4 ms·

I think this is a very important distinction you make, but it doesn't necessarily mean that they are fundamentally incompatible. It today's world, data about a

I think this is a very important distinction you make, but it doesn't necessarily mean that they are fundamentally incompatible. It today's world, data about a person is an asset. A person should own their assets, and have control over them. If there were only one option, this would have to be it - it's the only one that aligns with business interests. If you instead go purely the route of anonymous data collection, because data is such an asset it just gives businesses the strong incentive to find ways to de-anonymize your data. That is an unstable situation, and a societal counter-productive incentive. Since data on me has value (clearly since businesses are run off it), make it a true product. Give it value, allow me as a consumer to trade it, allow businesses to quantify it's value in the market place, and explicitly bid on. That aligns incentives. As data becomes more (or less) valuable, businesses will adjust their prices for it. This aligns incentives, the more data is worth to a business, the more they'll be willing to pay for it. IMHO this is clearly the right approach. That said, there is still a world where both methods exist. Users choose when they interact if they want to perform anonymous interaction (or pseudoanonymous), and people provide services to ensure it is anonymous. HN, reddit those are forms people would likely choose pseudoanon for, but there would be a firewall between someones pseudoanon identity and their true identity. And people would be pseudoanon knowing the risks and taking care to not divulge linking identityy info, and businesses would ensure there are limits on data preservation / recording of pseudoanon interactions. The same way people post on HN and use care in what they choose to disclose, HN would also ensur data expiry is short enough and would not share/sell pseudoanon data to 3rd parties. Again, if you can only pick one, it has to be consumer ownership of their data, but I think they both can work together.

danShumway 7y ago
In practice, this doesn't really work. You can compromise and build a system out of elements of each individual philosophy (and many people do), but there are going to be conflicts, and at that point you're going to have decide which system takes precedence. The first issue is that many privacy advocates who believe in anonymity do not believe in data ownership (or believe it should be much weaker). To them, the jump from "data is an asset" to "I own my data" to "because I own it, I should be able to control what people do with it" is begging the question. The second issue is that in practice, most anonymous systems also make it hard to verify data ownership. In order for regional restrictions to work, you need a way to tell what regions your users are in. The "anonymous" side's solution here is, "anybody should be able to convincingly and legally lie about their physical location to (virtually) any business." If that solution is implemented, GDPR and Right to Be Forgotten don't work because it's impossible to verify jurisdiction. This is part of why efforts around GDPR and Right to Be Forgotten are focused on businesses. Businesses have a physical address, they're easy to track, it's easy to prove that they're advertising to a specific region, and you can force them to share internal data with a judge. It's a compromise, because applying GDPR to non-commercial entities or individuals would require tracking them on a mass scale. It's not impossible to compromise -- I mean, privacy advocates do compromise all the time. We work together even though we're different, because we have lots of shared goals. But the differences aren't trivial in the real world. When someone sits down to build a system, they're either thinking about managing data, or eliminating data. That approach is a big indicator into whether you'll end with GDPR or Tor.
- shkkmo 7y ago
  > The "anonymous" side's solution here is, "anybody should be able to convincingly and legally lie about their physical location to (virtually) any business." If that solution is implemented, GDPR and Right to Be Forgotten don't work because it's impossible to verify jurisdiction. How is that? GDPR protects EU residents when they are outside the EU, so you already can't just look at someone's location and decide not to give them GPDR protections. If the GDPR applies to you, your GDPR related features need to accessible to all your users.
  - danans 7y ago
    > How is that? GDPR protects EU residents when they are outside the EU, so you already can't just look at someone's location and decide not to give them GPDR protections. How does the company know they are an EU resident when they are outside the EU? Probably because they have an account with the service, which makes it unlikely that they are anonymous.
  - danShumway 7y ago
    GDPR protects EU residents (even abroad) when a business sells to them (or when a website targets them). At the point of sale, in order to figure out whether or not GDPR applies, a business needs to figure out whether or not someone is an EU citizen. You have a couple of choices with a law like this: 1. Just comply with GDPR anyway. That's honestly the easiest choice, especially if you're already privacy conscious. But you're lucking out, because GDPR is a relatively mild law and comes with a bunch of exceptions that make it easy to comply with. It's not a good long-term strategy to say, "I'll just comply with every country, and that way I'll never need to figure out who my customers are." If you're not interested in complying with GDPR, then you have to stop selling to EU citizens. 2. At the point of sale, you can use something like billing information to try and figure out where your customer lives and block them if they're an EU citizen. This is unacceptable to someone who wants universal anonymity for citizens, because it requires billing information to be tied to identity/location. You're basically guaranteeing that you can't ever move to a payment system that doesn't provide that information. Maybe you can skip billing information, and use some kind of government ID number instead. But no matter what, you need some way to tie the thing giving you money to the person who legally has a citizenship in a country. 3. If you don't want to verify, you can just ask the person if they're European and block them if they say 'yes.' This is probably the compromise that would make anonymity-advocates happiest, because it doesn't require any extra data to be collected and customers can lie. But that's also the problem -- customers can lie. In the US, the most direct analogy here is COPPA. COPPA is a set of privacy restrictions for what information can be collected about children under the age of 13. There are traditional ways you can fall foul of COPPA (some sites are just obviously targeting children). But for the most part, the US went with option 3 -- you ask people their age before they sign up for your site, and you block them if they're under 13. Again, option 3 is great for people who love anonymity. But it takes all the teeth out of COPPA, because children just lie and use the services anyway, and then their privacy gets violated. And the company winks and very coyly says, "Oh, we had no idea 10 year olds were signing up for Facebook. It's not our fault." If you wanted a COPPA that did more to restrict data collection, you would probably prefer something like option 2 -- where we collect enough information about children so that they can't fake their age, and use that to block access. Except doing that reliably would require either building a national identity database or collecting other data that would itself be considered by some people to be a violation of privacy.

