Obama Administration Unveils Blueprint for a “Privacy Bill of Rights” | Hacker News Reader

Obama Administration Unveils Blueprint for a “Privacy Bill of Rights”

whitehouse.gov

104 pointsclebio56 comments

WASHINGTON, DC – The Obama Administration today unveiled a “Consumer Privacy Bill of Rights” as part of a comprehensive blueprint to improve consumers’ privacy protections and ensure that the Internet remains an engine for innovation and economic growth. ... In addition, advertising networks announced that leading Internet companies and online advertising networks are committing to act on Do Not Track technology in most major web browsers to make it easier for users to control online tracking.

Open articleView on HN

Unfortunately 'privacy' is an overloaded word in US politics.

A "Right to Privacy" is never called out in the Constitution, but between the due process clause and the ban on unreasonable search and seizure, the supreme court ruled that it is implicitly there.

Then the supreme court ruled that partly because of this Right to Privacy, abortion should be allowed. (i.e. Roe v Wade). I definitely DO NOT want to have Roe v Wade discussion on HN, but it is important to recognize that baggage is associated with Privacy.

We really will never get all the states on board because of that.

The issue is more nuanced than the picture you present. In 1967, the Fourth Amendment was extended to areas in which a person had the "reasonable expectation of privacy" (Katz v. United States). This is well established precedent which, in the worlds of Justice Scalia, "[Katz] has been around for so long, we're not going to overrule that". In a recent case, United States v. Antoine Jones, both a right leaning justice (Alito) and a left leaning justice (Sotomayor) expressed strong concerns in favor privacy.

The above illustrates that the problem is not with privacy, as you seem to think. Thinkers across the ideological spectrum generally believe people have the right to keep things private in many areas of their lives. The question is to what should this right apply and to what extent. Privacy is not doomed just because it is linked to Roe. It has well founded support in a range of cases.

It's important to remember that the federal Constitution and rulings by the Supreme Court interpreting the Constitution represent the floor of permissible action, not the ceiling. So, although there exists a somewhat amorphous "right to privacy" that has been applied to things like abortions, sex, contraception, and other things, this is not to say that Congress or state governments couldn't pass laws that further increase these rights. In fact, many state constitutions provide vastly more protections for their citizens than the federal Constitution does (specificaly becasue almost all states became states prior to the incorporation of the Bill of Rights to the states).

Point being, presuming that something is not a "right" or even a "fundamental right" simply becasue it does not exist in the Constitution or hasn't been interpreted to be included in it is, in my mind, a miscontruing of our federalist system. You could conceive of every state passing legislation permitting abortions (or not making abortions illegal) and have the same result as Roe. Similarly, if Congress has the power to pass a "Privacy Bill of Rights" as normal legislation (i.e. through the commerce clause), this would effectively "increase" the rights everyone has. If Congress wanted to pass a law (again, presuming that they had the power to--which is the underlying issue here) saying something like "everyone has a right to privacy," or criminalizing entities who impinge on people's privacy, this would also effectively increase the rights of everyone, subject to Congress changing its mind in the future.

One of the very difficult problems with anything political in the states is that all the terminology has been overloaded to the point where it's not really clear what people are saying.

What's a war? Does it involve a draft and killing large numbers of people somewhere? Nope. We have a war on poverty, a war on drugs, a war on obesity, and so on. How about "rights" what's a right? Is it some piece of property that the government is forbidden to take from you? Nope. We have an airline passenger's bill of rights, a right to contraceptives, now a privacy bill of rights, and so on.

I think people mean well when they re-use words like this. It certainly sounds more serious to say that such-and-such is a right. The problem is that when talking about the structure of the system overall, as opposed to just the change you are suggesting, you need to know what things are and where things fit together. I think this structural knowledge of the theory behind the way things are supposed to fit together -- the design pattern of the country if you like -- has been lost over time. now politicians just ask "what do people want", then spin it up to sound as dramatic as possible, then throw hundreds or thousands of pages of legislation at it until it looks as if it's been "fixed". If this were coding, it'd be obvious that they were just thrashing around, trying to hack their way through tons of cruft to try to get something to compile.

