Hacker News Reader

Comment by rootusrootus | Hacker News Reader

Right along with this, about we set up enforcement and require all data brokers to register with the gov't and give them API access for enforcement queries. Then the gov't can have a page that lets citizens find out which data brokers have information about them. Hell, let's put a button on that page that says "Forget me."

View on HN

> require all data brokers to register with the gov't and give them API access for enforcement queries

This codifies a unified surveillance apparatus.

Can the government not already purchase access to these databases?

> Can the government not already purchase access to these databases?

Sure. But providing mandatory registration and a legally-required API sure makes it easier. (There is also zero chance those data don't wind up accessible by every small-town cap.)

Other assets classes already have that

> Other assets classes already have that

Financial assets. You can even become an M&A advisor and, as long as you never touch securities, avoid registering with anyone.

user data is traded like financial assets and the burgeoning trend is to recognize it as user property

on the financial side the infrastructure of providers is also similar to securities trading

> user data is traded like financial assets and the burgeoning trend is to recognize it as user property

This is a tortured method. We generally treat things as property when we want to facilitate its ability to be traded and leveraged. What is the advantage of the property route versus enumerated rights?

Another column in the row:

   flag_isForgotten: TRUE

Then for the compliance query:

   SELECT * FROM victims WHERE flag_isForgotten = FALSE;

A better model for your purposes might be the “Bottled in Bond” model where bourbon had to be kept in government-owned whiskey aging warehouses. All PII data would have to be kept solely in government-owned databases. Your model would not be many citizens’ first choice because it makes the government surveillance absolute.

However, I don’t think there’s a good solution for those of us who’d like to return to the level of privacy afforded to us in the early ‘90s or before. I don’t believe that will ever be an option again.

Well yes, at a certain level we lose visibility into the internals and have to rely on penalties to coerce good behavior. Maybe a whistleblower law with a healthy reward?

What I want is to get all the private data collection out in the open. Average Joe can probably tell you that Google collects some information about him, maybe his browsing history or search queries. But how many people really understand that there are probably 100x or 1000x more scrapers out there putting together every bit of data they can find and correlating it?

I want to tightly regulate what companies can do with information they collect about you, especially once they start cross-referencing and selling it. Shine a very bright light on it.

> Maybe a whistleblower law with a healthy reward?

This would probably be a better framework.

That's what India did with its UID, Aadhar. The initial days were so bad with security. Anyone and everyone could take the id number and fetch info about you. Now you can lock access with biometrics and even after unlocking it auto locks in 5 minutes. You can also generate a virtual unique id number to prevent fingerprinting across various services. There are still some cases where the security of data seems to be questionable, but it's working there. They also have oAuth support for websites to use aadhar profile. But not many services have integrated with it yet.

Brave initially aspired to do this.

They wanted to use attestations on a blockchain to show a chain of consent and revoked consent from a user.

But that only works if data brokers are tied to that data source. (and the friction of using that data source being way lower)

Reply on news.ycombinator.com