4 ms·

I'm sorry that you read my statement as so hostile to the GDPR. The consensus at the hearing I think was unanimous—that so much of the GDPR is open to regulator

I'm sorry that you read my statement as so hostile to the GDPR. The consensus at the hearing I think was unanimous—that so much of the GDPR is open to regulatory interpretation that it is hard to evaluate yet. My fellow witness said there's a value to not going first, and I wholly agree with him. I believe we all testified it has made people safer. That said, there is time pressure on Congress because of the 2020 California law. The tech companies and data brokers are scared of 50 state laws on this and are pushing for the mildest form of Federal regulation they can get, to pre-empt state laws, and that is the context of the fight. I think the GDPR is inadequate but much better than nothing, and I tried to convey that in my testimony.

mindslight 7y ago
I didn't take it as outright "hostile", but rather more of a basis with which to pivot into the idea of doing something different. Which feels like playing to lawmakers' interest / American exceptionalism of doing something "better", but counterproductive given how the US lawmaking process works. I'm also not personally a huge fan of the GDPR as is, because I agree we have no idea how it will actually play out. But I don't think the American philosophy will be productive at coming up with a different approach. So if it's to be one national regime, why not simply match the EU for now? If we can't do that, then honestly each state having a different approach sounds better for individuals (assuming it it doesn't devolve into companies demanding one's physical address for compliance). It's more likely that one state will properly codify the idea that users should have full control over data about themselves. Ultimately I don't think we'll end up with sensible-looking legislation unless legislators actually get down and dirty with the technical specifics. For example, the brokenness of the cookie law actually necessitating cookies could have been avoided by mandating a fixed cookie/header format to express the preference rather than allowing every site to come up with its own bespoke implementation.
- idlewords 7y ago
  The problem with saying "let's just match the EU" is that key parts of the GDPR are still undecided. What is a "legitimate business interest" for data collection? What are the limits to algorithmic decisionmaking? No one knows. A regime with 50 state privacy laws would result in every website you visit having a consent click-through where you agree to abide by Alabama privacy laws (or whoever wins that race to the bottom).
  - mindslight 7y ago
    But how can it not come down to judgment calls? We're essentially trying to define the contour of a new right. If we stick with the axiomatic approach, then it feels like we can only end up essentially right back where we are now - data collected by companies is theirs to do with as they like. FWIW are you sure it would be a race to the bottom (companies going to the least-restrictive state) ? In the context of salestax/cookie-nexus, I would have hopes that it would be a race to the top (users benefiting from being in a more-restrictive state). Which is why I'd think the worry would be every random service demanding to verify your address to keep you from claiming to be in the more restrictive states.
Despegar 7y ago
I think what I didn't like about your comments about GDPR is that it used the worst example of the effects on users when you could have used a better one. Take the iPhone for example. The iOS permissions system has basically nailed the "how do we present this to the user" problem pretty much from day one of the iPhone and the App Store. It's specific, it's easy to understand, it's not bundled with anything else and it shows you the prompt exactly when the app actually needs the location data (not just a succession of 5 different permission requests when you first launch the app). The annoyance to users that comes from GDPR is because, like you said, the existing surveillance ecosystem is trying to respond to GDPR by changing as little about their practices as possible. Maybe the surveillance ad ecosystem shouldn't even exist? In iOS 11.3 Apple released a new API for ad attribution [1]. It seems like it could be very interesting from a privacy perspective [2]. >A successful app installation relays just five data points back to the ad network — ad network ID, transaction identification, ad campaign ID, app ID installed and attribution code — while excluding the private user information offered by Facebook and Google. If they chose to mandate the use of this API, it would vastly restructure the surveillance ad ecosystem overnight (at least within Apple's platforms, which is a very big economy) [3]. I think the same could be done for a user surfing the web under GDPR, it doesn't necessarily have to be a hellscape. [1] https://developer.apple.com/documentation/storekit/skadnetwork https://developer.apple.com/documentation/storekit/skadnetwo... [2] https://www.mobilemarketer.com/news/apple-ios-privacy-and-the-future-of-ad-attribution/543904/ https://www.mobilemarketer.com/news/apple-ios-privacy-and-th... [3] https://adexchanger.com/mobile/is-apple-angling-to-cut-out-app-attribution-vendors/ https://adexchanger.com/mobile/is-apple-angling-to-cut-out-a...

