5 ms·

I don't think it's possible to craft regulation such that companies collecting data for "internal use" can't abuse it. It's so easy to create plausibly deniable

by advael 2y ago

I don't think it's possible to craft regulation such that companies collecting data for "internal use" can't abuse it. It's so easy to create plausibly deniable ways to move data around. In ML research we get a lot of "anonymized" data for example, which is ridiculous because even pretty primitive statistical methods can usually use such data to uniquely identify people, let alone the inference techniques in widespread usage in industry today In theory it could be different, in practice it simply isn't. If we want any kind of privacy law, "internal use" or "legitimate interest" or whatever nonsense the data brokers deploy to pretend there's some way to do this that isn't unethical is a smokescreen and a loophole in every context, and we should ban the harvesting of that data regardless of its intended use

dylan604 2y ago
I'm much less concerned about if 'you collect it, you use it' situations. It's the companies that build an app with a psuedo purpose whose real purpose is to collect data for reselling later. Collecting data for the sole purpose of selling to others should be regulated into oblivion.
- advael 2y ago
  Okay, so we ban selling data and then people who want it will buy or even fund breaches instead. Massive breaches will likely become more common, because that's how driving valuable stuff into a black market always works, and companies who aggregate data already do a shit job protecting said data and face negligible consequences from regulators or markets for this. Even the press will happily blame the constant stream of leaked data on unnamed "hackers" every single time I also expect to see a shift to buying more "data-driven insights" from big data aggregators, which in practice will mean the same thing as buying the data means now, just with the middlemen rearranged slightly Governments will still be able to subpeona the data in ways that route around human rights and on the rare occasions where this comes to light, "national security" and the need to fight whatever war - whether against a concrete nation or organization or an abstract concept - they believe will most muddy the waters to cite
MetaWhirledPeas 2y ago
> I don't think it's possible to craft regulation such that companies collecting data for "internal use" can't abuse it. Actually, the regulatory language is easy. "You may not buy or sell user data." The friction comes from the fact that a large part of our economy is highly dependent on the ability to buy and sell user data.
- WhyNotHugo 2y ago
  > Actually, the regulatory language is easy. "You may not buy or sell user data." I believe the easy workaround is to designate the other party a "data processor" or something of that sort. "We're not selling data, we merely allow partners to access it to generate reports for us."
- A4ET8a8uTh0 2y ago
  This AND liability on the data being part of an inevitable breach. Both working in tandem would limit data collected to a minimum required to operate and remove incentive to collect. But as you note.. surveillance economy will not be happy about it and likely fight back. Amusingly, the people who understand the risks and take precautions are also least likely to put a spotlight on them, which privacy-conscious tend to avoid.
- dylan604 2y ago
  > The friction comes from the fact that a large part of our economy is highly dependent on the ability to buy and sell user data. This is only a recent part of the economy that the world would not collapse if we went back to a time of it not being part of the economy. Just because something is does not mean that it should. There are plenty of historical example of where something was that was not right that took time so that eventually what is is now no more.
- advael 2y ago
  I don't think any such regulation can have teeth or actually protect anyone. The mechanism by which data is abused is a moving target that will shift with any regulation you throw at it. It will go to black markets, be reshaped through loopholes, or done in plausibly deniable ways by entities that can bog any legal challenge down in technicalities indefinitely, while still probably making more doing it than they'll be fined for, and every loophole will require new regulation to close it. The only way to regulate data collection with teeth is to make the collection itself illegal, and actually enforce those laws
CuriousSkeptic 2y ago
GDPR is pretty clear on anonymisation requirements https://www.edps.europa.eu/system/files/2021-04/21-04-27_aepd-edps_anonymisation_en_5.pdf https://www.edps.europa.eu/system/files/2021-04/21-04-27_aep... So somewhat possible?
- michaelmrose 2y ago
  There is no point in leaving a loophole when we can forbid selling data entirely.
- ideashower 2y ago
  How do you anonymize a person's location? It just isn't possible. https://dl.acm.org/doi/abs/10.1145/3038912.3052620 https://dl.acm.org/doi/abs/10.1145/3038912.3052620
  - CuriousSkeptic 2y ago
    The law doesn’t really care if its possible. It just states that it is your responsibility when you fail.

by advael 2y ago

dylan604 2y ago

I'm much less concerned about if 'you collect it, you use it' situations. It's the companies that build an app with a psuedo purpose whose real purpose is to collect data for reselling later. Collecting data for the sole purpose of selling to others should be regulated into oblivion.

advael 2y ago
Okay, so we ban selling data and then people who want it will buy or even fund breaches instead. Massive breaches will likely become more common, because that's how driving valuable stuff into a black market always works, and companies who aggregate data already do a shit job protecting said data and face negligible consequences from regulators or markets for this. Even the press will happily blame the constant stream of leaked data on unnamed "hackers" every single time I also expect to see a shift to buying more "data-driven insights" from big data aggregators, which in practice will mean the same thing as buying the data means now, just with the middlemen rearranged slightly Governments will still be able to subpeona the data in ways that route around human rights and on the rare occasions where this comes to light, "national security" and the need to fight whatever war - whether against a concrete nation or organization or an abstract concept - they believe will most muddy the waters to cite

MetaWhirledPeas 2y ago

> I don't think it's possible to craft regulation such that companies collecting data for "internal use" can't abuse it. Actually, the regulatory language is easy. "You may not buy or sell user data." The friction comes from the fact that a large part of our economy is highly dependent on the ability to buy and sell user data.

WhyNotHugo 2y ago
> Actually, the regulatory language is easy. "You may not buy or sell user data." I believe the easy workaround is to designate the other party a "data processor" or something of that sort. "We're not selling data, we merely allow partners to access it to generate reports for us."
A4ET8a8uTh0 2y ago
This AND liability on the data being part of an inevitable breach. Both working in tandem would limit data collected to a minimum required to operate and remove incentive to collect. But as you note.. surveillance economy will not be happy about it and likely fight back. Amusingly, the people who understand the risks and take precautions are also least likely to put a spotlight on them, which privacy-conscious tend to avoid.
dylan604 2y ago
> The friction comes from the fact that a large part of our economy is highly dependent on the ability to buy and sell user data. This is only a recent part of the economy that the world would not collapse if we went back to a time of it not being part of the economy. Just because something is does not mean that it should. There are plenty of historical example of where something was that was not right that took time so that eventually what is is now no more.
advael 2y ago
I don't think any such regulation can have teeth or actually protect anyone. The mechanism by which data is abused is a moving target that will shift with any regulation you throw at it. It will go to black markets, be reshaped through loopholes, or done in plausibly deniable ways by entities that can bog any legal challenge down in technicalities indefinitely, while still probably making more doing it than they'll be fined for, and every loophole will require new regulation to close it. The only way to regulate data collection with teeth is to make the collection itself illegal, and actually enforce those laws

CuriousSkeptic 2y ago

GDPR is pretty clear on anonymisation requirements https://www.edps.europa.eu/system/files/2021-04/21-04-27_aepd-edps_anonymisation_en_5.pdf https://www.edps.europa.eu/system/files/2021-04/21-04-27_aep... So somewhat possible?

michaelmrose 2y ago
There is no point in leaving a loophole when we can forbid selling data entirely.
ideashower 2y ago
How do you anonymize a person's location? It just isn't possible. https://dl.acm.org/doi/abs/10.1145/3038912.3052620 https://dl.acm.org/doi/abs/10.1145/3038912.3052620
- CuriousSkeptic 2y ago
  The law doesn’t really care if its possible. It just states that it is your responsibility when you fail.