alt Hacker NewsI work in this space for a competitor to Persona, so take my opinion as potentially biased, but I have two points: 1. just because the DPA lists 17 subprocessors, it doesn't mean your data gets sent to all of them. As a company you put all your subprocessors in the DPA, even if you don't use them. We have a long list of subprocessors, but any one individual going through our system is only going to interact with two or three at most. Of course, Persona _could_ be sending your data to all 17 of them, legally, but I'd be surprised if they actually do. 2. the article makes it sound like biometric data is some kind of secret, but especially your _face_ is going to be _everywhere_ on the internet. Who are we kidding here? Why would _that_ be the problem? Your search/click behavior or connection metadata would seem a lot more private to me.
Replies
> your _face_ is going to be _everywhere_ on the internet.
Why is that your assumption?
Why not show a summary of who actually received the data? It should be easy to implement. You could also add what data is retained and an estimate of how long it is kept for. It could be a summary page that I can print as a PDF after the process is complete.
I'd consider that a feature that would increase trust in such a platform. These platforms require trust, right?
> I work in this space for a competitor to Persona
So that means you are participating in the evil that KYC services are.
The problem with anyone using my face to identify me is that it's hard for me to leave home without it.
> We have a long list of subprocessors, but any one individual going through our system is only going to interact with two or three at most.
So, in aggregate, all 17 data leeches are getting info. They are not getting info on all you users, but different subsets hit different subsets of the "subprocessors" you use.
And there's literally no way of knowing whether or not my data hits "two" or "three" or all 17 "at the most".
> but especially your _face_ is going to be _everywhere_ on the internet. Who are we kidding here? Why would _that_ be the problem?
If you don't see this as a problem, you are a part of the problem
[dead]
So they’ll send the data to whichever of the 17 pay them for it.
Obviously our faces are public, but there’s no easy way to tie it to all my PII unless I give it to them.
> Why would _that_ be the problem
Because it should still be my choice as to what you do with it, which data you associate with it, and how you store it. Removing that choice is anti-privacy.