5 ms·

Generally I agree but I think the law should take a different slant. Rather then providing consumers recourse after their data has been collected we need to pro

Generally I agree but I think the law should take a different slant. Rather then providing consumers recourse after their data has been collected we need to provide individuals the right to control what data will be collected. All devices should have a label describing what kind of data collection they do. This label should be on the packaging in easy to understand human terms (not buried in the EULA). Additionally devices would be put into classified into one of 4 different classes: Class A - no data collection Class B - anonymized statistics for diagnostics that cannot be used for marketing Class C - anonymized usage statistics that can be used in aggregate Class D - Targeted collection that can be used for targeted marketing Consumers should have the explicit right to opt out of any and all data collection without risk of impairing the primary function of a device. For example there is no reason a TV should need to be anything beyond class A (maybe B). A smart speaker on the other hand needs to be a B maybe C. Nothing should need to be a class D.

brainwad 9y ago
Your proposed classes would lead to everyone just collecting class D, because it's the only one that allows for targeted collection, which is needed even for diagnostics and debugging. In order to improve algorithms, you need to be able to figure out what the user wanted, which means being able to view their session specifically, not in aggregate.
- daveFNbuck 9y ago
  You don't need to view my session to improve my toaster. I currently have a class A television and would love to be able to buy another one in the future. I'm not sure that will be possible, but maybe having a standard label would help.
  - bognition 9y ago
    This exactly. People never believe me whenever I explain that smart refrigerators phone home about use and potentially contents. Then I show then the terms and Eula and almost universally they think it should be illegal.
    - fnord123 9y ago
      So make it illegal.
      - ryandrake 9y ago
        Sure! Where are the politicians who have “enact a GDPR-like law in the USA” on their platform? Hell, where are the politicians who even have multiple words to say about privacy?
        fnord123 9y ago
        Not sure if you're being sarcastic, but the context is bognation's proposal for data collection tiering. Instead of tiering, just adopt a GDPR-like law. > Hell, where are the politicians who even have multiple words to say about privacy? In the vein of Manufacturing Consent - the elites in the US are not split on the topic so there is no discussion. Larger companies, especially in SV, run on private data.
- bognition 9y ago
  As long as users have the right to opt into collection under class d it would be fine. Keep in mind that products were successfully developed for thousands of years without invasive data collection.
  - gingerlime 9y ago
    to play devil's advocate though, I think product development accelerated greatly thanks to analytics and usage tracking, and lots of mistakes were avoided. This in turn can reduce the price for consumers of those products or features. Of course, at the expense of privacy, but I'm still wearing my devil's hat here for a moment. And I would go as far as saying people by and large don't care as much about privacy as they do about cost, or getting free stuff (e.g. Facebook).
    - mantas 9y ago
      And a lot of those innovations were just to keep users more immersed while showing them ads. There was little innovation that actually helped end user in the past decade.
      - gingerlime 9y ago
        It certainly has been abused. But I think it’s throwing the baby with the bath water to some extent. People won’t be immersed in something that doesn’t bring them value. Some products would make money from users by showing them ads, others would ask those users to pay. Both would want to create immersive experience in my opinion. I would even argue that less immersive experience (getting bored or distracted) leads to ad clicks. Whereas a service that charges wants to keep users truly engaged.
        ryandrake 9y ago
        Is “being immersed in the product” a real user need? That sounds like a company goal to me, not something I would want as a user.
- tlogan 9y ago
  No - I would pay for TV which is class A. Sure the TV manufacturer will need to buy data from company from class D - but they already do that.
jsty 9y ago
Would these be applied specifically to data collected not for the primary purpose of the product? If such a regulation applied to all the data collected by a device / service, I'm not sure the classes you propose would be a good basis for a consumer to decide on which products to use. Let's take a product that stores data on the company's servers as part of the core offering. Under a GDPR-like system where the purposes of data collection were specified as only fulfilling that core offering, you'd get a pretty good guarantee that it wouldn't be used for personalised marketing etc. Yet on my reading of this system, it'd be a class D since this data could potentially be used for targeted marketing.
- bognition 9y ago
  Admittedly this is the first time I've written this idea down and it needs a bit more work. But I stand by the general sentiment of empowering users to decide and telling them in plain language the reasons why their data is being collected.
  - icebraining 9y ago
    But I stand by the general sentiment of empowering users to decide and telling them in plain language the reasons why their data is being collected. That's exactly what the GDPR does. You can use the data for other purposes (e.g. marketing) as long as you request for that specific permission in "clear and plain language". Citing the text: "The principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used."
  - jsty 9y ago
    I don't mean to say it's a bad idea by any means, just wanted to provide some constructive criticism. I'd say that GDPR's rules around providing purposes for data collection and not bricking services un-necessarily for refusing such are pretty good; and a labelling scheme similar to that you've proposed to highlight what is being collected outside the core requirements of the service might complement it nicely.
  - 9y ago
Anon1096 9y ago
Would I as a business owner be allowed to kick people off my service for not allowing class D? Because in some cases it really is necessary and why should I host a customer who is only costing money?
- throwaway2016a 9y ago
  Might I suggest an alternative? If the customer is not comfortable with Class D, don't kick them off, require a monthly subscription fee. If they don't like it they will kick themselves off.
  - psandersen 9y ago
    The subscription fee should be equivalent to the loss to the business from no longer collecting the data on the user. It could actually be an eye-opener for many people. Most middle-class tech people would probably happily pay $10+ a month for the service Facebook provides, but if its something like $70 then Facebook is either scarily good at monetizing their information or unreasonably pricing the service. On the flip side, you shouldn't be allowed to undercharge for the cost of a private membership. Transparency is good, let users be part of the free market for their data and make informed consent.
