4 ms·

> The current practice in America is that once data* about a person has been disclosed to a business by any means, the person loses all rights to it and it beco

> The current practice in America is that once data* about a person has been disclosed to a business by any means, the person loses all rights to it and it becomes the property of that business to do with and resell it however they want. Yes. I think what's being alluded to is that the ultimate problem lies there, and carving out special systems and cases to legislate to avoid bad behavior that might results from that will always fall short of what we could get with some more overarching legislation that makes it so the end person retains at least enough rights about that data to know when it's happening and preferably be able to stop it and requiring very stringent rules about those that do attempt it with permission from end users. At that point it's no longer about finding which if the data aggregators are doing unsavory things with the data they get from you and trying to find some way to get them to stop and it's then about any data broker that wants your information trying to get you to allow it (because there are undoubtedly cases where the data is good for society and even good for you) needs to justify what and why and how they use it. Edit: And there would be legal recourse if they don't follow those legal standards, of course. It's implied, but might as well be stated outright.

smolder 2y ago
I think the better starting point would be that businesses have no right to share personally identifying information about their customers (short of court orders) and the carve outs go the other way. I should then grant the "identity handling rights", by way of a license, to businesses, as needed. Put some standards around the language and method of establishing consent so it can't be buried in EULAs, and then I'll be happy to check a box to grant businesses to transact with my PII on my behalf if there is a legitimate need.
- hi-v-rocknroll 2y ago
  Yes, this would need grassroots single issue advancement of something like a HIPAA law for general privacy and personal data that starts with an opt-in standard practice. There's really no way to change the structure of how the current situation of data brokering works in America without a broad and draconian law. Perhaps there should also be a nonprofit clearinghouse like a "credit agency" that provides a centralized portal for reviewing all of the permission links at and between businesses, and also a central point for changing phone numbers, email, shipping, mailing address, etc.
- kbenson 2y ago
  I think that's essentially just what I described, with the main difference being that I think we'll only actually get there if we approach it from the angle of PII being something intrinsically owned by the individual, not the company that generated it, which I think is easiest approached by making it a right of some sort. Then the carved out allowances for specific companies or industries are clear and their need can always be weighed against our rights, making them much easier to pull back, because it's obvious when it comes to our rights and the needs of an industry to continue making money, our rights come first. If it's approached from a non-rights angle at some point we are attempting to curtail an industry, I think that might be a much more contentious discussion. If we can't get rights, I wouldn't mind HIPAA being expanded into an overall PII protection system with two or more levels, one being current HIPAA health info, and the other main one being all other PII info and that allows a company to collect it for internal use without lots of constraints (depending on info, and purely so it doesn't accidentally tank existing industries that aren't problematic because all of a sudden they can't store some benign info they need that the law accidentally targets) but once they want to share it at all they need to adopt a much more stringent framework like medical info requires for tracking and accounting of it, which would probably weed out the vast majority of random "collect the PII and sell it because it's cheap" stuff that goes on, since it's no longer low cost at all given the requirements that would exist around it (including authorization to share). Just the cost structure around strict legal and storage compliance and requiring authorization and tracking of all sharing of information would disincentivize a huge amount of the abuse we see.

smolder 2y ago

I think the better starting point would be that businesses have no right to share personally identifying information about their customers (short of court orders) and the carve outs go the other way. I should then grant the "identity handling rights", by way of a license, to businesses, as needed. Put some standards around the language and method of establishing consent so it can't be buried in EULAs, and then I'll be happy to check a box to grant businesses to transact with my PII on my behalf if there is a legitimate need.

hi-v-rocknroll 2y ago
Yes, this would need grassroots single issue advancement of something like a HIPAA law for general privacy and personal data that starts with an opt-in standard practice. There's really no way to change the structure of how the current situation of data brokering works in America without a broad and draconian law. Perhaps there should also be a nonprofit clearinghouse like a "credit agency" that provides a centralized portal for reviewing all of the permission links at and between businesses, and also a central point for changing phone numbers, email, shipping, mailing address, etc.
kbenson 2y ago
I think that's essentially just what I described, with the main difference being that I think we'll only actually get there if we approach it from the angle of PII being something intrinsically owned by the individual, not the company that generated it, which I think is easiest approached by making it a right of some sort. Then the carved out allowances for specific companies or industries are clear and their need can always be weighed against our rights, making them much easier to pull back, because it's obvious when it comes to our rights and the needs of an industry to continue making money, our rights come first. If it's approached from a non-rights angle at some point we are attempting to curtail an industry, I think that might be a much more contentious discussion. If we can't get rights, I wouldn't mind HIPAA being expanded into an overall PII protection system with two or more levels, one being current HIPAA health info, and the other main one being all other PII info and that allows a company to collect it for internal use without lots of constraints (depending on info, and purely so it doesn't accidentally tank existing industries that aren't problematic because all of a sudden they can't store some benign info they need that the law accidentally targets) but once they want to share it at all they need to adopt a much more stringent framework like medical info requires for tracking and accounting of it, which would probably weed out the vast majority of random "collect the PII and sell it because it's cheap" stuff that goes on, since it's no longer low cost at all given the requirements that would exist around it (including authorization to share). Just the cost structure around strict legal and storage compliance and requiring authorization and tracking of all sharing of information would disincentivize a huge amount of the abuse we see.