5 ms·

Why would you unify two unrelated things? I think privacy is a right and copyright is so overstretched it literally works against its original intention. As an

Why would you unify two unrelated things? I think privacy is a right and copyright is so overstretched it literally works against its original intention. As an aside, the only part of "Intellectual Property" as an idea that I agree with is the right for an author to claim that they authored something. It shoudln't give them a right to control how its distributed or what people do with it. Why would you compare the rights of people to the "rights" of companies? Why would you defend enormous corporations? Disney doesn't have "knowledge". It's not a person.

specialist 6y ago
To simplify the bookkeeping. When all data about me is mine, everything else falls into place.
- kube-system 6y ago
  This doesn't simply it, it complicates it. With privacy, you are generally looking to prevent the redistribution of facts, but only in specific circumstances. Copyright does a very different thing, where it only prevents the redistribution of more creative expressions, but does so in broad circumstances. If you take the typical data elements that you want to keep private and apply copyright law to them, I think you'll end up with more problems than solutions. Facts -- like your name -- are something that people need to reproduce just to do basic things, like have a conversation with you. I don't think we need to start all conversations with: "By starting a conversation with me, you hereby grant and will grant me and affiliated discussion participants a nonexclusive, worldwide, royalty free, fully paid up, transferable, sublicensable, perpetual, irrevocable license to reproduce, mention, perform, vocalize, remember and otherwise use your name for purposes of this conversation" It sounds silly, but copyright is this broad in scope. It applies to everyone. For the purposes of privacy, you really need a much more narrow paradigm -- something that applies to strangers but not people who you expect to know things about you, like friends, family, or people you are voluntarily sharing with. This is probably why every privacy law on the planet is not an extension of copyright. They are two very different things.
  - specialist 6y ago
    Great reply, thanks. How is collecting, aggregating, redistributing PII prevented today? I like that you distinguish voluntary sharing, eg with friends and family. I'll ponder your point about names (identifiers). There are currently semi-legitimate uses, like political campaigns in the USA have voter files for GOTV (ballot chasing). Which is a ridiculous practice. (I've worked on many campaigns.) So instead of accommodating pathological use cases, I'd rather resolve the paradox by eliminating the practice. In the case of GOTV, compulsory voting would greatly improve voter privacy. I've been waiting for anyone to criticize my thesis by pointing out the government already knows all. My provisional response remains: If someone's making a buck off my data, I want my cut. In cases like the CA State's DMV reselling PII, my thesis is that treating my data as an asset, and therefore a liability, would deter that behavior. So relying on disincentives vs prohibition.
    - kube-system 6y ago
      > How is collecting, aggregating, redistributing PII prevented today? The handful of privacy laws today (HIPAA, CCPA, GDPR) take a pretty direct approach; they define: * the types of organizations that are restricted from sharing PII * the types of collection, retention, and sharing that is allowed and/or prohibited * the definition of PII -- which specific attributes about a person are protected > In cases like the CA State's DMV reselling PII, my thesis is that treating my data as an asset, and therefore a liability, would deter that behavior. So relying on disincentives vs prohibition. It seems to me the CCPA could have prevented that -- if it applied to governments as well as "businesses".
      - specialist 6y ago
        I've been keen to see how the GDPR and CCPA play out. Hopefully better than HIPAA, FERPA, etc. Providence Hospital in Portland OR (details?) had a big (for the time) data leak about the time I started doing medical records. They settled out of court. I contacted both sides and tried to reach the admins, to ask what fix they settled on. "Try harder next time." Terrific. We geeks creating the infrastructure for electronic medical record interchanges resigned ourselves to the inevitable massive data leak. I spent a lot of effort trying to figure out how to protect patient privacy. I eventually determined there's only one technical solution, based on strategies from Translucent Databases book. (TLDR: field level encryption for all data at rest, just like proper password storage.) But there's no social, legal, or cultural protection. And the small legal change (globally unique person identifiers) we'd have to do for the sole workable technical solution is strenuously opposed across the political spectrum. So. My plan now is to rethink the entire stack. Extend property rights to PII. Let accounting fix what algorithms couldn't. If someone divines a better plan, I'm totally on board. As in "shut up and take my money". But I'm not holding my breath. FWIW, one of my besties wrote a book on privacy. My proposal makes his head explode. Apoplectic. So I get the push back. But 15 years later, no one, including him, have a better idea. Better as in feasible, actionable. If you've got something, please share.

