3 ms·

The problem is that no form of data personal protection is really a good fit for the American (political) system, because the US leans heavily into the fallacy

The problem is that no form of data personal protection is really a good fit for the American (political) system, because the US leans heavily into the fallacy that if it's legal for one individual to do some as private activity, then allowing to be scaled up to mass corporate behavior is inherently reasonable. So telling Surveillance Valley to stop building Stasi 2.0 is akin to telling your friends that they must forget your birthday. Furthermore, the American concept of "consent" mostly functions as a legal fiction whereby less powerful parties are coerced into signing a bunch of binding legal documents. Hence the desire to copy the GDPR verbatim - because if a privacy law used the American version of "consent", why even bother? One way to port the overall idea of the GDPR into the US legal system might be to define a non-transferable property right in personal information (information about yourself), which could only be licensed revocably. Those two key bits would be tough though, given widespread deference to the Coase fallacy that has blessed much corporate looting.

JumpCrisscross 4y ago
> no form of data personal protection is really a good fit for the American system Not true. We have the Privacy Act of '74, HIPAA, GLBA and COPPA, to say nothing of e.g. California's CCPA and Virginia's CDPA [1]. Or Illinois' biometric privacy protections [2]. > the US leans heavily into the fallacy that if it's legal for one individual to do some as private activity, then allowing to be scaled up to mass corporate behavior is inherently reasonable This is true for rights, which don't get diluted through assembly. Not rules or the law. Plenty of laws exempt small businesses and natural persons. > the American concept of "consent" mostly functions as a legal fiction whereby less powerful parties are coerced into signing a bunch of binding legal documents Not entirely true. See: EULA enforceability as it pertains to natural persons [3]. > to define a property right in personal information (information about yourself), making it non-transferable and revocable at any time One generally defines a property right to enable transferability. Revocable property isn't property, it's a license. Making information one's inalienable property that can only be revocably licensed sounds neat, but it doesn't add value over enumerating data rights. [1] https://www.comparitech.com/data-privacy-management/federal-state-data-privacy-laws/ https://www.comparitech.com/data-privacy-management/federal-... [2] https://www.jacksonlewis.com/sites/default/files/docs/IllinoisBIPAFAQs.pdf https://www.jacksonlewis.com/sites/default/files/docs/Illino... [3] https://en.wikipedia.org/wiki/End-user_license_agreement#Enforceability_of_EULAs_in_the_United_States https://en.wikipedia.org/wiki/End-user_license_agreement#Enf...
- mindslight 4y ago
  > This is true for rights, which don't get diluted through assembly Calling it "assembly" is disingenuous (this is directed at the legal canon, not you). Generally companies aren't just mere assemblies of people, but rather are separate legal entities whose members have limited liability. Just as it's accepted for a company to say to an employee "if you want to get paid your 1st amendment rights are irrelevant", it would be reasonable for the government to say "if you want to have a statutory liability shield, your 1st amendment rights are irrelevant for activities facilitated by the shield". > Not entirely true. See: EULA enforceability as it pertains to natural persons I didn't say there weren't exceptions. Just overwhelmingly when a new regulation is created that requires "consent", the main result is for there to be a new piece of paper that people are forced to sign to "give consent". Rarely is there spelled out a path where the individual can refuse to give consent and still obtain a service that didn't intrinsically require it. > Making information one's inalienable property that can only be revocably licensed sounds neat, but it doesn't add value over enumerating data rights. The value is that trying to carve out new rights is an uphill battle, whereas dovetailing into the customs of commerce might just be possible. For example you had mentioned carve outs in the various state attempts at privacy laws due to the 1st amendment. Whereas those carve outs (unfortunately) don't exist for copyright! But sure, I do support trying to carve out completely new rights to repudiate our burgeoning surveillance society. It's just that the way the legislative process works in this country, it will be an amazing feat if the drafting process doesn't end up gutting most individual rights while still creating a bunch of red tape to stifle competition. Hence the attraction to copying GDPR wholesale and letting the courts sort it out.
  - JumpCrisscross 4y ago
    > when a new regulation is created that requires "consent", the main result is for there to be a new piece of paper that people are forced to sign to "give consent" You'll see my suggestions purposely skirt the question of consent. Access, erasure and objection. You can access your information held by others. You can require its deletion. And you can object to how it's used. (In practice, revocable consent. But avoiding the concept directly.) > those carve outs (unfortunately) don't exist for copyright Copyright is in the Constitution [1]. Its interaction with the First Amendment is why we have the fair-use doctrine [2]. I doubt the Congress could enact copyright without the Copyright Clause. Incorporating privacy through commercial code strikes me as messy. We have many mechanisms for abrogating property rights. Do we really want to deal with e.g. civil forfeiture of a person's privacy, banks seizing possession of personal data in obscure foreclosure proceedings, or an employer holding parts of an employee's privacy rights in bond? > the attraction to copying GDPR wholesale and letting the courts sort it out This would involve a decade plus of anarchy, litigation and uncertainty. That is enough time for generational backlash. Lazy legislating rarely pays off. [1] https://en.wikipedia.org/wiki/Copyright_Clause https://en.wikipedia.org/wiki/Copyright_Clause [2] https://www.law.cornell.edu/constitution-conan/article-1/section-8/clause-8/copyright-and-the-first-amendment https://www.law.cornell.edu/constitution-conan/article-1/sec...

