7 ms·

> What's needed is a ban on usage of location and health data unless very specific conditions are met We need a ban on collection of that data, not just the sa

> What's needed is a ban on usage of location and health data unless very specific conditions are met We need a ban on collection of that data, not just the sale or use of it. The conditions under which it is legal to collect that data should be subject to very strict regulation and involve explicit informed consent of every person tracked, ideally refreshing that consent on a regular basis so that it's not something you could consent to once years ago and forget about.

datalopers 4y ago
Not just collection. You want to know how health data is sold? Because the SaaS platforms that small doctor's offices and clinics use to run their practice, they turn around and sell "anonymized" visit and prescription data. But those platforms clearly have legitimate need to collect/house that data. They need to be restricted from selling/licensing it to third parties, regardless of any amount of anonymization or differential privacy applied.
- robonerd 4y ago
  Health data is only part of it, and there needs to be more regulations about what and when it can be collected, stored, digitized, transmitted, sold, etc. Every aspect of this needs more regulation and much of it needs to be prohibited entirely. Regulating just sale/licensing of the data is not enough, but is obviously a necessary part of it. We need to also regulate the conditions under which this data is collected and stored as well. Informed patient consent is needed before digitizing any patient data, let alone before a doctor entrusts that data to some SaaS provider. Patients need to know which SaaS provider is storing their data on their servers, and have the opportunity and right to veto it without abstaining from medical treatment. Furthermore if the patient does opt into the third-party recordkeeping, they each need to be contacted and asked for consent if that company is ever sold or otherwise acquired, and given the opportunity to have their data deleted instead of transferred to the new owner of the company. Just because I consent to Small SaaS Provider A having my records 5 years ago doesn't mean I consent to Conglomerate B buying out A today and getting all my data in the process. Consent should be confirmed at every single time a new company wants to possess it, let alone transfer it or sell it. For instance, suppose I consent for Fitbit to track me five years ago. Then Fitbit gets bought by Google. It should be illegal for Fitbit to transfer that data to Google without my consent, and illegal for Google to receive that data without my consent. It shouldn't even be legal for Fitbit 5 years ago to secretly store that data on rented Google or AWS servers without telling me which company they are subcontracting my data out to. tl;dr: Possessing any data about people should be considered a toxic liability and a huge regulatory pain in the ass. User data should not be considered a valuable asset, but rather an evil that you loath to touch at all unless there's no other way.
  - heretogetout 4y ago
    Do you suppose the same thing would have to apply if Fitbit bought a company? Should they be able to share data "downstream"? What if they ditch the purchased brand and absorb the company's employees into Fitbit Prime -- do they have access? I think it can get tricky. I'd rather just not allow them to track me in the first place, I guess.
- bluGill 4y ago
  I want anonymized data to be used for research purposes. I want it possible to unblind the data when a research seems to show something and they need more information. However the purposes the data can be used for needs to be strictly controlled, and when it is unblinded even more strictly.
onlyrealcuzzo 4y ago
> We need a ban on collection of that data. So, how am I supposed to use Google Maps? Maybe you mean long-term storage? Still - I like to be able to see all the restaurants and places I went to. What if I like that?
- l33t2328 4y ago
  HN is generally very hostile to the idea that many people want their data collected, or at least don’t care much at all.
  - robonerd 4y ago
    The surveillance industry is very hostile to the idea of letting the public know what's going on and giving them a choice. If people consent to it after being informed, then fine. But they need to be told and asked.
    - onlyrealcuzzo 4y ago
      Like how everyone just clicks on "I AGREE" to the EU cookie popup without reading anything? Most people don't even read their mortgage contract carefully. People aren't ever going to read a EULA to read a recipe for chicken soup.
      - TheCoelacanth 4y ago
        People click "I agree" when the "I disagree" button is non-existent or buried where they can't find it. The people making those popups wouldn't be going to such great lengths to make it hard to opt-out if people didn't want to opt-out.
      - robonerd 4y ago
        The only places I ever read people complain about cookie consent dialogs is on forums with lots of people in the web/surveillance industry. I don't take this complaint seriously. Anyway, the forms should all be standardized government forms, not bespoke anti-pattern devices cooked up by web designers in a competition of malicious compliance.
mikece 4y ago
Any easy solution here would be to classify the collection of personal data as stalking and then treated accordingly under existing law.
rmbyrro 4y ago
There's no chance such a ban proposal survives in Congress as Google, Apple, Facebook and hundreds others would battle to death against it...
Melatonic 4y ago
I think we need a ban on all three and heavy penalties for those caught doing it. Not just a fine that could be potentially a cost of doing business.
jasonlotito 4y ago
> We need a ban on collection of that data If you send me data, why shouldn't I be able to collect it?
- blooalien 4y ago
  And if you sneak around and collect data behind my back without telling me, how is that not "stalking"?