The lack of clean structure and terms makes talking about and resolving everything a lot more difficult than it should be.

> I think people mean well when they re-use words like this.

You're being too generous.

> The lack of clean structure and terms makes talking about and resolving everything a lot more difficult than it should be.

That's the intent. There are many who benefit by maintaining the status quo. The last thing they want is to make things clear. When things are clear, the populace at large has a nasty habit of voting sensibly and in the process, disenfranchises the few who are benefiting at the expense of everyone else.

You have parasites on both sides of the isle. Ranging from unions to defense contractors. Clear and frank conversations are dangerous to people who draw a check from the government.

Exactly. In my opinion if it's not a constitutional amendment it's not worth anything. Law enforcement and intelligence agencies barely follow the constitution at times, forget following simple bills.

I feel like we don't even try to follow the Constitution as the Law of the Land in the United States anymore.

Look at Drug Prohibition for instance (at a federal level). When they tried to do it with Alcohol in the 20's at least they had respect for the rule of law to properly make it a constitutional amendment.

Now we have federal raids in California for marijuana, where the people being raided haven't broken any local state laws.

Depressing.

'But whether the Constitution really be one thing, or another, this much is certain - that it has either authorized such a government as we have had, or has been powerless to prevent it. In either case, it is unfit to exist.' -Lysander Spooner

I find this kind of funny, as both parties seem to have no problem with the US becoming an all seeing, all knowing, incredibly invasive surveillance state.

This privacy bill seeks to limit what businesses can do to consumers, not the government.

Everything the White House does between now and November will be hand-waving to distract attention from the economy.

If the economy continues the way it has for the last 4 months I think the exact opposite will be true. Recent economic news has been good and Obama's approval rating has hit 50% in some polls - if you take out the blip for the bin Laden hit his numbers haven't been that good since his honeymoon period.

http://www.realclearpolitics.com/epolls/other/president_obam...

It is almost laughable how soon people forget where they have been, how much national debt has has been piled to bring this meager growth in economy. The main reason the employers are hiring is the extension of temporary tax cuts. It is only a short term boost to the market for the time being.

Those laughable people have a different name this year... voters.

I won't address the rest of your post. HN political discussions usually make me cringe and I don't have a dog in this fight anyway.

Obama signs the USA PATRIOT Act and the 2012 NDAA, only to propose a Privacy Bill of Rights? The goodwill gesture of a hypocritical administration is vain and illusory. To trust it is to be fooled.

As Bush tried to say, and in retrospect became the first instance: "Fool me once, shame on you; fool me twice, shame on me." Let us not shame ourselves in this instance.

Ah, but his proposed privacy bill of rights is all aimed at corporate data collection, not government data collection. He WANTS the government to have a monopoly in this area.

This protects your data from companies, not the government. Obama obviously feels it's perfectly acceptable to issue NSLs by the tens of thousands and demand Twitter hand over user data w/o a warrant. Somehow I doubt he feels individual privacy extends to privacy from the government's prying eyes and grasping claws.

Here's the specific rights they call out:

− Individual Control: Consumers have a right to exercise control over what personal data companies collect from them and how they use it.

− Transparency: Consumers have a right to easily understandable and accessible information about privacy and security practices.

− Respect for Context: Consumers have a right to expect that companies will collect, use, and disclose personal data in ways that are consistent with the context in which consumers provide the data.

− Security: Consumers have a right to secure and responsible handling of personal data.

− Access and Accuracy: Consumers have a right to access and correct personal data in usable formats, in a manner that is appropriate to the sensitivity of the data and the risk of adverse consequences to consumers if the data is inaccurate.

− Focused Collection: Consumers have a right to reasonable limits on the personal data that companies collect and retain.

− Accountability: Consumers have a right to have personal data handled by companies with appropriate measures in place to assure they adhere to the Consumer Privacy Bill of Rights.

As the document points out, it's based on the Fair Information Practices.

Notice it's all about "consumers" and "companies," not "citizens" and "government." I'd hardly call this a bill of rights. It's more like a campaign advertisement for Obama. If I wanted to be more of a conspiracy theorist about it, I might believe that if this were passed into law, it would be to force companies to maintain readily exportable data about their users, which is only a court order away from being exported to government officials.

