GDPR doesn't work as described and companies have found many ways to make the process difficult. There is a clause (last case scenario) where the company can say that the data is critical to the system and can't delete it.
You probably refer to "legitimate interests". If you play that card, you are required to show a "Legitimate Interest Balancing Test", in which you show that your interests are arguably more important than the interest of the consumer: https://ico.org.uk/for-organisations/guide-to-data-protectio...
Source: I love to watch Facebook becoming the first GDPR unicorn, i.e., a company with more than 1 billion € GDPR fine.
> watch Facebook becoming the first GDPR unicorn
They're paying $725mm to users in America [1]. Difference being the damages go to users, not a regulator.
[1] https://www.popsci.com/technology/meta-725-million-lawsuit-c...
Furthermore, the American concept of "consent" mostly functions as a legal fiction whereby less powerful parties are coerced into signing a bunch of binding legal documents. Hence the desire to copy the GDPR verbatim - because if a privacy law used the American version of "consent", why even bother?
One way to port the overall idea of the GDPR into the US legal system might be to define a non-transferable property right in personal information (information about yourself), which could only be licensed revocably. Those two key bits would be tough though, given widespread deference to the Coase fallacy that has blessed much corporate looting.
Not true. We have the Privacy Act of '74, HIPAA, GLBA and COPPA, to say nothing of e.g. California's CCPA and Virginia's CDPA [1]. Or Illinois' biometric privacy protections [2].
> the US leans heavily into the fallacy that if it's legal for one individual to do some as private activity, then allowing to be scaled up to mass corporate behavior is inherently reasonable
This is true for rights, which don't get diluted through assembly. Not rules or the law. Plenty of laws exempt small businesses and natural persons.
> the American concept of "consent" mostly functions as a legal fiction whereby less powerful parties are coerced into signing a bunch of binding legal documents
Not entirely true. See: EULA enforceability as it pertains to natural persons [3].
> to define a property right in personal information (information about yourself), making it non-transferable and revocable at any time
One generally defines a property right to enable transferability. Revocable property isn't property, it's a license. Making information one's inalienable property that can only be revocably licensed sounds neat, but it doesn't add value over enumerating data rights.
[1] https://www.comparitech.com/data-privacy-management/federal-...
[2] https://www.jacksonlewis.com/sites/default/files/docs/Illino...
[3] https://en.wikipedia.org/wiki/End-user_license_agreement#Enf...
Calling it "assembly" is disingenuous (this is directed at the legal canon, not you). Generally companies aren't just mere assemblies of people, but rather are separate legal entities whose members have limited liability. Just as it's accepted for a company to say to an employee "if you want to get paid your 1st amendment rights are irrelevant", it would be reasonable for the government to say "if you want to have a statutory liability shield, your 1st amendment rights are irrelevant for activities facilitated by the shield".
> Not entirely true. See: EULA enforceability as it pertains to natural persons
I didn't say there weren't exceptions. Just overwhelmingly when a new regulation is created that requires "consent", the main result is for there to be a new piece of paper that people are forced to sign to "give consent". Rarely is there spelled out a path where the individual can refuse to give consent and still obtain a service that didn't intrinsically require it.
> Making information one's inalienable property that can only be revocably licensed sounds neat, but it doesn't add value over enumerating data rights.
The value is that trying to carve out new rights is an uphill battle, whereas dovetailing into the customs of commerce might just be possible. For example you had mentioned carve outs in the various state attempts at privacy laws due to the 1st amendment. Whereas those carve outs (unfortunately) don't exist for copyright!
But sure, I do support trying to carve out completely new rights to repudiate our burgeoning surveillance society. It's just that the way the legislative process works in this country, it will be an amazing feat if the drafting process doesn't end up gutting most individual rights while still creating a bunch of red tape to stifle competition. Hence the attraction to copying GDPR wholesale and letting the courts sort it out.
You'll see my suggestions purposely skirt the question of consent. Access, erasure and objection. You can access your information held by others. You can require its deletion. And you can object to how it's used. (In practice, revocable consent. But avoiding the concept directly.)
> those carve outs (unfortunately) don't exist for copyright
Copyright is in the Constitution [1]. Its interaction with the First Amendment is why we have the fair-use doctrine [2]. I doubt the Congress could enact copyright without the Copyright Clause.
Incorporating privacy through commercial code strikes me as messy. We have many mechanisms for abrogating property rights. Do we really want to deal with e.g. civil forfeiture of a person's privacy, banks seizing possession of personal data in obscure foreclosure proceedings, or an employer holding parts of an employee's privacy rights in bond?
> the attraction to copying GDPR wholesale and letting the courts sort it out
This would involve a decade plus of anarchy, litigation and uncertainty. That is enough time for generational backlash. Lazy legislating rarely pays off.
[1] https://en.wikipedia.org/wiki/Copyright_Clause
[2] https://www.law.cornell.edu/constitution-conan/article-1/sec...
Sure. I just see the legislative meat grinder turning "information" into narrowly construed red herrings like SSN's and account numbers, "access" into the ability to file individual written requests (which include more personal information) to specific entities you happen to know about, "deletion" into the null operation because it "infringes freedom", and "objection" into a strongly worded protest rather than anything actionable. I certainly do want to be wrong here, but this is the same country where widely-lauded healthcare reform ended up including a provision that everyone had to pay the parasites.
Good point about the perils of making one's interest in personal information more property like. I had wanted to head that off by making it non-transferable, but you're right to point out the slippery slope that legislative corruption would surely push us down.
As far as copyright, it grows ever stronger in spite of patently obvious free speech concerns (eg DMCA "anti-circumvention"), because legislation that benefits corporations wins out over legislation that benefits individual rights.
And for "lazy legislating", what I see really not paying off is when congress addresses an issue a single time and then considers the matter solved, regardless of the actual result.
This is incrementalism. It’s the solution preference of a deliberative, consensus-building democracy. We make a move. See the effects. Iterate. It works in the long run.
The opposite, forcing through chaotic legislation, tends to result in alienation, repeal and the resignation of the issue to the partisan trash pile.
Doesn't a class-action lawsuit just mean that like a third of it goes to private law firms?
could you expand upon or clarify that? i work in systems infrastructure and have been a part of implementing GDPR-driven changes in both apps and infrastructure, so it certainly seems to be working in my line of work
- After you've requested deletion the company has 30 days to "respond" but they can extend that with two additional months. - They can go to extreme lengths to verify the identity of the user which they have the right to do so and if you don't respond to the confirmation they are not obligated to delete anything.
I've encountered both practices in the past (and I've only made 3 requests, ever).
The dream would have been an automated way to do it, something like a government service where each company would have to publish metadata about captured user data and once you request deletion through the service the company would receive an event, a webhook call...
oh yeah, hard agree with this