4 ms·

What's needed is a ban on usage of location and health data unless very specific conditions are met, targeting the purchasers of data not only the middlemen and

What's needed is a ban on usage of location and health data unless very specific conditions are met, targeting the purchasers of data not only the middlemen and ensuring that it's illegal to use personal data which "fell off of a truck". Data brokers can go underground to circumvent a ban on sales, but the end users funding that industry are legitimate businesses who (hopefully) would have to follow the laws, so it's important to target them.

duxup 4y ago
Interesting idea. I kinda would go with both. I'd rather see the sales banned to some extent as well even if it was underground anyway.
tmp_anon_22 4y ago
Isn't that a war on billionaires using drugs? Where "information usage being criminalized" is "drug consumption being criminalized" and the "billionaire doing drugs" is the "multi-billion dollar corporation using the data"?
- robonerd 4y ago
  "War on drugs" and alcohol prohibition are frequently used by libertarians to suggest that all forms of prohibition are doomed to cause more damage than that which they prohibit. But this is a sleight of hand, drawing attention to two specific prohibitions which generally failed, away from the myraid of prohibitions that work just fine. Such as the prohibition against selling cars without airbags, or the regulation of CFCs, or asbestos in new construction, or selling live frag grenades to the unlicensed public, or a thousand other things governments around the world successfully regulate and prohibit every day.
- mindslight 4y ago
  A corporation (or LLC) is not equivalent to a singular person or a small informal group, but rather a bureaucracy that operates according to openly promulgated rules and goals. Operating outside of those rules exposes one to individual liability, regardless of specific individuals often being judgement proof or otherwise impractical to assign blame to. One of the practical problems with the "war on drugs" was its bumping up against individual privacy. Corporations have no such privacy nor right to privacy - being chartered under government authority means they need to continually file compliance reports and are essentially closer to being organs of the state rather than individual humans. So no, if a company does decide to illicitly process personal information for nonconsensual purposes, that most certainly can be enforced upon.
robonerd 4y ago
> What's needed is a ban on usage of location and health data unless very specific conditions are met We need a ban on collection of that data, not just the sale or use of it. The conditions under which it is legal to collect that data should be subject to very strict regulation and involve explicit informed consent of every person tracked, ideally refreshing that consent on a regular basis so that it's not something you could consent to once years ago and forget about.
- datalopers 4y ago
  Not just collection. You want to know how health data is sold? Because the SaaS platforms that small doctor's offices and clinics use to run their practice, they turn around and sell "anonymized" visit and prescription data. But those platforms clearly have legitimate need to collect/house that data. They need to be restricted from selling/licensing it to third parties, regardless of any amount of anonymization or differential privacy applied.
  - robonerd 4y ago
    Health data is only part of it, and there needs to be more regulations about what and when it can be collected, stored, digitized, transmitted, sold, etc. Every aspect of this needs more regulation and much of it needs to be prohibited entirely. Regulating just sale/licensing of the data is not enough, but is obviously a necessary part of it. We need to also regulate the conditions under which this data is collected and stored as well. Informed patient consent is needed before digitizing any patient data, let alone before a doctor entrusts that data to some SaaS provider. Patients need to know which SaaS provider is storing their data on their servers, and have the opportunity and right to veto it without abstaining from medical treatment. Furthermore if the patient does opt into the third-party recordkeeping, they each need to be contacted and asked for consent if that company is ever sold or otherwise acquired, and given the opportunity to have their data deleted instead of transferred to the new owner of the company. Just because I consent to Small SaaS Provider A having my records 5 years ago doesn't mean I consent to Conglomerate B buying out A today and getting all my data in the process. Consent should be confirmed at every single time a new company wants to possess it, let alone transfer it or sell it. For instance, suppose I consent for Fitbit to track me five years ago. Then Fitbit gets bought by Google. It should be illegal for Fitbit to transfer that data to Google without my consent, and illegal for Google to receive that data without my consent. It shouldn't even be legal for Fitbit 5 years ago to secretly store that data on rented Google or AWS servers without telling me which company they are subcontracting my data out to. tl;dr: Possessing any data about people should be considered a toxic liability and a huge regulatory pain in the ass. User data should not be considered a valuable asset, but rather an evil that you loath to touch at all unless there's no other way.
Helmut10001 4y ago
I agree to all of that. That said, data also has a positive value, for society and democracy. Our societies need data to find fair, just and equal solutions, e.g. to resource distribution. This is not possible without data, and location data is the most important of all.
hinkley 4y ago
M&A teams can “innovate” new systems where companies merge and spin off subsidiaries all of the time to amass large volumes of historical data that is of course shared equally with the divested interests. I think we are mistaking how important recency is. Sure the current data on me has value, but there is also value in figuring out what my current behavior has meant in the past with other people, and trying to figure out what I might do next even if you haven’t tracked me specifically within an inch of my life, right now. Knowing what I did five years ago and what people in my social groups do might be valuable enough even though you’re “protecting me” going forward. As you say, we might have to make this data a hot potato. Create situations where hoarding is a liability rather than an underutilized asset.

