Hacker News Reader

Comment by bigmattystyles | Hacker News Reader

I always wondered the same about credit reporting bureaus.

A fine example of regulatory capture. The "Fair" Credit Reporting Act 15 USC 1681h (e):

> Except as provided in sections 1681n and 1681o of this title, no consumer may bring any action or proceeding in the nature of defamation, invasion of privacy, or negligence with respect to the reporting of information against any consumer reporting agency, any user of information, or any person who furnishes information to a consumer reporting agency, based on information disclosed pursuant to section 1681g, 1681h, or 1681m of this title, or based on information disclosed by a user of a consumer report to or for a consumer against whom the user has taken adverse action, based in whole or in part on the report except as to false information furnished with malice or willful intent to injure such consumer.

This country desperately needs a GDPR equivalent. One that does not except financial surveillance bureaus, the healthcare industry, or any other quasi-governmental organization that abuses our personal information.

We need another word when the capture is beneficial to the government because it solves a quasi governmental problem which is easier without oversight.

This crap does not benefit any defensible purpose of government. Probably it does benefit certain government employees. The principal-agent problem appears again.

How do you define the principal-agent problem when appied to govt, though? Govt and its departments are not 'owned', and cabinet secretaries and even Presidents are not principals. Who is the 'principal': that particular govt's most powerful donors and lobbyists? Also, govt has both career and political appointees, the latter can change every 4/8 years. So seems to me there are multiple groups of agents/parties.

So when you say 'does not benefit any defensible purpose of government', is that a statement about political science, rather than two-party govt system with lots of lobbying? I mean it seems like any policy you could concoct would benefit some (posibly small) interest-group of people somewhere, unless it was 100% wasteful.

[0]: https://www.investopedia.com/ask/answers/041315/how-principl...

No one who has read your link would then question whether the chief executive is a principal: of course not. In polities who aspire to representative government, agents are anyone in public employ. Principals are the rest of us. Our interests are not served by solving problems without oversight, as GP suggests.

But still unclear which among us is the Principal, in US-style democracy? Principals are only the tiny few among us who control election outcomes, through funding/ influencing/ lobbying or (rarely) affecting the outcome in one of the 8% of House seats that are still competitive [0]. Even if you believe it is all the rest of us, we certainly aren't equally influential principals.

> Our interests are not served by solving problems without oversight, as GP suggests.

Sure, that's a given. But many of us think the oversight is working on our behalf, yet isn't. (Compare e.g. the sham of the TikTok oversight hearings vs the not-very-effective Facebook ones.)

[0]: https://www.politico.com/newsletters/weekly-score/2023/02/27...

> This country desperately needs a GDPR equivalent.

Hmmm, I wonder how hard it’d be to lawyer up and force Clearview (and OpenAI?) under GDPR (or CCPA?) to remove every piece of personally identifying information about me?

Clearview: “We have a 99.7% certainly match for the Zodiac Killer. The name is [deleted as per GDPR request] and the link to their mugshot photo is 410 Gone. Deleted as per GDPR request”

Pictures of your face are most certainly personal information, so with proper deletion (or lack of consent in the first place), there should be nothing to match against.

Good point.

I wonder how low a resolution in facial keypoints you would have to go to have any plausible claim that the data is no longer PII?

“We don’t have any PII as covered by the GDPR. We do however have this list of 15 xy coordinates here, that coincidentally happen to match up with the output of a facial keypoints that might be generated if somebody _else_ had a photo of you and ran it through a keypoints extraction algorithm…”

I’d probably take a day off to do some justice tourism and visit the courtroom the day a lawyer for Clearview tried to argue “My clients product, which they sell as a method of personally identifying individuals, does not store any personally identifying data for individuals it identifies, your honor.”

> I wonder how low a resolution in facial keypoints you would have to go to have any plausible claim that the data is no longer PII?

It doesn't matter how low the matching resolution is, they still need to store the whole image somewhere to show the match and that is 100% personal information

Reply on news.ycombinator.com