  > only a court order away from being exported to government

This would actually be an improvement over the current state of affairs where companies are under no legal obligation to force the government to get a court order in many cases.

Fortunately the government can only take data you have. They can't force you to have data (yet).

This is not the state of affairs in the telephone network, where every phone company is mandated to have government backdoors installed (http://en.wikipedia.org/wiki/Communications_Assistance_for_L...). That law was passed under Clinton, by the way.

That's a fair point. The main point I was trying to make though is that this "bill of rights" will ensure that companies have already gathered that information into a readily exportable format, thus reducing the friction when the government comes knocking, whatever form that might take.

Too bad they don't apply it to the government. I know, the Fourth Amendment is pretty much toast. Still I have come to realize that if you reverse the meaning of the bill's title you get closer to truth.

This will simply codify the limits companies have to go to, can go to, without getting into trouble.

I am more worried about my privacy rights in regards to government agencies, like the IRS, the myriad of new agencies and regulations that will result from the Affordable Care Act, and that Nazi like Department of Homeland Defense.

Got to give the politicians credit, they are deft at redirecting the attention of the masses. Don't look behind the curtain, no no no, instead look over there.

You say "that companies will...", but the whitehouse.gov version says "that organizations will...". I think that's quite a significant semantic difference. Is the government subjecting themselves to these same rules?

Interesting. I cut-and-paste from the PDF report, which uses the word "companies". The language in the press release is slightly different.

Is the government subjecting themselves to these same rules?

I don't think you can talk about government as a single entity. but this proposal inclines in that direction. One feature of this administration has been a stronger commitment to openness via Freedom Of Information Act requests. Although this commitment propagates through different agencies at different speeds (depending on budgets, bureaucratic inertia, and political factors), there is certainly an administrative mandate for greater responsiveness to public inquiry. I think this indicated an increased awareness of privacy issues since the identification/specification of information is a necessary first step to challenging the retention or application of such information.

I'm not sure that the complex issues surrounding privacy can be addressed with a single bill or even the attractive simplicity of a simple-seeming constitutional amendment. There's a constant tension between rules on the gathering of information vs. rules on its use. Preventing information from being gathered or retained obviously limits the scope for abuse, but also has a distinct opportunity cost - consider the value of individuals' health information in performing epidemiological research, for example. Some argue that since humans are morally fallible and abuses are inevitable, the risk premium of such abuse must exceed the cost of foregone opportunities by definition, pointing to incidences of organizational abuse such as genocide or systematic discrimination. Others (including myself) prefer to look at the risks/costs in probabilistic terms and consider institutionalized secrecy or obscurity to have significant risks of its own.

> One feature of this administration has been a stronger commitment to openness via Freedom Of Information Act requests.

Not really:

http://www.salon.com/2012/02/02/aclu_sues_obama_administrati...

Yes really. I'm talking about the overall trend, and acknowledged its unevenness. Contemporary national security activities have always been subject to secrecy considerations in the short term.

Reading through this, I wonder how much of this is a bet that consumers will be happy to let folks track them in exchange for cool deals on the theory that now that this is willingly disclosed, the gov. has an easier time arguing the 4th Amendment doesn't apply.....

I like the idea, but how enforceable are those and how will they enforce them? One of the things about information is that you don't really have any way of knowing what other people know.

Given the past ten years, I have to wonder whether the government will subject itself to the same rules respecting the privacy of its citizens from government surveillance, monitoring and data collection.

Wait a second.. The 9th amendment to Constitution already states that "certain rights shall not be construed to deny or disparage others retained by the people" It is not the governments role to "set aside" rights that already belong to the people.There was a very specific set of reasons why the original Bill of Rights came to be and I could go into a long complicated post about this however for the A.D.D and TLDR crowd I'll just shorten it to this.

You already have the rights, the government does not need to "bless them"

These rights have nothing to do with the U.S. Bill of Rights. For one thing, it concerns consumers' relationships with businesses, not citizens' relationships with government.

