Hacker News Reader

Comment by api | Hacker News Reader

In the long term we need HIPAA style regulation for all kinds of personal data: friend graphs, behavioral histories, private messages, and especially things like location data or voice assistant audio samples.

Leak such data without explicit customer consent? That will be $10,000 per incident. So if you leak 100 data points of someone's location history that will be a $1,000,000 fine.

Explicit consent must be per-incident as in "YES I give my consent to send this information to <recipient> for purpose of <...>."

That would incentivize strong security practices and even more importantly dis-incentivize data hoarding beyond what is needed to provide a service. Hoarded personal data would be a gigantic risk and liability.

View on HN

It would just pass the buck. What everyone on HN is clamoring for will result in basically more bureaucracy and longer EULAs with no actual change in business practice.

Businesses don't take it seriously because people don't actually care. Some do. The vast majority don't. They might say so in a survey, but at the end of the day, Facebook (and companies like it) will continue to survive doing what they always have been and people will continue using those services.

That's the root of the issue, though. People really don't care as much as posters on HN think they do. If we could acknowledge that, I think we could come up with better solutions.

The GDPR should take care of that to a large degree.

Consent must be asked for in a clear understandable fashion.

Burrying some legalese crap at page 29 of your 12'000 word TOS doesn't cut it.

Could be that Facebook tries to push the envelope yet again. They may come to regret it.

We'll see.

If I had to bet, it will not be the case that we'll see some big exile of users as a result of having to click through an additional "Agree and Continue" dialogue to get to what they were going to do anyway. The GDPR will do a lot more to appear to be doing things right than actually benefiting users.

> implying that adding an additional "are you sure" to the process of joining a social media platform _doesn't_ benefit users.

/snark

It'll be about as beneficial as the "this site uses cookies" notices or the Vista UAC that everyone just clicked through anyway.

It depends. Courts could rule that click through licences don't constitute "informed consent", because let's be honest, people aren't informed about what they're signing.

Respectfully if users are honestly considered too dumb to read targeted dialog boxes, the regulation required to "fix" that "problem" is going to be downright draconian.

What about the data already collected? Do they need consent to keep it?

I'm not the expert, but from what I know

You have a right to learn what data they have about you, with whom they share it and a lot more details In addition you can opt out of anything you agreed on earlier and I would be surprised if you can't request deletion if the business has no business reason to store it. (Arguably, a difficult call with Facebook whom's entire raison d'être is to fuck with your privacy).

That's the root of the issue, though. People really don't care as much as posters on HN think they do. If we could acknowledge that, I think we could come up with better solutions.

FB didn’t drop billions in value because nobody cares, it’s just that most people take a lot of repetition to grasp the scope of the issue.

Investors care when a company is painted in a negative light and threatened with regulation.

That is not the same as individual users caring about data privacy as much as HNers believe.

What constitutes that reputation if not the views of “individual users” determining the fate of the platform?

I think you’re selling poeple short, and in the face of evidence contrary to your claims.

Looming regulatory threats will push any stock price down.

And I'm not selling people short. I think the risks are incredibly overstated and the people who appreciate free services (acknowledging some data sharing is happening) are not necessarily just dumb-dumbs being preyed upon.

It’s not a free service, it’s a surveillance platform that provides a paid service to advertisers.

So is Google. But the semantics are irrelevant.

The same Google covering its ass with $300 million to fight disinformation on its own platforms?

Is that what taking down videos that are conservative or critical of the government is called now?

Yeah, that same one?

"People don't care" about things like this until there are consequences. Nobody cares about pollution until it impacts their health or destroys their property. Nobody cares about financial crime until it crashes the economy and costs them their job.

I think we're reaching the point where all these data mining honeypots we've built over the past 20 years are being used in ways that are nefarious enough that people are starting to care.

I feel like claims like these are easy to make, yet very difficult to substantiate.

I think it's in the media a lot right now because it potentially helped Donald Trump win an election (despite the Obama '12 campaign being praised for similar tactics).

People having the data I put on Facebook (which is not notably more than is available through public sources) is not going to destroy my property or lose me my job. The rhetoric here has been dialed up to 11 and it's not winning any converts.

> [Spammers] don't take it seriously because people don't actually care. Some do. The vast majority don't. They might say so in a survey, but at the end of the day, Facebook (and companies like it) will continue to survive doing what they always have been and people will continue using [email].

Yes, always thought it weird that folks are so protective about health data but nothing else. Why the dichotomy?

Yeah but then who is going to pay to use every single website? I'm going to do that. I'd rather they spend all this time attempting to show me ads that I will never see and be able to use great sites/apps for free rather than keep paying everytime I want to go to a website.

This is basically what GDPR is.

Reply on news.ycombinator.com