6 ms·

personal data should be 2-party consent for every data sale transaction by law, not this ‘opted-in by corporate mandate and backed by regulatory capture and mon

personal data should be 2-party consent for every data sale transaction by law, not this ‘opted-in by corporate mandate and backed by regulatory capture and monopolistic power’ we have now. people should be able to negotiate a rate at which they’re willing to allow the corporation to sell their data, including not allowing it at all ever.

amelius 5y ago
Can't we have a smart contract system where every company in possession of some user data can be asked to provide a machine-verifiable proof that it legally obtained that information?
- clairity 5y ago
  sure, but it’s essentially a social/legal problem, not a technical one. the onus is on the company holding data to show the chain of consent, which doesn’t require anything fancy outside a purpose-built database.
  - amelius 5y ago
    So how does that work then? How does Google prove that I clicked that accept-EULA button? Or that I approve of them keeping track of my information? I never put my signature anywhere and still there are companies holding or even trading my information. > it’s essentially a social/legal problem, not a technical one And ironically, it's the tech companies who are getting away with it.
    - clairity 5y ago
      right, that’s the social/legal problem, that consent is assumed, and i’d argue, coerced. bundling like this is actually an anti-trust concern, because it’s using power in one market (for instance, search) to exert control in another (data brokerage), but we’ve collectively lost sight of this being a problem. but yes, they should be required to get your unambiguous consent for data sharing separate from any other transaction, otherwise it shouldn’t be considered consent.
    - Xelynega 5y ago
      For software that doesn't require you to click a EULA button or change a value in a EULA file to acknowledge you agree to the EULA, they can just make it part of the Terms Of Service that you inherently agree to by using their software/service.
- foobiekr 5y ago
  There is no technical solution to this problem. First parties can just lie or use dark patterns to gain permission.
  - amelius 5y ago
    Look, if some authority finds your personal information on some server, and they can't produce your digital signature on a contract which says that the company can keep the information from some date to some other date, then they are in violation. It is simply not possible to lie about it. https://en.wikipedia.org/wiki/Digital_signature https://en.wikipedia.org/wiki/Digital_signature
    - nine_k 5y ago
      Now every person needs to have a government-verified signing key, and suddenly consent given on disparate sites can be trivially linked to the same public key that verifies it...
      - amelius 5y ago
        Why does there need to be only one public key per user? The authorities only have to look at the leaked information, contact you, and ask you to generate proof that you signed the contract.

amelius 5y ago

Can't we have a smart contract system where every company in possession of some user data can be asked to provide a machine-verifiable proof that it legally obtained that information?

clairity 5y ago
sure, but it’s essentially a social/legal problem, not a technical one. the onus is on the company holding data to show the chain of consent, which doesn’t require anything fancy outside a purpose-built database.
- amelius 5y ago
  So how does that work then? How does Google prove that I clicked that accept-EULA button? Or that I approve of them keeping track of my information? I never put my signature anywhere and still there are companies holding or even trading my information. > it’s essentially a social/legal problem, not a technical one And ironically, it's the tech companies who are getting away with it.
  - clairity 5y ago
    right, that’s the social/legal problem, that consent is assumed, and i’d argue, coerced. bundling like this is actually an anti-trust concern, because it’s using power in one market (for instance, search) to exert control in another (data brokerage), but we’ve collectively lost sight of this being a problem. but yes, they should be required to get your unambiguous consent for data sharing separate from any other transaction, otherwise it shouldn’t be considered consent.
  - Xelynega 5y ago
    For software that doesn't require you to click a EULA button or change a value in a EULA file to acknowledge you agree to the EULA, they can just make it part of the Terms Of Service that you inherently agree to by using their software/service.
foobiekr 5y ago
There is no technical solution to this problem. First parties can just lie or use dark patterns to gain permission.
- amelius 5y ago
  Look, if some authority finds your personal information on some server, and they can't produce your digital signature on a contract which says that the company can keep the information from some date to some other date, then they are in violation. It is simply not possible to lie about it. https://en.wikipedia.org/wiki/Digital_signature https://en.wikipedia.org/wiki/Digital_signature
  - nine_k 5y ago
    Now every person needs to have a government-verified signing key, and suddenly consent given on disparate sites can be trivially linked to the same public key that verifies it...
    - amelius 5y ago
      Why does there need to be only one public key per user? The authorities only have to look at the leaked information, contact you, and ask you to generate proof that you signed the contract.