4 ms·

> The views expressed in these remarks are my own and do not necessarily reflect the views of the Federal Trade Commission or any other commissioner. Is that

> The views expressed in these remarks are my own and do not necessarily reflect the views of the Federal Trade Commission or any other commissioner. Is that even a valid disclaimer when it's published directly on the ftc.gov ? > In I would like to challenge: that we can solve for data abuses by providing consumers with more transparency and control—in other words, more notice and choice. This is a bit of a non-argument. Look at the EU, GDPR etc they work. So much so that some US websites will not serve the EU as they're not in line. A clear indication that companies are influence. Also I don't think she understands the notion of how privacy is supposed to work.

the_other 4y ago
Further to that, most companies are refusing to comply with the spirit of GDPR and pushing the burden of transparency onto the user with those dreadful cookie UX journeys. The intent is clear: to promote negative opinion of what is actually pretty good, customer-centric legislation.
Terry_Roll 4y ago
> Look at the EU, GDPR etc they work. They are made to look like they work, in practice, its unenforceable, and backups including software still dont have any easy way to delete an individuals records, mostly because its a database that is backed up and you'd have to restore the database in order to clear the individuals data. Secondly, nobody has to wipe data if its being used for law enforcement or scientific purposes. Those are two loaded parameters, but look at what wiki says because its hard to get access to case law and the legislation search facilities in various countries is absolutely despicable; https://en.wikipedia.org/wiki/Law_enforcement https://en.wikipedia.org/wiki/Law_enforcement "Law enforcement is the activity of some members of government who act in an organized manner to enforce the law by discovering, deterring, rehabilitating, or punishing people who violate the rules and norms governing that society." Discovering means hacking people's computer systems as Edward Snowden highlighted, so the security services will take everything they can find and when they dont have the tools, they have the search engines to fall back on via court orders if need be! Other point is anyone who is not the police can make records and say they are for law enforcement purposes as well! Neighbourhood watch is a voluntary law enforcement scheme engaged by the public. Its even listed on wiki in the UK Law enforcement index https://en.wikipedia.org/wiki/Category:Law_enforcement_in_the_United_Kingdom https://en.wikipedia.org/wiki/Category:Law_enforcement_in_th... The other parameter is scientific purposes, again what exactly is scientific purposes? Is it training an AI, would all the tech companies like facebook, MS, Apple & Google et al be justified in retaining all and any data they can get their hands on in order to further develop AGI? They would be, but recently the UK data commissioner seemed to ignore the law and fined US based Clearview AI a facial recognition company £7.5 million for collecting 20billion images of people. https://www.dailymail.co.uk/news/article-10845123/Orwellian-facial-recognition-company-used-UK-police-forces-fined-7-5M.html https://www.dailymail.co.uk/news/article-10845123/Orwellian-... Now the fact that UK Police authorities are reportedly using their services, would suggest the Police are happy with what Clearview AI have done, no criminality whatsoever, but the data commissioner thinks otherwise. The other misdirection is the fine is not that much money. Whilst it will effect a behaviour change in Clearview AI, that behaviour change may well include putting up the prices because the data commissioner gave them a free advert which police and law enforcement agencies elsewhere in the world will sit up and notice. As they are also US based, any UK enforcement notices are just hot air. This imo is nothing more than an advert and a way to make Clearview AI charge more. This is on a par with the US Coastguard and Canada and the Northwest Passage. https://en.wikipedia.org/wiki/1985_Polar_Sea_controversy#Voyage https://en.wikipedia.org/wiki/1985_Polar_Sea_controversy#Voy... Some of the Northwest Passage is classed as international waters, the US coastguard using it instead of Panama (usage fees) gave Canada the reason to take the US to some international court and whilst getting a fine levied on the US coastguard also happened to get the Northwest Passage recognised as Canadian waters so that Canada could start charging fees for ships using it! It also advertised the waterways as open for business because of the lack of arctic ice, ironically Russia also helped Canada out here as well by recognising the Canadian waters so there is now an alternative to using the Panama canal for some journeys. If you are a soccer player, this is kicking the ball out of play for the other team.
- mhh__ 4y ago
  GDPR hasn't magically fixed everything but people are actually thinking about privacy now which is the first step to achieving anything at all no matter the exact route. Scrupulous companies really do think about compliance (they usually miss something because they're not tech people so they forget about backups as you mention)
  - Terry_Roll 4y ago
    The financial sector has the largest amount of compliance to contend with, but even with all that compliance history shows there are always loopholes and interpretations which need to be tested in court. What is also common, is big business doesnt advertise the testing of boundaries, they just go ahead and do it. Just look at the K2 tax avoidance scheme https://en.wikipedia.org/wiki/K2_(tax_scheme) https://en.wikipedia.org/wiki/K2_(tax_scheme) Or look at the big tech companies running their affairs through offshore tax havens. I think you would have to be naive to think that scrupulous companies exist, their primary objective is existence and profit making which can involve some risk taking.
