Quote from: senor_coconut on October 09, 2012, 10:13:37 AM

Quote from: Deprived on October 09, 2012, 09:48:33 AM

Quote from: bitcoin.me on October 09, 2012, 05:18:00 AM

Nefario has most of the funds. There is literally nothing preventing him from starting to pay back straight away, except the AML stuff.

The "AML stuff" seem to be a delaying tactic rather than some reasonable issue.

Let's be clear aboiut a few things, starting with what AML actually is (I'm talking here only about its use in the UK - where GLBSE is run - it may be different in the US).

Regulated Financial Service Providers in the UK are required to attempt to identify suspicious transactions (which could be money laundering) and report them. There is NO definition of what information they need to hold to do this - but holding information for this purpose IS a valid reason to hold personal information under the DPA (Data Protection Act).

This is a total red herring now - unless Nefario has some intention that hasn't yet been mentioned:

1. He is not a Regulated Financial Service Provider.
2. Unless I'm missing something, the ONLY transactions he now intends to conduct is refunding the BTC in people's accounts. There is ZERO way identification documents could allow him to identify any of those transactions as being suspicious.

If, instead, he's claiming he intends to go over past transactions to see if any were suspicious and then report them then that's a different case - however he'd then need far more information than just ID. Information held for AML purposes would for legitimate companies be far wider than just ID details - things such as credit ratings, employment details etc.

It seems to me that at some stage AML has become conflated with KYC - partly through laziness (I've referred to the two together myself on occasion) nad partly through total ignorance.

Regulated Financial Service Providers DO have a requirement to know the identities of their customers. Do note that this is NOT the case for all businesses - you can go in a shop and buy something, or employ a tradesman's service without ever giving your name let alone proving your ID. There are a specific subset of cases where ID MUST be verified. GLBSE is not registered or regulated in any of these categories as far as I am aware.

My concern is with adherence to the Data Protection Act. Both the content of that Act and the guidelines for implementing it lay out the following three key points (along with others, such as ensuring that the data is accurate, giving customers access to data held on them etc):

1. There must be a clear NEED for the data to be held.
2. The customer must be aware what that need is (i.e. how the data will be used).
3. The data must be destroyed once it is no longer needed.

Now IF GLBSE is claiming there is some statutory or regulatory force compelling them to hold this data, then what is it? If, on the other hand GLBSE is NOT under any current obligation to hold that data then what precisely is the reason it is needed - and how will it be used? If it won't be used at all then there is no reason to be asking for it. I think what some may be missing is that just askjing for ID is no use unless GLBSE is in some way going to determine that the ID is actually the ID of the person whose account it was submitted for. And how can they possibly do that?

I do NOT personally actually have a problem with providing my identity to GLBSE. What I DO have a HUGE problem with is providing copies of identification documents which could then be used to impersonate me elsewhere. I doubly have a problem with doing that to a company which appears to be closing down and doesn't have anything os any legitimate use they could conceivably actually DO with that information.

SO here's my questions to GLBSE if they want copies of personal documents:

1. What is that information going to allow (or prevent) you from doing that you couldn't do without it?
2. How long will that information be held for?
3. If your claim is that you are requesting that information as though you were regulated by the FSA then who is your officer responsible for the protection of that data and where can I see a copy of your (required) policy on data protection?
4. Could please confirm (with insurers details) that you have insurance covering claims against you caused if that data were to be accessed or used other than in accordance with the DPA? i.e. professional indemnity insurance. To put it simply, if you leave my documents lieing around, someone steals them and then impersonates me, then do you have cover against any claim I make for losses? Copies of identity documents would clearly fall under "client's data" - which you should have professional indemnity insurance against losing.

If you want to play it "by the book" then do so properly. I don't, as a habit, send personal documents to ANY company unless they jave a reasonable need for it, I am SURE they will protect it properly and KNOW I have recourse if they don't. I'm fine with giving a name+address to send a GBP cheque to (if you think you're entitled to convery BTC to fiat on my behalf) or even with providing details of a bank account you can transfer to. But I'm NOT fine with sending copies of ID documents.

+1, Very well put Deprived.

These guys, nefario at the top, will get into even more trouble by requesting IDs from the users.

I agree with the +1, good analysis of the theory.

I somehow doubt the second, very rarely do companies get into trouble over data protection laws, and then it's a slap on the fingers. If agencies are somehow "interested" in the illegally harvested data, not even that.

I think Nefario has far worse worries.