7 ms·

Senate takes another stab at privacy law with proposed COPRA bill

49 points by troydavis 7y ago

troydavis 7y ago
Summary: https://www.cantwell.senate.gov/imo/media/doc/COPRA%20One-Pager.pdf https://www.cantwell.senate.gov/imo/media/doc/COPRA%20One-Pa... Press release, including endorsements by EPIC, law school professors, Consumer Reports, Georgetown Center on Privacy & Technology, and others: https://www.cantwell.senate.gov/news/press-releases/cantwell-senate-democrats-unveil-strong-online-privacy-rights https://www.cantwell.senate.gov/news/press-releases/cantwell... Bill text: https://www.cantwell.senate.gov/imo/media/doc/COPRA%20Bill%20Text.pdf https://www.cantwell.senate.gov/imo/media/doc/COPRA%20Bill%2...
- deleted 7y ago
  [deleted]
erentz 7y ago
Is this law only applicable to some definition of “online” companies? Why not a generic privacy law that applies to all?
kelnos 7y ago
Looks like it was written/sponsored by four Senate Democrats. In other words, no chance this is even going to get to a vote, unless/until the balance of power in the Senate changes.
- bluejekyll 7y ago
  The article agrees with you. I do wonder if this could be a bipartisan issue, as it really does concern a lot of people online. It could easily become a wedge issue, “protect your children from the evil internet corporations—look the other side is doing nothing about it!”
  - henryfjordan 7y ago
    Can anything be bipartisan right now?
    - scarejunba 7y ago
      Yes, but US politics is most strongly determined by the committees that allow votes. Example bipartisan resolution: https://www.congress.gov/bill/116th-congress/house-bill/1044/cosponsors https://www.congress.gov/bill/116th-congress/house-bill/1044...
    - vharuck 7y ago
      Plenty of things, we just don't often hear about them because that'd be boring news.
      - jrockway 7y ago
        The Hong Kong Human Rights and Democracy Act has been all over the news and passed with only one vote against it in the House. The DMCA was also bipartisan, which has made me very skeptical anytime that word comes up.
    - notatoad 7y ago
      yes, but bipartisan probably means pro-corporate.
- ftkudtkfkl 7y ago
  That's probably why they're proposing it now, there's very little risk in proposing something the average use at worst won't understand and at best will assume you had good faith in suggesting.
downerending 7y ago
That's a truly awful acronym.
- keitmo 7y ago
  Maybe the'll trim it down and call it COPRA LITE.
  - Accujack 7y ago
    You are the wind beneath my wings.
  - aasasd 7y ago
    I vaguely felt that with the meh name the bill's not gonna pass. But now, seeing as I'm not a native speaker of English, I have a definite need for someone to explain the pun.
    - cwkoss 7y ago
      Coprolite is the name for fossilized poop Copro- is a suffix that generally applies to poop-related things.
Thriptic 7y ago
Once again we continue to look at data privacy and identity theft in the wrong way in my opinion. To me the solution is very simple. If you are reselling my data, allowing access to my data, or deriving data / servives from my data that identifies me in any way and then selling that to a third party for a profit or giving it to them as part of a license so that they can generate profit from it (including ad targeting or analytics) then when I visit your site or use your service there should be a big box in simple to understand English, not legalese or a lengthy EULA, that says "we [do one of the things listed above], are you ok with that?" If I say "no", then you cannot descriminate against me and you cannot do those things. You still have to let me use your site or service; you still have to provide me with identical services; etc. You can still show me ads (non-personalized), charge me a bit more money commensurate with the value of my data, or introduce a different monetization method, but you can't deny me service all together. Further, if you collect my data, YOU are liable for it. Breaches should not be the user's problem. Meaning, if someone walks off with the contents of your database containing my PII using anything less than a crazy number of zero days, you are liable for a set financial penalty per user's info lost (in the way HIPAA does it) and / or you are liable in perpetuity for protecting against identity theft with an insurance policy. I don't need to prove attribution. If I ever have a problem that could plausibly be linked back to the data exposure, you are liable for damages. Finally, it should not be the user's problem to clean up identity theft, ever. If a bank opens an account in my name without properly authenticating me, that is the bank's problem, not mine. It should be up to them to conclusively prove it was me that did it, not up to me to prove that I didn't. Does this mean it will be more complicated to open up various accounts and credit? Yes. Does it mean that there will be lost business for these institutions? Yup. Tough luck; that is the price we have to pay. The entire point of this should be to heavily disincentivize collection of PII unless absolutely necessary for core business function.
- adamc 7y ago
  Run for office.
- deleted 7y ago
  [deleted]
- analog31 7y ago
deleted 7y ago
[deleted]
prepend 7y ago
Are supporters of this bill called COPRAphiliacs?
aasasd 7y ago
> COPRA also seems to take the challenges the EU and consumers have faced since the GDPR went into effect into account, as it specifically tasks the FTC with making sure those rules not only require "clear and conspicuous" notices to opt in or opt out of data collection and transfers but also "to minimize the number of opt-out designations of a similar type that a consumer must make" (such as an "accept cookies" warning on every single website one visits). I think I need a cigarette after going through the dependencies and embeddings in this sentence.
lupire 7y ago
Title is misleading, as usual for Ars Technica on politics. > group of Senate Democrats Not "Senate". Minority parties don't get partisan bills passed into law.
- munk-a 7y ago
  > Minority parties don't get partisan bills passed into law. I don't really see this bill as partisan in nature, though it only currently has Dem support consumer protections are something both parties should be able to get behind.
  - rndgermandude 7y ago
    It is partisan at the moment because, while it is neutral in nature, it only has support of the one party. They may get (enough) Republicans on board, but given the current political climate, I'd guess it's rather unlikely, unless Trump decides this is a good way to fuck with his nemeses i.e. FAA(N)G.
musicale 7y ago
I assume the privacy law they're trying to stab is CCPA?

