Senator Warren proposes sweeping ban on location and health data sales
theverge.com
theverge.com
Data brokers can go underground to circumvent a ban on sales, but the end users funding that industry are legitimate businesses who (hopefully) would have to follow the laws, so it's important to target them.
One of the practical problems with the "war on drugs" was its bumping up against individual privacy. Corporations have no such privacy nor right to privacy - being chartered under government authority means they need to continually file compliance reports and are essentially closer to being organs of the state rather than individual humans. So no, if a company does decide to illicitly process personal information for nonconsensual purposes, that most certainly can be enforced upon.
We need a ban on collection of that data, not just the sale or use of it. The conditions under which it is legal to collect that data should be subject to very strict regulation and involve explicit informed consent of every person tracked, ideally refreshing that consent on a regular basis so that it's not something you could consent to once years ago and forget about.
But those platforms clearly have legitimate need to collect/house that data. They need to be restricted from selling/licensing it to third parties, regardless of any amount of anonymization or differential privacy applied.
For instance, suppose I consent for Fitbit to track me five years ago. Then Fitbit gets bought by Google. It should be illegal for Fitbit to transfer that data to Google without my consent, and illegal for Google to receive that data without my consent. It shouldn't even be legal for Fitbit 5 years ago to secretly store that data on rented Google or AWS servers without telling me which company they are subcontracting my data out to.
tl;dr: Possessing any data about people should be considered a toxic liability and a huge regulatory pain in the ass. User data should not be considered a valuable asset, but rather an evil that you loath to touch at all unless there's no other way.
I think it can get tricky. I'd rather just not allow them to track me in the first place, I guess.
So, how am I supposed to use Google Maps?
Maybe you mean long-term storage?
Still - I like to be able to see all the restaurants and places I went to. What if I like that?
Most people don't even read their mortgage contract carefully.
People aren't ever going to read a EULA to read a recipe for chicken soup.
The people making those popups wouldn't be going to such great lengths to make it hard to opt-out if people didn't want to opt-out.
Anyway, the forms should all be standardized government forms, not bespoke anti-pattern devices cooked up by web designers in a competition of malicious compliance.
I personally hate being the "I told you so" guy. I try to warn people about things like security, privacy, and backups of important data, and am frequently ridiculed as "paranoid" (and much worse) right up until their cavalier attitudes about these things bite them in the ass and they lose decades of irreplaceable important data, or they get "doxxed" or worse yet, become the victims of "identity theft" and then they inevitably come crying back to me to help them "fix it". I don't want to have to tell people "Yeah, sorry. You're screwed at this point." That never feels good to say.
This uncontrolled corporate and government collection of (what should be private) data is another such situation, where people don't need it to be happening, but they've been trained by these corporate and government entities to believe it's "necessary" or "useful" somehow, and those people absolutely refuse to accept that there may be better (and safer) ways to handle such situations other than just blanket collection of data on corporate or government servers. Maybe we're "hostile" to these activities because they're hostile activities and we're trying desperately to convince folks there's better options.
Have none of these people considered that maybe other "people in the know" AREN'T "hostile" about these "data collection" actions for good reason perhaps?
Most people are aware that everything has a cost. Some people want us all to live under rocks because they don't like big companies. Other people think it's worth the cost. The vast majority of people just like "free" stuff.
They do want their data "collected", in the sense that they are happy with it being used for some kind of legitimate purpose – like providing a service to them. Most people will also accept their data being collected for various other reasonable purposes – like logging, fraud monitoring, that kind of thing. I will accept that there are probably quite a few people who don't care either way.
There's a weird kind of reaction—among some tech people in particular—to the idea of regulating data collection – all sorts of total non-sequiturs, like "but are you telling me I can't have web server logs any more!!!" or "how would we have google maps!!" that requires either a stunning lack of imagination or deliberate feigned ignorance.
Atlas data can be sent to the map application without the map application sending personal data back to the atlas provider. If that means the map application can no longer be "free" (funded by user giving up their data) then so be it. Of course the atlas provider could log users and which map regions they request, but the point is to regulate that logging so severely that the data becomes a liability not an asset.
> I like to be able to see all the restaurants and places I went to
This isn't difficult to implement either without sending any information out.
If you send me data, why shouldn't I be able to collect it?
I think we are mistaking how important recency is. Sure the current data on me has value, but there is also value in figuring out what my current behavior has meant in the past with other people, and trying to figure out what I might do next even if you haven’t tracked me specifically within an inch of my life, right now.
