[njovin]

IANAL but if this is actually true then they're violating California law.

I submitted a CCPA request to them to give me and delete everything they had on me.

Their response is that they own no data, and I have to make the request to their customer, whomever that may be.

If they're retaining any identifying data about me and then selling it to new customers, they are explicitly violating CCPA.

[mistercheph]

IANAL, but making some assumptions to fill in gaps, it seems they are avoiding having to comply with CCPA and other privacy laws like this: they harvest camera data and retain the images probably forever, but only turn it into identifying data on demand for customers. So you really do have to go talk to the customer, because Flock never "has" any identifying data about anyone, they just have anonymous images that when mixed with a model happen to produce identifying data.

This allows them to promise that they don't keep any data and have strict retention policies etc. to jurisdictions that are on the fence or where the contract-purchasers are constrained by law in some way, but they can transfer identifying information at any point in the future to any customer, by mixing raw data and a model.

[bix6]

> but only turn it into identifying data on demand for customers.

How could this seriously hold legal weight? The data is identifiable. Just because it’s gated by some transformation doesn’t mean they are magically not holding my identifiable information.

[mistercheph]

Reading the definition of personal information from CCPA (https://cppa.ca.gov/regulations/pdf/ccpa_statute.pdf), I'll produce the relevant parts:

1798.140 (v)

> “Personal information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal information includes, but is not limited to, the following if it identifies, relates to, describes, is reasonably capable of being associated with, or could be reasonably linked, directly or indirectly, with a particular consumer or household."

The phrase "reasonably capable of being associated with" seems like it would apply against this transformation argument, but later:

> (2) (A) “Personal information” does not include publicly available information or lawfully obtained, truthful information that is a matter of public concern.

> (B) (i) For purposes of this paragraph, “publicly available” means any of the following:

> (II) Information that a business has a reasonable basis to believe is lawfully made available to the general public by the consumer or from widely distributed media.

So I think the above comment was wrong, this might be the actual way around it, AIUI courts have long established that individuals don't have a reasonable expectation of privacy from being photographed or recorded when in public, so it seems like public surveillance footage is actually exempt from CCPA even if it can be reasonably linked with personally identifying information.

[bix6]

That’s nice you got a response from them. I did not.