5 ms·

It's really simple (not easy): pass a US equivalent of GDPR, and make sure biometrics count as "personal data" as they do in the EU. CCPA gets you a lot of the

It's really simple (not easy): pass a US equivalent of GDPR, and make sure biometrics count as "personal data" as they do in the EU. CCPA gets you a lot of the way there (indeed I suspect you can request to have Google delete all your biometric data under the "right to be forgotten" clause), but I think CCPA doesn't prevent collection/processing of data without an agreement in place as the GDPR does. (Basically, GDPR requires you to have an agreement in place before storing any of my Personal Data, since it's that agreement that then binds who you can share it with, and how. If I don't use Google, then Google can't process my biometric data. I wonder if they get around this by approximately everyone using Google in some capacity, and having a "I also agree that you can process my biometric data" term in the ToS?) Interested in any lawyers' opinions on the above; my read of e.g. https://www.bakerlaw.com/webfiles/Privacy/2018/Articles/CCPA-GDPR-Chart.pdf https://www.bakerlaw.com/webfiles/Privacy/2018/Articles/CCPA... is that Google cannot (i.e. would be forbidden to) do biometric recognition on people that have requested for their data to be deleted. Where I'd like to see CCPA go further is that it doesn't strongly restrict transfers of data; under GDPR you explicitly approve a set of Processors and Sub-Processors, and must be informed when that changes. CCPA does seem to restrict sales of data, but doesn't tightly control where it is shared without sale.

mindslight 4y ago
A direct analog of the GDPR is exactly what the US needs, especially with its framing of consent that doesn't allow the standard dance of nullification-via-nonconsentual-contract. I fear that all of these half-baked state privacy laws are going to force a move for overriding federal legislation, at which time the surveillance companies will lobby hard for all sorts of loopholes that effectively neuter the protections, and the totalitarian status quo will be set in stone. It's unfortunate the Internet surveillance industry wasn't nipped in the bud 15 years ago, now Surveillance Valley is held up as a bastion of "innovation" and most of the people who should know better are happily on the take.
- shadowgovt 4y ago
  On the other hand, given that the GDPR is the source of the now-near-ubiquitous cookie-consent noise, perhaps it's better if the US not mirror that law. There are probably good parts of it that can be lifted, but it may tilt too hard in the direction of personal ownership of other people's perception of you. In any case, we can be confident that nothing will pass at the Federal level that would make credit scores illegal.
  - mindslight 4y ago
    The GDPR is not "the source of the now-near-ubiquitous cookie-consent noise". Rather, those banners arose from malicious compliance by companies protesting the earlier EU cookie law, and you've seemingly fallen for the ruse. Furthermore, the GDPR fixed the loophole that made this malicious compliance technically legal. So the only take away from your point is that enforcing regulations on large companies suffers from incompleteness, which is obvious. Your assertion that the GDPR affects "personal ownership of other people's perception of you" is blatantly false. From the GDPR: "2. This Regulation does not apply to the processing of personal data: ... (c) by a natural person in the course of a purely personal or household activity". It explicitly excepts regulating personal activity, and instead focuses on commercial activity - ie companies. Companies do not have some inherent right to keep surveillance records on individuals. And this often referenced idea that company behavior is merely individual behavior scaled up is utterly fallacious, starting with the fact that companies are formed precisely to shield liability by diffusing responsibility. And sure, the corporate lobby is extremely powerful in the US, so I agree I'm dreaming to think that any law would ever hamper the credit surveillance bureaus - they already bought their regulatory capture with the indemnifying "Fair" Credit Reporting Act. But still if we're talking about what ought to be, then a law that would allow me to opt out of their keeping surveillance records on me is sorely needed. I for one would be happy to live without them.
    - shadowgovt 4y ago
      > those banners arose from malicious compliance The consequences of malicious compliance must be considered for every law passed. That's fundamental to the process of law, because humans react to incentives and are often selfish (or at least, self-focused). There was very little carrot attached to the law and plenty of stick, so people pushing right up to the edge of what the law allows was completely anticipated. Can't blame people with goals opposed to the law for legally bending the law to reach those goals. I like thinking about what ought to be, but I sure get burned too often by people passing laws in that direction who haven't paid sufficient thought to what is.

mindslight 4y ago

A direct analog of the GDPR is exactly what the US needs, especially with its framing of consent that doesn't allow the standard dance of nullification-via-nonconsentual-contract. I fear that all of these half-baked state privacy laws are going to force a move for overriding federal legislation, at which time the surveillance companies will lobby hard for all sorts of loopholes that effectively neuter the protections, and the totalitarian status quo will be set in stone. It's unfortunate the Internet surveillance industry wasn't nipped in the bud 15 years ago, now Surveillance Valley is held up as a bastion of "innovation" and most of the people who should know better are happily on the take.

shadowgovt 4y ago
On the other hand, given that the GDPR is the source of the now-near-ubiquitous cookie-consent noise, perhaps it's better if the US not mirror that law. There are probably good parts of it that can be lifted, but it may tilt too hard in the direction of personal ownership of other people's perception of you. In any case, we can be confident that nothing will pass at the Federal level that would make credit scores illegal.
- mindslight 4y ago
  The GDPR is not "the source of the now-near-ubiquitous cookie-consent noise". Rather, those banners arose from malicious compliance by companies protesting the earlier EU cookie law, and you've seemingly fallen for the ruse. Furthermore, the GDPR fixed the loophole that made this malicious compliance technically legal. So the only take away from your point is that enforcing regulations on large companies suffers from incompleteness, which is obvious. Your assertion that the GDPR affects "personal ownership of other people's perception of you" is blatantly false. From the GDPR: "2. This Regulation does not apply to the processing of personal data: ... (c) by a natural person in the course of a purely personal or household activity". It explicitly excepts regulating personal activity, and instead focuses on commercial activity - ie companies. Companies do not have some inherent right to keep surveillance records on individuals. And this often referenced idea that company behavior is merely individual behavior scaled up is utterly fallacious, starting with the fact that companies are formed precisely to shield liability by diffusing responsibility. And sure, the corporate lobby is extremely powerful in the US, so I agree I'm dreaming to think that any law would ever hamper the credit surveillance bureaus - they already bought their regulatory capture with the indemnifying "Fair" Credit Reporting Act. But still if we're talking about what ought to be, then a law that would allow me to opt out of their keeping surveillance records on me is sorely needed. I for one would be happy to live without them.
  - shadowgovt 4y ago
    > those banners arose from malicious compliance The consequences of malicious compliance must be considered for every law passed. That's fundamental to the process of law, because humans react to incentives and are often selfish (or at least, self-focused). There was very little carrot attached to the law and plenty of stick, so people pushing right up to the edge of what the law allows was completely anticipated. Can't blame people with goals opposed to the law for legally bending the law to reach those goals. I like thinking about what ought to be, but I sure get burned too often by people passing laws in that direction who haven't paid sufficient thought to what is.