US House Republicans introduce strategy to establish national privacy standard
republicans-energycommerce.house.gov
republicans-energycommerce.house.gov
(a) PROHIBITED CONDUCT.— A covered entity may not, through the collection use or sharing of personal information, discriminate against or make an economic opportunity unavailable on the basis of race, color, religion, national origin, sex, age, political ideology, or disability of a persons or class of persons.
(b) EXCEPTIONS.—Nothing in this section shall prohibit a covered entity from using or sharing personal information for the purpose of advertising, marketing, or soliciting economic opportunities to underrepresented populations."
The juxtaposition here makes it appear that every person could be considered a member of an underrepresented group and therefore that nothing will prohibit data sharing for marketing purposes. This bill looks like it is written with the goal of killing consumer privacy protections in the country.
Edit: Yes, I know draft bills change before they are passed. But draft bills often are the best expression of the drafters' priorities and intent.
Also: why are Republicans proposing big new regulation that would apply to every US business, impose additional bookkeeping & accounting work for every business, and then not improve consumer privacy protection? This is a tax on every US business, and it appears there is no meaningful payoff for consumers. Sounds like a lose-lose.
The answer is obvious with their historic agenda...
> discriminate against or make an economic opportunity unavailable on the basis of race, color, religion, national origin, sex, age, political ideology, or disability of a persons or class of persons.
They want, ironically, the anti-discrimination clauses. They want to prevent someone from discriminating in tech. That would (they hope) block the perceived anti-right bias, and maybe even prevent companies from blocking people like trump all together.
This bill is really about banning content moderation. Everything else is window dressing.
That's clearly a mistake of history. Political affiliation or non-affiliation really needs to be protected at the same level as religious affiliation or non-affiliation.
Gender and race are social constructs. But they have some form. Political ideology has zero form. This is either a move to render protected classes useless or turn every decision in America into a California-style well of litigation.
It's okay to apply standards to public spaces. Not every ideology deserves to be heard.
It is also religiously critical for religious institutions to be able to engage in religious discrimination; lest we ask whether we may have a Jewish pope lead the Catholic church.
We can discuss what ought to be all day, but I don't see the winds shifting anytime soon. We mind as well also discuss whether the world should be united, or... it would be a better expenditure of energy to discuss the oughts which we can actually do something about.
Protecting people for retribution and discrimination based on their voting is already a thing, so why stop there?
From EEOC on employment: "race, color, religion, sex (including pregnancy, sexual orientation, or gender identity), national origin, age (40 or older), disability and genetic information (including family medical history)." [1]
From FHA: "The Fair Housing Act prohibits this discrimination because of race, color, national origin, religion, sex, familial status, and disability." [2]
Note that this act's (a) clause does not contain "sexual orientation" as above, and (b) specifically contains the new protected category of "political ideology".
[1] https://www.eeoc.gov/employers/small-business/3-who-protecte...
[2] https://www.hud.gov/program_offices/fair_housing_equal_opp/f...
This is all about getting "political ideology" added to the list so that they can publicly discuss their horrendous beliefs and not get fired
https://www.shouselaw.com/ca/labor/harassment/political-reta...
AFAICT the bill does nothing to limit who Twitter can ban based on publicly available information, including posts on Twitter itself.
Two potential reasons.
One: They believe federal privacy regulations are inevitable, and want to take the opportunity to shape it as much as they can. Two years ago there were competing Republican & Democrat proposals for privacy legislation; the meats were pretty similar to each other, and GDPR, and CCPA. The differences were some subtle details around the edges that are likely to end up being HUGELY impactful.
For example, the democrat proposal included a Right of Private Action while the republican proposal did not. You can blah blah blah all goddamn day about what counts as private and what doesn't. But at the end of the day, the thing that matters most is "what happens when a company breaks the law?" Being able to sue them yourself is a very large difference from requiring all enforcement run through the Attorney General or an executive branch whose funding can be rescinded.
Two, but related to the first: There are currently multiple states that have local privacy regulations. The number is likely to increase. Companies would prefer to deal with one set of laws rather than fifty even if the one set of laws is more difficult that any of the fifty laws it replaces.
On a related note, the other serious difference between democrat and republican proposals was called "pre-emption." The republic proposal would have removed the ability for states to pass stricter privacy laws at home.
This is a strategy to introduce a national standard of no privacy.