nonrandomstring 4y ago
Regardless her views representing the official FTC position I thought this challenge to dogmas of surveillance capitalism by Rebecca Kelly Slaughter was on the money, and it evidences widespread sentiment in the US population that supports her ideas. The first section on "Not just privacy" echos my own thoughts. Privacy is a too broad and ill-defined term. Labelling some things as "privacy issues" reduces them to relative personal morals and sweeps other harms under the rug. She properly terms these broader effects - that touch on civil liberties, freedom of movement, harms to competition, misinformation and exploitation - as "data abuses", the same language I've used in Digital Vegan and in Ethics for Hackers. So I am really happy to see this gaining usage. Overall though I still think a useful term is "Digital Dignity" because many of the harms done are hard to formulate yet seem natural affronts to personal dignity. Later she touches on the body dysphoria, suicides and other mental health issues plaguing teenage girls as a result of digital exploitation, but does not fully link them to the business models of Facebook etc. In the second section "Notice and Choice Is Not the Answer" Commissioner Slaughter nicely sums up why simply telling someone that you are going to harm them, when they have no effective choice or capacity to extricate, merely adds insult to injury. It is certainly no excuse or useful legal mechanism. I have long maintained that "meaningful choice" is absent since most ordinary people, even the most intelligent and well educated amongst us, effectively lack the capacity to consent over complex technical issues. Onerous contracts leveraging general ignorance abound in the digital world. In a way, section three is really her conclusion, albeit an obvious one, that "Minimization is a Better Model", but possibly because the scope of the FTC is limited fails to identify the broader problems of how abusive technologies are foisted onto people via other agencies, such as schools, governments and medical services. A more mature analysis would not blame only commercial data collection, but the overall societal normalisation of risky behaviours, and poor data hygiene. That said, I feel she gets the deeper point in saying: "It should not be necessary to trade one’s data away as the cost of full participation in society and the modern information economy." There is much more to this position statement that asserts "The FTC Can Lead the Way Forward on Data Minimalism", but whether that is possible or whether technical counter-surveillance and other kinds of Digital Self-Defence will be needed to beat back surveillance capitalism remains to be seen. In a sense the problem is that FTC and similar organisations may see themselves as omnipotent, or over-rate the effects of regulation. Therefore what I think is missing is a clear statement from bodies like the FTC that, where they exercise equity of power they will no longer impede citizens digital self defence measures, including reverse engineering, cracking and hacking DRM and keys, or any kind of hacking so long as it is clearly in the pursuit of protecting ones data, privacy and digital dignity. That would mean dissolving things like the DCMA of course. It maybe that USA, being a country that upholds a strong tradition of allowing people to defend themselves and their property, might lead the way on this, in different a way from Europe.
weberer 4y ago
Imagine you're out in town and your decide to go home, so you start walking to your car. Suddenly a guy comes up and blocks your path while rambling about how he cares about your privacy. He says he won't let you through until you tell him to go away or ask to learn more. By telling him to go away, you just consented to him putting a GPS tracker on your car and looking through your windows at night. Anyway, GDPR in its current state is broken and needs to be updated.
- anonymous_sorry 4y ago
  I suspect those pop-ups aren't really compliant. Bur it will probably take years for a test case. "Go away/confirm my choices" should mean "I don't consent".
  - SiempreViernes 4y ago
    Yeah, telling that guy to go away is obviously not giving consent to be tracked. The problem is mostly impatience with how slow the data protection agencies are with putting a stop to these violating popups, especially the Irish DPA that has jurisdiction on the big FANG. This slowness isn't too surprising given that the industry developed to where it is under the eye of the DPAs in the first place, so they aren't exactly packed with folk that have shown initiative...
- rcMgD2BwE72F 4y ago
  >By telling him to go away, you just consented to him putting a GPS tracker on your car and looking through your windows at night. That is 100% against GDPR. The button to oppose data processing should be as big and accessible as the one to accept it. Closing the prompt does not equate to giving consent. I'm sure all drivers did not stop at stop signs immediately when they were introduced. And I still see people not stopping at these signs. I still believe they're good regulation and the more people know it makes roads safer, the more they respect the signs. Same with seat belt.
overgard 4y ago
GDPR might be busted, but there's no technical reason we can't prevent companies from spying on us for their own profit.

the_other 4y ago

Further to that, most companies are refusing to comply with the spirit of GDPR and pushing the burden of transparency onto the user with those dreadful cookie UX journeys. The intent is clear: to promote negative opinion of what is actually pretty good, customer-centric legislation.

