Control as Liability

Maybe you are good today, but in the future you might start to be swayed by changing incentives or situations due to forces such as "absolutely power corrupts absolutely".

Or maybe you manage to always be good, but--as humans have fixed life spans--eventually retire or die or simply move on and are replaced by someone who is less good than you are.

Or maybe you are good but the power you manage to concentrate gets stolen by someone (in the digital world, maybe you get hacked) and used without your permission to do bad things.

Or maybe you want to be good, but your power is seen as an asset for something external--such as a government--and you end up being required to do bad things that make you sad.

We see all of these issues play out constantly with large tech companies, with control techniques such as curated application markets getting abused as anti-competitive measures, or getting regulated by authoritarian governments as a tool for their regime.

In 2017, I gave a talk at Mozilla Privacy Lab that looked at many of these issues, citing tons of situations--every slide is a screenshot of a news source, as somehow people always want to believe these situations are far-fetched--where having control has gone badly:

https://youtu.be/vsazo-Gs7ms

Though perhaps a slight oversimplification, I would say that a guiding principal for determining whether a relationship is characterised as fiduciary one is the possibility of control over another person's affairs, either literally (as in the case of a trustee or agent), or because that person is accustomed to place a high degree of trust in your judgement (attorneys, financial advisors).

In that context, I find this article quite interesting (if a little short). Maybe there is a concept emerging of "data fiduciaries", even if regulators and courts don't yet call it that. It has long been accepted that a financial institution that holds your stocks and bonds has onerous obligations not just to their regulators but to you as their principal. Given how important and valuable data is becoming, people may begin to question why data custodianship should be treated any differently.

Incidentally, in some European asset-backed finance transactions, I have already seen "data trustees" appointed to hold personal data relating to the underlying assets in accordance with applicable data protection laws.

(The specific rules about fiduciaries will vary by jurisdiction, so don't complain if the above is not a perfect description of the rules in your location, though I'd be interested to hear if your rules are fundamentally different.)

https://www.schneier.com/blog/archives/2016/03/data_is_a_tox...

Once you collect data, it can become very attractive to various parties, like nation states and snooping employees. Google found this out the hard way multiple times!

For the US, I think the most expedient route to this climate of fear (caution) that yields positive consequences lies not in government regulation but in removing impediments to private liability, or perhaps creating new sources of private liability. The requisite fear of liability to yield positive consequences is a threat of private litigation, not a threat of fines set by government agencies.

It is not for the government to decide how much "tech" companies should pay for their wrongdoing. It is for the victims of that wrongdoing and a jury of their peers to decide.

It is not users who have pushed us to this breaking point. it is "tech" companies and web developers.

The intent of privacy protecting legislations like GDPR was explicitly and intentionally to give individuals / 'natural persons' control and ownership of their own data, it says so in Chapter 1 of the entire thing.

Vitalik is right I think but it's funny how he frames this as some sort of unexpected or revelatory thing. Well functioning ecosystems are created through rules, and people benefit from having the protection of these laws. That the people don't benefit if you let the wolves run around freely in the henhouse is obvious.

We already see this with hosting on cloud services, or external auth providers and the like — for small players, it is very unlikely that they're better at e.g. security or availability than google, aws, et al. The downside is obviously that this clusters a lot of the risk and when something does go wrong, it takes many more people down in its wake.

But wait a moment. It offers, in exchange, and in an indirect way, but as the author being the founder of Ethereum, the decentralized app business model, where app developers / users must pay a fee to participate.

So the current choice is: Go develop a business the classic / mainstream / centralized way, and do, or do not harm by collecting data and control the users. Or, create a decentralized app, where the first thing, for you or your users is to "Get some ETH".

No thanks. I don't think the answer for what FAANG did wrong is me / my users to pay a fee to develop / use an app. There should be a third way.

Perhaps this analogy of private user data to electronic gadgets is helpful for predicting the future? Public data is another matter all together.

I’m working on a social media-style app that needs to take very good care of its member data. Many folks here would probably be appalled at the measures I’m taking.