datalopers 4y ago

Not just collection. You want to know how health data is sold? Because the SaaS platforms that small doctor's offices and clinics use to run their practice, they turn around and sell "anonymized" visit and prescription data. But those platforms clearly have legitimate need to collect/house that data. They need to be restricted from selling/licensing it to third parties, regardless of any amount of anonymization or differential privacy applied.

robonerd 4y ago
Health data is only part of it, and there needs to be more regulations about what and when it can be collected, stored, digitized, transmitted, sold, etc. Every aspect of this needs more regulation and much of it needs to be prohibited entirely. Regulating just sale/licensing of the data is not enough, but is obviously a necessary part of it. We need to also regulate the conditions under which this data is collected and stored as well. Informed patient consent is needed before digitizing any patient data, let alone before a doctor entrusts that data to some SaaS provider. Patients need to know which SaaS provider is storing their data on their servers, and have the opportunity and right to veto it without abstaining from medical treatment. Furthermore if the patient does opt into the third-party recordkeeping, they each need to be contacted and asked for consent if that company is ever sold or otherwise acquired, and given the opportunity to have their data deleted instead of transferred to the new owner of the company. Just because I consent to Small SaaS Provider A having my records 5 years ago doesn't mean I consent to Conglomerate B buying out A today and getting all my data in the process. Consent should be confirmed at every single time a new company wants to possess it, let alone transfer it or sell it. For instance, suppose I consent for Fitbit to track me five years ago. Then Fitbit gets bought by Google. It should be illegal for Fitbit to transfer that data to Google without my consent, and illegal for Google to receive that data without my consent. It shouldn't even be legal for Fitbit 5 years ago to secretly store that data on rented Google or AWS servers without telling me which company they are subcontracting my data out to. tl;dr: Possessing any data about people should be considered a toxic liability and a huge regulatory pain in the ass. User data should not be considered a valuable asset, but rather an evil that you loath to touch at all unless there's no other way.
- heretogetout 4y ago
  Do you suppose the same thing would have to apply if Fitbit bought a company? Should they be able to share data "downstream"? What if they ditch the purchased brand and absorb the company's employees into Fitbit Prime -- do they have access? I think it can get tricky. I'd rather just not allow them to track me in the first place, I guess.
bluGill 4y ago
I want anonymized data to be used for research purposes. I want it possible to unblind the data when a research seems to show something and they need more information. However the purposes the data can be used for needs to be strictly controlled, and when it is unblinded even more strictly.

onlyrealcuzzo 4y ago

> We need a ban on collection of that data. So, how am I supposed to use Google Maps? Maybe you mean long-term storage? Still - I like to be able to see all the restaurants and places I went to. What if I like that?

l33t2328 4y ago
HN is generally very hostile to the idea that many people want their data collected, or at least don’t care much at all.
- robonerd 4y ago
  The surveillance industry is very hostile to the idea of letting the public know what's going on and giving them a choice. If people consent to it after being informed, then fine. But they need to be told and asked.
  - onlyrealcuzzo 4y ago
    Like how everyone just clicks on "I AGREE" to the EU cookie popup without reading anything? Most people don't even read their mortgage contract carefully. People aren't ever going to read a EULA to read a recipe for chicken soup.
    - TheCoelacanth 4y ago
      People click "I agree" when the "I disagree" button is non-existent or buried where they can't find it. The people making those popups wouldn't be going to such great lengths to make it hard to opt-out if people didn't want to opt-out.
    - robonerd 4y ago
      The only places I ever read people complain about cookie consent dialogs is on forums with lots of people in the web/surveillance industry. I don't take this complaint seriously. Anyway, the forms should all be standardized government forms, not bespoke anti-pattern devices cooked up by web designers in a competition of malicious compliance.

mikece 4y ago

Any easy solution here would be to classify the collection of personal data as stalking and then treated accordingly under existing law.

rmbyrro 4y ago

There's no chance such a ban proposal survives in Congress as Google, Apple, Facebook and hundreds others would battle to death against it...

Melatonic 4y ago

I think we need a ban on all three and heavy penalties for those caught doing it. Not just a fine that could be potentially a cost of doing business.

jasonlotito 4y ago

> We need a ban on collection of that data If you send me data, why shouldn't I be able to collect it?

blooalien 4y ago
And if you sneak around and collect data behind my back without telling me, how is that not "stalking"?