Terry_Roll 4y ago

> Look at the EU, GDPR etc they work. They are made to look like they work, in practice, its unenforceable, and backups including software still dont have any easy way to delete an individuals records, mostly because its a database that is backed up and you'd have to restore the database in order to clear the individuals data. Secondly, nobody has to wipe data if its being used for law enforcement or scientific purposes. Those are two loaded parameters, but look at what wiki says because its hard to get access to case law and the legislation search facilities in various countries is absolutely despicable; https://en.wikipedia.org/wiki/Law_enforcement https://en.wikipedia.org/wiki/Law_enforcement "Law enforcement is the activity of some members of government who act in an organized manner to enforce the law by discovering, deterring, rehabilitating, or punishing people who violate the rules and norms governing that society." Discovering means hacking people's computer systems as Edward Snowden highlighted, so the security services will take everything they can find and when they dont have the tools, they have the search engines to fall back on via court orders if need be! Other point is anyone who is not the police can make records and say they are for law enforcement purposes as well! Neighbourhood watch is a voluntary law enforcement scheme engaged by the public. Its even listed on wiki in the UK Law enforcement index https://en.wikipedia.org/wiki/Category:Law_enforcement_in_the_United_Kingdom https://en.wikipedia.org/wiki/Category:Law_enforcement_in_th... The other parameter is scientific purposes, again what exactly is scientific purposes? Is it training an AI, would all the tech companies like facebook, MS, Apple & Google et al be justified in retaining all and any data they can get their hands on in order to further develop AGI? They would be, but recently the UK data commissioner seemed to ignore the law and fined US based Clearview AI a facial recognition company £7.5 million for collecting 20billion images of people. https://www.dailymail.co.uk/news/article-10845123/Orwellian-facial-recognition-company-used-UK-police-forces-fined-7-5M.html https://www.dailymail.co.uk/news/article-10845123/Orwellian-... Now the fact that UK Police authorities are reportedly using their services, would suggest the Police are happy with what Clearview AI have done, no criminality whatsoever, but the data commissioner thinks otherwise. The other misdirection is the fine is not that much money. Whilst it will effect a behaviour change in Clearview AI, that behaviour change may well include putting up the prices because the data commissioner gave them a free advert which police and law enforcement agencies elsewhere in the world will sit up and notice. As they are also US based, any UK enforcement notices are just hot air. This imo is nothing more than an advert and a way to make Clearview AI charge more. This is on a par with the US Coastguard and Canada and the Northwest Passage. https://en.wikipedia.org/wiki/1985_Polar_Sea_controversy#Voyage https://en.wikipedia.org/wiki/1985_Polar_Sea_controversy#Voy... Some of the Northwest Passage is classed as international waters, the US coastguard using it instead of Panama (usage fees) gave Canada the reason to take the US to some international court and whilst getting a fine levied on the US coastguard also happened to get the Northwest Passage recognised as Canadian waters so that Canada could start charging fees for ships using it! It also advertised the waterways as open for business because of the lack of arctic ice, ironically Russia also helped Canada out here as well by recognising the Canadian waters so there is now an alternative to using the Panama canal for some journeys. If you are a soccer player, this is kicking the ball out of play for the other team.

mhh__ 4y ago
GDPR hasn't magically fixed everything but people are actually thinking about privacy now which is the first step to achieving anything at all no matter the exact route. Scrupulous companies really do think about compliance (they usually miss something because they're not tech people so they forget about backups as you mention)
- Terry_Roll 4y ago
  The financial sector has the largest amount of compliance to contend with, but even with all that compliance history shows there are always loopholes and interpretations which need to be tested in court. What is also common, is big business doesnt advertise the testing of boundaries, they just go ahead and do it. Just look at the K2 tax avoidance scheme https://en.wikipedia.org/wiki/K2_(tax_scheme) https://en.wikipedia.org/wiki/K2_(tax_scheme) Or look at the big tech companies running their affairs through offshore tax havens. I think you would have to be naive to think that scrupulous companies exist, their primary objective is existence and profit making which can involve some risk taking.