I understand that, however it's not the Governments place to establish "rights". Regulations Yes! it is in their power to regulate But "rights" are something much more they are not established by the government only recognized by it.

rights that already belong to the people

...but which are unfortunately not clearly enumerated, and so subject to ongoing (and some would say endless) debate. One can't simply rely on having any given right in the absence of a prohibition to the contrary, but rather one needs to go through the process of asserting it judicially.

I'm perplexed by the downvoting, given the obvious fact that courts evaluate rights-based arguments all the time. The proper scope of the judicial power is about the biggest ongoing argument within the legal establishment, it seems to me - unless you can point me at some agreed-upon list of rights retained by the people that I don't know about.

This is hard to take seriously at face value after looking at the Obama for America privacy policy http://www.barackobama.com/privacy-policy

If you go through the trouble of creating an account, you will find that the claim: "You can view or modify information stored with your user account by logging in to your account and accessing the Manage My Account page."

appears to only refer to address and messaging subscription settings - no other information is available. They fail to meet the standards set for both transparency and individual control - and that's even before addressing the set of unlisted "third party vendors" (both suppliers and consumers).

"[Obama's] DOJ Urges Supreme Court to Halt Challenge to Warrantless Eavesdropping"

http://www.wired.com/threatlevel/2012/02/scotus-fisa-amendme...

Yup they really care about privacy.

Left hand, right hand. The executive branch is very big. That case is about "security". This proposal is about consumer and business behavior. I'm not at all surprised that there's a philosophical disconnect between them, are you?

It would be strange if the Attorney General and the President didn't speak to each other very often. imo There is a difference between empty PR gestures and real action. The 'bill of rights' excludes the government.

Lots of these things will be coming out of white house this election year. They will propose specific changes to woo parts of population.

This one is for those who are more technical oriented, couple of days ago white house talked about reducing the corporate tax, till now they were all about increasing it. But these are just things they will put forward which according to them will be done if reelected. We all know when happens once politicians get reelected.

The Second term is the one where things really start to go bad. Most of the damage gets done because they don't have anything to loose so they push through whatever they feel like even if it's bad for the country. It helps however if one party does not control both the Whitehouse and the Congress/Senate. it does not seem to matter what party is in power, when they have full control really terrible laws tend to get passed.

The six points remind me a lot of the points in the European data privacy conventions, which date from the 80s. I wonder if the connection was explicit/intentional?

That's rich! Especially after recently signing the National Defense Authorization Act: https://www.google.com/search?&q=Obama+Signs+the+Nationa...

Funny how carefully so-called bill of rights mentions nothing about privacy rights as they relate to government. The main reason I don't want companies and "organizations" having too much personal data is it's being shared with the government. Nothing here puts restrictions on DHS, CIA, NSA data mining.

I'm eagerly awaiting the Orwellian twist they'll put on this "privacy" bill where we'll be required to submit iris scans and fingerprints in order to go online.

This does not look like a very well-defined or comprehensive list, but it is good to see some kind of movement.

I support immediate and binding legislation to fix things in the states, but overall, looking at the politics, I really think this is bad news. Here's why:

1) It's not something that's going to pass. It's not like the White House got together with members of the opposing party and came out with a bipartisan document that would survive the election cycle. There's no indication of having the votes necessary, there's little or no coordination with members of their own party on the hill, and there's no competing sets of legislation where this would be a beginning negotiating position.

2) The fixes required, I believe, are going to have to be constitutional amendments. Something like this would be a nice effort (if it had a chance of passing), but the situation is so murky that we need real absolutes, a real set of rights, not an addition to the current system.

I'm left with the somewhat sad conclusion that this only begins to firm up opposition in the Republican party -- although they'd never admit it with Ron Paul currently doing so well in their polls. This is a statement something along the lines of "Hey! We get it! We're on this problem and we want to fix it."

That's a great political statement to make. But I think in terms of actually fixing the problem, it takes us backwards rather than forward. A simple statement along the lines of "Something is really wrong with online privacy. We look for partners in the opposition party to move this forward immediately." could have done the same thing without as much counterproductive posturing. I leave it to the reader to determine whether the goal here is actually fixing the problem or staking out a political position for the upcoming election.

I remind people, including Ron Paul supporters, that's it's very possible for elements of a party to make all kinds of noise that folks want to hear -- while actually creating a long-term fight that will continue to draw donations and support. There are many scenarios in politics where creating a good fight is much more advantageous than fixing the problem. In my analysis, this is the purpose of that document. I'm desperately hoping over the next couple of years that the Republicans do not rise to the bait. The last thing I want to see is the Republicans spinning libertarian values as some excuse for my every move to be tracked.

"The last thing I want to see is the Republicans spinning libertarian values as some excuse for my every move to be tracked."

We all know that's what's gonna happen, though. Just like net neutrality. "The government should stay out of the free market and not burden these job creators with excessive regulation." How many lobbyists do privacy advocates have on their payroll? Throw in the fact that privacy in the Griswold decision paved the way for Roe v Wade, and no way Republicans support anything of the kind. So Obama will just posture a little with it.

Consumers bill of rights? It should be people's right of privacy......we're more than "consumers"

All you need to do is uphold the Constitution and this would not be necessary.

Direct link to the underlying document (PDF):

http://www.whitehouse.gov/sites/default/files/privacy-final....

Until you have the right to purge the data--all of it--that companies collect on you with or without your permission, this "Bill of Rights" is woefully incomplete.

Why do you say that? Last I checked, I don't have the right to expunge any/all data a corporate entity has collected about me that I deal with in the brick & mortar realm.

I can sue for it, but I can't just walk in and say: Where's your form for me to have all my records shredded?

The only big difference here is that our vehicle for traveling through the various sites of businesses in the electronic realm leaks data about us like a sieve: I'm a Comcast customer, I live in state XYZ, I'm using a Mac, I've been to another site from your .com and here's my cookie, etc.

Tor, UserAgent modifiers, strict cookie settings and many other tools can help hide this information - but the average consumer doesn't know about them or how to use them.

This attempt at a rights bill is purely to put some "common sense"-style consumer expectations in place and give them standard tools/methods to learn more about what a particular company is doing.

Where the real failure comes into play is that, unlike in the brick & mortar world, it's quite easy to stroll down an electronic avenue and enter a shop that's actually housed in China - where suddenly this bill becomes a moot point.

Last I checked, I don't have the right to expunge any/all data a corporate entity has collected about me that I deal with in the brick & mortar realm.

It's interesting, because, you see, here in Poland I do indeed have the right to do it. I believe this is true in most EU countries as well.

Likewise in Ireland, under certain conditions[1]. Interestingly there are ongoing proposals to unify all EU data laws to make business easier/less expensive between EU countries and the "right to be forgotten" is one key feature that is being championed.

[1] http://www.dataprotection.ie/ViewDoc.asp?fn=/documents/right...

Who ever heard of data that was really deleted or purged? IT folks work really hard to ensure that data can't easily be deleted in such a way that it will disappear irrecoverably.

Legislation will not fix the fundamental problem that some data is actually really hard to selectively delete. Take the very common scenario of some small company that made backups of its databases to tape for years and years. If you were to exercise your right to purge your data, how can this be reasonably done? If they just delete it from their online, live database you'll have folks cry foul because they didn't really delete it. What a mess!

Well, you aren't guaranteed that people can't collect information on you. You'd never see a news paper story mentioning anyone ever again. I mean that's information about me - it needs to be purged!

Woo, a solution to a problem that doesn't exist - the current state of privacy enforcement in America works fine. Companies with something to lose effectively self-police. Companies that are a little too cavalier with user privacy get whacked with bad PR and swarmed by class-action trolls - a far greater penalty than anything the FTC can dish out. The adversarial model is a little messy, but it results in a sane equilibrium that can evolve over time.

While the document this press release is based on probably won't result in any laws, if it does, it's only going to codify current expectations around the use of personal data, which will grow increasingly stale as society changes. Over time, having these obsolete expectations as law will become a greater and greater albatross for entrepreneurs and for the economy.

Reply on news.ycombinator.com