4 ms·

Would these be applied specifically to data collected not for the primary purpose of the product? If such a regulation applied to all the data collected by a de

by jsty 9y ago

Would these be applied specifically to data collected not for the primary purpose of the product? If such a regulation applied to all the data collected by a device / service, I'm not sure the classes you propose would be a good basis for a consumer to decide on which products to use. Let's take a product that stores data on the company's servers as part of the core offering. Under a GDPR-like system where the purposes of data collection were specified as only fulfilling that core offering, you'd get a pretty good guarantee that it wouldn't be used for personalised marketing etc. Yet on my reading of this system, it'd be a class D since this data could potentially be used for targeted marketing.

bognition 9y ago
Admittedly this is the first time I've written this idea down and it needs a bit more work. But I stand by the general sentiment of empowering users to decide and telling them in plain language the reasons why their data is being collected.
- icebraining 9y ago
  But I stand by the general sentiment of empowering users to decide and telling them in plain language the reasons why their data is being collected. That's exactly what the GDPR does. You can use the data for other purposes (e.g. marketing) as long as you request for that specific permission in "clear and plain language". Citing the text: "The principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used."
- jsty 9y ago
  I don't mean to say it's a bad idea by any means, just wanted to provide some constructive criticism. I'd say that GDPR's rules around providing purposes for data collection and not bricking services un-necessarily for refusing such are pretty good; and a labelling scheme similar to that you've proposed to highlight what is being collected outside the core requirements of the service might complement it nicely.
- jdietrich 9y ago
  How the data is used is at least as important as what data is collected. I'm fine with a smart speaker securely storing my voice data in the cloud to provide me with personalised speech recognition. I'm not OK with that data being sold to a fraudster who wants to phone my bank and impersonate me. If you classify based on data collection alone, then both these scenarios would result in a "class D" rating.
  - sgc 9y ago
    Yes, It would need to distinguish in each class between technical capacity and reserved legal rights, with stiff penalties for breach of either one. One might use your targeted voice data only to improve your service, but also reserve the right to aggregate it for marketing purposes.

by jsty 9y ago

bognition 9y ago

Admittedly this is the first time I've written this idea down and it needs a bit more work. But I stand by the general sentiment of empowering users to decide and telling them in plain language the reasons why their data is being collected.

icebraining 9y ago
But I stand by the general sentiment of empowering users to decide and telling them in plain language the reasons why their data is being collected. That's exactly what the GDPR does. You can use the data for other purposes (e.g. marketing) as long as you request for that specific permission in "clear and plain language". Citing the text: "The principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used."
jsty 9y ago
I don't mean to say it's a bad idea by any means, just wanted to provide some constructive criticism. I'd say that GDPR's rules around providing purposes for data collection and not bricking services un-necessarily for refusing such are pretty good; and a labelling scheme similar to that you've proposed to highlight what is being collected outside the core requirements of the service might complement it nicely.
jdietrich 9y ago
How the data is used is at least as important as what data is collected. I'm fine with a smart speaker securely storing my voice data in the cloud to provide me with personalised speech recognition. I'm not OK with that data being sold to a fraudster who wants to phone my bank and impersonate me. If you classify based on data collection alone, then both these scenarios would result in a "class D" rating.
- sgc 9y ago
  Yes, It would need to distinguish in each class between technical capacity and reserved legal rights, with stiff penalties for breach of either one. One might use your targeted voice data only to improve your service, but also reserve the right to aggregate it for marketing purposes.