"Principle #1: The internet does not stop at state lines, so why should one state set the standard for the rest of the country?"
then later
"Principle #4: We must also protect small businesses and innovation. We know that in Europe, investments in startups are down more than 40% since their data protection and privacy law—the General Data Protection Regulation—went into effect. We must guard against a similar situation here. We want small businesses hiring coders and engineers, not lawyers."
This is not that world.
Don't forget it being short enough for the average person to be able to have time to read it.
I can't find it, but I remember just seeing a headline on HN that European startup investments were at an all-time high. First relevant search hits were [1], [2], I did not fact-check those.
[1] https://news.crunchbase.com/news/european-vc-funding-h1-2021... [2] https://www.cnbc.com/2021/06/18/european-start-up-investment...
https://2utfff4d3dkt3biit53nsvep-wpengine.netdna-ssl.com/wp-...
Couldn't you replace "privacy" here with guns or healthcare or nearly any other national issue.
edit:
>SEC. 111. ANTI-DISCRIMINATION. (a) PROHIBITED CONDUCT.— A covered entity may not, through the collection use or sharing of personal information, discriminate against or make an economic opportunity unavailable on the basis of race, color, religion, national origin, sex, age, political ideology, or disability of a persons or class of persons.
Notice they added something to the normal "protected classes" in the US.
How do you even define something as political? Eg. Saying X group of people should stop being killed by police is, to some, a validation of humanity, but to others a political issue to be argued at the ballot box?
What about marriage, which is based in laws, but some say should be a religious issue? Is that protected?
What about hate speech? Thats very much bad, until someone claims they're just politically conservative, so now its protected?
That's not how westerners feel about gender any more.
What about terrorist recruiters? People in the US who try to garner support of others but don't actually do the terrorism.
How and when you got there is irrelevant. I'd want the same protections for people I vehemently disagree with because it's the right thing to do (and aligned with the consitution).
> How do you even define something as political?
I imagine this will be made more concrete but based on some political affiliation (party registration).
> What about marriage, which is based in laws, but some say should be a religious issue? Is that protected?
Strawman...?
> What about hate speech?
You can choose to ignore and disregard (like most people do) these types. They're fringe for a reason. In cases of actual threats taking place (as opposed to things that don't suggest action being said that people don't like), there is already a legal framework in place for handling that.
Nah. I disagree. In Germany, its illegal to be nazi-sympathizing. As someone who disagrees with Nazi ideology, I think that sort of law (and societal environment) is healthy and don't think we should protect that.
If that happened in the US then some small group would still be waving the nazi flag as a source of pride the way that some still wave the confederate flag. I don't see a need to protect such extreme awfulness.
> I imagine this will be made more concrete but based on some political affiliation (party registration).
So any topic that is related to a party platform is political? If Bernie keeps tweeting about amazon is amazonian discussions now protected political speech?
> Strawman...?
No its a very real topic. "Gay" marriage is an important issue in many countries. Its becoming less relevant in the political sphere of the US lately, but its not crazy to imagine republicans trying to re-litigate the issue.
Gay people don't think of marriage as particularly political, its just a right they expect to continue having. Religious zealots want to strip that right away, and litigate it in courts. Discussions of the right to marry are classified by some as political discussions.
This is a real topic real people actively discuss and does come up in political discourse.
> as opposed to things that don't suggest action being said that people don't like
Hate speech is not just speech "that people don't like".
Also why should platforms be forced to host speech that is hateful? As is often mentioned here on HN, you have a right to speak, not to an audience. Why should platforms not be able to avoid or dispell people that say things that no one wants to hear?
Well, yeah, they were throwing people in gas chambers over there—context matters. Here, you might get a small group of assholes wearing armbands and shaving their heads. And, because they're nazis, they're likely gigantic pussies who aren't going to do anything (and if they do, guys like me will just shoot them). It's moot.
> So any topic that is related to a party platform is political?
Is that what I said? No. And I'm making a guess.
> "Gay" marriage is an important issue in many countries.
You didn't say anything about gay marriage, you said marriage.
> Hate speech is not just speech "that people don't like".
Yes, it is. Unless someone takes physical _action_, "sticks and stones" applies. What's also troublesome about "hate speech" is who gets to define it. Once that cat's out of the bag, all hell breaks loose (what we've seen the past few years is the prototype). People should be free to speak and deal with the social consequences of that speech just like they have for hundreds of years.
> Also why should platforms be forced to host speech that is hateful?