danShumway 7y ago

In practice, this doesn't really work. You can compromise and build a system out of elements of each individual philosophy (and many people do), but there are going to be conflicts, and at that point you're going to have decide which system takes precedence. The first issue is that many privacy advocates who believe in anonymity do not believe in data ownership (or believe it should be much weaker). To them, the jump from "data is an asset" to "I own my data" to "because I own it, I should be able to control what people do with it" is begging the question. The second issue is that in practice, most anonymous systems also make it hard to verify data ownership. In order for regional restrictions to work, you need a way to tell what regions your users are in. The "anonymous" side's solution here is, "anybody should be able to convincingly and legally lie about their physical location to (virtually) any business." If that solution is implemented, GDPR and Right to Be Forgotten don't work because it's impossible to verify jurisdiction. This is part of why efforts around GDPR and Right to Be Forgotten are focused on businesses. Businesses have a physical address, they're easy to track, it's easy to prove that they're advertising to a specific region, and you can force them to share internal data with a judge. It's a compromise, because applying GDPR to non-commercial entities or individuals would require tracking them on a mass scale. It's not impossible to compromise -- I mean, privacy advocates do compromise all the time. We work together even though we're different, because we have lots of shared goals. But the differences aren't trivial in the real world. When someone sits down to build a system, they're either thinking about managing data, or eliminating data. That approach is a big indicator into whether you'll end with GDPR or Tor.

shkkmo 7y ago
> The "anonymous" side's solution here is, "anybody should be able to convincingly and legally lie about their physical location to (virtually) any business." If that solution is implemented, GDPR and Right to Be Forgotten don't work because it's impossible to verify jurisdiction. How is that? GDPR protects EU residents when they are outside the EU, so you already can't just look at someone's location and decide not to give them GPDR protections. If the GDPR applies to you, your GDPR related features need to accessible to all your users.
- danans 7y ago
  > How is that? GDPR protects EU residents when they are outside the EU, so you already can't just look at someone's location and decide not to give them GPDR protections. How does the company know they are an EU resident when they are outside the EU? Probably because they have an account with the service, which makes it unlikely that they are anonymous.
- danShumway 7y ago
  GDPR protects EU residents (even abroad) when a business sells to them (or when a website targets them). At the point of sale, in order to figure out whether or not GDPR applies, a business needs to figure out whether or not someone is an EU citizen. You have a couple of choices with a law like this: 1. Just comply with GDPR anyway. That's honestly the easiest choice, especially if you're already privacy conscious. But you're lucking out, because GDPR is a relatively mild law and comes with a bunch of exceptions that make it easy to comply with. It's not a good long-term strategy to say, "I'll just comply with every country, and that way I'll never need to figure out who my customers are." If you're not interested in complying with GDPR, then you have to stop selling to EU citizens. 2. At the point of sale, you can use something like billing information to try and figure out where your customer lives and block them if they're an EU citizen. This is unacceptable to someone who wants universal anonymity for citizens, because it requires billing information to be tied to identity/location. You're basically guaranteeing that you can't ever move to a payment system that doesn't provide that information. Maybe you can skip billing information, and use some kind of government ID number instead. But no matter what, you need some way to tie the thing giving you money to the person who legally has a citizenship in a country. 3. If you don't want to verify, you can just ask the person if they're European and block them if they say 'yes.' This is probably the compromise that would make anonymity-advocates happiest, because it doesn't require any extra data to be collected and customers can lie. But that's also the problem -- customers can lie. In the US, the most direct analogy here is COPPA. COPPA is a set of privacy restrictions for what information can be collected about children under the age of 13. There are traditional ways you can fall foul of COPPA (some sites are just obviously targeting children). But for the most part, the US went with option 3 -- you ask people their age before they sign up for your site, and you block them if they're under 13. Again, option 3 is great for people who love anonymity. But it takes all the teeth out of COPPA, because children just lie and use the services anyway, and then their privacy gets violated. And the company winks and very coyly says, "Oh, we had no idea 10 year olds were signing up for Facebook. It's not our fault." If you wanted a COPPA that did more to restrict data collection, you would probably prefer something like option 2 -- where we collect enough information about children so that they can't fake their age, and use that to block access. Except doing that reliably would require either building a national identity database or collecting other data that would itself be considered by some people to be a violation of privacy.