5 ms·

I worked with a gentleman who worked with Asher. I learned a lot about databases and people's data through those conversations. I think the solution to data p

I worked with a gentleman who worked with Asher. I learned a lot about databases and people's data through those conversations. I think the solution to data privacy is to require companies to provide the receipts of where they obtained the data. Know my age? I didn't tell you. You bought it? From whom? Follow up with them. No receipt? Fine paid directly to the individual. Make PII data property.

bsder 3y ago
> Make PII data property. No, PII should be treated as toxic, radioactive waste. If you lose it, you should get MASSIVE fines--multiple years of revenue level massive fines. This incentivizes companies to not even collect it and to dispose of it promptly. It also places a dollar value on it that is high enough that you have to understand the profit amount that it is worth. You won't collect it "just in case" since there is such a risk associated with holding it.
dataflow 3y ago
> No receipt? Fine paid directly to the individual. Make PII data property. Er, so anyone can keep your 'property' (data) without your consent by just paying you the statutory fee?
- digdugdirk 3y ago
  The value of modern data analytics comes from the massive quantities they have available. Each individual piece of data is hardly worth anything. Make it easy to file a claim and set the fine at $100 per occurance and things would change rather quickly.
  - dataflow 3y ago
    I think you missed the point? You're putting a price on people's privacy. Not everyone who feels their privacy is being violated really wants payment in exchange, they just don't want their privacy to be violated.
    - digdugdirk 3y ago
      Ah, I was looking at it from a system level. Make it a highly lopsided financial cost for a company to use data that hasn't been consented to, and the huge number of people keeping tabs on them would make it financially ruinous for a company to try and skirt the rules. End outcome is the same - peoples privacy already has a price. That price is just currently only represented by FAANG profits.
      - dataflow 3y ago
        [flagged]
      - ianai 3y ago
        In the US the civil courts dole out rulings requiring the injured party be paid by the offender when enough evidence has been presented. It’s not perfect-money can’t right all wrongs and the valuations can be problematic-but it can act as a counterbalance. Making it a law would mean a company would risk losing their ability to continue as a business following a successful conviction. In the US this has been turned into rarely indicting companies as the government doesn’t want to destroy whole companies that way and give other companies undue market power, or something. Feels like an area that could be handled better.
    - tiffanyg 3y ago
      There is a certain mindset that unfortunately has been ever more widely 'bought into' and is especially highly represented at the top levels of corporations in recent years* (particularly in the US). The mindset is fundamentally "invisible hand", "Adam Smith", "Ayn Rand", etc. People who mostly or nearly only think in terms of costs, profits, etc.** The easiest way to deal with people like this is by putting it in 'the language' they speak. While I'd love, personally, to see some direct regulation, legislation, etc. that doesn't involve turning this into yet another line 'in the books' / in the annual reports etc. of companies ... and feeds, arguably, even more into that sort of thinking ... for multiple reasons there are extensive practical issues with doing that in the US currently. It'd certainly be helpful in the longer term if we could get some people away from viewing everything through the lens of numbers - especially conflating OTHER PEOPLE with "format strings" in Excel (effectively). But, I believe in being practical along with strategic. If such metrics are needed, private-party lawsuits are needed ... if government (outside of perhaps putting some basic accounting in place &/ the justice system and current tort laws) is not an option for sorting out disputes and correcting bad behavior, particularly some forms of