[markovbot]

Then why do they have all those incredibly questionable things in their privacy policy? What makes them "trustworthy"? I've never heard of them, but from reading this blog post it seems like yet another evil company trying to suck up PII from unsuspecting victims and sell it.

[Kiro]

And that's why you shouldn't trust a random blog. They completely misrepresented that paragraph. Here's the full quote:

"As part of a business transfer. Onfido may disclose your personal information to an actual or potential buyer, investor or partner (and its agents and advisers) in relation to any actual or proposed divestiture, merger, acquisition, joint venture, bankruptcy, dissolution, reorganization, or any other similar transaction or proceeding"

[markovbot]

how is that different from what the blogpost said?

edit: to be clear, the blog post has listed, among other complaints:

> Onfido may disclose your personal information to an actual or potential buyer (note "potential")

which you seem to be confirming from your own review of their policy. What did the blog post misrepresent?

[Kiro]

Omitting the context very clearly makes it sound like they sell your personal information, when the paragraph is actually referring to disclosing the data in an M&A transaction. The "buyer" here is not a buyer of data but the buyer of the company. Even you said "from reading this blog post it seems like yet another evil company trying to suck up PII from unsuspecting victims and sell it".

[markovbot]

It actually wasn't that particular line that made me think they were selling personal information, it was mostly the other three points in that list which you seem to be ignoring:

* Each of Onfido’s and/or Provider’s third-party vendors may have access to the facial scan data

* Onfido is in no way linked to or responsible for the practices of other Providers. Onfido encourages you to read Company’s privacy policies and terms and conditions, as well as those of other Providers, which may apply to the use of facial scan data extracted from photos and videos.

* Onfido may disclose your personal information... or other third party where we believe disclosure is necessary... to protect your vital interests or those of any other person

[Kiro]

And I replied to "how is that different from what the blogpost said?", not the other points but you got me curious so here goes:

* "Each of Onfido’s and/or Provider’s third-party vendors may have access to the facial scan data"

This is actually "Each of Onfido’s and/or Provider’s third-party vendors may have access to the facial scan data to store the data, to maintain backup copies, and to service the systems on which such data is stored.".

Completely standard and another misrepresentation by the blog trying to paint it like they send the stuff everywhere when it's just about their storage and backup solution.

* "Onfido is in no way linked to or responsible for the practices of other Providers. Onfido encourages you to read Company’s privacy policies and terms and conditions, as well as those of other Providers, which may apply to the use of facial scan data extracted from photos and videos."

Nothing strange whatsoever. Again completely standard in GDPR that you need to have to to acquit yourself.

* Onfido may disclose your personal information... or other third party where we believe disclosure is necessary... to protect your vital interests or those of any other person

This is actually "To comply with laws. Onfido may disclose your personal information to any competent law enforcement body, regulatory, government agency, court or other third party where we believe disclosure is necessary (i) as a matter of applicable law or regulation, (ii) to exercise, establish or defend our legal rights, or (iii) to protect your vital interests or those of any other person; and"

Wow, probably the worst misrepresentation. This blog is straight-up misinformation and slander. Thanks for highlighting it.