But at some point to interact with any kind of large company … You could also consider not interacting with large companies at all

Actually the large corps are more likely to hold the data in-house. Small companies cling to outsourcing. E.g. credit unions are the worst… outsource every service they offer to the same giant suppliers. Everyone thinks only a small company has the data (and consequently that the small dataset does not appeal to cyber criminals) but it’s actually worse because they outsource jobs even as small as printing bank statements to the same few giants most other credit unions use. Then they do the same for bill pay with another company. It’s getting hard to find a credit union that does not put Cloudflare in the loop. So in the end a dozen or so big corps have your data and it’s not even disclosed in the privacy statement.

Of course it depends on the nature of the business. A large grocery chain is more likely to make sure your offline store purchase history reaches Amazon and Google than a mom & pop grocer who doesn’t even have a loyalty program.

Whether businesses get copies of information is usually included in a site’s privacy policy,

I have never seen a privacy policy that lists partners and recipients apart from Paypal, who lists the 600+ corps they share data with for some reason. Apart from bizarre exceptions privacy policies are always too vague to be useful. Even in the GDPR region. If you read them you can often find text that does not even make sense for their business because they just copied someone else’s sufficiently vague policy to use as a template.

If you really want to limit your information exposure, you either have to audit everyone you do business with this way (because most large companies do this) or hire someone (or a service) to do it.

The breach happened in a country where companies are not required to respond to audits. No company wants any avg joe’s business badly enough to answer questions about data practices. In the EU, sure, data controllers are obligated to disclose the list of parties they share with (on request, not automatically). And even then, some still refuse. Then you file an article 77 complaint with the DPA where it just sits for years with no enforcement action.

My approach is a combination of avoiding business entirely, or supplying fake info, or less sensitive info (mailing address instead of residential, mission-specific email, phone number that just goes to a v/m or fax). This is where the battle needs to be fought – at data collection time. Countless banks needlessly demand residential address. That should be rejected by consumers. Data minimization is key.

In the case at hand, I’m leaning toward opting out of the class action lawsuit and suing them directly in small claims court. I can usually get better compensation that way.

I’ve been out of the loop on games for a while but ReactOS may be worth a look.

The 1st ½ of your comment sounds accurate. But…

And also in Foss there are highly opinionated software where the devs completely ignore users, ban them from GitHub when they post issues,

Right, but to be clear non-free s/w is worse - you can’t even reach the devs, generally, and there is no public bug tracker. FOSS is an improvement in this regard because at least there is a reasonable nuclear option (forking). The nuclear option for non-free software is writing it yourself from scratch.

That all sounds accurate enough to me… but thought I should comment on this:

However - in larger enterprises there’s so much more, you get the whole SDL maturity thing going - money is invested into raising the quality of the whole development lifecycle and you get things like code reviews, architects, product planning, external security testing etc. Things that cost time, money and resources.

It should be mentioned that many see testing as a cost, but in fact testing is a cost savings. In most situations, you only spend some money on testing in order to dodge a bigger cost: customers getting burnt in a costly way that backfires on the supplier. Apart from safety-critical products, this is the only business justification to test. Yet when budgets get tightened, one of the first cuts many companies make is testing – which is foolish assuming they are doing testing right (in a way that saves money by catching bugs early).

Since the common/general case with FOSS projects is there is no income that’s attached to a quality expectation (thus testing generates no cost savings) - the users are part of the QA process as free labor, in effect :)

Apparently I’m wrong about this… the preview is said to be created by the server:

https://links.hackliberty.org/comment/1068761

EDIT: well, apparently it’s questionable. No one knows with confidence.

Do you want an answer or just a space to br angry and rant?

It’s all about getting an answer. Any rant that you think you sensed is at most an attempt to motivate a good answer.

I should also stress that I don’t want bad answers. The same broken speculation has been posted multiple times in this thread and in the parent. Thus compelling me to repeat the flaws in that bad answer.

I’m confident at this point that I finally got a viable answer: insurance. But I might be tempted to press for more details because it’s still unclear how the GDPR compliance pans out. GDPR violations are rampant these days, so it could lead to an article 77 complaint. I still have to do a bit of analysis on that from the insurance narrative.

That’s all plausible. But in the end the airline (their insurance) will be the loser, no?

