4 ms·

I think the better starting point would be that businesses have no right to share personally identifying information about their customers (short of court order

I think the better starting point would be that businesses have no right to share personally identifying information about their customers (short of court orders) and the carve outs go the other way. I should then grant the "identity handling rights", by way of a license, to businesses, as needed. Put some standards around the language and method of establishing consent so it can't be buried in EULAs, and then I'll be happy to check a box to grant businesses to transact with my PII on my behalf if there is a legitimate need.

hi-v-rocknroll 3y ago
Yes, this would need grassroots single issue advancement of something like a HIPAA law for general privacy and personal data that starts with an opt-in standard practice. There's really no way to change the structure of how the current situation of data brokering works in America without a broad and draconian law. Perhaps there should also be a nonprofit clearinghouse like a "credit agency" that provides a centralized portal for reviewing all of the permission links at and between businesses, and also a central point for changing phone numbers, email, shipping, mailing address, etc.
kbenson 3y ago
I think that's essentially just what I described, with the main difference being that I think we'll only actually get there if we approach it from the angle of PII being something intrinsically owned by the individual, not the company that generated it, which I think is easiest approached by making it a right of some sort. Then the carved out allowances for specific companies or industries are clear and their need can always be weighed against our rights, making them much easier to pull back, because it's obvious when it comes to our rights and the needs of an industry to continue making money, our rights come first. If it's approached from a non-rights angle at some point we are attempting to curtail an industry, I think that might be a much more contentious discussion. If we can't get rights, I wouldn't mind HIPAA being expanded into an overall PII protection system with two or more levels, one being current HIPAA health info, and the other main one being all other PII info and that allows a company to collect it for internal use without lots of constraints (depending on info, and purely so it doesn't accidentally tank existing industries that aren't problematic because all of a sudden they can't store some benign info they need that the law accidentally targets) but once they want to share it at all they need to adopt a much more stringent framework like medical info requires for tracking and accounting of it, which would probably weed out the vast majority of random "collect the PII and sell it because it's cheap" stuff that goes on, since it's no longer low cost at all given the requirements that would exist around it (including authorization to share). Just the cost structure around strict legal and storage compliance and requiring authorization and tracking of all sharing of information would disincentivize a huge amount of the abuse we see.

hi-v-rocknroll 3y ago

Yes, this would need grassroots single issue advancement of something like a HIPAA law for general privacy and personal data that starts with an opt-in standard practice. There's really no way to change the structure of how the current situation of data brokering works in America without a broad and draconian law. Perhaps there should also be a nonprofit clearinghouse like a "credit agency" that provides a centralized portal for reviewing all of the permission links at and between businesses, and also a central point for changing phone numbers, email, shipping, mailing address, etc.

kbenson 3y ago

I think that's essentially just what I described, with the main difference being that I think we'll only actually get there if we approach it from the angle of PII being something intrinsically owned by the individual, not the company that generated it, which I think is easiest approached by making it a right of some sort. Then the carved out allowances for specific companies or industries are clear and their need can always be weighed against our rights, making them much easier to pull back, because it's obvious when it comes to our rights and the needs of an industry to continue making money, our rights come first. If it's approached from a non-rights angle at some point we are attempting to curtail an industry, I think that might be a much more contentious discussion. If we can't get rights, I wouldn't mind HIPAA being expanded into an overall PII protection system with two or more levels, one being current HIPAA health info, and the other main one being all other PII info and that allows a company to collect it for internal use without lots of constraints (depending on info, and purely so it doesn't accidentally tank existing industries that aren't problematic because all of a sudden they can't store some benign info they need that the law accidentally targets) but once they want to share it at all they need to adopt a much more stringent framework like medical info requires for tracking and accounting of it, which would probably weed out the vast majority of random "collect the PII and sell it because it's cheap" stuff that goes on, since it's no longer low cost at all given the requirements that would exist around it (including authorization to share). Just the cost structure around strict legal and storage compliance and requiring authorization and tracking of all sharing of information would disincentivize a huge amount of the abuse we see.