nonrandomstring 4y ago

Regardless her views representing the official FTC position I thought this challenge to dogmas of surveillance capitalism by Rebecca Kelly Slaughter was on the money, and it evidences widespread sentiment in the US population that supports her ideas. The first section on "Not just privacy" echos my own thoughts. Privacy is a too broad and ill-defined term. Labelling some things as "privacy issues" reduces them to relative personal morals and sweeps other harms under the rug. She properly terms these broader effects - that touch on civil liberties, freedom of movement, harms to competition, misinformation and exploitation - as "data abuses", the same language I've used in Digital Vegan and in Ethics for Hackers. So I am really happy to see this gaining usage. Overall though I still think a useful term is "Digital Dignity" because many of the harms done are hard to formulate yet seem natural affronts to personal dignity. Later she touches on the body dysphoria, suicides and other mental health issues plaguing teenage girls as a result of digital exploitation, but does not fully link them to the business models of Facebook etc. In the second section "Notice and Choice Is Not the Answer" Commissioner Slaughter nicely sums up why simply telling someone that you are going to harm them, when they have no effective choice or capacity to extricate, merely adds insult to injury. It is certainly no excuse or useful legal mechanism. I have long maintained that "meaningful choice" is absent since most ordinary people, even the most intelligent and well educated amongst us, effectively lack the capacity to consent over complex technical issues. Onerous contracts leveraging general ignorance abound in the digital world. In a way, section three is really her conclusion, albeit an obvious one, that "Minimization is a Better Model", but possibly because the scope of the FTC is limited fails to identify the broader problems of how abusive technologies are foisted onto people via other agencies, such as schools, governments and medical services. A more mature analysis would not blame only commercial data collection, but the overall societal normalisation of risky behaviours, and poor data hygiene. That said, I feel she gets the deeper point in saying: "It should not be necessary to trade one’s data away as the cost of full participation in society and the modern information economy." There is much more to this position statement that asserts "The FTC Can Lead the Way Forward on Data Minimalism", but whether that is possible or whether technical counter-surveillance and other kinds of Digital Self-Defence will be needed to beat back surveillance capitalism remains to be seen. In a sense the problem is that FTC and similar organisations may see themselves as omnipotent, or over-rate the effects of regulation. Therefore what I think is missing is a clear statement from bodies like the FTC that, where they exercise equity of power they will no longer impede citizens digital self defence measures, including reverse engineering, cracking and hacking DRM and keys, or any kind of hacking so long as it is clearly in the pursuit of protecting ones data, privacy and digital dignity. That would mean dissolving things like the DCMA of course. It maybe that USA, being a country that upholds a strong tradition of allowing people to defend themselves and their property, might lead the way on this, in different a way from Europe.

weberer 4y ago

Imagine you're out in town and your decide to go home, so you start walking to your car. Suddenly a guy comes up and blocks your path while rambling about how he cares about your privacy. He says he won't let you through until you tell him to go away or ask to learn more. By telling him to go away, you just consented to him putting a GPS tracker on your car and looking through your windows at night. Anyway, GDPR in its current state is broken and needs to be updated.

anonymous_sorry 4y ago
I suspect those pop-ups aren't really compliant. Bur it will probably take years for a test case. "Go away/confirm my choices" should mean "I don't consent".
- SiempreViernes 4y ago
  Yeah, telling that guy to go away is obviously not giving consent to be tracked. The problem is mostly impatience with how slow the data protection agencies are with putting a stop to these violating popups, especially the Irish DPA that has jurisdiction on the big FANG. This slowness isn't too surprising given that the industry developed to where it is under the eye of the DPAs in the first place, so they aren't exactly packed with folk that have shown initiative...
rcMgD2BwE72F 4y ago
>By telling him to go away, you just consented to him putting a GPS tracker on your car and looking through your windows at night. That is 100% against GDPR. The button to oppose data processing should be as big and accessible as the one to accept it. Closing the prompt does not equate to giving consent. I'm sure all drivers did not stop at stop signs immediately when they were introduced. And I still see people not stopping at these signs. I still believe they're good regulation and the more people know it makes roads safer, the more they respect the signs. Same with seat belt.

overgard 4y ago

GDPR might be busted, but there's no technical reason we can't prevent companies from spying on us for their own profit.