Hacker News Reader

Comment by giantg2 | Hacker News Reader

Your argument assumes that selling data is bad. What supports your position?

Edit: in the context of the CA DMV releasing data under the DPPA law.

Data is personal property that is being handled without consent and without regard for social problems. There needs to be a hard stop put towards those practices.

In general I would agree, but how does that apply to the to the scenario we are discussing which is the CA DMV under the DPPA?

These data were collected to ensure road safety. Anything unrelated to road safety is taboo. No enforcement of immigration, no debt collection, no enabling of stalking, especially no aggregation with other data sources.

Actually that's only part of their intended use. The data is also used to collect tax (registration) and maintain records of ownership (titling).

Many states also use this information to register, or solicit the individual to register, to vote. Law enforcement also uses this data for enforcing all manners of law when they look up a person to question or cite, not just immigration. Since drivers' licenses are used for identification, you can see that they are used on many government forms such as tax returns or background checks. Along these lines, the only way to ensure the government will not use your data would be to prevent the government from collecting and storing it (rough paraphrase from Snowden). But if you prevent the collection of the basic data referenced in the article, then how do you provide the same benefits to society that the systems do today?

The issues you have seem not to be about the state releasing records but rather with how the government uses the data. The basic information referenced in the article is also available in other country's systems to many of the same organizations authorized under the DPPA. Given the system is also about titling and registration, the access by debt collectors would be warranted, especially if it is dealing with a vehicle. How exactly is this system enabling stalking given the protections of the DPPA?

Do you have any examples of countries that don't aggregate data for government use and don't allow PIs to search many kinds of official documents? What system do you see that would replace the current one and maintain all the societal benefits but somehow increase privacy?

Somehow we fell down a slippery slope where a debt collector got access to unrelated DMV data. This is unacceptable, the alternative is to resist expanding scope.

It is acceptable, that's why the law protecting DMV data categorically allows it, indicating that society approves of that use.

It wasn't a slippery slope - the opposite in fact. The records were practically wide open and the DPPA set the limits on who can access it and for what reasons.

I'd appreciate a real response to my prior comment. Simply stating your opinion that an action is unacceptable does not make for productive discourse.

The concept itself. It is being sold without my express consent. I'm being given no share of the profit that someone else is making from my information.

You have implied consent because as an informed citizen you know that the law allows this data to be used in the ways defined under the law.

You have no choice, that does not mean you consent. No driver license or you give the data, it's closer to gunpoint coercion than to free choice.

Actually, your choice is a combination of getting the license and voting. The DPPA defined who could have access and for what purposes. States can also restrict it further. The DPPA and state laws are created by the officials that citizens elect, and as part of being a citizen we consent to being governed by those laws. If this sort paradigm is a problem, then there are many other issues in out society that would need to be changed, such as TSA searches and taxes.

Why not have mandatory public webcams in everyone's homes?

Two reasons; privacy is axiomatically a human right (since it's an axiom you can unilaterally disagree, just as with any other human right), and caused harm arguments that the information is available in a way that can cause your physical harm (when you cannot escape a stalker, or a general class of invasive people if you're a celebrity or piss off qanon).

How does a caused harm argument apply to the scenario being discussed (the CA DMV under the DPPA law)?

That's a very generalized axiom that doesn't even define what would be accepted by a society as falling under the protection of privacy. so we could accept it as true and discuss it's limitations and scope, but the axiom itself does not address whether the 'selling' of data under the DPPA is wrong. For example, is everything protected under privacy? Can I claim that my salary should be private from the government so that I don't have to pay taxes?

I was primarily responding to "what's the harm in selling data?" generally. I don't know about DPPA specifically but it's hard for me to imagine the DMV selling data to a broad subset of private companies in a way that is notably different than just making it public (eg, I know that companies have done soft pulls of my credit report even while I had a freeze, so it actually seems like the info in my credit report is nearly-public despite protections similar to DPPA).

The difference between the current structure and making it fully public is that the current law regulates what the data can be used for and who could access it. So only companies in specific industries or PIs would be able to access it and only for authorized use cases. That cuts out a very large portion of the public and has basically eliminated (couldn't find any examples nor people on here provide any) the abuse that was taking place before, like targeting abortion providers. Any misuse of the info results in loss of access and possibly other actions, like losing your PI license.

I see what you mean about the credit data access. My suspicion is that the permission to do that is hidden in the fine print of many agreements. They do similar stuff with credit cards where they will periodically check your card to see if it is valid, like for EZ-Pass. Car insurance does the same sort of thing. When you sign up, you give them permission to access your driving records, ownership info etc. That's how they can do that spooky stuff like list what cars you own without even needing to put in the VIN yourself (the industry also aggregates the data that any insurance provider has on a driver, but that much more detailed and personal).

The only way to truly end the privacy concerns around the DMV data would be to eliminate the need for the data to be collected and distributed. The government wont stop collection because they use that data in all sorts of systems for stuff like collecting fees/taxes and validating identities addresses. Data distribution could be partially reduced by making insurance companies ignore that type of data in their models. Many states would not go for this because they work with the companies to verify insurance information around mamdatory insurance laws. Plus, as long as cars are financed the banks and debt collectors need some way to track who is registering their asset and where.

Reply on news.ycombinator.com