specialist 6y ago

To simplify the bookkeeping. When all data about me is mine, everything else falls into place.

kube-system 6y ago
This doesn't simply it, it complicates it. With privacy, you are generally looking to prevent the redistribution of facts, but only in specific circumstances. Copyright does a very different thing, where it only prevents the redistribution of more creative expressions, but does so in broad circumstances. If you take the typical data elements that you want to keep private and apply copyright law to them, I think you'll end up with more problems than solutions. Facts -- like your name -- are something that people need to reproduce just to do basic things, like have a conversation with you. I don't think we need to start all conversations with: "By starting a conversation with me, you hereby grant and will grant me and affiliated discussion participants a nonexclusive, worldwide, royalty free, fully paid up, transferable, sublicensable, perpetual, irrevocable license to reproduce, mention, perform, vocalize, remember and otherwise use your name for purposes of this conversation" It sounds silly, but copyright is this broad in scope. It applies to everyone. For the purposes of privacy, you really need a much more narrow paradigm -- something that applies to strangers but not people who you expect to know things about you, like friends, family, or people you are voluntarily sharing with. This is probably why every privacy law on the planet is not an extension of copyright. They are two very different things.
- specialist 6y ago
  Great reply, thanks. How is collecting, aggregating, redistributing PII prevented today? I like that you distinguish voluntary sharing, eg with friends and family. I'll ponder your point about names (identifiers). There are currently semi-legitimate uses, like political campaigns in the USA have voter files for GOTV (ballot chasing). Which is a ridiculous practice. (I've worked on many campaigns.) So instead of accommodating pathological use cases, I'd rather resolve the paradox by eliminating the practice. In the case of GOTV, compulsory voting would greatly improve voter privacy. I've been waiting for anyone to criticize my thesis by pointing out the government already knows all. My provisional response remains: If someone's making a buck off my data, I want my cut. In cases like the CA State's DMV reselling PII, my thesis is that treating my data as an asset, and therefore a liability, would deter that behavior. So relying on disincentives vs prohibition.
  - kube-system 6y ago
    > How is collecting, aggregating, redistributing PII prevented today? The handful of privacy laws today (HIPAA, CCPA, GDPR) take a pretty direct approach; they define: * the types of organizations that are restricted from sharing PII * the types of collection, retention, and sharing that is allowed and/or prohibited * the definition of PII -- which specific attributes about a person are protected > In cases like the CA State's DMV reselling PII, my thesis is that treating my data as an asset, and therefore a liability, would deter that behavior. So relying on disincentives vs prohibition. It seems to me the CCPA could have prevented that -- if it applied to governments as well as "businesses".
    - specialist 6y ago
      I've been keen to see how the GDPR and CCPA play out. Hopefully better than HIPAA, FERPA, etc. Providence Hospital in Portland OR (details?) had a big (for the time) data leak about the time I started doing medical records. They settled out of court. I contacted both sides and tried to reach the admins, to ask what fix they settled on. "Try harder next time." Terrific. We geeks creating the infrastructure for electronic medical record interchanges resigned ourselves to the inevitable massive data leak. I spent a lot of effort trying to figure out how to protect patient privacy. I eventually determined there's only one technical solution, based on strategies from Translucent Databases book. (TLDR: field level encryption for all data at rest, just like proper password storage.) But there's no social, legal, or cultural protection. And the small legal change (globally unique person identifiers) we'd have to do for the sole workable technical solution is strenuously opposed across the political spectrum. So. My plan now is to rethink the entire stack. Extend property rights to PII. Let accounting fix what algorithms couldn't. If someone divines a better plan, I'm totally on board. As in "shut up and take my money". But I'm not holding my breath. FWIW, one of my besties wrote a book on privacy. My proposal makes his head explode. Apoplectic. So I get the push back. But 15 years later, no one, including him, have a better idea. Better as in feasible, actionable. If you've got something, please share.