4 ms·

I thought this was an interesting angle: "U.S. policymakers argue that American data protection standards, enshrined in the constitution and enforced aggressiv

I thought this was an interesting angle: "U.S. policymakers argue that American data protection standards, enshrined in the constitution and enforced aggressively by the Federal Trade Commission, do more to guard against misuse than European standards, which often can be more bark than bite." Can someone more familiar with the US constitution elaborate on what exactly it says about data protection?

nickonline 9y ago
They didn't do much about equifax so I'd be very suspicious of such statements about American data protection standards.
- x0x0 9y ago
  Nothing in the gdpr would ban equifax. Creditors will continue to have the right (legitimate interests) to create, submit data to, and use credit reports in decision making. GDPR would have attached more liability to equifax (though 4% of global revenues really isn't that much), including a much shorter timeline on reporting the breach.
  - athrowaway3z 9y ago
    https://www.eugdpr.org/key-changes.html https://www.eugdpr.org/key-changes.html Apart from the fine and the notification of the breach. Equifax would have been different because of. - Consent : " companies will no longer be able to use long illegible terms and conditions full of legalese " - Right to Access : " Further, the controller shall provide a copy of the personal data, free of charge, in an electronic format. " - Right to be Forgotten - Data Portability - Data Protection Officers But Europe ( the countries that i know about ) have different requirements rules for credit bureaus all together. So AFAIK there is little incentive for Equifax to hold European data at all.
    - x0x0 9y ago
      The majority of those rights don't apply for reasons that should be obvious if you had even a modest understanding of the gdpr (see legitimate interest basis) and other related legislation. It is distinctly not helpful to spew misinformation on HN. So that people don't rely on your lack of understanding of the gdpr: * consent isn't required; it's merely one basis to permit processing * since consent isn't required, it will be an extraordinary stretch to exercise a right to be forgotten. In fact, credit reports are probably one of the canonical cases where LI override most rights of the data subject. * data access is not new; see DPA * Equifax does, in fact, have an EU business; it is in the UK. And has offered £2 access to credit reports since 2010-ish. I recognize 2 > 0, but it is not significantly different.
mtgx 9y ago
Last I checked, hundred billion dollar companies were getting "record fines" of a couple million dollars for multi-year privacy violations. So those policymakers are either clueless or lying.
- Feniks 9y ago
  Well its difficult for the EU to go after US companies. Take Facebook, they have a direct line to the US administration and before you know it there's a diplomatic incident going on.
matt4077 9y ago
I think the statement is accurate with regards to the "bark or bite" criticism of current EU privacy law. Enforcement of these laws lacks the efforts expended on, for example, antitrust enforcement. Among the problems is that Europe doesn't have "class action" lawsuits. Coupled with the fact that any single individual usually incurs only relatively small harm from privacy violations, the incentives to invest in lawsuits just aren't there. Public enforcement is also delegated to privacy watchdogs in each member state. Because jurisdiction is based on a company's registration, there is an obvious conflict of interest in these positions. This has played out, for example, in numerous cases against Facebook: It is (like Google and others) registered in Ireland, where the government has long been rather sympathetic to industry interests. The US Constitution says absolutely nothing about privacy, but the Supreme Court has found it reading between the lines of the 4th (unreasonable search and seizure), as well as the 1st. There's also the 9th ("This list of rights is not intended to be exhaustive" or something to that effect). In practice, US data protection lacks the EU by a wide margin, except for certain, specific cases such as video surveillance (which the UK uses far more) and health data (HIIPA seems to work rather well).
kelnos 9y ago
It doesn't say anything about data protection specifically. The Fourth Amendment deals with people being (theoretically; the reality is not great) safe from unreasonable searches and seizures perpetuated by the government. I don't really know of anything that deals with giving people more power to direct how private entities can use (or not use) their data. Frankly, US privacy and data protection laws are terrible, and what little we do have ends up being weak enough that companies and the government can usually find ways around it when it's inconvenient for them. Not sure how well the GDPR will work in practice; this is going to rely on broad but even-handed enforcement. The fines are hefty enough that not complying would actually do financial harm to companies, but that'll only work if the EU actually enforces the law properly. Only time will tell if they do.