    - slaymaker1907 9y ago
      According to their filings, it's about $26 per user in the US and Canada per year.
joejerryronnie 9y ago
This would likely have to be paired with a tiered pricing model for said good or service - i.e. Class A = 100% of retail cost Class B = 75% of retail cost Class C = 50% of retail cost Class D = free I'm convinced that the vast majority of those outraged by today's data collection practices will conveniently direct their ire to some other cause when faced with the possibility of actually having to pay for the services they've gotten used to having for free.
- amelius 9y ago
  Is such tiered pricing allowed under the GDPR? Because that would provide an easy way out of the whole sitation. Just make the price ridiculously high, and all users will choose the free, your-data-belongs-to-us version.
- wtfstatists 9y ago
  Sadly this is illegal in EU. You have to offer both Free+ClassD and Free+ClassA versions otherwise its forced consent. I have written more about this here https://news.ycombinator.com/item?id=16351892 https://news.ycombinator.com/item?id=16351892
  - joejerryronnie 9y ago
    Does this essentially force companies to charge for services in the EU then? The only reason FB, Google, etc even offer "free" services is because they make money on the backend utilizing the data they collect. If everyone can say "don't collect my data but also keep my service free", I'm not sure how a business can remain viable in the EU without charging some type of subscription or micro-transaction fee. Maybe this is how the whole web-based fee structure should have been setup in the first place but it's not the current deal we have in place. How difficult will it be to shift an entire industry (and consumer mindset) to a vastly different fee structure?
    - tjoff 9y ago
      They can still show ads, and they can still be relevant to whatever page the user is currently viewing. Since they do such a terrible job of it anyway I can't imagine it being less profitable. And then again, maybe actually paying for something like facebook is the right way to go.
m12k 9y ago
I think an important point that the GDPR gets right is to recognize that you often need to give data to services in order for them to be useful, but you currently have almost no recourse if you stop using it and don't want that data 'out there' any more. Even just the data limited data that services can 'reasonably' need will still paint a very detailed picture of you in aggregate. Forcing companies to allow users to recall consent and actually get their data deleted is the only way to prevent that picture from becoming very detailed over time.
- evrydayhustling 9y ago
  Yes, this, and a second part: GDPR recognizes that data moves between services, and people should have rights about their data that can be enforced on recipients after data is transferred. Currently, agreeing to transfer is a ratchet, where the secondhand party has basically no responsibility to you.
- sgc 9y ago
  Is there a way to flag yourself as a consumer who always requires personal data deleted when you cancel a service, or is it opt-in on a case by case basis only?
  - Someone 9y ago
    That’s neither opt-in nor opt-out, but stronger. Companies only may have data they need for doing their business. If you cancel a service, accounting and similar laws may dictate a company has to keep your address and payment info for a couple of years, but that’s about it (this actually is covered by the implementation of the “data protection directive”, the precursor to the GDPR, which has been in effect since at least 1-1-1999. See https://en.m.wikipedia.org/wiki/Data_Protection_Directive#Legitimate_purpose https://en.m.wikipedia.org/wiki/Data_Protection_Directive#Le...) Student clubs (yes, the GDPR applies to them, too, even if they are 100% volunteer run) that want to keep address info of past members for communicating with alumni, for example, have to make that opt-in. “necessary for running the business” has some gray areas. For example, an athletics club will want to keep a list of club records, photos of past victories, etc. That’s something that is allowed as “necessary for being a sports club”. I don’t know whether there’s any case history on this)
Someone 9y ago
The GDPR is broader than you make it look here. It doesn’t only have provisions for ”providing consumers recourse after their data has been collected”, it also provides ”individuals the right to control what data will be collected”. It even goes further than your request for an opt-out. All data collection must be opt-in, and opt-in requests must be written in such a way that your users can understand them. Opt-out in combination with not ”providing consumers recourse after their data has been collected” is especially dangerous. Extreme example: application X installs a keylogger, and sends all your keystrokes to evilEmpire.com. Would you consider that to be OK, as long as there is an opt-out button? Would you be OK if evilEmpire.com kept the keystrokes it collected before you opted out?
tlogan 9y ago
I 100% agree with this approach. The problem with GDPR is the following: - big corporations which do collect the data will lawyer up and still collect data they do - small companies will do whatever they can do and they will bet that enforcement is going to be sparse - the enforcement will be non-existent So nothing will change. The GDPR will not improve privacy, not improve users knowledge who is collecting what, will give false sense of privacy for some users, etc.
- r00fus 9y ago
  I do think a few "heads on pikes" in the media will make enforcement a lot easier afterwards.
  - tlogan 9y ago
    Like Volkswagen diesel emission scandal? Where is the enforcement after that? Car companies can still shop around Eu and get their emission standards certified in Malta or some other less fortunate EU country.
- ascorbic 9y ago
  I know in the UK at least, big first are taking this very seriously. The potential fines are huge. But it's true that enforcement will be spotty, as the ICO and its equivalents are under-resourced. But you can bet that they will be looking for some big targets pour encourager les autres.
- Joeri 9y ago
  Doesn't your argument apply basically to any law? The problem with tax law is the following: - big corporations will lawyer up and still dodge taxes - small companies will do whatever they can do and they will bet that enforcement is going to be sparse - the enforcement will be non-existent I don't know if you meant to do so, but you seem to be arguing governments are incapable of enforcing law against companies.
  - chongli 9y ago
    They're pretty incapable against large multinationals. The sort that hoard profits offshore for years and years, waiting for the tax holiday. CEOs can outlast multiple election cycles to get what they want.
jopsen 9y ago
On California buildings my isn't display a sign of they contain dangerous chemicals... All buildings display said warning, because that way they have zero liability.