traditional government regulation, and the bottom-line is king ... then let's use what is available or might be put in place, ultimately speaking the 'language' necessary to push things in a more reasonable direction. * Not uniformly distributed, for sure, but increasingly visible on average - in part, thanks MBA programs, but also, somewhat relatedly, decades of work and marketing from people who really want to turn the clock back ... wannabe robber-barons (https://youtu.be/DqgvHUg_vxY https://youtu.be/DqgvHUg_vxY) and even those with plantation 'wetdreams' ** Incidentally, this is related to the kind of "mob rule" that outright dangerous politicians like Trump represent. Importantly, dangerous to EVERYONE, even those in the cult, though they almost certainly don't know the true extent of the danger, even remotely. In essence, without any principles / rule of law established in notions like actual justice, truth, fairness, equitable treatment, etc., any forces driving large systems involving people will tend to devolve into forms of mob rule. Whether it's markets for goods and services, the "marketplace of ideas", etc. What is more and more absent in America, in particular, in public discourse especially, but also in certain business sectors of, in some cases, outsized importance in this entire 'picture', is the kind of principled viewpoints, ideas, thinking, etc. that have repeatedly re-formed this country at those critical moments when it might have broken / not become the exemplar that it often has been. Whether that happens this time as well remains to be seen, I think. That's a massive topic ... all of this is ... and I am really no expert in much of this, so caveat there, but, I have enough of a sense and of the details of history and the differences in outcomes at different times and in different places to offer the commentary I am right now. More importantly, regardless of some of the background / mechanisms, the actual behaviors are clear enough in recent times / events / data. I.e., what I've written outside of these footnotes.
- verve_rat 3y ago
  Why wouldn't the fine also come with instructions to "stop that"? If you shoplift and get caught, you don't get to keep the stuff.
  - musicale 3y ago
    Only the stuff you got caught with. Maybe not even that.
  - dataflow 3y ago
    Well it wasn't in the comment, they just mentioned a fine, not any other penalty. Moreover, have you seen how some people (generally wealthier, but not always) treat, say, paid parking? They just don't pay at all, because it's not worth the hassle for them. Sometimes even with the occasional enforcement, they come out ahead compared to just paying the original fee. But even if it isn't worth it financially, it's often worth their time, so they do it without really caring one way or the other. Anyway... the penalty for shoplifting (assuming they bother to go after you) isn't generally a "pay this fine and return what you stole". It's being subject to everything that comes with crimes... dealing with law enforcement, tarnishing your personal record, potentially getting jail time depending on the severity, etc. Any civil case that you might get filed against you for damages, attorneys' fees, etc. is just icing on the cake, and hardly the meat of the punishment.
    - Nevermark 3y ago
      Ok, but let's strong man this instead of finding reasons not to consider it. If they get caught it's $100 and they need to delete it. Caught with the same data its $1000. Furthermore, if they are caught storing data in a pattern, say 100 people catch them within a year of the first, the fine retroactively becomes $1000 per incident over the time of the pattern. With a Judge having discretion to raise fines, retroactively and inclusive of new violations, for companies that simply refuse to comply. I feel like this could work. In fact, I would think most companies would start designing their systems to ensure they didn't violate by accident. Which is what they are supposed to be doing, but not.
YeBanKo 3y ago
Why not require companies to get consent from the person to store the data, regardless where they get it from?
- johndhi 3y ago