nickonline 9y ago

They didn't do much about equifax so I'd be very suspicious of such statements about American data protection standards.

x0x0 9y ago
Nothing in the gdpr would ban equifax. Creditors will continue to have the right (legitimate interests) to create, submit data to, and use credit reports in decision making. GDPR would have attached more liability to equifax (though 4% of global revenues really isn't that much), including a much shorter timeline on reporting the breach.
- athrowaway3z 9y ago
  https://www.eugdpr.org/key-changes.html https://www.eugdpr.org/key-changes.html Apart from the fine and the notification of the breach. Equifax would have been different because of. - Consent : " companies will no longer be able to use long illegible terms and conditions full of legalese " - Right to Access : " Further, the controller shall provide a copy of the personal data, free of charge, in an electronic format. " - Right to be Forgotten - Data Portability - Data Protection Officers But Europe ( the countries that i know about ) have different requirements rules for credit bureaus all together. So AFAIK there is little incentive for Equifax to hold European data at all.
  - x0x0 9y ago
    The majority of those rights don't apply for reasons that should be obvious if you had even a modest understanding of the gdpr (see legitimate interest basis) and other related legislation. It is distinctly not helpful to spew misinformation on HN. So that people don't rely on your lack of understanding of the gdpr: * consent isn't required; it's merely one basis to permit processing * since consent isn't required, it will be an extraordinary stretch to exercise a right to be forgotten. In fact, credit reports are probably one of the canonical cases where LI override most rights of the data subject. * data access is not new; see DPA * Equifax does, in fact, have an EU business; it is in the UK. And has offered £2 access to credit reports since 2010-ish. I recognize 2 > 0, but it is not significantly different.

mtgx 9y ago

Last I checked, hundred billion dollar companies were getting "record fines" of a couple million dollars for multi-year privacy violations. So those policymakers are either clueless or lying.

Feniks 9y ago
Well its difficult for the EU to go after US companies. Take Facebook, they have a direct line to the US administration and before you know it there's a diplomatic incident going on.

matt4077 9y ago

I think the statement is accurate with regards to the "bark or bite" criticism of current EU privacy law. Enforcement of these laws lacks the efforts expended on, for example, antitrust enforcement. Among the problems is that Europe doesn't have "class action" lawsuits. Coupled with the fact that any single individual usually incurs only relatively small harm from privacy violations, the incentives to invest in lawsuits just aren't there. Public enforcement is also delegated to privacy watchdogs in each member state. Because jurisdiction is based on a company's registration, there is an obvious conflict of interest in these positions. This has played out, for example, in numerous cases against Facebook: It is (like Google and others) registered in Ireland, where the government has long been rather sympathetic to industry interests. The US Constitution says absolutely nothing about privacy, but the Supreme Court has found it reading between the lines of the 4th (unreasonable search and seizure), as well as the 1st. There's also the 9th ("This list of rights is not intended to be exhaustive" or something to that effect). In practice, US data protection lacks the EU by a wide margin, except for certain, specific cases such as video surveillance (which the UK uses far more) and health data (HIIPA seems to work rather well).

kelnos 9y ago

It doesn't say anything about data protection specifically. The Fourth Amendment deals with people being (theoretically; the reality is not great) safe from unreasonable searches and seizures perpetuated by the government. I don't really know of anything that deals with giving people more power to direct how private entities can use (or not use) their data. Frankly, US privacy and data protection laws are terrible, and what little we do have ends up being weak enough that companies and the government can usually find ways around it when it's inconvenient for them. Not sure how well the GDPR will work in practice; this is going to rely on broad but even-handed enforcement. The fines are hefty enough that not complying would actually do financial harm to companies, but that'll only work if the EU actually enforces the law properly. Only time will tell if they do.