I just wish that wasn't a typo...
If construction was anything like programming, an incorrectly fitted lock would bring down the entire building...
They give literally everything to everyone for every reason. Mostly the reason seems to be money, there are a lot of data brokers on that list.
This "To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering. RESEARCH AND TESTING as to appropriateness of new products"
Research and testing is literally any cover reason for getting the data.
The list of companies are largely data brokers, some for marketing some for intelligence gathering, some governmental. Giving a known data broker everything including a copy of the photo ID, presumably as the result of a monetary transaction is clearly be illegal in Europe at least. It likely violates the banking privacy act in the US too.
Put it this way, Putin's front data broker is on the list. Paypal have given access to every US Congress/Senate critter's documents and transactions to Putin's nerve gassing friends. Time to implement a privacy law in the US? Or is this like the NRA, too much lobby money to do it?
I got the heads up about PayPal privacy revisions months ago. Yes, they do seem to share with a lot of others. But clearly PayPal is a large company itself doing business with many areas of the economy. My interest is more in protecting my information through this exchange, not how many receive it as long as its legitimate. At least PayPal tells you up front and you can choose not to accept it and move on. Nobody forces you to use PayPal.
e.g. pull one from the list at random: Global Data Consortium.
"To verify identity and carry out checks for the prevention and detection of crime including fraud and/or money laundering; research and testing as to appropriateness of new products"
There's the cover (fraud prevention) and the catchall "research and testing" which covers any reason at all.
GDC sell data, they buy it from "Data Partners" and resell it. They phrase it real nice here:
"We invest in our data partners, establishing deep relationships with them and providing them with technology to make their information available on our platform. We give them access to a broader market through our MARKETING AND DISTRIBUTION programs, PAYING FAIR ROYALTIES that reflect the value of their services."
i.e. they are a data broker that pays Paypal royalties for selling your data to others. A conduit rather than an endpoint. And Paypal use the catchall phrase to cover bulk sales of all data.
Share away, Elon! I signed up for Paypal with the name "Sausage McMuffin". I can't change it easily, because they instituted all these name change rules later. I make maybe one or two purchases with Paypal a year (and I would never be so foolish as to share my bank info with Paypal). Share as you wish, guys!
- Sausage McMuffin
Is that the Chaos Communication Club?
I hope she's not into infographics, or computer graphics, or user interface, because she did a poor job . Rebecca Ricks
Now we know where these online data aggregators get their information from. They have startling amounts of information about people. It makes stalking a breeze. Before, you'd have to go to the local court and attempt to social engineer a clerk. Now it's just a Google query.
"Sharing" is a friendly gesture and a positive thing. This is neither friendly nor positive -- it's an act of pure greed. What these companies are doing is selling your personal data, not "sharing" it.
Forced Telemetry / spying, installing programs you do want, taking away your choices.
Sitting down and your computer to feel like your nice computer is an enemy.
the real question is, why haven't you just topped yourself yet?
back when they first started. They were such assholes that I've only used them once or twice since. And even then, it was only their credit card processing service that I used, and only because I really, really wanted to donate money and that was the only way to do it. In the meantime there have been lots of musical artists, software authors, etc. that I wanted to give some money to - but not badly enough to suck it up and support a company that I'd like to see die. As for making purchases, if PayPal is the only way to pay, then I simply don't buy. I've made special arrangements to do Interac transfers, both to make a point with a vendor, and as a 'fuck you' to PP. As for an actual PayPal account with my money in it? I wouldn't be caught dead with one of those. PayPal is utterly evil, and I'm glad that the choice to never support them in any way is a viable one. Now if only I found it viable to make the same choice with Google...
I'd like to hope that this latest report about PayPal will hurt their business. Sadly, I don't think it will.
'The Economy' is a giant Ponzi scheme whose most pitiable suckers are the youngest among us and the yet-unborn.
LinkedIn recently started sharing their "private" data with public records databases such as Intelius. (https://en.wikipedia.org/wiki/Intelius)
I don't have much respect for people who sell their dignity for a few seconds of convenience. If you use PayPal, or Amazon or Google or Facebook or Apple, you're a sucker, plain and simple.
I don't respond to AC's.
A good many of these seem legit: companies to which PayPal has outsourced work, or partners such as banks, which all form an integral part of PayPal's actual operation. The shady ones are the companies listed under "marketing and communications". But all in all there aren't many shocking revelations in there. The sheer number seems high until you look at the list, and realise that this is what comes with running a global service.
I disagree! Under 'operational' it lists Microsoft US to obtain the images of the profiles. I don't find that OK and this has nothing to do with the purpose of being a payment processor.
I hope the EU will take appropriate action!
Only use PayPal when it's absolutely necessary. Remember that you can sell to people in your own country much easier than via PayPal, in particular in the EU where Internet banking is growing faster than anywhere else.
There is often no need to use PayPal, and cutting out this middle-hand will 1. lower all the fees for you/customers and 2. keep both your and your customer's data private.