Knowing what I did five years ago and what people in my social groups do might be valuable enough even though you’re “protecting me” going forward. As you say, we might have to make this data a hot potato. Create situations where hoarding is a liability rather than an underutilized asset.
The issue with privacy (and many other problem) is politics. The US has a critical political problem. There is a political problem to solve. Why would the GOP stop doing it if they keep gaining at the ballot box, and if the Democratic Party doesn't make them pay a price for it? Who would ever vote for a party that advertises it's haplessness?
The problem is that too much of the GOP base actually wants that obstructionism.
Now, granted, the Democrats do have a big problem with admitting that the game has changed and changing how they do things to take that into account, but personally, I believe continuing to introduce bills to try to genuinely address some of the problems in our country, thus showing that they do have the will and the ideas to continue governing, is something they absolutely should be doing even in this situation.
What, exactly, would you propose the Democrats do instead?
That's what the Dems tell themselves, but everyone know it's BS - that's why everyone is so anxious and stressed, why it seems that the world is going crazy. We are in a crisis and our leaders are hiding their heads in the sand, telling us - against all reality - that they will proceed like everything is normal. It's just a way for the leaders to stay in their safe space (legislation) and not get into the political fight, which is all that matters at this point - nothing can happen until that problem is solved, and our society and freedom will continue to be destroyed.
The Democratic leaders are cowards - just like military commanders who avoid engaging the enemy, with every rationalization in the book. The enemy is advancing, they are over the next hill, you need to fight (lawfully, politically, peacefully, with integrity) - and WIN. Is that too strong? That it seems strong shows how backward the Dems are. There is no doubt, they need to fight and must win, but they aren't even in the mindset of fighting. 'Trying' is for losers. The Dems are content to lose.
> I believe continuing to introduce bills to try to genuinely address some of the problems in our country, thus showing that they do have the will and the ideas to continue governing, is something they absolutely should be doing even in this situation.
Showing who? Who in the public knows what bills they've introduced (HN is a rarefied population)? Who even knows what they've passed? What effect does this have on the crisis? Legislation is their safe space. It's like the insurgency has broken into the Capitol and the Democratic leaders say, 'Let's introduce bills!' And don't forget, 'but only introduce bills that don't risk any conflict or confrontation - we don't want any of that!' (like the gun control bill).
> What, exactly, would you propose the Democrats do instead?
Here's what they could do: Don't compromise on the gun control bill, push for the really needed measures and hold it over the GOP all the way through November. Hammer on the GOP's inaction, their sociopathic response to these murders. Keep repeating it, keep challenging them publicly, make the GOP leaders piss in their pants fearing the next mass shooting. Then we might get real, sane gun regulations (no, not taking away everyone's guns), by voting out the obstructionists. Instead, the hapless Dems gave the GOP a major victory, making the GOP look reasonable and non-obstructionist, and demonstrating again to the public that the GOP holds the real power and must be appeased - and that the Dems are the appeasers. Unbelievable - and entirely expected.
The only way to stop these shootings is to make it very hard to get and keep weapons.
That’s how every other country solved this.
In the 1990s, there was a ban on assault weapons. Studies showed these laws helped a bit, but weren’t game changers.
Same is true with everything being proposed: background checks, “red flag laws,” etc.
Realistically, we need to take away peoples guns to stop mass shooters.
In response, today's Democrats are drafting up bills that have broad public support (even among Republican voters), and forcing the Republican congresspeople to put their names down voting against it. As we get closer to midterms, they're going to harp on this point endlessly: Republicans are nothing but obstructionists that prevent anything from getting done.
Personally, I think it's a better strategy, but I also think they're fighting the last war. They might be better off trying to find tiny cracks in the Republican ranks and then magnifying them.
It's completely ineffective! Better than what? What has it achieved?
> today's Democrats are drafting up bills that have broad public support (even among Republican voters), and forcing the Republican congresspeople to put their names down voting against it.
This is a performance by insiders, for insiders. Few other people have any idea those bills exist, that the votes take place, or who voted what.
And because the Democrats barely try to contest the public narrative - the foundation of the reactionary movement and GOP power - it's all spun to make the Dems look bad regardless.
It is a strategy of people who only can think of legislation - like a ship captain who only will use the rudder, not the engine, the anchor, etc. It's so bizarrely focused on legislation, it's like the rest of the world doesn't exist. Really, the Dems are cowards and legislation is their safe space. They will not acknowledge the rest of the world. Did you read that they are 'tired' of dealing with voting rights?
