11 ms·

US House Republicans introduce strategy to establish national privacy standard

• tmaly 5y ago
  >In order to ensure that our information is protected, we need one national privacy law that supports small businesses Is that a typo? Did they mean supports individuals?
  • dboreham 5y ago
    Almost certainly means "supports large businesses".
  • mminer237 5y ago
    I think the idea is that if Congress doesn't act, the states are going to still set their own privacy standards. If there are fifty different standards in fifty different states, only large companies will have the manpower to sort out what they all require. These congressmen want to put everyone on the same standard so small companies can have websites and only have to worry about one standard of privacy.
  • outside1234 5y ago
    No, they mean they want to standard to be federal so they can collect lots of donations in the course of influencing it.
• rglover 5y ago
  Good: "Principle #4: We must also protect small businesses and innovation. We know that in Europe, investments in startups are down more than 40% since their data protection and privacy law—the General Data Protection Regulation—went into effect. We must guard against a similar situation here. We want small businesses hiring coders and engineers, not lawyers."
  • forgotmysn 5y ago
    Yes, let's start building our National Privacy Regime by protecting businesses from the burden of implementing privacy for their users.
    • vineyardmike 5y ago
      Which, ironically, is something the GDPR exempted small businesses from.
      • tchock23 5y ago
        It did? I thought there were no business size exemptions for GDPR.
        • vineyardmike 5y ago
          I don't think there are "ignore this law" style exemptions, but my understanding was that some policies were looser if you're small. Not in EU, not a lawyer, so i could be wrong.
  • 0xcde4c3db 5y ago
    Plenty of American companies, including small businesses, have already overhauled their systems and business processes to comply with GDPR. It's not the Ghost of Tech Future that some politicians apparently think it is.
• DannyB2 5y ago
  Principle #1: The internet does not stop at state lines Hey, it doesn't stop at national borders either.
  • throwawayay02 5y ago
    Their jurisdiction does, though.
  • nostrademons 5y ago
    Reminds me of https://xkcd.com/927/ https://xkcd.com/927/
• outside1234 5y ago
  This is not a strategy to introduce a national privacy standard. This is a strategy to introduce a national standard of no privacy. "Principle #1: The internet does not stop at state lines, so why should one state set the standard for the rest of the country?" then later "Principle #4: We must also protect small businesses and innovation. We know that in Europe, investments in startups are down more than 40% since their data protection and privacy law—the General Data Protection Regulation—went into effect. We must guard against a similar situation here. We want small businesses hiring coders and engineers, not lawyers."
  • deleted 5y ago
    [deleted]
  • deleted 5y ago
    [deleted]
  • babyshake 5y ago
    As suspicious as I am of their intentions, I also would like a world where small businesses do not need to hire lawyers. As in, I think privacy regulations and other regulations are best if the amount of work requires is proportional to your market capitalization. Of course, with lobbying things end up going in the exact opposite direction usually.
    • outside1234 5y ago
      You don't need to hire a lawyer to understand GDPR. That is just something they tacked on the end there to add a boogeyman to their argument that everyone hates.
    • lostcolony 5y ago
      I would like a world where no one needed to hire lawyers. The law should be understandable to the average citizen sufficiently that they can ensure they are adhering to it. This is not that world.
      • meragrin_ 5y ago
• rhcom2 5y ago
  > Privacy does not end at state lines and Americans deserve better than a patchwork of different and conflicting state laws. Couldn't you replace "privacy" here with guns or healthcare or nearly any other national issue. edit: >SEC. 111. ANTI-DISCRIMINATION. (a) PROHIBITED CONDUCT.— A covered entity may not, through the collection use or sharing of personal information, discriminate against or make an economic opportunity unavailable on the basis of race, color, religion, national origin, sex, age, political ideology, or disability of a persons or class of persons. Notice they added something to the normal "protected classes" in the US.
  • rglover 5y ago
    Which is a good addition.
    • outside1234 5y ago
      The next step though is to say that Trump is being "persecuted" because he incited an attempted coup, which will be called "political expression"
    • vineyardmike 5y ago
      Why. The existing ones were un-changable aspects about you that you can't control, and are born into. You can change the addition with the wind, and its a thing you grow into and learn and mold. How do you even define something as political? Eg. Saying X group of people should stop being killed by police is, to some, a validation of humanity, but to others a political issue to be argued at the ballot box? What about marriage, which is based in laws, but some say should be a religious issue? Is that protected? What about hate speech? Thats very much bad, until someone claims they're just politically conservative, so now its protected?
      • jackorange 5y ago
        >The existing ones were un-changable aspects about you that you can't control, and are born into. That's not how westerners feel about gender any more.