duxup 4y ago

Interesting idea. I kinda would go with both. I'd rather see the sales banned to some extent as well even if it was underground anyway.

tmp_anon_22 4y ago

Isn't that a war on billionaires using drugs? Where "information usage being criminalized" is "drug consumption being criminalized" and the "billionaire doing drugs" is the "multi-billion dollar corporation using the data"?

robonerd 4y ago
"War on drugs" and alcohol prohibition are frequently used by libertarians to suggest that all forms of prohibition are doomed to cause more damage than that which they prohibit. But this is a sleight of hand, drawing attention to two specific prohibitions which generally failed, away from the myraid of prohibitions that work just fine. Such as the prohibition against selling cars without airbags, or the regulation of CFCs, or asbestos in new construction, or selling live frag grenades to the unlicensed public, or a thousand other things governments around the world successfully regulate and prohibit every day.
mindslight 4y ago
A corporation (or LLC) is not equivalent to a singular person or a small informal group, but rather a bureaucracy that operates according to openly promulgated rules and goals. Operating outside of those rules exposes one to individual liability, regardless of specific individuals often being judgement proof or otherwise impractical to assign blame to. One of the practical problems with the "war on drugs" was its bumping up against individual privacy. Corporations have no such privacy nor right to privacy - being chartered under government authority means they need to continually file compliance reports and are essentially closer to being organs of the state rather than individual humans. So no, if a company does decide to illicitly process personal information for nonconsensual purposes, that most certainly can be enforced upon.

robonerd 4y ago

> What's needed is a ban on usage of location and health data unless very specific conditions are met We need a ban on collection of that data, not just the sale or use of it. The conditions under which it is legal to collect that data should be subject to very strict regulation and involve explicit informed consent of every person tracked, ideally refreshing that consent on a regular basis so that it's not something you could consent to once years ago and forget about.

datalopers 4y ago
Not just collection. You want to know how health data is sold? Because the SaaS platforms that small doctor's offices and clinics use to run their practice, they turn around and sell "anonymized" visit and prescription data. But those platforms clearly have legitimate need to collect/house that data. They need to be restricted from selling/licensing it to third parties, regardless of any amount of anonymization or differential privacy applied.
- robonerd 4y ago
  Health data is only part of it, and there needs to be more regulations about what and when it can be collected, stored, digitized, transmitted, sold, etc. Every aspect of this needs more regulation and much of it needs to be prohibited entirely. Regulating just sale/licensing of the data is not enough, but is obviously a necessary part of it. We need to also regulate the conditions under which this data is collected and stored as well. Informed patient consent is needed before digitizing any patient data, let alone before a doctor entrusts that data to some SaaS provider. Patients need to know which SaaS provider is storing their data on their servers, and have the opportunity and right to veto it without abstaining from medical treatment. Furthermore if the patient does opt into the third-party recordkeeping, they each need to be contacted and asked for consent if that company is ever sold or otherwise acquired, and given the opportunity to have their data deleted instead of transferred to the new owner of the company. Just because I consent to Small SaaS Provider A having my records 5 years ago doesn't mean I consent to Conglomerate B buying out A today and getting all my data in the process. Consent should be confirmed at every single time a new company wants to possess it, let alone transfer it or sell it. For instance, suppose I consent for Fitbit to track me five years ago. Then Fitbit gets bought by Google. It should be illegal for Fitbit to transfer that data to Google without my consent, and illegal for Google to receive that data without my consent. It shouldn't even be legal for Fitbit 5 years ago to secretly store that data on rented Google or AWS servers without telling me which company they are subcontracting my data out to. tl;dr: Possessing any data about people should be considered a toxic liability and a huge regulatory pain in the ass. User data should not be considered a valuable asset, but rather an evil that you loath to touch at all unless there's no other way.

Helmut10001 4y ago

I agree to all of that. That said, data also has a positive value, for society and democracy. Our societies need data to find fair, just and equal solutions, e.g. to resource distribution. This is not possible without data, and location data is the most important of all.

hinkley 4y ago

M&A teams can “innovate” new systems where companies merge and spin off subsidiaries all of the time to amass large volumes of historical data that is of course shared equally with the divested interests. I think we are mistaking how important recency is. Sure the current data on me has value, but there is also value in figuring out what my current behavior has meant in the past with other people, and trying to figure out what I might do next even if you haven’t tracked me specifically within an inch of my life, right now. Knowing what I did five years ago and what people in my social groups do might be valuable enough even though you’re “protecting me” going forward. As you say, we might have to make this data a hot potato. Create situations where hoarding is a liability rather than an underutilized asset.