Just last month it was reported that the CDC was buying troves of this data (from the same vendor Warren is calling out) to monitor millions of us without our permission. Similarly DHS, ICE, and the FBI have all been found to be buying this data -- which is a legal loophole to get around actually getting a warrant.
I hope lawmakers don't carve out any exceptions for government in any such ban.
Even if there was a chance that the GOP would let this through the Senate on its own merits, tying this to abortion-related issues all but guarantees this bill is dead.
Personally, I believe it should be illegal to sell, or buy, personal data for the purposes of marketing or monetization. Companies can use the data they've acquired through direct integration, and companies can provide services which utilize that data to other companies, but the actual data should never change hands or be exposed to a third-party.
I'd also like to see a ban on politicians sharing, renting or selling donor lists but I have absolutely no faith that bill would pass.
For example a navigation app itself could still collect and use the data itself, but couldn’t sell that to a third-party. A geofenced application could be woken up by the system when I entered the region (say OmniFocus reminding me that I could stop in and pick up a prescription that is ready — I would be explicitly asking for this to happen).
So what great functionality could I miss out on if this became law?
We are just at the beginning of analyzing and using health and location data; if there are groundbreaking use cases for them, it's very likely that we haven't seen (or even thought) of them yet.
They already HAVE this data. It’s part of running Maps or a cell network.
So this further entrenches them in some ways because they can make decisions and products off data no one else has.
You know that thing when you search a place and it tells you how busy it is at certain hours?
Bing could never replicate that. They have no way of knowing.
The bank cannot directly sell your location information but they can disclose it to financial partners, likely for some financial quid pro quo. If you read the contracts on the You have to manually opt out by way of mail. I'm assuming Google does the same thing.
When a business is busy is a part of Google Maps, but no one else but Apple could realistically try to duplicate it. That’s a hell of a wall against innovation.
But can Google include that graph in search results? It’s part of Maps. But it’s derived from location data. But Google Search has location data, so maybe. But what if that would show different busy time? Do you have to show a different graph?
What does Google Assistant do?
I don’t know how we put the genie back in the box on this stuff. I like the idea. But I don’t know if it’s executable.
That being said, data brokers seem to be rather poorly behaved players in the market with little respects for users privacy. So it's a tradeoff I guess.
Nothing will change. You'll just be bombarded with requests for permission or it will be buried in the fine print you agreed to in the non-negotiated "contract".
> When abortion is illegal, researching reproductive health care online, updating a period-tracking app, or bringing a phone to the doctor’s office all could be used to track and prosecute women across the U.S. It amounts to uterus surveillance
The pro-abortion folks could use this to identify where abortion services are in the highest demand, so limiting access to the data isn't an unmitigated good (assuming you think abortions are "good").
Moreover, healthcare researchers buy a whole bunch of data from these brokerages--how are we supposed to advance healthcare research without access to good data (at least it seems from reading this article that this bill would prohibit this sort of access)? I'm all for making it harder for advertisers to track people, but I'm not willing to trade off prospective treatments and cures for serious diseases. There has to be a more selective approach.
Don't get me wrong-- I think stopping the exploitation of consumer data would be a good step-- but politicians (of all parties) are some of the most enthusiastic purchasers of such data.
What about changing the "do not call me register" to a "please call me register" and making do not call me the default, and penalizing those who break the rules?
How about banning all those websites that aggregate and sell personal information from social media and public records?
If you actually read the article, you'd see that this is in response to the upcoming Roe v. Wade vote and how health app data could be used against citizens in the future.
More broadly though, if we always chose to reject legislation based on the fact that we believe it could go further in some way, nothing would ever get done. It's never good enough for somebody. We're OK with businesses shipping half-baked MVPs but we always expect elegant and complete waterfall legislation from our government.
You can see for yourself here: https://eddm.usps.com/eddm/select-routes.htm
I think everything you suggested is something that should be addressed in one way or another. I think banning the sale of medical data is probably a good thing more often than not. All these things can be true, but responding to a statement about banning the sale of medical data with "yeah well what about the post office?!" seems weird, and perhaps politically motivated.
I think most people use it because they feel there is a larger systemic cause not being addressed by treating a specific symptom, but it does tend to read as a way to shift conversation away from the topic at hand.
---
Re the gender obsessives - sorry, dropped an s.