  Kind of a nightmare for cloud computing. What if for example I'm a small business who stores my customer's email in Salesforce. And uses another cloud provider to port data in and out of Salesforce. And then uses splunk for error monitoring... etc. All of them need explicit consent?
  - jckahn 3y ago
    Yes please! That sounds great.
  - duncan-donuts 3y ago
    This is the difference between a data processor and a data controller in the GDPR.
  - LapsangGuzzler 3y ago
    Adding friction makes sense in this context. The ease with which we as technologists move customer data between systems directly contributes to the privacy problem. It’s not the only avenue to improve end-user privacy, but as long it remains easy for companies to move sensitive customer data between systems, this will continue to be abused.
  - PeterisP 3y ago
    The EU solution for that is specific 'data processor' agreements where (a) they process the data on your behalf; (b) they don't gain any permission whatsoever to use that data for their own purposes, only what you ask them to do; (c) they only have the right to do with that data the same things you are permitted to do; (d) you have to inform users (but not necessarily get consent) of all the processors which are handling their data; (e) you're fully responsible for what the processor does with that data. Reasonable cloud providers like Saleforce, Splunk (and pretty much all others which do business in EU) all have adapted to GDPR and will give contractual guarantees that they'll do everything properly but it's up to you to pick providers which will actually uphold that contract.
tacticalmook 3y ago
Could give us the run-around with circular receipts, or millions of back-and-forth receipts.
- DangitBobby 3y ago
  If we can't follow the trail, you get a fine. It's not our problem, it's your problem.
Obscurity4340 3y ago
Yas! Paper trails and more paper trails. Follow the money and handoffs
avgcorrection 3y ago
The solution to data tracking is more data tracking? This would work if everything would be done in bulk and by officials. It wouldn't work if it was just something citizens would have a right to know but would have to do all the legwork in order to uncover (sending out dozens of requests) and then would have to sue entities in court. It seems simpler to regulate PII based on consent and strict need-to-know principles.
VinLucero 3y ago
I agree this solution solves privacy in an economically sensible way.
specialist 3y ago
> Fine paid directly to the individual. Make PII data property. Correct. Specifically, establish personal sovereignty over one's data. If someone's using my data, I get my cut. Pay me. -- I'll have to ponder the notion of receipts (provenance). I can imagine how the provenance of my data probably matters. Prescriptions, test results, reading list, etc. But PII is so ubiquitous now, it's part of the public record. Which, counter intuitively, is a good thing. Establishing a stable universal identifier unlocks the ability to encrypt our personal data at rest. In our current world of no universal identifiers, linking personal data data across systems requires it be stored as plaintext. The book Translucent Databases (2nd ed) explains the techniques.
rexf 3y ago
> I think the solution to data privacy is to require companies to provide the receipts of where they obtained the data. In the article, Asher and presumably the rest of their industry has many legal avenues for acquiring data. Such as directly from the government: > the Department of Highway Safety’s trove of vehicle registrations, an untapped resource held separately from M.V.R.s. These the department sold for a penny a record, a low price (relative to those $2 M.V.R.s)
- musicale 3y ago
  This is pretty terrible, so it would be nice to be able to audit the receipts.
darkclouds 3y ago
> I worked with a gentleman who worked with Asher. I Were they British or American? The best advice I got from someone who knew Hank was, even been on his boat down at Ft Lauderdale, was if you dont want to get hacked, dont put your computer online. Even that is virtually impossible now, one has to become an expert in everything. There is alot of data sharing going on, not just official businesses like this, but media & news outlets. Journalists have the law on their side as well!

