[gitremote]

What was leaked was women's personal data, like driver's licenses. What they shared with each other was their experiences with men who sexually assaulted them or stalked them and their names, not the men's personal data.

Men's driver licenses were not distributed online. Only women's driver licenses were distributed online.

[quietbritishjim]

I'm not familiar with this app, but surely those accusations of sexual assault are only useful to other users of the men are sufficiently well identified?

[gitremote]

Name and photo.

[9dev]

So… Personal data?

[tgsovlerkhgsel]

The article says that what gets shared with the app is a picture of the man, and it's not just "those who sexually assaulted them or stalked them" but anyone they want feedback about.

I assume the app then runs facial recognition.

This may be legal in the US, but not under GDPR. Pictures of faces are biometric data (explicitly listed as such), which falls under additional restrictions beyond personally identifiable information.

A drivers license with the picture blacked out would be less sensitive than the picture itself!

[9dev]

> This may be legal in the US, but not under GDPR.

This whole story is an amazing example of why the GDPR is correct about this, IMHO.

[tgsovlerkhgsel]

There are soo many examples from the US showing why GDPR is a good thing: Clearview AI (biometric mass surveillance, essentially "search the internet by face"), car manufacturers collecting and selling location data, phone companies collecting and selling location data, ISPs collecting and selling browsing behavior, companies running mass surveillance on license plates and selling the data to law enforcement and really anyone who pays, some DNA sequencing related abuses that I don't remember the details of, all the data collected by the ad "ecosystem" (note that this still happens in GDPR-land because enforcement is lacking), this, ...