49 points by troydavis 7y ago

Summary: https://www.cantwell.senate.gov/imo/media/doc/COPRA%20One-Pager.pdf https://www.cantwell.senate.gov/imo/media/doc/COPRA%20One-Pa... Press release, including endorsements by EPIC, law school professors, Consumer Reports, Georgetown Center on Privacy & Technology, and others: https://www.cantwell.senate.gov/news/press-releases/cantwell-senate-democrats-unveil-strong-online-privacy-rights https://www.cantwell.senate.gov/news/press-releases/cantwell... Bill text: https://www.cantwell.senate.gov/imo/media/doc/COPRA%20Bill%20Text.pdf https://www.cantwell.senate.gov/imo/media/doc/COPRA%20Bill%2...

deleted 7y ago
[deleted]

erentz 7y ago

Is this law only applicable to some definition of “online” companies? Why not a generic privacy law that applies to all?

kelnos 7y ago

Looks like it was written/sponsored by four Senate Democrats. In other words, no chance this is even going to get to a vote, unless/until the balance of power in the Senate changes.

bluejekyll 7y ago
The article agrees with you. I do wonder if this could be a bipartisan issue, as it really does concern a lot of people online. It could easily become a wedge issue, “protect your children from the evil internet corporations—look the other side is doing nothing about it!”
- henryfjordan 7y ago
  Can anything be bipartisan right now?
  - scarejunba 7y ago
    Yes, but US politics is most strongly determined by the committees that allow votes. Example bipartisan resolution: https://www.congress.gov/bill/116th-congress/house-bill/1044/cosponsors https://www.congress.gov/bill/116th-congress/house-bill/1044...
  - vharuck 7y ago
    Plenty of things, we just don't often hear about them because that'd be boring news.
    - jrockway 7y ago
      The Hong Kong Human Rights and Democracy Act has been all over the news and passed with only one vote against it in the House. The DMCA was also bipartisan, which has made me very skeptical anytime that word comes up.
  - notatoad 7y ago
    yes, but bipartisan probably means pro-corporate.
ftkudtkfkl 7y ago
That's probably why they're proposing it now, there's very little risk in proposing something the average use at worst won't understand and at best will assume you had good faith in suggesting.

