6 ms·

I would think that this would first require the adoption of something much closer to the EU data privacy regime: actual rights to know what data is collected, h

by siegel 9y ago

I would think that this would first require the adoption of something much closer to the EU data privacy regime: actual rights to know what data is collected, how it would be used prospectively, rights to collect and be forgotten, etc...I think this would be a precondition to the setup you are proposing. It would also seem clear to me that, from a regulatory standpoint, there would need to be a regulatory body in charge of developing regs around this and enforcing it. So, in other words, this would be expensive to implement (both in terms of adding government regulatory costs + costs of private enterprises complying). That being said, what I find particularly attractive about your proposal is that it might shock people into understanding what they are really doing by pressing "I agree." In other words, it could cause a huge cultural shift that I think is really necessary. There are a lot of things written about how people (particularly younger people) do not really value privacy anymore. I would bet a large sum of money that if your proposal were implemented, many of these people who "don't care about privacy" would start caring because the implications of their giving up their personal data would suddenly become clear. I can't see this being all that difficult to implement technologically, would it be?

ilovetux 9y ago
Technically I do not believe so, in python (with which I am most familiar) it is trivial to add a handler to a logger. That handler can do anything including sending emails or http requests. A similar technique should be possible within similar technologies such as log4j (a common framework written in java). What I like about my idea is that nothing need to be changed by the business except implementation of the new requirement. In other words the "I agree" you clicked still applies but now they have to tell you what actually happened with the actual data which could be used to inform future decisions. What I find troubling about your prerequisites is the word "prospectively". Reporting of actual facts should be the goal and this is only possible in the past and present tense. By the way, thank you for your response, I need to research current European laws more thoroughly before I can give a proper response.
- siegel 9y ago
  I wonder if this could be marketed as a 3rd-party service? Plenty of companies pay for privacy certifications that are not legally required - presumably because there is some amount of customer demand. I could imagine incredible demand for a service like you propose, if people knew that they could get this kind of information.
  - ilovetux 9y ago
    That is a great idea! Personally the only organization I would trust at this point would be the Free Software Foundation. They are a nonprofit organization with a long history of supporting user rights. In fact, if everyone were to use the GPL and/or Affero licenses for their software, the source code would be auditable. That would alleviate half of my concerns as I could tell what information would be available to them. All that would be left is my concern about what is done with my personal information after collection. If an organization which I trust were to issue certification which conveys assurances as to what does or doesn't happen to my data, I might be ok with that even without access to specific details. I don't think the big guys would sign up for this without incentive. That's the main reason I think a law would be the best way. In order to make this happen, a boycott could be organized. Participation would need to be easy so we could facilitate it with a custom build of Firefox (or similar) which will only allow you to visit sites certified to respect users privacy.
  - ilovetux 9y ago
    @siegel I want to express my appreciation for your responses, simply discussing this has made me more at ease. I had time to mull this over. I even went so far as to draft a few emails and even started in on a business plan for a business which could offer this type of certification. I have had to reconsider. There is no finality to this solution. The details of the certification would have to be ironed out beforehand and would need to be fluid enough to allow for changes as needed. Then there would have to be a penal framework defined around the entire process. In fact the only real benefit to this would be that the barrier to entry for starting a new business (or NGO) is less than that for getting a law passed. I feel the need to accommodate both sides of the isle here as I love creating and using technology, so I would never want to hurt the technology sector. I, however, feel very strongly that some fundamental, undefined right of ours is being violated. We have absolutely no idea what is happening with the data collected about us, therefore I do not believe that we have the ability to enter into a contract in any sensible way. Some might argue that we have no right to know what a company is doing with the money we gave to them, but that argument is flawed because money has no significant attachment to ourselves after we tender payment. Copyright law provides a default of no rights except to the author of a creative work, could this be used to enforce the duplication of our data or at least force some sort of dual-licensing for the co-creators of the data. As an example: I am a user of a fictional online service, monitor.com. I interact with the service in a variety of ways which in turn generates a lot of data about my use of the service. Also present on the page is a social network integration (ie. a facebook "like" button) which also reports on data generated by not only my interaction with monitor.com, but also correlates this with my actions on other sites. Now in this scenario, monitor.com and myself work together to create a series of data-points. At the same time, I am working with the social network to create a larger data set. If we could be acknowledged as co-creators of the data, what ramifications could that have on the legalities involving the duplication of the data? When the data is transmitted over a network, it is indeed copied. Does one co-creator have an inerrant right to use the data without a specific license being granted, more importantly can a co-creator grant licenses to third parties without the explicit consent of the other co-creator? This is probably a false argument based on a certain level of legal ignorance on my part. Ideally, I would simply like an established right to know when data about me is collected or used so I can make an informed decision on whether or not to continue using the service. I believe a law is necessary as a free-market solution could not provide a consistent level of assurances, there would always be doubts. I am not looking to punish anyone or to be petty, but I would like it to be established that this right exists. Violations could be a civil matter, I could sue or initiate a class action lawsuit. Is it possible to simply pass a law without specifically defining the penalties and governance policies?