brainwad 9y ago

Your proposed classes would lead to everyone just collecting class D, because it's the only one that allows for targeted collection, which is needed even for diagnostics and debugging. In order to improve algorithms, you need to be able to figure out what the user wanted, which means being able to view their session specifically, not in aggregate.

daveFNbuck 9y ago
You don't need to view my session to improve my toaster. I currently have a class A television and would love to be able to buy another one in the future. I'm not sure that will be possible, but maybe having a standard label would help.
- bognition 9y ago
  This exactly. People never believe me whenever I explain that smart refrigerators phone home about use and potentially contents. Then I show then the terms and Eula and almost universally they think it should be illegal.
  - fnord123 9y ago
    So make it illegal.
    - ryandrake 9y ago
      Sure! Where are the politicians who have “enact a GDPR-like law in the USA” on their platform? Hell, where are the politicians who even have multiple words to say about privacy?
      - fnord123 9y ago
        Not sure if you're being sarcastic, but the context is bognation's proposal for data collection tiering. Instead of tiering, just adopt a GDPR-like law. > Hell, where are the politicians who even have multiple words to say about privacy? In the vein of Manufacturing Consent - the elites in the US are not split on the topic so there is no discussion. Larger companies, especially in SV, run on private data.
bognition 9y ago
As long as users have the right to opt into collection under class d it would be fine. Keep in mind that products were successfully developed for thousands of years without invasive data collection.
- gingerlime 9y ago
  to play devil's advocate though, I think product development accelerated greatly thanks to analytics and usage tracking, and lots of mistakes were avoided. This in turn can reduce the price for consumers of those products or features. Of course, at the expense of privacy, but I'm still wearing my devil's hat here for a moment. And I would go as far as saying people by and large don't care as much about privacy as they do about cost, or getting free stuff (e.g. Facebook).
  - mantas 9y ago
    And a lot of those innovations were just to keep users more immersed while showing them ads. There was little innovation that actually helped end user in the past decade.
    - gingerlime 9y ago
      It certainly has been abused. But I think it’s throwing the baby with the bath water to some extent. People won’t be immersed in something that doesn’t bring them value. Some products would make money from users by showing them ads, others would ask those users to pay. Both would want to create immersive experience in my opinion. I would even argue that less immersive experience (getting bored or distracted) leads to ad clicks. Whereas a service that charges wants to keep users truly engaged.
      - ryandrake 9y ago
        Is “being immersed in the product” a real user need? That sounds like a company goal to me, not something I would want as a user.
tlogan 9y ago
No - I would pay for TV which is class A. Sure the TV manufacturer will need to buy data from company from class D - but they already do that.