mindslight 7y ago

I didn't take it as outright "hostile", but rather more of a basis with which to pivot into the idea of doing something different. Which feels like playing to lawmakers' interest / American exceptionalism of doing something "better", but counterproductive given how the US lawmaking process works. I'm also not personally a huge fan of the GDPR as is, because I agree we have no idea how it will actually play out. But I don't think the American philosophy will be productive at coming up with a different approach. So if it's to be one national regime, why not simply match the EU for now? If we can't do that, then honestly each state having a different approach sounds better for individuals (assuming it it doesn't devolve into companies demanding one's physical address for compliance). It's more likely that one state will properly codify the idea that users should have full control over data about themselves. Ultimately I don't think we'll end up with sensible-looking legislation unless legislators actually get down and dirty with the technical specifics. For example, the brokenness of the cookie law actually necessitating cookies could have been avoided by mandating a fixed cookie/header format to express the preference rather than allowing every site to come up with its own bespoke implementation.

idlewords 7y ago
The problem with saying "let's just match the EU" is that key parts of the GDPR are still undecided. What is a "legitimate business interest" for data collection? What are the limits to algorithmic decisionmaking? No one knows. A regime with 50 state privacy laws would result in every website you visit having a consent click-through where you agree to abide by Alabama privacy laws (or whoever wins that race to the bottom).
- mindslight 7y ago
  But how can it not come down to judgment calls? We're essentially trying to define the contour of a new right. If we stick with the axiomatic approach, then it feels like we can only end up essentially right back where we are now - data collected by companies is theirs to do with as they like. FWIW are you sure it would be a race to the bottom (companies going to the least-restrictive state) ? In the context of salestax/cookie-nexus, I would have hopes that it would be a race to the top (users benefiting from being in a more-restrictive state). Which is why I'd think the worry would be every random service demanding to verify your address to keep you from claiming to be in the more restrictive states.

Despegar 7y ago

I think what I didn't like about your comments about GDPR is that it used the worst example of the effects on users when you could have used a better one. Take the iPhone for example. The iOS permissions system has basically nailed the "how do we present this to the user" problem pretty much from day one of the iPhone and the App Store. It's specific, it's easy to understand, it's not bundled with anything else and it shows you the prompt exactly when the app actually needs the location data (not just a succession of 5 different permission requests when you first launch the app). The annoyance to users that comes from GDPR is because, like you said, the existing surveillance ecosystem is trying to respond to GDPR by changing as little about their practices as possible. Maybe the surveillance ad ecosystem shouldn't even exist? In iOS 11.3 Apple released a new API for ad attribution [1]. It seems like it could be very interesting from a privacy perspective [2]. >A successful app installation relays just five data points back to the ad network — ad network ID, transaction identification, ad campaign ID, app ID installed and attribution code — while excluding the private user information offered by Facebook and Google. If they chose to mandate the use of this API, it would vastly restructure the surveillance ad ecosystem overnight (at least within Apple's platforms, which is a very big economy) [3]. I think the same could be done for a user surfing the web under GDPR, it doesn't necessarily have to be a hellscape. [1] https://developer.apple.com/documentation/storekit/skadnetwork https://developer.apple.com/documentation/storekit/skadnetwo... [2] https://www.mobilemarketer.com/news/apple-ios-privacy-and-the-future-of-ad-attribution/543904/ https://www.mobilemarketer.com/news/apple-ios-privacy-and-th... [3] https://adexchanger.com/mobile/is-apple-angling-to-cut-out-app-attribution-vendors/ https://adexchanger.com/mobile/is-apple-angling-to-cut-out-a...