bsder 3y ago

> Make PII data property. No, PII should be treated as toxic, radioactive waste. If you lose it, you should get MASSIVE fines--multiple years of revenue level massive fines. This incentivizes companies to not even collect it and to dispose of it promptly. It also places a dollar value on it that is high enough that you have to understand the profit amount that it is worth. You won't collect it "just in case" since there is such a risk associated with holding it.

dataflow 3y ago

> No receipt? Fine paid directly to the individual. Make PII data property. Er, so anyone can keep your 'property' (data) without your consent by just paying you the statutory fee?

digdugdirk 3y ago
The value of modern data analytics comes from the massive quantities they have available. Each individual piece of data is hardly worth anything. Make it easy to file a claim and set the fine at $100 per occurance and things would change rather quickly.
- dataflow 3y ago
  I think you missed the point? You're putting a price on people's privacy. Not everyone who feels their privacy is being violated really wants payment in exchange, they just don't want their privacy to be violated.
  - digdugdirk 3y ago
    Ah, I was looking at it from a system level. Make it a highly lopsided financial cost for a company to use data that hasn't been consented to, and the huge number of people keeping tabs on them would make it financially ruinous for a company to try and skirt the rules. End outcome is the same - peoples privacy already has a price. That price is just currently only represented by FAANG profits.
    - dataflow 3y ago
      [flagged]
    - ianai 3y ago
      In the US the civil courts dole out rulings requiring the injured party be paid by the offender when enough evidence has been presented. It’s not perfect-money can’t right all wrongs and the valuations can be problematic-but it can act as a counterbalance. Making it a law would mean a company would risk losing their ability to continue as a business following a successful conviction. In the US this has been turned into rarely indicting companies as the government doesn’t want to destroy whole companies that way and give other companies undue market power, or something. Feels like an area that could be handled better.
  - tiffanyg 3y ago
    There is a certain mindset that unfortunately has been ever more widely 'bought into' and is especially highly represented at the top levels of corporations in recent years* (particularly in the US). The mindset is fundamentally "invisible hand", "Adam Smith", "Ayn Rand", etc. People who mostly or nearly only think in terms of costs, profits, etc.** The easiest way to deal with people like this is by putting it in 'the language' they speak. While I'd love, personally, to see some direct regulation, legislation, etc. that doesn't involve turning this into yet another line 'in the books' / in the annual reports etc. of companies ... and feeds, arguably, even more into that sort of thinking ... for multiple reasons there are extensive practical issues with doing that in the US currently. It'd certainly be helpful in the longer term if we could get some people away from viewing everything through the lens of numbers - especially conflating OTHER PEOPLE with "format strings" in Excel (effectively). But, I believe in being practical along with strategic. If such metrics are needed, private-party lawsuits are needed ... if government (outside of perhaps putting some basic accounting in place &/ the justice system and current tort laws) is not an option for sorting out disputes and correcting bad behavior, particularly some forms of traditional government regulation, and the bottom-line is king ... then let's use what is available or might be put in place, ultimately speaking the 'language' necessary to push things in a more reasonable direction. * Not uniformly distributed, for sure, but increasingly visible on average - in part, thanks MBA programs, but also, somewhat relatedly, decades of work and marketing from people who really want to turn the clock back ... wannabe robber-barons (https://youtu.be/DqgvHUg_vxY https://youtu.be/DqgvHUg_vxY) and even those with plantation 'wetdreams' ** Incidentally, this is related to the kind of "mob rule" that outright dangerous politicians like Trump represent. Importantly, dangerous to EVERYONE, even those in the cult, though they almost certainly don't know the true extent of the danger, even remotely. In essence, without any principles / rule of law established in notions like actual justice, truth, fairness, equitable treatment, etc., any forces driving large systems involving people will tend to devolve into forms of mob rule. Whether it's markets for goods and services, the "marketplace of ideas", etc. What is more and more absent in America, in particular, in public discourse especially, but also in certain business sectors of, in some cases, outsized importance in this entire 'picture', is the kind of principled viewpoints, ideas, thinking, etc. that have repeatedly re-formed this country at those critical moments when it might have broken / not become the exemplar that it often has been. Whether that happens this time as well remains to be seen, I think. That's a massive topic ... all of this is ... and I am really no expert in much of this, so caveat there, but, I have enough of a sense and of the details of history and the differences in outcomes at different times and in different places to offer the commentary I am right now. More importantly, regardless of some of the background / mechanisms, the actual behaviors are clear enough in recent times / events / data. I.e., what I've written outside of these footnotes.
verve_rat 3y ago
Why wouldn't the fine also come with instructions to "stop that"? If you shoplift and get caught, you don't get to keep the stuff.
- musicale 3y ago
  Only the stuff you got caught with. Maybe not even that.
- dataflow 3y ago
  Well it wasn't in the comment, they just mentioned a fine, not any other penalty. Moreover, have you seen how some people (generally wealthier, but not always) treat, say, paid parking? They just don't pay at all, because it's not worth the hassle for them. Sometimes even with the occasional enforcement, they come out ahead compared to just paying the original fee. But even if it isn't worth it financially, it's often worth their time, so they do it without really caring one way or the other. Anyway... the penalty for shoplifting (assuming they bother to go after you) isn't generally a "pay this fine and return what you stole". It's being subject to everything that comes with crimes... dealing with law enforcement, tarnishing your personal record, potentially getting jail time depending on the severity, etc. Any civil case that you might get filed against you for damages, attorneys' fees, etc. is just icing on the cake, and hardly the meat of the punishment.
  - Nevermark 3y ago
    Ok, but let's strong man this instead of finding reasons not to consider it. If they get caught it's $100 and they need to delete it. Caught with the same data its $1000. Furthermore, if they are caught storing data in a pattern, say 100 people catch them within a year of the first, the fine retroactively becomes $1000 per incident over the time of the pattern. With a Judge having discretion to raise fines, retroactively and inclusive of new violations, for companies that simply refuse to comply. I feel like this could work. In fact, I would think most companies would start designing their systems to ensure they didn't violate by accident. Which is what they are supposed to be doing, but not.

