4 ms·

Assume the only surviving beneficiary of the company is a Chinese nationalist. All of the company and servers are transferred over to him. He quickly moves all

by RyanZAG 11y ago

Assume the only surviving beneficiary of the company is a Chinese nationalist. All of the company and servers are transferred over to him. He quickly moves all the data over to mainland China and uses it for.. who knows? Even if you had laws, I'm not sure they would help in this case. Besides, even if you have perfectly written self-binding contracts, there's nothing stopping the next owner from being a scumbag and finding clever or illegal ways around the deal. eg, he could 'find' a million dollars on the pavement in the surprising position where he happened to 'lose' a hard drive with all the data. Exaggeration obviously, but if the data is in someones possession there are a lot of things that can be done with it without overtly breaching any agreement. Eg, he could start a new company himself that 'leverages' the data to provide all previous customers with 'incredible deals and benefits'.

JoshTriplett 11y ago
You're now assuming the new owners are willing to commit illegal acts, or at the very least breach a contract. (And the newly started company would be breaching the contract as well, if it was written to exclude that.) That's at least a significantly higher bar than "the highest bidder can do whatever they want with the data", which is the current state of things. But yes, even better protection would be never collecting data you don't need in the first place.
- pgeorgi 11y ago
  > But yes, even better protection would be never collecting data you don't need in the first place. "Germans even have a word for it: Datensparsamkeit, the principle of only collecting the bare minimum of data necessary." (http://qz.com/390988/germans-are-paranoid-that-the-us-is-spying-on-their-data/ http://qz.com/390988/germans-are-paranoid-that-the-us-is-spy...) Since the concept was established in 1983 by the constitutional court, there's probably a body of knowledge around that, just in the 'wrong' language and hence less known in the anglo-saxon culture.
  - icebraining 11y ago
    The EU Data Protection Directive also pushes for that: "Member States shall provide that personal data must be (...) collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes [and must be] adequate, relevant and not excessive in relation to the purposes for which they are collected and/or further processed". http://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX:31995L0046 http://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX:319...
  - Symbiote 11y ago
    Britain has similar laws, of a similar age. We don't have a word for it, but I think there's an attitude that companies shouldn't be given more data than needed, and a suspicion when they ask. "Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed." [2] Which the guidance[1] explains as "So you should identify the minimum amount of personal data you need to properly fulfil your purpose. You should hold that much information, but no more. This is part of the practice known as “data minimisation”." [1] https://ico.org.uk/for-organisations/guide-to-data-protection/principle-3-adequacy/ https://ico.org.uk/for-organisations/guide-to-data-protectio... [2] http://www.legislation.gov.uk/ukpga/1998/29/schedule/1/part/I?view=plain http://www.legislation.gov.uk/ukpga/1998/29/schedule/1/part/...
    - amelius 11y ago
      And how much data is google allowed to store about us? And why isn't the user allowed to specify the amount of bits that google store about us? There are 7 billion people on this planet. If I allow google to store at most 32 bits about me, then at least that data cannot uniquely identify me (roughly speaking).
  - GauntletWizard 11y ago
    It's a pretty anti-science stance. Data is very rarely 'unnecessary'. The scientific method requires that you investigate and control as many variables as possible, because often things that you don't realize have far-reaching effects. Throwing that data away early is bad for your business, bad for your customers, and bad for society. No, I don't think companies should be aggregating all data without regard for consequences of breach, but nor do I believe that cutting data is the answer. Consumers, nee, people, need to learn that 'their' data is not so special snowflake, and that aggregate data is a fantastic tool for making their lives better.

by RyanZAG 11y ago

JoshTriplett 11y ago

You're now assuming the new owners are willing to commit illegal acts, or at the very least breach a contract. (And the newly started company would be breaching the contract as well, if it was written to exclude that.) That's at least a significantly higher bar than "the highest bidder can do whatever they want with the data", which is the current state of things. But yes, even better protection would be never collecting data you don't need in the first place.

pgeorgi 11y ago
> But yes, even better protection would be never collecting data you don't need in the first place. "Germans even have a word for it: Datensparsamkeit, the principle of only collecting the bare minimum of data necessary." (http://qz.com/390988/germans-are-paranoid-that-the-us-is-spying-on-their-data/ http://qz.com/390988/germans-are-paranoid-that-the-us-is-spy...) Since the concept was established in 1983 by the constitutional court, there's probably a body of knowledge around that, just in the 'wrong' language and hence less known in the anglo-saxon culture.
- icebraining 11y ago
  The EU Data Protection Directive also pushes for that: "Member States shall provide that personal data must be (...) collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes [and must be] adequate, relevant and not excessive in relation to the purposes for which they are collected and/or further processed". http://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX:31995L0046 http://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX:319...
- Symbiote 11y ago
  Britain has similar laws, of a similar age. We don't have a word for it, but I think there's an attitude that companies shouldn't be given more data than needed, and a suspicion when they ask. "Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed." [2] Which the guidance[1] explains as "So you should identify the minimum amount of personal data you need to properly fulfil your purpose. You should hold that much information, but no more. This is part of the practice known as “data minimisation”." [1] https://ico.org.uk/for-organisations/guide-to-data-protection/principle-3-adequacy/ https://ico.org.uk/for-organisations/guide-to-data-protectio... [2] http://www.legislation.gov.uk/ukpga/1998/29/schedule/1/part/I?view=plain http://www.legislation.gov.uk/ukpga/1998/29/schedule/1/part/...
  - amelius 11y ago
    And how much data is google allowed to store about us? And why isn't the user allowed to specify the amount of bits that google store about us? There are 7 billion people on this planet. If I allow google to store at most 32 bits about me, then at least that data cannot uniquely identify me (roughly speaking).
- GauntletWizard 11y ago
  It's a pretty anti-science stance. Data is very rarely 'unnecessary'. The scientific method requires that you investigate and control as many variables as possible, because often things that you don't realize have far-reaching effects. Throwing that data away early is bad for your business, bad for your customers, and bad for society. No, I don't think companies should be aggregating all data without regard for consequences of breach, but nor do I believe that cutting data is the answer. Consumers, nee, people, need to learn that 'their' data is not so special snowflake, and that aggregate data is a fantastic tool for making their lives better.