JumpCrisscross 4y ago

> no form of data personal protection is really a good fit for the American system Not true. We have the Privacy Act of '74, HIPAA, GLBA and COPPA, to say nothing of e.g. California's CCPA and Virginia's CDPA [1]. Or Illinois' biometric privacy protections [2]. > the US leans heavily into the fallacy that if it's legal for one individual to do some as private activity, then allowing to be scaled up to mass corporate behavior is inherently reasonable This is true for rights, which don't get diluted through assembly. Not rules or the law. Plenty of laws exempt small businesses and natural persons. > the American concept of "consent" mostly functions as a legal fiction whereby less powerful parties are coerced into signing a bunch of binding legal documents Not entirely true. See: EULA enforceability as it pertains to natural persons [3]. > to define a property right in personal information (information about yourself), making it non-transferable and revocable at any time One generally defines a property right to enable transferability. Revocable property isn't property, it's a license. Making information one's inalienable property that can only be revocably licensed sounds neat, but it doesn't add value over enumerating data rights. [1] https://www.comparitech.com/data-privacy-management/federal-state-data-privacy-laws/ https://www.comparitech.com/data-privacy-management/federal-... [2] https://www.jacksonlewis.com/sites/default/files/docs/IllinoisBIPAFAQs.pdf https://www.jacksonlewis.com/sites/default/files/docs/Illino... [3] https://en.wikipedia.org/wiki/End-user_license_agreement#Enforceability_of_EULAs_in_the_United_States https://en.wikipedia.org/wiki/End-user_license_agreement#Enf...

mindslight 4y ago
> This is true for rights, which don't get diluted through assembly Calling it "assembly" is disingenuous (this is directed at the legal canon, not you). Generally companies aren't just mere assemblies of people, but rather are separate legal entities whose members have limited liability. Just as it's accepted for a company to say to an employee "if you want to get paid your 1st amendment rights are irrelevant", it would be reasonable for the government to say "if you want to have a statutory liability shield, your 1st amendment rights are irrelevant for activities facilitated by the shield". > Not entirely true. See: EULA enforceability as it pertains to natural persons I didn't say there weren't exceptions. Just overwhelmingly when a new regulation is created that requires "consent", the main result is for there to be a new piece of paper that people are forced to sign to "give consent". Rarely is there spelled out a path where the individual can refuse to give consent and still obtain a service that didn't intrinsically require it. > Making information one's inalienable property that can only be revocably licensed sounds neat, but it doesn't add value over enumerating data rights. The value is that trying to carve out new rights is an uphill battle, whereas dovetailing into the customs of commerce might just be possible. For example you had mentioned carve outs in the various state attempts at privacy laws due to the 1st amendment. Whereas those carve outs (unfortunately) don't exist for copyright! But sure, I do support trying to carve out completely new rights to repudiate our burgeoning surveillance society. It's just that the way the legislative process works in this country, it will be an amazing feat if the drafting process doesn't end up gutting most individual rights while still creating a bunch of red tape to stifle competition. Hence the attraction to copying GDPR wholesale and letting the courts sort it out.
- JumpCrisscross 4y ago
  > when a new regulation is created that requires "consent", the main result is for there to be a new piece of paper that people are forced to sign to "give consent" You'll see my suggestions purposely skirt the question of consent. Access, erasure and objection. You can access your information held by others. You can require its deletion. And you can object to how it's used. (In practice, revocable consent. But avoiding the concept directly.) > those carve outs (unfortunately) don't exist for copyright Copyright is in the Constitution [1]. Its interaction with the First Amendment is why we have the fair-use doctrine [2]. I doubt the Congress could enact copyright without the Copyright Clause. Incorporating privacy through commercial code strikes me as messy. We have many mechanisms for abrogating property rights. Do we really want to deal with e.g. civil forfeiture of a person's privacy, banks seizing possession of personal data in obscure foreclosure proceedings, or an employer holding parts of an employee's privacy rights in bond? > the attraction to copying GDPR wholesale and letting the courts sort it out This would involve a decade plus of anarchy, litigation and uncertainty. That is enough time for generational backlash. Lazy legislating rarely pays off. [1] https://en.wikipedia.org/wiki/Copyright_Clause https://en.wikipedia.org/wiki/Copyright_Clause [2] https://www.law.cornell.edu/constitution-conan/article-1/section-8/clause-8/copyright-and-the-first-amendment https://www.law.cornell.edu/constitution-conan/article-1/sec...