• encryptluks2 5y ago
  > We must also protect small businesses and innovation. We know that in Europe, investments in startups are down more than 40% since their data protection and privacy law—the General Data Protection Regulation—went into effect. We must guard against a similar situation here. We want small businesses hiring coders and engineers, not lawyers. I was about to say something along the lines of, since it was introduced by Republicans you know that this will get ignored. However, after reviewing what they are actually proposing, I hypothesize that this isn't actually designed to increase privacy. I believe this is more about them making it easier to collect data and giving businesses more means to do so at your expense. If they wanted to increase privacy they'd mirror at least somewhat the CCPA, which already addresses many of these issues. The CCPA is not perfect and there are far too many exceptions IMO, but at least it was effective and California residents can easily request that their accounts and information be deleted. If anything they should be looking at the CCPA and GDPR as a starting point for how to address privacy, not ignore and gaslight you into thinking they are somehow bad. I hope that a tech blog and EFF do a write up on this and create an entire campaign against what the Republicans are proposing here so that people don't get duped by this con.
• advisedwang 5y ago
  The content of the standard matters immensely, as this almost certainly will preempt state standards. If they make a weak law, this is essentially reversing CCPA and its copycats. This would have the effect of stripping privacy protection. If they make a strong law, this is essentially extending CCPA etc to the whole country and making it standardized. This would be a huge win for consumer privacy. I haven't read the draft bill, but the "Principle 4" makes me think they plan on making some huge exceptions in the protections.
• runako 5y ago
  From the draft bill: "SEC. 111. ANTI-DISCRIMINATION. (a) PROHIBITED CONDUCT.— A covered entity may not, through the collection use or sharing of personal information, discriminate against or make an economic opportunity unavailable on the basis of race, color, religion, national origin, sex, age, political ideology, or disability of a persons or class of persons. (b) EXCEPTIONS.—Nothing in this section shall prohibit a covered entity from using or sharing personal information for the purpose of advertising, marketing, or soliciting economic opportunities to underrepresented populations." The juxtaposition here makes it appear that every person could be considered a member of an underrepresented group and therefore that nothing will prohibit data sharing for marketing purposes. This bill looks like it is written with the goal of killing consumer privacy protections in the country. Edit: Yes, I know draft bills change before they are passed. But draft bills often are the best expression of the drafters' priorities and intent. Also: why are Republicans proposing big new regulation that would apply to every US business, impose additional bookkeeping & accounting work for every business, and then not improve consumer privacy protection? This is a tax on every US business, and it appears there is no meaningful payoff for consumers. Sounds like a lose-lose.
  • vineyardmike 5y ago
    > why are Republicans proposing big new regulation that would apply to every US business, impose additional bookkeeping & accounting work for every business, and then not improve consumer privacy protection? The answer is obvious with their historic agenda... > discriminate against or make an economic opportunity unavailable on the basis of race, color, religion, national origin, sex, age, political ideology, or disability of a persons or class of persons. They want, ironically, the anti-discrimination clauses. They want to prevent someone from discriminating in tech. That would (they hope) block the perceived anti-right bias, and maybe even prevent companies from blocking people like trump all together.
    • jude- 5y ago
      "Political ideology" really is the trojan horse here. Political ideology is not a protected class, whereas the others are. This bill is really about banning content moderation. Everything else is window dressing.
• tboyd47 5y ago
  Some interesting points I gleamed from skimming the draft: 1. The way “small-to-medium” and “large” businesses or “entities” are defined. The bill separates entities into 2 classes based on any of 3 factors: annual revenue, number of users, and percentage of revenue from the sale of consumer information. So even if you’re a one-person startup with 20 users, if you make the larger part of your revenue from consumer data, you are considered a large entity. The extra compliance requirements for large entities seem quite onerous. 2. Two levels of personal information. This might be pre-existing in U.S. code (I don’t know) but the bill defines a separate category of “sensitive information,” that is quite broad, including data on your health, geolocation, biometric markers, finances, children, private communications, and government IDs. All other data that is not encrypted or de-identified is “personal information.” 3. Most of the rights and procedures defined in the bill apply only to personal information, and there are many exceptions, such as “performing a task carried out in the public interest.” So you have no right to privacy if the entity believes sharing your data will be in the public interest? 4. No rights or restrictions apply to the collection and usage of “sensitive information” except that “express prior consent” and “separate consent” are given before collection, use, and sharing of it. I would have expected there to be more rules and restrictions around the sensitive data, not less. It seems to me that very little of what today’s companies collect would be considered “personal information” according to this bill. Most of it would either be disqualified by encryption or de-identification, or fall under sensitive information.
• downWidOutaFite 5y ago
  Why is this interesting? It is not news. The Republicans aren't in power so this won't pass. This is just signaling and PR.
  • kasey_junk 5y ago
    Because it shows intent? The House Republicans want to establish a federal regime that allows punishment for data use but does not include privacy from data collection for commercial purposes? That’s a stance lots of people on various parts of the political spectrum would be interested in.
    • andrew_ 5y ago
      Indeed. The future of 2022 is not written. It's good to know what may be coming.