jsty 9y ago

Would these be applied specifically to data collected not for the primary purpose of the product? If such a regulation applied to all the data collected by a device / service, I'm not sure the classes you propose would be a good basis for a consumer to decide on which products to use. Let's take a product that stores data on the company's servers as part of the core offering. Under a GDPR-like system where the purposes of data collection were specified as only fulfilling that core offering, you'd get a pretty good guarantee that it wouldn't be used for personalised marketing etc. Yet on my reading of this system, it'd be a class D since this data could potentially be used for targeted marketing.

bognition 9y ago
Admittedly this is the first time I've written this idea down and it needs a bit more work. But I stand by the general sentiment of empowering users to decide and telling them in plain language the reasons why their data is being collected.
- icebraining 9y ago
  But I stand by the general sentiment of empowering users to decide and telling them in plain language the reasons why their data is being collected. That's exactly what the GDPR does. You can use the data for other purposes (e.g. marketing) as long as you request for that specific permission in "clear and plain language". Citing the text: "The principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used."
- jsty 9y ago
  I don't mean to say it's a bad idea by any means, just wanted to provide some constructive criticism. I'd say that GDPR's rules around providing purposes for data collection and not bricking services un-necessarily for refusing such are pretty good; and a labelling scheme similar to that you've proposed to highlight what is being collected outside the core requirements of the service might complement it nicely.
- 9y ago

Anon1096 9y ago

Would I as a business owner be allowed to kick people off my service for not allowing class D? Because in some cases it really is necessary and why should I host a customer who is only costing money?

throwaway2016a 9y ago
Might I suggest an alternative? If the customer is not comfortable with Class D, don't kick them off, require a monthly subscription fee. If they don't like it they will kick themselves off.
- psandersen 9y ago
  The subscription fee should be equivalent to the loss to the business from no longer collecting the data on the user. It could actually be an eye-opener for many people. Most middle-class tech people would probably happily pay $10+ a month for the service Facebook provides, but if its something like $70 then Facebook is either scarily good at monetizing their information or unreasonably pricing the service. On the flip side, you shouldn't be allowed to undercharge for the cost of a private membership. Transparency is good, let users be part of the free market for their data and make informed consent.
  - slaymaker1907 9y ago
    According to their filings, it's about $26 per user in the US and Canada per year.

joejerryronnie 9y ago

This would likely have to be paired with a tiered pricing model for said good or service - i.e. Class A = 100% of retail cost Class B = 75% of retail cost Class C = 50% of retail cost Class D = free I'm convinced that the vast majority of those outraged by today's data collection practices will conveniently direct their ire to some other cause when faced with the possibility of actually having to pay for the services they've gotten used to having for free.

amelius 9y ago
Is such tiered pricing allowed under the GDPR? Because that would provide an easy way out of the whole sitation. Just make the price ridiculously high, and all users will choose the free, your-data-belongs-to-us version.
wtfstatists 9y ago
Sadly this is illegal in EU. You have to offer both Free+ClassD and Free+ClassA versions otherwise its forced consent. I have written more about this here https://news.ycombinator.com/item?id=16351892 https://news.ycombinator.com/item?id=16351892
- joejerryronnie 9y ago
  Does this essentially force companies to charge for services in the EU then? The only reason FB, Google, etc even offer "free" services is because they make money on the backend utilizing the data they collect. If everyone can say "don't collect my data but also keep my service free", I'm not sure how a business can remain viable in the EU without charging some type of subscription or micro-transaction fee. Maybe this is how the whole web-based fee structure should have been setup in the first place but it's not the current deal we have in place. How difficult will it be to shift an entire industry (and consumer mindset) to a vastly different fee structure?
  - tjoff 9y ago
    They can still show ads, and they can still be relevant to whatever page the user is currently viewing. Since they do such a terrible job of it anyway I can't imagine it being less profitable. And then again, maybe actually paying for something like facebook is the right way to go.