downerending 7y ago

That's a truly awful acronym.

keitmo 7y ago
Maybe the'll trim it down and call it COPRA LITE.
- Accujack 7y ago
  You are the wind beneath my wings.
- aasasd 7y ago
  I vaguely felt that with the meh name the bill's not gonna pass. But now, seeing as I'm not a native speaker of English, I have a definite need for someone to explain the pun.
  - cwkoss 7y ago
    Coprolite is the name for fossilized poop Copro- is a suffix that generally applies to poop-related things.

Thriptic 7y ago

Once again we continue to look at data privacy and identity theft in the wrong way in my opinion. To me the solution is very simple. If you are reselling my data, allowing access to my data, or deriving data / servives from my data that identifies me in any way and then selling that to a third party for a profit or giving it to them as part of a license so that they can generate profit from it (including ad targeting or analytics) then when I visit your site or use your service there should be a big box in simple to understand English, not legalese or a lengthy EULA, that says "we [do one of the things listed above], are you ok with that?" If I say "no", then you cannot descriminate against me and you cannot do those things. You still have to let me use your site or service; you still have to provide me with identical services; etc. You can still show me ads (non-personalized), charge me a bit more money commensurate with the value of my data, or introduce a different monetization method, but you can't deny me service all together. Further, if you collect my data, YOU are liable for it. Breaches should not be the user's problem. Meaning, if someone walks off with the contents of your database containing my PII using anything less than a crazy number of zero days, you are liable for a set financial penalty per user's info lost (in the way HIPAA does it) and / or you are liable in perpetuity for protecting against identity theft with an insurance policy. I don't need to prove attribution. If I ever have a problem that could plausibly be linked back to the data exposure, you are liable for damages. Finally, it should not be the user's problem to clean up identity theft, ever. If a bank opens an account in my name without properly authenticating me, that is the bank's problem, not mine. It should be up to them to conclusively prove it was me that did it, not up to me to prove that I didn't. Does this mean it will be more complicated to open up various accounts and credit? Yes. Does it mean that there will be lost business for these institutions? Yup. Tough luck; that is the price we have to pay. The entire point of this should be to heavily disincentivize collection of PII unless absolutely necessary for core business function.

adamc 7y ago
Run for office.
deleted 7y ago
[deleted]
analog31 7y ago

deleted 7y ago

[deleted]

prepend 7y ago

Are supporters of this bill called COPRAphiliacs?

aasasd 7y ago

> COPRA also seems to take the challenges the EU and consumers have faced since the GDPR went into effect into account, as it specifically tasks the FTC with making sure those rules not only require "clear and conspicuous" notices to opt in or opt out of data collection and transfers but also "to minimize the number of opt-out designations of a similar type that a consumer must make" (such as an "accept cookies" warning on every single website one visits). I think I need a cigarette after going through the dependencies and embeddings in this sentence.

lupire 7y ago

Title is misleading, as usual for Ars Technica on politics. > group of Senate Democrats Not "Senate". Minority parties don't get partisan bills passed into law.

munk-a 7y ago
> Minority parties don't get partisan bills passed into law. I don't really see this bill as partisan in nature, though it only currently has Dem support consumer protections are something both parties should be able to get behind.
- rndgermandude 7y ago
  It is partisan at the moment because, while it is neutral in nature, it only has support of the one party. They may get (enough) Republicans on board, but given the current political climate, I'd guess it's rather unlikely, unless Trump decides this is a good way to fuck with his nemeses i.e. FAA(N)G.

musicale 7y ago

I assume the privacy law they're trying to stab is CCPA?