Official statement on the recent news about privacy

[bob3160]

Am I the only one that wants to know what kind of information Jumpshot has on me? I've sent a request for information to them as I have the right to do under GDPR but no response. I'm going to wait 30 days and then sue them to get the information, the fine for not complying is quite steep. And if Jumpshot shuts down I'm going after AVAST.

you may want to know that if data is anonymised GDPR does not apply

I was wondering how long it would before someone would realise/mention this.

well, Im not so sure. It is especially hard since we dont know what was in the data that Avast pulled from our computers, but about 5 minutes of digging gives that GDPR goes pretty far here,  Article 4, §1 clearly specifies:

"‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;"



Moving on to Avast, in the privacy policy, Avast specifies that they collect:

"Email address             -              To send you communications regarding your license and support
Username             -              To manage your account and facilitate your login into the service
Subscription renewal date             -              To tell us until when the account is valid
Trial User             -              To add a trial period before the account is charged"

Especially Email Address and Username looks to me like they would be what one would call "Online identifiers".





Furthermore, Avast privacy policy also states that these bits of information are collected:

"Product Data includes two sub-categories:

Device Data includes information about the operating system; hardware; city/country of device; error logs; browser; network; applications running on the device, including the Avast products; and
Service Data includes information about the Avast product usage and events relating to use of our product by you such as malware samples and detections, information concerning URLs of websites, usage statistics (activation, crashes, scans, errors), IP address."

IP address and city/country will most probably also fall under what GDPR considers "personal data", wouldnt you agree?

For reference:
----------------
Avast privacy policy:
https://www.avast.com/privacy-policy

GDPR official legal text, Article 4:
https://gdpr-info.eu/art-4-gdpr/

Disclosing what's collected is a good thing not done by many but it isn't necessarily the same as what was shared.

[anon.nona]

Are you suggesting that what avast writes in its privacy policy is not correct?

[bob3160]

Are you suggesting that what avast writes in its privacy policy is not correct?

Where in the privacy statement does it state what they shared?

[anon.nona]

Are you suggesting that what avast writes in its privacy policy is not correct?

Where in the privacy statement does it state what they shared?

It was my understanding the poster wanted to know what data jumpshot (or in the long run, avast, since jumpshot looks shutdown already) had on them, not what they shared?
And knowing what data a company has on its customer seem to fall within the rights of gdpr, does it not?

[bob3160]

Are you suggesting that what avast writes in its privacy policy is not correct?

Where in the privacy statement does it state what they shared?

It was my understanding the poster wanted to know what data jumpshot (or in the long run, avast, since jumpshot looks shutdown already) had on them, not what they shared?
And knowing what data a company has on its customer seem to fall within the rights of gdpr, does it not?

One has nothing to do with the other. What Avast collected is disclosed and something you agreed to have them collect.
What they shared was stripped of personal information. You also didn't notice the following, if data is anonymised GDPR does not apply

[anon.nona]

Are you suggesting that what avast writes in its privacy policy is not correct?

Where in the privacy statement does it state what they shared?

It was my understanding the poster wanted to know what data jumpshot (or in the long run, avast, since jumpshot looks shutdown already) had on them, not what they shared?
And knowing what data a company has on its customer seem to fall within the rights of gdpr, does it not?

One has nothing to do with the other. What Avast collected is disclosed and something you agreed to have them collect.
What they shared was stripped of personal information. You also didn't notice the following, if data is anonymised GDPR does not apply

That they disclosed what they collect hardly means that the user loses his right to see the data though, does it? and again, what they shared was not the point the poster was making, it was "What data Jumpshot/Avast has on them".

[bob3160]

Again you are using Avast and Jumpshot as one entity they are two separate companies
They don't share the same data.

[anon.nona]

Again you are using Avast and Jumpshot as one entity they are two separate companies
They don't share the same data.

I am fully aware of that. I am sorry, what I intended to say was:
"That they disclosed what they collect hardly means that the user loses his right to see the data though, does it? and again, what they shared was not the point the poster was making, it was "What data Jumpshot has on them, failing that, they want to know what data Avast has on them".

Can we now agree that the user is in their full right to ask for this data, whether it contains horrible amounts of personal data, or only a nick for the forum and an email address, probably tied to an IP as well?

[bob3160]

Again you are using Avast and Jumpshot as one entity they are two separate companies
They don't share the same data.

I am fully aware of that. I am sorry, what I intended to say was:
"That they disclosed what they collect hardly means that the user loses his right to see the data though, does it? and again, what they shared was not the point the poster was making, it was "What data Jumpshot has on them, failing that, they want to know what data Avast has on them".

Can we now agree that the user is in their full right to ask for this data, whether it contains horrible amounts of personal data, or only a nick for the forum and an email address, probably tied to an IP as well?

