Hacker News Reader

Comment by Icedcool | Hacker News Reader

This is yet another example of a need for some level of a bill of rights for our online lives/information.

Something that guarantee's proper and fair usage, with privacy. The decision making of which I'm sure would be a long and deep debate.

If someone stuck an rfid tag in your ear, and tracked where you moved and what you did, I would expect some compensation for that information. Yet we get cookies attached to our browsers, we are profiled and tagged to watch everything that we do online.

The de-regulation of the consumer information protection is important in that it is bringing attention to a bigger issue. The ISP's just want to do the same thing other companies have been doing all along.

View on HN

The European Union has some rules on personal data which are worth reading:

http://ec.europa.eu/justice/data-protection/

There's also an interesting difference in philosophy here: the EU and its member states have, reasonably consistently, been moving in a direction of more privacy and safeguards for personal data in recent years, and this has been significantly influenced by a perception that the tech industry can't or won't self-regulate to a level that was in the spirit of the previous laws.

Now, the EU doesn't always get this right. Some of the rules already agreed at that level, which will in due course become enforceable in member states, are obviously awkward or outright broken to anyone familiar with the actual technologies involved. There are some obvious contradictions (a cynic might use the word "hypocrisy") particularly in areas around potential surveillance by government agencies.

Still, compared to the kind of laissez-faire attitude adopted particularly in the US, the EU is practically living in a different world, and the difference is getting wider almost by the day. Moreover, I suspect a significant fraction of the US public would prefer a more EU-style arrangement (witness the arguments in the EFF report here). Obviously a lot of US businesses would not, though others, particularly those whose reputations rely more directly on being secure or trustworthy in some sense, might disagree.

Unfortunately, given the lobbyist-centric and partisan nature of current US politics, it seems inevitable that this fundamental divide will cause increasing amounts of grief all round, and the unknowns are more about who will be hurt more.

To my knowledge those privacy and safeguard were there since the beginning, originating in a 1978 french law passed in reaction to a government attempt to create a centralized database of all french citizen. This law created the french CNIL[1] in charge of data protection, the first of its kind but soon to be replicated in other countries.

In 1980 work began on a data protection directive[2] which would pass 15 years later after giving birth to 1981's Convention for the protection of individuals with regard to automatic processing of personal data[3]

At the turn of the 2000's through lobbying of various industries and government (including the french government) reversed direction and managed to pass a data retention directive at the European level. This got challenged at all steps from locals to the highest European Court of Justice which invalidated the directive for being contrary to fundamental human rights.

This didn't happened by chance, it took years of dedication and hard work to get there. And it got the attention of a bunch of very dedicated internet geeks who got themselves into politics to defend the internet and privacy. This gave rise to association of people such as la quadrature du net[4] who has been active at the national level up to the European level.

So now the politicians at the European level have a significant amount of backup from concerned citizens and netizens who provide all technical knowledge and background required to understand the significance of technical piece of legislation.

But a most significant difference with the US is World War 2 took place in Europe. (which kinda gave birth to the EU as to prevent Germany and France going to war again a joined union of coal and steel production deal was made which laid the foundation for the European union[5]. The point is Europe and in particular Germany one of the most influential country in the European Union has first hand experience of what the effect of mass surveillance can be and the importance of privacy. WW2 and nazism industrial attempt at genocide explains why the french were outraged by the government attempt at a centralized database of french citizen identified by social security numbers, and why Germany opposed the data retention directive.

The situation is a bit different in the US, when google or the like publicly oppose a bill they're defending their own interest not the general public. When an individual organize people to successfully oppose a bill, he gets pushed to suicide under government pressure probably using the data the govt agencies have on him as Aaron Schwartz story shows.

There's also the economic standpoint, most of the major internet companies are from the US so it makes sense for the EU to defend their population from those and maybe give an advantage to European companies while on the other hand the US has no foreign market dominant companies to defend from and instead has incentive to protect those companies and further extend their domination.

Different histories, different incentives hence different approaches to privacy.

[1]: https://en.wikipedia.org/wiki/Commission_nationale_de_l%27in...

[2]: https://en.wikipedia.org/wiki/Convention_for_the_protection_...

[3]: https://en.wikipedia.org/wiki/Data_Protection_Directive

[4]: https://www.laquadrature.net/en

[5]: https://en.wikipedia.org/wiki/European_Coal_and_Steel_Commun... and https://en.wikipedia.org/wiki/Schuman_Declaration

I would disagree that a bill of online rights is needed, rather a bill of universal unalienable rights would be enough.

Oh and the good news is that such a declaration of human rights already exists so most of the work is already done.

I'm not aware of this deregulation of consumer information protection, can you provide context on this as a web search drives me to the FTC website.

I'm not sure what you mean by ISP wanting to do the same thing other companies have been doing, AFAIK ISPs have been involved is collecting data and exploiting it for profit for as long as commercial ISPs exist.

Not to take away from your point (if anything, it underscores your position), but you do realize nobody needs to stick an RFID tag in most people's ears. Most people willingly carry a tracking device around. I'm using mine to write this comment.

Yep, I meant to allude to this... and agree 100%.

>If someone stuck an rfid tag in your ear, and tracked where you moved and what you did, I would expect some compensation for that information.

How many centimeters away from your ear is your mobile phone right now?

Totally.

One of the things that strikes me as so crazy we don't have this here in the US, is the UN considers it a basic human right[1].

[1] http://www.un.org/en/universal-declaration-human-rights/

Since "this" as defined by the U.N. means "No one shall be subjected to arbitrary interference with [personal] privacy", not "absolute right to privacy", we do indeed have "this" in the U.S: https://en.wikipedia.org/wiki/Privacy_laws_of_the_United_Sta...