YeBanKo 3y ago

Why not require companies to get consent from the person to store the data, regardless where they get it from?

johndhi 3y ago
Kind of a nightmare for cloud computing. What if for example I'm a small business who stores my customer's email in Salesforce. And uses another cloud provider to port data in and out of Salesforce. And then uses splunk for error monitoring... etc. All of them need explicit consent?
- jckahn 3y ago
  Yes please! That sounds great.
- duncan-donuts 3y ago
  This is the difference between a data processor and a data controller in the GDPR.
- LapsangGuzzler 3y ago
  Adding friction makes sense in this context. The ease with which we as technologists move customer data between systems directly contributes to the privacy problem. It’s not the only avenue to improve end-user privacy, but as long it remains easy for companies to move sensitive customer data between systems, this will continue to be abused.
- PeterisP 3y ago
  The EU solution for that is specific 'data processor' agreements where (a) they process the data on your behalf; (b) they don't gain any permission whatsoever to use that data for their own purposes, only what you ask them to do; (c) they only have the right to do with that data the same things you are permitted to do; (d) you have to inform users (but not necessarily get consent) of all the processors which are handling their data; (e) you're fully responsible for what the processor does with that data. Reasonable cloud providers like Saleforce, Splunk (and pretty much all others which do business in EU) all have adapted to GDPR and will give contractual guarantees that they'll do everything properly but it's up to you to pick providers which will actually uphold that contract.

tacticalmook 3y ago

Could give us the run-around with circular receipts, or millions of back-and-forth receipts.

DangitBobby 3y ago
If we can't follow the trail, you get a fine. It's not our problem, it's your problem.

Obscurity4340 3y ago

Yas! Paper trails and more paper trails. Follow the money and handoffs

avgcorrection 3y ago

The solution to data tracking is more data tracking? This would work if everything would be done in bulk and by officials. It wouldn't work if it was just something citizens would have a right to know but would have to do all the legwork in order to uncover (sending out dozens of requests) and then would have to sue entities in court. It seems simpler to regulate PII based on consent and strict need-to-know principles.

VinLucero 3y ago

I agree this solution solves privacy in an economically sensible way.

specialist 3y ago

> Fine paid directly to the individual. Make PII data property. Correct. Specifically, establish personal sovereignty over one's data. If someone's using my data, I get my cut. Pay me. -- I'll have to ponder the notion of receipts (provenance). I can imagine how the provenance of my data probably matters. Prescriptions, test results, reading list, etc. But PII is so ubiquitous now, it's part of the public record. Which, counter intuitively, is a good thing. Establishing a stable universal identifier unlocks the ability to encrypt our personal data at rest. In our current world of no universal identifiers, linking personal data data across systems requires it be stored as plaintext. The book Translucent Databases (2nd ed) explains the techniques.

rexf 3y ago

> I think the solution to data privacy is to require companies to provide the receipts of where they obtained the data. In the article, Asher and presumably the rest of their industry has many legal avenues for acquiring data. Such as directly from the government: > the Department of Highway Safety’s trove of vehicle registrations, an untapped resource held separately from M.V.R.s. These the department sold for a penny a record, a low price (relative to those $2 M.V.R.s)

musicale 3y ago
This is pretty terrible, so it would be nice to be able to audit the receipts.

darkclouds 3y ago

> I worked with a gentleman who worked with Asher. I Were they British or American? The best advice I got from someone who knew Hank was, even been on his boat down at Ft Lauderdale, was if you dont want to get hacked, dont put your computer online. Even that is virtually impossible now, one has to become an expert in everything. There is alot of data sharing going on, not just official businesses like this, but media & news outlets. Journalists have the law on their side as well!