Avast has already declared what it collects and the user agreed to allow that collection. So I don't understand what you're trying to point out?

[Kermit80]

That they disclosed what they collect hardly means that the user loses his right to see the data though, does it? and again, what they shared was not the point the poster was making, it was "What data Jumpshot/Avast has on them".

just to clarify:

1.) Avast states in its policy that some user data is collected, they clearly say for what purposes that data is collected (sharing it's not included). It's your right (GDPR) to know from Avast what data they have about you and to ask for its deletion.

2.) Avast share, on your consent, browsing history with Jumpshot. That data is anonymised and aggregated thus it's no more referrable to you. In this case GDPR does not apply since there is no more personal data.

[DavidR]

Again you are using Avast and Jumpshot as one entity they are two separate companies
They don't share the same data.

Even if they were, which they aren't.
When the data has identifiable data removed/anonymised (stripped out) and then aggregated, how does one go about identifying what data is held for that person making the enquiry, when personalised data has been removed.

[anon.nona]

Again you are using Avast and Jumpshot as one entity they are two separate companies
They don't share the same data.

I am fully aware of that. I am sorry, what I intended to say was:
"That they disclosed what they collect hardly means that the user loses his right to see the data though, does it? and again, what they shared was not the point the poster was making, it was "What data Jumpshot has on them, failing that, they want to know what data Avast has on them".

Can we now agree that the user is in their full right to ask for this data, whether it contains horrible amounts of personal data, or only a nick for the forum and an email address, probably tied to an IP as well?

Avast has already declared what it collects and the user agreed to allow that collection. So I don't understand what you're trying to point out?

yeah, I am sorry, but I made it fairly clear. I dont have time to try to make someone understand that actively refuses to do so. I think most other people on this forum understood my point atleast.
One last time; "The user has, in accordance with GDPR, the right to know the data that a company, in this case Jumpshot or Avast or any other company really, holds about them". That is it, end of story, thats what I am getting at, and it is within their rights, even if it says in some bundled up privacy nonsense what information they may or may not have on said user. The user still has the right to request a printout of said information. Period.

[bob3160]

Again you are using Avast and Jumpshot as one entity they are two separate companies
They don't share the same data.

I am fully aware of that. I am sorry, what I intended to say was:
"That they disclosed what they collect hardly means that the user loses his right to see the data though, does it? and again, what they shared was not the point the poster was making, it was "What data Jumpshot has on them, failing that, they want to know what data Avast has on them".

Can we now agree that the user is in their full right to ask for this data, whether it contains horrible amounts of personal data, or only a nick for the forum and an email address, probably tied to an IP as well?

Avast has already declared what it collects and the user agreed to allow that collection. So I don't understand what you're trying to point out?

yeah, I am sorry, but I made it fairly clear. I dont have time to try to make someone understand that actively refuses to do so. I think most other people on this forum understood my point atleast.
One last time; "The user has, in accordance with GDPR, the right to know the data that a company, in this case Jumpshot or Avast or any other company really, holds about them". That is it, end of story, thats what I am getting at, and it is within their rights, even if it says in some bundled up privacy nonsense what information they may or may not have on said user. The user still has the right to request a printout of said information. Period.

If you don't reside in the US, you have the right you stated. I'm also pretty sure that Avast would honor that request if you're in the US.

[Kermit80]

yeah, I am sorry, but I made it fairly clear. I dont have time to try to make someone understand that actively refuses to do so. I think most other people on this forum understood my point atleast.

Your point is pretty clear. Just please understand that you do have the right to know what data Avast has on you (at least if you live in the EU) but you can't ask for what data Jumpshot has on you since they don't have any (it has been anonymized and aggregated)

[DavidR]

<snip quotes>
yeah, I am sorry, but I made it fairly clear. I dont have time to try to make someone understand that actively refuses to do so. I think most other people on this forum understood my point atleast.

One last time; "The user has, in accordance with GDPR, the right to know the data that a company, in this case Jumpshot or Avast or any other company really, holds about them". That is it, end of story, thats what I am getting at, and it is within their rights, even if it says in some bundled up privacy nonsense what information they may or may not have on said user.

The user still has the right to request a printout of said information. Period.

And just how do you suggest they go about this:
When the data has had any identifiable data removed/anonymised (stripped out) and then aggregated, how does one go about identifying what data is held for that person making the enquiry, when personalised data has been removed.

They would under GDPR (even if this were the case having given permission for that data to be used) be entitled to know what information is held on them.  They would have to give personal information with which to make a search, a search on any anonymised and then aggregated data would return zero hits.

You can't just give them a print out of all of the aggregated data as they would have no right to that.