3 ms·

While I would love for something like this to move forward, I think the focus in this bill takes a weird turn. E.g. the definition for "High-Risk Information Sy

by abeppu 4y ago

While I would love for something like this to move forward, I think the focus in this bill takes a weird turn. E.g. the definition for "High-Risk Information System" includes as one its 4 criteria: > involves the personal information of a significant number of consumers regarding race, color, national origin, political opinions, religion, trade union membership, genetic data, biometric data, health, gender, gender identity, sexuality, sexual orientation, criminal convictions, or arrests; Systems that allow for discrimination against protected classes are certainly high risk, but I think most of us are more concerned by the identify theft risk online, and more likely to be discriminated against in person. But the bill does _not_ anywhere mention addresses, social security numbers, banking information, etc. Maybe those things would reasonably be included under one of the other criteria: > taking into account the novelty of the technology used and the nature, scope, context, and purpose of the information system, poses a significant risk to the privacy or security of personal information of consumers; Separately they define Personal Information as: > The term “personal information” means any information, regardless of how the information is collected, inferred, or obtained that is reasonably linkable to a specific consumer or consumer device. That seems like a reasonable definition, but I think an "including but not limited to" list would have been helpful.

bckygldstn 4y ago
> most of us are more concerned by the identify theft To give a single datapoint, I am much more concerned about automated discrimination than identity theft. (I do agree with you though that the bill ought to cover more information). > addresses Until recently, everyone's address were printed in a big book that was sent to every household for free. I lived for years in a country where the government published everyone's address online and never experienced or heard about any issues. > banking information Many jurisdictions required banks to (eventually) make whole anyone impacted by theft of banking information. Don't get me wrong: I wish I had more privacy around my "identity/administrative" data. But we understand pretty well the risks involved there and have some legal mitigations in place. I think we're just seeing the tip of the automated discrimination iceberg. This data props up almost all of the marketing industry these days, and is spreading faster than laws can be made or than people can comprehend what's occurring.
- marcus_holmes 4y ago
  > Until recently, everyone's address were printed in a big book that was sent to every household for free. I lived for years in a country where the government published everyone's address online and never experienced or heard about any issues. Back in those days you had to turn up in person to do things like open a bank account, pay a cheque into your bank account, draw money from a bank account, etc. You probably used the same bank (my first bank account only allowed me to draw money from a specific branch, during work hours, and only up to a set limit each month). The bank staff probably knew who you were on sight. I'm not saying your address should be secret - I agree with you that this is probably OK. I'm saying the attack surface for identity theft is so much larger now that we should probably be more careful than we were.
  - SoftTalker 4y ago
    The problem is that we allow information to be a proxy for turning up in person. Information that is either public record, or very likley to be available in one of the many known or unknown data breaches that occur regularly. Knowing my mother's maiden name, the history of addresses I've lived at, any of my various ID numbers, account numbers, etc. should not be sufficient to prove identity. Yeah this is inconvenient for many things but the reality today is that all of this "identifying" information is (or should be) considered public. Stop accepting this, and most of the problems with data breaches and leaks go away.
    - Turing_Machine 4y ago
      > Knowing my mother's maiden name, the history of addresses I've lived at, any of my various ID numbers, account numbers, etc. should not be sufficient to prove identity. What should be, then? I'd like to see a compartmentalized ID that doesn't have all the information there in one easily human-readable (or scannable) form. For instance, a bar only really needs to know if you're of legal drinking age. They shouldn't be able to get your exact date of birth, your address, a copy of your photo, etc.
      - 4y ago
q1w2 4y ago
Personally identifiable information (PII) is widely used in regulatory law across industries to include SSN, DoB, bank account numbers, home address, etc... so I don't think that's an issue. They typically don't get so so specific to allow the regulators to use their reasonable judgement

by abeppu 4y ago

bckygldstn 4y ago

> most of us are more concerned by the identify theft To give a single datapoint, I am much more concerned about automated discrimination than identity theft. (I do agree with you though that the bill ought to cover more information). > addresses Until recently, everyone's address were printed in a big book that was sent to every household for free. I lived for years in a country where the government published everyone's address online and never experienced or heard about any issues. > banking information Many jurisdictions required banks to (eventually) make whole anyone impacted by theft of banking information. Don't get me wrong: I wish I had more privacy around my "identity/administrative" data. But we understand pretty well the risks involved there and have some legal mitigations in place. I think we're just seeing the tip of the automated discrimination iceberg. This data props up almost all of the marketing industry these days, and is spreading faster than laws can be made or than people can comprehend what's occurring.

marcus_holmes 4y ago
> Until recently, everyone's address were printed in a big book that was sent to every household for free. I lived for years in a country where the government published everyone's address online and never experienced or heard about any issues. Back in those days you had to turn up in person to do things like open a bank account, pay a cheque into your bank account, draw money from a bank account, etc. You probably used the same bank (my first bank account only allowed me to draw money from a specific branch, during work hours, and only up to a set limit each month). The bank staff probably knew who you were on sight. I'm not saying your address should be secret - I agree with you that this is probably OK. I'm saying the attack surface for identity theft is so much larger now that we should probably be more careful than we were.
- SoftTalker 4y ago
  The problem is that we allow information to be a proxy for turning up in person. Information that is either public record, or very likley to be available in one of the many known or unknown data breaches that occur regularly. Knowing my mother's maiden name, the history of addresses I've lived at, any of my various ID numbers, account numbers, etc. should not be sufficient to prove identity. Yeah this is inconvenient for many things but the reality today is that all of this "identifying" information is (or should be) considered public. Stop accepting this, and most of the problems with data breaches and leaks go away.
  - Turing_Machine 4y ago
    > Knowing my mother's maiden name, the history of addresses I've lived at, any of my various ID numbers, account numbers, etc. should not be sufficient to prove identity. What should be, then? I'd like to see a compartmentalized ID that doesn't have all the information there in one easily human-readable (or scannable) form. For instance, a bar only really needs to know if you're of legal drinking age. They shouldn't be able to get your exact date of birth, your address, a copy of your photo, etc.
    - 4y ago

q1w2 4y ago

Personally identifiable information (PII) is widely used in regulatory law across industries to include SSN, DoB, bank account numbers, home address, etc... so I don't think that's an issue. They typically don't get so so specific to allow the regulators to use their reasonable judgement