4 ms·

This seems to be unforced data retention, which is leaked/stolen, as is pretty much a given. However the privacy commissioner is saying "data retention is a pro

by olliej 4y ago

This seems to be unforced data retention, which is leaked/stolen, as is pretty much a given. However the privacy commissioner is saying "data retention is a problem", and at the same time we have: Spy agencies: we need everyone to collect data to prevent terrorism! Politicians: We need to do that to protect children! Politicians: Also if you ever leak any of the data we forced you to collect and store data whether you want it or not, you will be liable.

throwbadubadu 4y ago
These, but also politicians: Its the new oil, we need it for the economy, stay competitive and throw all principles learned by blood away. If we would just start with all their data first for their in office part, as that is of real public interest again...
rstuart4133 4y ago
> This seems to be unforced data retention, I didn't get that impression. Drivers licences and passports aren't things banks generally care about. It sounds more like the "know you customer" and "anti money laundering" hoops all financial institutions are forced to jump through now. The rest of your comment rings true, although "spy agencies" is too narrow. It's spy agencies, police, the tax office, the social welfare agencies (like Centre Link in Australia), the financial agencies like Australia's ASIC. I don't think it's politically possible to stop the data collection. A few real terrorist plots in Australia have been caught with this data, banks have been fined billions for allowing what is effectively money washing. Regardless of what I personally think, the Law Enforcement Agencies will say not collecting this information is the equivalent of "let the terrorists/paedophiles win" making any argument to stop it a near impossible sell. But that doesn't matter. You can insist this data is collected without creating a wide open barn door like we have currently using cryptographic protocols. As an example, the government could you an app on your phone, lets say a car rental agency requires proof you have a valid drivers licence. You present the phone to an NFC reader, the phone says "XYZ Business has an authority to verify you have a current licence and it's expiry date", you click "hand it over", the phone provides the required data to the rental company. It's signed to prove to the rental company the the government has certified you have a licence expiring on some date. It also contains a lot of details about you the police can use to chase you down if you are in a road accident - but that's all encrypted, so no one can see it, including the car rental company. So it doesn't matter if it leaks. Barn door closed. Well sort of. The car rental is probably going to collect a lot of information about you anyway, like a name, contact phone and address. But that's because they want it, not because the government demands it. Hopefully those details won't be sufficient to pull off identity fraud. The government ID's they are collecting now definitely are ID fraud material. This way of handling sensitive data isn't novel. We already do something like this for credit card details. When a web site offers to remember your credit card, it's likely they've never seen it, let alone remember it. The only people who have seen it is the payment processor - Stripe maybe. What they are remembering is a token Stripe gives to them, which they can use to charge your card again. But the token reveals nothing about you. What's more it is useless to everyone bar them - Stripe won't accept it from anyone else.
- olliej 4y ago
  > I didn't get that impression. I initially thought that it was gov mandated data, but I felt that given the available info in the article meant I couldn't back up that as a statement so backed off. I would guess it's probably a mix of government mandated and business purposes, at the same time I suspect there's a bunch of info they want but that happens to overlap the gov requirements.
boredumb 4y ago
"Spy agencies" aka your government.
berniedurfee 4y ago
There’s also an issue of legal holds. I have worked at large enterprises where data was retained in perpetuity due to a constant influx of lawsuits. Legal tends not to understand the subtleties of data models, so they blanket prohibit any data deletion from anywhere. Yes, sometimes even archiving or vaulting of old data is not allowed as it might compromise ongoing litigation.

by olliej 4y ago

throwbadubadu 4y ago

These, but also politicians: Its the new oil, we need it for the economy, stay competitive and throw all principles learned by blood away. If we would just start with all their data first for their in office part, as that is of real public interest again...

rstuart4133 4y ago

> This seems to be unforced data retention, I didn't get that impression. Drivers licences and passports aren't things banks generally care about. It sounds more like the "know you customer" and "anti money laundering" hoops all financial institutions are forced to jump through now. The rest of your comment rings true, although "spy agencies" is too narrow. It's spy agencies, police, the tax office, the social welfare agencies (like Centre Link in Australia), the financial agencies like Australia's ASIC. I don't think it's politically possible to stop the data collection. A few real terrorist plots in Australia have been caught with this data, banks have been fined billions for allowing what is effectively money washing. Regardless of what I personally think, the Law Enforcement Agencies will say not collecting this information is the equivalent of "let the terrorists/paedophiles win" making any argument to stop it a near impossible sell. But that doesn't matter. You can insist this data is collected without creating a wide open barn door like we have currently using cryptographic protocols. As an example, the government could you an app on your phone, lets say a car rental agency requires proof you have a valid drivers licence. You present the phone to an NFC reader, the phone says "XYZ Business has an authority to verify you have a current licence and it's expiry date", you click "hand it over", the phone provides the required data to the rental company. It's signed to prove to the rental company the the government has certified you have a licence expiring on some date. It also contains a lot of details about you the police can use to chase you down if you are in a road accident - but that's all encrypted, so no one can see it, including the car rental company. So it doesn't matter if it leaks. Barn door closed. Well sort of. The car rental is probably going to collect a lot of information about you anyway, like a name, contact phone and address. But that's because they want it, not because the government demands it. Hopefully those details won't be sufficient to pull off identity fraud. The government ID's they are collecting now definitely are ID fraud material. This way of handling sensitive data isn't novel. We already do something like this for credit card details. When a web site offers to remember your credit card, it's likely they've never seen it, let alone remember it. The only people who have seen it is the payment processor - Stripe maybe. What they are remembering is a token Stripe gives to them, which they can use to charge your card again. But the token reveals nothing about you. What's more it is useless to everyone bar them - Stripe won't accept it from anyone else.

olliej 4y ago
> I didn't get that impression. I initially thought that it was gov mandated data, but I felt that given the available info in the article meant I couldn't back up that as a statement so backed off. I would guess it's probably a mix of government mandated and business purposes, at the same time I suspect there's a bunch of info they want but that happens to overlap the gov requirements.

boredumb 4y ago

"Spy agencies" aka your government.

berniedurfee 4y ago

There’s also an issue of legal holds. I have worked at large enterprises where data was retained in perpetuity due to a constant influx of lawsuits. Legal tends not to understand the subtleties of data models, so they blanket prohibit any data deletion from anywhere. Yes, sometimes even archiving or vaulting of old data is not allowed as it might compromise ongoing litigation.