m12k 9y ago

I think an important point that the GDPR gets right is to recognize that you often need to give data to services in order for them to be useful, but you currently have almost no recourse if you stop using it and don't want that data 'out there' any more. Even just the data limited data that services can 'reasonably' need will still paint a very detailed picture of you in aggregate. Forcing companies to allow users to recall consent and actually get their data deleted is the only way to prevent that picture from becoming very detailed over time.

evrydayhustling 9y ago
Yes, this, and a second part: GDPR recognizes that data moves between services, and people should have rights about their data that can be enforced on recipients after data is transferred. Currently, agreeing to transfer is a ratchet, where the secondhand party has basically no responsibility to you.
sgc 9y ago
Is there a way to flag yourself as a consumer who always requires personal data deleted when you cancel a service, or is it opt-in on a case by case basis only?
- Someone 9y ago
  That’s neither opt-in nor opt-out, but stronger. Companies only may have data they need for doing their business. If you cancel a service, accounting and similar laws may dictate a company has to keep your address and payment info for a couple of years, but that’s about it (this actually is covered by the implementation of the “data protection directive”, the precursor to the GDPR, which has been in effect since at least 1-1-1999. See https://en.m.wikipedia.org/wiki/Data_Protection_Directive#Legitimate_purpose https://en.m.wikipedia.org/wiki/Data_Protection_Directive#Le...) Student clubs (yes, the GDPR applies to them, too, even if they are 100% volunteer run) that want to keep address info of past members for communicating with alumni, for example, have to make that opt-in. “necessary for running the business” has some gray areas. For example, an athletics club will want to keep a list of club records, photos of past victories, etc. That’s something that is allowed as “necessary for being a sports club”. I don’t know whether there’s any case history on this)

Someone 9y ago

The GDPR is broader than you make it look here. It doesn’t only have provisions for ”providing consumers recourse after their data has been collected”, it also provides ”individuals the right to control what data will be collected”. It even goes further than your request for an opt-out. All data collection must be opt-in, and opt-in requests must be written in such a way that your users can understand them. Opt-out in combination with not ”providing consumers recourse after their data has been collected” is especially dangerous. Extreme example: application X installs a keylogger, and sends all your keystrokes to evilEmpire.com. Would you consider that to be OK, as long as there is an opt-out button? Would you be OK if evilEmpire.com kept the keystrokes it collected before you opted out?

tlogan 9y ago

I 100% agree with this approach. The problem with GDPR is the following: - big corporations which do collect the data will lawyer up and still collect data they do - small companies will do whatever they can do and they will bet that enforcement is going to be sparse - the enforcement will be non-existent So nothing will change. The GDPR will not improve privacy, not improve users knowledge who is collecting what, will give false sense of privacy for some users, etc.

r00fus 9y ago
I do think a few "heads on pikes" in the media will make enforcement a lot easier afterwards.
- tlogan 9y ago
  Like Volkswagen diesel emission scandal? Where is the enforcement after that? Car companies can still shop around Eu and get their emission standards certified in Malta or some other less fortunate EU country.
ascorbic 9y ago
I know in the UK at least, big first are taking this very seriously. The potential fines are huge. But it's true that enforcement will be spotty, as the ICO and its equivalents are under-resourced. But you can bet that they will be looking for some big targets pour encourager les autres.
Joeri 9y ago
Doesn't your argument apply basically to any law? The problem with tax law is the following: - big corporations will lawyer up and still dodge taxes - small companies will do whatever they can do and they will bet that enforcement is going to be sparse - the enforcement will be non-existent I don't know if you meant to do so, but you seem to be arguing governments are incapable of enforcing law against companies.
- chongli 9y ago
  They're pretty incapable against large multinationals. The sort that hoard profits offshore for years and years, waiting for the tax holiday. CEOs can outlast multiple election cycles to get what they want.

jopsen 9y ago

On California buildings my isn't display a sign of they contain dangerous chemicals... All buildings display said warning, because that way they have zero liability.