Because they're taking advantage of other protections offered by the U.S. government and operating a U.S. based company which operates under U.S. law (and by extension, the constitution). If they're that concerned about preventing a few assholes from saying stupid stuff, they should move their servers out of the U.S. I'd rather see those companies going after real crimes like scams, pedophiles, etc—not people getting their feelings hurt.
Ultimately, banning speech further excites extreme behavior because those people don't have an outlet. It's far more likely that they'll be corrected (or simply ignored) by others if they're uncensored than they would if they were censored.
Notice how for the first ~15-20 years of the internet, there was no nazi panic? They were around. Nobody paid them any mind. They didn't accomplish anything (and were on no trajectory to do so). Does that mean they're good? Of course not. But I'd rather they have their skinhead jamboree on a forum rather than go after gay people on the street for being "those people who took our speech away."
This is not true at all and would be dystopian if it were. I don't even know where to start with the idea that it can be illegal to sympathize with something or other, in any state that has some basic respect for the rule of law. Show me the paragraph that bans being "nazi-sympathizing" or the court case where someone got convicted for being "nazi-sympathizing". Not some court case where someone who was "nazi-sympathizing" got convicted for something else, something concrete, but a case where someone got convicted for just his sympathies.
Will I be allowed to have a gun free workplace, for example, when I am required to hire people who believe in sovereign citizen movements? Will we be forced to permit people to carry guns in workplaces because of their political positions and values?
LGBT rights can also be defined as a political position. Same with being pro-Union. Will we be protecting doctors who believe in holistic medicine at major hospitals, and nurses who discourage all vaccinations?
The limit of what is an opinion vs a political opinion does not exist. Therefore this protects everyone and nobody at the same time.
"Oh no, we want states level laws for that."
1. The way “small-to-medium” and “large” businesses or “entities” are defined. The bill separates entities into 2 classes based on any of 3 factors: annual revenue, number of users, and percentage of revenue from the sale of consumer information. So even if you’re a one-person startup with 20 users, if you make the larger part of your revenue from consumer data, you are considered a large entity. The extra compliance requirements for large entities seem quite onerous.
2. Two levels of personal information. This might be pre-existing in U.S. code (I don’t know) but the bill defines a separate category of “sensitive information,” that is quite broad, including data on your health, geolocation, biometric markers, finances, children, private communications, and government IDs. All other data that is not encrypted or de-identified is “personal information.”
3. Most of the rights and procedures defined in the bill apply only to personal information, and there are many exceptions, such as “performing a task carried out in the public interest.” So you have no right to privacy if the entity believes sharing your data will be in the public interest?
4. No rights or restrictions apply to the collection and usage of “sensitive information” except that “express prior consent” and “separate consent” are given before collection, use, and sharing of it. I would have expected there to be more rules and restrictions around the sensitive data, not less.
It seems to me that very little of what today’s companies collect would be considered “personal information” according to this bill. Most of it would either be disqualified by encryption or de-identification, or fall under sensitive information.
If they make a weak law, this is essentially reversing CCPA and its copycats. This would have the effect of stripping privacy protection.
If they make a strong law, this is essentially extending CCPA etc to the whole country and making it standardized. This would be a huge win for consumer privacy.
I haven't read the draft bill, but the "Principle 4" makes me think they plan on making some huge exceptions in the protections.
I was about to say something along the lines of, since it was introduced by Republicans you know that this will get ignored. However, after reviewing what they are actually proposing, I hypothesize that this isn't actually designed to increase privacy.
I believe this is more about them making it easier to collect data and giving businesses more means to do so at your expense. If they wanted to increase privacy they'd mirror at least somewhat the CCPA, which already addresses many of these issues. The CCPA is not perfect and there are far too many exceptions IMO, but at least it was effective and California residents can easily request that their accounts and information be deleted.
If anything they should be looking at the CCPA and GDPR as a starting point for how to address privacy, not ignore and gaslight you into thinking they are somehow bad. I hope that a tech blog and EFF do a write up on this and create an entire campaign against what the Republicans are proposing here so that people don't get duped by this con.
Is that a typo? Did they mean supports individuals?
Hey, it doesn't stop at national borders either.
That’s a stance lots of people on various parts of the political spectrum would be interested in.
"Principle #4: We must also protect small businesses and innovation. We know that in Europe, investments in startups are down more than 40% since their data protection and privacy law—the General Data Protection Regulation—went into effect. We must guard against a similar situation here. We want small businesses hiring coders and engineers, not lawyers."
Not in EU, not a lawyer, so i could be wrong.