6 ms·

Admittedly this is the first time I've written this idea down and it needs a bit more work. But I stand by the general sentiment of empowering users to decide

Admittedly this is the first time I've written this idea down and it needs a bit more work. But I stand by the general sentiment of empowering users to decide and telling them in plain language the reasons why their data is being collected.

icebraining 9y ago
But I stand by the general sentiment of empowering users to decide and telling them in plain language the reasons why their data is being collected. That's exactly what the GDPR does. You can use the data for other purposes (e.g. marketing) as long as you request for that specific permission in "clear and plain language". Citing the text: "The principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used."
jsty 9y ago
I don't mean to say it's a bad idea by any means, just wanted to provide some constructive criticism. I'd say that GDPR's rules around providing purposes for data collection and not bricking services un-necessarily for refusing such are pretty good; and a labelling scheme similar to that you've proposed to highlight what is being collected outside the core requirements of the service might complement it nicely.
jdietrich 9y ago
How the data is used is at least as important as what data is collected. I'm fine with a smart speaker securely storing my voice data in the cloud to provide me with personalised speech recognition. I'm not OK with that data being sold to a fraudster who wants to phone my bank and impersonate me. If you classify based on data collection alone, then both these scenarios would result in a "class D" rating.
- sgc 9y ago
  Yes, It would need to distinguish in each class between technical capacity and reserved legal rights, with stiff penalties for breach of either one. One might use your targeted voice data only to improve your service, but also reserve the right to aggregate it for marketing purposes.

icebraining 9y ago

But I stand by the general sentiment of empowering users to decide and telling them in plain language the reasons why their data is being collected. That's exactly what the GDPR does. You can use the data for other purposes (e.g. marketing) as long as you request for that specific permission in "clear and plain language". Citing the text: "The principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used."

jsty 9y ago

I don't mean to say it's a bad idea by any means, just wanted to provide some constructive criticism. I'd say that GDPR's rules around providing purposes for data collection and not bricking services un-necessarily for refusing such are pretty good; and a labelling scheme similar to that you've proposed to highlight what is being collected outside the core requirements of the service might complement it nicely.

jdietrich 9y ago

How the data is used is at least as important as what data is collected. I'm fine with a smart speaker securely storing my voice data in the cloud to provide me with personalised speech recognition. I'm not OK with that data being sold to a fraudster who wants to phone my bank and impersonate me. If you classify based on data collection alone, then both these scenarios would result in a "class D" rating.

sgc 9y ago
Yes, It would need to distinguish in each class between technical capacity and reserved legal rights, with stiff penalties for breach of either one. One might use your targeted voice data only to improve your service, but also reserve the right to aggregate it for marketing purposes.