by siegel 9y ago

ilovetux 9y ago

Technically I do not believe so, in python (with which I am most familiar) it is trivial to add a handler to a logger. That handler can do anything including sending emails or http requests. A similar technique should be possible within similar technologies such as log4j (a common framework written in java). What I like about my idea is that nothing need to be changed by the business except implementation of the new requirement. In other words the "I agree" you clicked still applies but now they have to tell you what actually happened with the actual data which could be used to inform future decisions. What I find troubling about your prerequisites is the word "prospectively". Reporting of actual facts should be the goal and this is only possible in the past and present tense. By the way, thank you for your response, I need to research current European laws more thoroughly before I can give a proper response.

siegel 9y ago
I wonder if this could be marketed as a 3rd-party service? Plenty of companies pay for privacy certifications that are not legally required - presumably because there is some amount of customer demand. I could imagine incredible demand for a service like you propose, if people knew that they could get this kind of information.
- ilovetux 9y ago
  That is a great idea! Personally the only organization I would trust at this point would be the Free Software Foundation. They are a nonprofit organization with a long history of supporting user rights. In fact, if everyone were to use the GPL and/or Affero licenses for their software, the source code would be auditable. That would alleviate half of my concerns as I could tell what information would be available to them. All that would be left is my concern about what is done with my personal information after collection. If an organization which I trust were to issue certification which conveys assurances as to what does or doesn't happen to my data, I might be ok with that even without access to specific details. I don't think the big guys would sign up for this without incentive. That's the main reason I think a law would be the best way. In order to make this happen, a boycott could be organized. Participation would need to be easy so we could facilitate it with a custom build of Firefox (or similar) which will only allow you to visit sites certified to respect users privacy.
- ilovetux 9y ago
  @siegel I want to express my appreciation for your responses, simply discussing this has made me more at ease. I had time to mull this over. I even went so far as to draft a few emails and even started in on a business plan for a business which could offer this type of certification. I have had to reconsider. There is no finality to this solution. The details of the certification would have to be ironed out beforehand and would need to be fluid enough to allow for changes as needed. Then there would have to be a penal framework defined around the entire process. In fact the only real benefit to this would be that the barrier to entry for starting a new business (or NGO) is less than that for getting a law passed. I feel the need to accommodate both sides of the isle here as I love creating and using technology, so I would never want to hurt the technology sector. I, however, feel very strongly that some fundamental, undefined right of ours is being violated. We have absolutely no idea what is happening with the data collected about us, therefore I do not believe that we have the ability to enter into a contract in any sensible way. Some might argue that we have no right to know what a company is doing with the money we gave to them, but that argument is flawed because money has no significant attachment to ourselves after we tender payment. Copyright law provides a default of no rights except to the author of a creative work, could this be used to enforce the duplication of our data or at least force some sort of dual-licensing for the co-creators of the data. As an example: I am a user of a fictional online service, monitor.com. I interact with the service in a variety of ways which in turn generates a lot of data about my use of the service. Also present on the page is a social network integration (ie. a facebook "like" button) which also reports on data generated by not only my interaction with monitor.com, but also correlates this with my actions on other sites. Now in this scenario, monitor.com and myself work together to create a series of data-points. At the same time, I am working with the social network to create a larger data set. If we could be acknowledged as co-creators of the data, what ramifications could that have on the legalities involving the duplication of the data? When the data is transmitted over a network, it is indeed copied. Does one co-creator have an inerrant right to use the data without a specific license being granted, more importantly can a co-creator grant licenses to third parties without the explicit consent of the other co-creator? This is probably a false argument based on a certain level of legal ignorance on my part. Ideally, I would simply like an established right to know when data about me is collected or used so I can make an informed decision on whether or not to continue using the service. I believe a law is necessary as a free-market solution could not provide a consistent level of assurances, there would always be doubts. I am not looking to punish anyone or to be petty, but I would like it to be established that this right exists. Violations could be a civil matter, I could sue or initiate a class action lawsuit. Is it possible to simply pass a law without specifically defining the penalties and governance policies?