There have to be teeth to the law in order to "have" it, though. Case in point: Gregg Steinhafel is still sitting pretty.

The UN can make whatever they want a right. They don't really have any way to enforce these rights.

This is true, and I wasn't claiming anything further. However, according to Wikipedia, the United States was one of the 48 countries who voted to proclaim the Universal Declaration of Human Rights. There were 8 abstentions, but none opposed.

The Universal Declaration of Human Rights is a document which is globally accepted, therefore, to represent what human rights should be. The fact that the US, the supposed "land of the free", falls short of this, is just particularly sad.

[The UN] don't really have any way to enforce these rights.

However, the countries that belong to the UN do. If enough of them are willing to put their money where their mouth is, which is going to be a matter of local political pressures as much as anything, the picture changes.

The UN shouldn't have any power. Especially because of things like this (among others):

https://www.washingtonpost.com/news/the-intersect/wp/2015/09...

it seems like we fail by restricting the majority of those rights. very sad.

Interesting. Thanks for the link.

Is article 12 what you are speaking on?

"No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honour and reputation. Everyone has the right to the protection of the law against such interference or attacks."

That seems really broad. Does this apply to private citizens and firms or only governments? If the former it seems a great deal of journalism would be illegal.

A few recent examples. When Rachel Maddow released Trumps tax returns was that a violation of article 12? What about when that "grab her by the" tape came out, Trump clearly intended that to be a private conversation and it was a "attack upon his honour and reputation" wasn't it? I don't see a line that allows for truthful attacks.

I don't know if I want to live in a country where it is illegal to report on fact in such a broad and sweeping manner.

There's the general rule of thumb that one's right to privacy is inversely proportional to one's power over others. Be it political, economic, or whatever. So a Presidential candidate deserves less privacy, because they pose more of a public risk. That distinction is clear in US libel law.

That's US law, in the US truth is a sufficient argument against libel. This is the UN charter. Do you know of any other documentation that outlines article 12 in more detail? I'm coming up empty.

Well, the UN charter dates from 1948. Those were heady days. I'm sure that there's much commentary. The legacy in the EU Right to Be Forgotten is clear. And more generally, in EU enforcement of privacy rights vs corporations.

The UN charter does not apply in Europe, instead it's the 1950's council of Europe "European convention on Human Rights"[1] that applies.

[1]: https://en.wikipedia.org/wiki/European_Convention_on_Human_R...

I think what we need is acknowledgement that any sufficiently large institution is indistinguishable from government, and include only those corporations that meet the criteria of "too big to be private" (related to "too big to fail") in restrictions placed on government.

I wouldn't say "indistinguishable", because governments at least theoretically serve the people's will. US law was initially quite hostile to corporations, which were considered unaccountable. Until the late 1800s, only corporations with public-interest charters were legal.

Who defines sufficiently large? There is probably a ISP that is smaller than the New York Times does this standard not apply to them?

I don't think it's possible to create a totally incorruptible system, and who defines sufficiently large is an important problem, but I think it's not a reason to dismiss the idea. Any regulation is plagued by this question and the specter of regulatory capture. Do you think it's possible to counteract the natural decay of free markets without a [del:'central'] regulatory authority?

No, that standard would not apply to a small ISP. The premise is institutions that grow strong enough are able to unduly influence and capture the regulators more easily. Corporations need to be kept small enough to regulate effectively. The existence of "too big to fail" private institutions is a threat to democracy.

EDIT: National government, itself an institution, also needs to be kept small enough that it can be contained by the regulators on it, so this is clearly not a simple problem. The issue there (in my opinion) is that the check on national government is supposed to be the states, and they are too weak to do that effectively.

I volunteer to define sufficiently large, and I say larger than 0 is sufficiently large. Why ? Because a big player can buy or control any smaller player, so if you want protection from the bigger ones, you need either to protect from everyone or change the way corporation work. I'd suggest going back to earlier times when corporations did not have the same rights as humans and were of public interest, or maybe remove the stock exchange, or limit gambling to banks' own money instead of using deposits.

> Does this apply to private citizens and firms or only governments?

Human rights apply to humans. Firms and government are not human, not even alive or have any tangible existence.

I don't know about those Trump examples, but it seems to me that usually an elected official is a public figure and as such privacy laws do not apply. Then again human rights and legality are two different things, some human rights may be considered illegal in some places.

Indeed. That's also why Libel and Slander are an offense in England, even if it is true. Truth there, is no defense.

I much prefer the truth as a defense idea, which goes against the strict interpretation of the UN's charter.

And do not forget, "Grab her by the pussy" is now the presidential standard. there was some in this country that were that crude and direct about sexual assault, but those views are now given much more airtime..

I much prefer the truth as a defense idea

The problem with truth as an absolute defence is that as the courts famously remind us, "the truth" is not the same standard as "the truth, the whole truth, and nothing but the truth".

The extra parts can be rather important when someone's reputation is at stake. For example, consider the difference between "John was accused of being a paedophile" and "John was accused of being a paedophile, though the investigation was soon dropped after no supporting evidence was found and it turned out that his accuser was an ex-girlfriend with a track record of psychiatric problems including making false allegations of serious criminal behaviour to get people she didn't like into trouble".

This is also why the EU "right to be forgotten" ruling wasn't nearly as crazy as some people have been suggesting, BTW.

I'm a big supporter of the RTBF and I wish we had it here in the United States. The law does, actually, set fairly clear lines in most of the places people seem to be concerned, in terms of prohibiting "forgetting" information deemed important to public interest, for instance about celebrities or severe crimes. It explicitly highlights outdated or incorrect information as being suitable to be forgotten.

I think corporations here in the US that are against it managed to set a pretty good FUD campaign about right to be forgotten, and I think a lot of people bought into it.

Reply on news.ycombinator.com