Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Haha that's not dodgy at all. There is a legitimate business around selling data;

This is OK in 3 scenarios I can think offhand: 1) A company collects personal/contact information on behalf of another and is upfront about this at collection 2) A company contacts their list asking if these people would like to share their information with a company 3) Permission to sell information is in the T&C on sign-up of the original company.

If one of these 3 is not covered I image companies should purge data if the business closes. Option 2 would be good for companies that are looking for a cash bump on the way out.

At a financial level I see a bunch of people with lists in the 10's of thousands and they are surprised how little it is worth. To earn a western level income from a contact list you'd likely need a hundred thousand plus of contacts assuming a typical consumer audience and reasonable response rates. Lists are worth significantly more for specific hard to reach groups like CTO's or surgeons etc. For me these would be 15x what I pay against a standard consumer list as a massive generalisation.



This assumes you have only US citizen's data. One Canadian in there for example and you're surely breaking the law.


I don't see why. Could you shed light on this view?


It's illegal to sell user data without explicit consent in a lot of countries. It should also be illegal in the US tho due to the Fair Information Practices.


What is defined as explicit consent? Most terms of service and EULAs on websites and software do explicitly give the company the right to sell your data.

Also aren't the FTC's Fair Information Practices just recommendations with no consequences for violating?


Probably "We are going to disclose your data to party X. Do you consent this?". Saying that you are going to share user information with undisclosed 3rd parties seems like a bit too broad.


Here is how it works in France:

http://www.cnil.fr/english/data-protection/rights-and-obliga...

Practically, if you operate a service in France, you need to have 2 checkboxes at user creation:

* I accept to receive commercial informations and advertising from the service

* I accept to receive commercial informations and advertising from third parties

If you don't have the checkboxes or the user unchecked, no sharing.


In the UK, even if you've managed to buy emails it's of no use, you aren't allowed to contact people unless you've had a business relationship for a related product in the last 12 months.


This is new to me. How does this exactly work? Can you report the email senders to someone, if you get spam or something?


You have to sue them yourself, in small claims court.

http://www.legislation.gov.uk/uksi/2003/2426/regulation/22/m...

http://www.legislation.gov.uk/uksi/2003/2426/regulation/30/m...

Judges range in how they feel about these complaints, generally you won't be able to claim just for the time they've wasted, you'll have to justify why you have suffered damages. Extreme cases are different, if they're truly wasting huge amounts of your time, but the occasional email is unlikely to be enough for wasted time.

Alternatively, you can get the ICO to tell them off even if you haven't suffered any damages, but that's not always easy…


Don't confuse facts with views.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: