A Lithuanian-registered startup called Whitebridge AI is offering to buy “packages” of information about any person, and the data is collected from social networks; it has caused quite a stir and the Lithuanian State Data Protection Inspectorate has launched an investigation.
Anyone who holds a high position, is successful or simply plans a promising career can face the fact that there will be people who are willing to pay for a collection of social media posts, regardless of whether they are newly made or more than a decade old. Employers, competitors or simply someone with bad intentions can get a complete “reputation report” for a few euros. And this is not a scenario from the movies. Whitebridge AI is offering such an opportunity. The startup has already received criticism from privacy advocates and the VDAI has launched an investigation after the Austrian NGO NOYB reported on the complaints it received.
Lisa Steinfeld, a lawyer for NOYB, said that under the European Union’s General Data Protection Regulation (GDPR), individuals have the right to access information held about them. However, the Lithuanian company has not responded to a request to provide this data. Therefore, NOYB decided to investigate what the Lithuanian startup is selling.
Steinfeld noted that the organization decided to order a report on the complainants. It turned out that it contained information about the interests of individuals, political opinions and even very private content, and everything was organized in structured reports. After that,
the complainants contacted Whitebridge AI again, asking to provide the data, delete it or correct it,
but the company did not do so.
Lithuanian State Data Protection Inspectorate confirmed that an investigation is underway, mainly regarding the legality of the processing of personal data and possible violations of the GDPR.
Representatives of Whitebridge AI insist that the law has not been broken, and only publicly available information is being obtained. The company’s CEO Paulius Taraškevičius told LRT Radio that privacy and data protection are taken very seriously, and all data is collected only from public sources. The company does not collect data without a request, and it is not stored. All information is collected from public profiles on social networks, as well as from news portals and other open-access sources. Taraškevičius noted that all reports are deleted after 30 days and can no longer be accessed.
The NOYB representative emphasizes that the collection of such data requires the consent of the person, which Whitebridge AI does not obtain, and, according to the provisions of the GDPR, individuals have the right to know if data is collected about them.
Lithuanian MEP Virginijus Sinkevičius pointed out that there are still many gray areas in this area of data protection that companies use. He explained that Europeans are better protected, but there are also dubious cases. “When you download the app, you are offered a long contract text. I doubt that there are many people on the planet who actually read hundreds of pages prepared by high-level lawyers, giving consent to the collection of data. Many companies use this loophole to collect information,” Sinkevičius said.
It is not known what the outcome of the investigation into Whitebridge AI, which sells “reputation reports,” will be. Possibly, there will be lawsuit. Meanwhile, Western commentators warn that personal data can also be used by criminals.
Steinfeld stressed that it is necessary to understand that the information that people share on social networks is not public information, but Whitebridge AI mistakenly assumed that it was.
Whether the company will continue its work largely depends on the position of the Lithuanian Lithuanian State Data Protection Inspectorate.
Read the whole article in English here: https://www.lrt.lt/en/news-in-english/19/2721051/who-s-buying-your-digital-past-lithuanian-start-up-investigated-for-trading-rersonal-data
Read also: Dutch authorities warn voters: chatbots should not determine political choice