When a traveler has insurance they have some reassurance & comfort that the loss won’t be theirs as they will file a claim. In my cases of lost luggage, the rules of the traveler’s insurance claim required me to still file a claim with the airline. The airline seemed to have the primary liability. Wouldn’t it be bizarre if the airline (who caused the loss) would get off the hook? My insurance just ensured I was compensated one way or another so long as I followed the rules and reported the loss to the airline. From there, wouldn’t my insurance work in their own interest to ensure the airline pays out? Surely my insurance must only be liable for benefits coverage that exceed the airline’s responsibility (depending on how generous my policy is).

Since an insurance company has the resources and legal muscle to ensure the responsible company pays out, I would expect it to /not/ be in the airline’s interest to deal with another insurance company over a loss. Just about every time I had a loss without insurance, the airline was directly liable to me but they told me to pound sand. Every time IIRC. They wouldn’t get away with that against another insurer.

Most of my cards are free with lousy policies that only pay out if I lose a limb or something like that. It was only when I paid for extra insurance that I got coverage that was useful.

In any case, if you are correct, that implies if I get a payment card with zero insurance (a prepaid card?), then the flight details won’t be shared, correct? Might be interesting to test that, but tricky because prepaid cards often don’t issue a statement.

The travel insurance sounds more plausible than the anti-fraud measure. I had not considered that. Although the question is how is that info sharing is arranged considering airline would not inherently care about my travel insurance or have a duty to inform my insurer.

if you travel to another place and use your card there, then your bank are going to know you’re there.

That’s not the same bank that I bought my airfare with. The bank I use to buy the airfare with has no reason to know where I am. IIRC there’s a stat that on avg Americans have like ~15 or so different bank/credit cards. What you’re saying makes no sense. The airline takes the liberty of giving a travel notice to just one of your dozens of banks, and what about the rest?

If there’s a transaction showing you bought tickets to that city/country for the same dates that transactions happen within that city/country, that’s evidence to support one decision over the other on the algorithm’s part.

I often buy a one-way ticket with one card and a one-way return with another. So not even one bank has the full picture. I typically leave those cards at home as well because they have poor forex rates. Yet this doesn’t trip fraud sensors on the cards I carry to the destination. The fraud sensors are tripped when I forget my ATM limit or incorrectly adjust that limit for the foreign currency.

One bank that requires a travel notice doesn’t even accept that a trip would last more than 2 weeks. I call and say I will be gone 3 weeks, or 4 weeks, and they cannot handle it. They say “the travel notice will expire in 2 weeks so you have to call again when that time comes to renew your travel notice”. What I tell them directly carries more weight than whatever shows up on the transactions because they have no way of knowing what other travel arrangements I have. Yet what I tell them is not fully utilized.

The other problem with your theory is travel notices are a recent development of the past ~10—20 years, whereas itineraries have been shared with banks for as long as I can recall (~25+ years). Anyway, speculation isn’t cutting it. Solid info needed on why this is happening.

If your bank knows you’re meant to be in a specific place, they’ll know transactions happening there aren’t because someone’s stolen your card.

Every bank’s AI-driven fraud detection system is different and non-transparent. Whenever my account gets frozen for “fraud” and I removed¹ at the bank over it, I ask WHY my account was frozen. The CSR guesses what happened (because apparently it’s such a secret the bank’s own staff is kept in the dark). This can be deceiving because bankers seem to be trained to propose their guesswork with confidence to thwart questions. I ask “where in my terms of service agreement does it say I shouldn’t do [whatever the CSR thinks triggered the fraud sensors] & how can I prevent this false positive in the future?” They can never answer that.

Some banks don’t require travel notices and some do. The banks that don’t: how are they finding out my travel plans when I buy the ticket using a different bank? Most likely their fraud algo is (or tries to be) smart enough to not need to track you.

It would probably be a valid exception to GDPR on those grounds.

How is sharing purchase info with banks within the bounds of the airline’s operational needs? The bank’s problem is not the airline’s problem.

(edit)

1: woah, slur filter did a silent hit-and-run on my post. The word “removed” should be some form of “complain” using a synonym that begins with a “b”.

That’s been suggested in the parent thread and another crosspost. It’s the most popular answer but I don’t buy it.

Why would the airline risk the liability of excessive oversharing of personal data for no benefit in return? Is the bank giving them a reduced transaction fee for sharing that data?

I cannot imagine a hairless RMS. He should have insured his beard and hair, just like Tom Jones’ insured his chest hair for $6.8 million.