Slashdot Mirror

← Back to Stories (view on slashdot.org)

Netflix Has Saved Every Choice You've Ever Made In 'Black Mirror: Bandersnatch' (vice.com)

Posted by BeauHD on from the data-harvesting-operations dept.

According to a technology policy researcher, Netflix records all the choices you make in Black Mirror's Bandersnatch episode. "Michael Veale, a technology policy researcher at University College London, wanted to know what data Netflix was collecting from Bandersnatch," reports Motherboard. "People had been speculating a lot on Twitter about Netflix's motivations," Veale told Motherboard in an email. "I thought it would be a fun test to show people how you can use data protection law to ask real questions you have." From the report: The law Veale used is Europe's General Data Protection Regulation (GDPR). The GDPR granted EU citizens a right to access -- anyone can request a wealth of information from a company collecting data. Users can formally request a company such as Netflix tell them the reason its collecting data, the categories they're sorting data into, third parties it's sharing the data with, and other information. Veale used this right of access to ask Netflix questions about Bandersnatch and revealed the answers in a Twitter thread. He found that Netflix is tracking the decisions its users make (which makes sense considering how the film works), and that it is keeping those decisions long after a user has finished the film. It is also stores aggregated forms of the users choice to "help [Netflix] determine how to improve this model of storytelling in the context of a show or movie," the company said in its email response to him. The .csv and PDF files displayed Veale's journey through Bandersnatch, every choice displayed in a long line for him to see.

After sending along a copy of his passport to prove his identity, Veale got the answers he wanted from Netflix via email and -- in a separate email -- a link to a website where he downloaded an encrypted version of his data. He had to use a Netflix-provided key to unlock the data, which came in the form of a .csv file and a PDF. Veale is concerned by what he learned. Netflix didn't tell Veale how long it keeps the data and what the long term deletion plans are. "They claim they're doing the processing as it's 'necessary' for performing the contract between me and Netflix," Veale told Motherboard. "Is storing that data against my account really 'necessary'? They clearly haven't delinked it or anonymized it, as I've got access to it long after I watched the show. If you asked me, they should really be using consent (which you should be able to refuse) or legitimate interests (meaning you can object to it) instead."

7 of 102 comments (clear)

  1. Revolutionary by rmdingler · · Score: 4, Funny

    If this catches on, and other entertainment and social media companies start collecting data on every keystroke of input, personal privacy is doomed.

    --
    Happiness in intelligent people is the rarest thing I know.

    Ernest Hemingway

    1. Re:Revolutionary by AmiMoJo · · Score: 2

      Been happening for years.

      Google "record user session javascript" and see what comes up. Many platforms have to built in these days. The site can record every keystroke, every mouse movement or click, window resize events, scrolling, pretty much every interaction. Similar stuff exists for apps on mobile platforms too.

      Developers love it, they can see how people interact with their work and reproduce bugs. Unfortunately it's also a privacy nightmare and somewhat difficult to block consistently.

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
  2. Don't buy it by PopeRatzo · · Score: 3, Insightful

    Clearly, Netflix hasn't been saving all my choices, because if they were, they wouldn't keep recommending that I watch shitty Norwegian police procedurals or bad stand-up comedy specials.

    --
    You are welcome on my lawn.
  3. Netflix Has Saved Every Choice You've Ever Made by Kernel+Kurtz · · Score: 4, Interesting

    Duh.

  4. It is necessary! by SuperKendall · · Score: 5, Interesting

    My God, am I the only actual nerd left here??? The only one who has gone through pretty much every iteration and node of Bandersnatch????

    Netflix DOES need to record and store your choices, because they affect nodes in the story sometimes EVERY AFTER YOU RESTART.

    That to me was the most fun and brilliant aspect, the effect choices could have even going back to earlier choices (and a meta reference if you know the story).

    Seriously, Bandersnatch is awesome, and this guy is an ass. Screw him and everyone else that hates fun.

    --
    "There is more worth loving than we have strength to love." - Brian Jay Stanley
    1. Re:It is necessary! by Okind · · Score: 2

      The issues are:

      1) They don't ask for specific consent to do that, which is required under GDPR.

      Consent is not necessary, if they can use one of the other 5 grounds for keeping the information. Some of them are related to government applying the law, or the public welfare, which obviously don't apply here. Netflix basically has 4 possible grounds:

      1. 1. Consent, which allows everything a customer can understand (!), but can also be revoked at any time
      2. 2. Legitimate use, where they have to prove the loss of privacy outweighs any possibly benefit to you, and you can object to this
      3. 3. Fulfilling a contract, which allows Netflix to store any necessary information for as long as necessary to fulfill their obligations (this is really quite limited)
      4. 4. Obeying the law, such as legal warranties, may force them to store certain information (mostly related to who bought what & when). It's unlikely this could ever apply to this case.

      2) They keep the data indefinitely, without any kind of anonymization, for the claimed purpose of improving their storytelling. If they kept it for you benefit that might be different, but they are keeping it to help themselves... Forever, and without asking first.

      Would it really be so hard for them to ask up front "can we store this forever and use it, or would you prefer us to delete/anonymize the data after a while, noting that your progress will be lost?"

      Now here we have a good argument. It's really not necessary to store your choices after you've seen Bandersnatch: the next time you view it, you should be able to choose a different outcome. In fact, unless Netflix can prove a followup is already planned, there's really no reason to keep the (non-aggregated, personal) data. And hence it's illegal.

  5. They had some trivial personal data... by cardpuncher · · Score: 2
    ... and they now have a copy of his passport. Great result!

    I'm not sure how the production of a passport gives any assurance of the identity of the requestor, especially if they didn't ask for it when the account was set up in the first place. It does sound very much like a charade to deter people from going through the (otherwise free) process of asking for their data.