The law should treat personal data like human organs – not for sale
theglobeandmail.com
theglobeandmail.com
Data is not like anything. It's its own thing that shouldn't be sold or abused like it is right now, and nobody will ever get it as long as they need to use analogies to understand it.
At least they have a "simplistic narrative". You just vaguely gesture towards what you think should happen without any reasoning or argument to support your point.
> Data is not like anything.
Every model is wrong, some are useful.
Yes, and I'm saying this one isn't useful, it's worse than no model at all. I can still be correct in pointing out that something is bad even if I don't have something better.
I hear you say it, but you provide still no reasoning. Not even a handwave. Do you expect us to intuit your thinking? Why is it not usefull? What do you find disagreable with the article’s reasoning?
> I can still be correct in pointing out that something is bad even if I don't have something better.
You could be. You are not convincing. The article is. So who is winning here? “Simplistic narrative” vs “believe it because mihaic says so”?
Yeah, and I was just expressing my opinion on disliking that simple narratives are winning. If you were honestly trying to have a conversation, and were genuinely curios of my arguments, I'd put in the effort to explain them, like hakunin for instance posted slightly above. I could for instance talk about how I feel like the overuse of analogies is dumbing the audience, like how movie scenes of "hacking" get removed from reality, but the medium develops a language of its own.
Data is also hard to explain properly since a difference in scale change the nature of what abuses you can make with it. I could here introduce the analogy to the problems of solving a random crime (a data point) versus organized crime, that reached a new dimension simply from scale. But I would also make a point of where this analogy breaks down -- the article merely mentions it's not a perfect analogy and then just continues.
Again, I'm not trying to convince anyone about what I think about data, but rather of more responsibility in properly communicating concepts, and correcting when someone oversimplified concepts.
I am actually.
> I'd put in the effort to explain them
Thank you!
> I could for instance talk about how I feel like the overuse of analogies is dumbing the audience, like how movie scenes of "hacking" get removed from reality, but the medium develops a language of its own.
Now that is an interesting example. The thing is a real hacker doesn't look like much. Visually they can be anybody. They probably have a computer. They probably type in commands (but not always) to a command line. They probably type into a text editor and save it. Visually me sitting in this chair and writing this comment to you, and a master hacker infiltrating a secure network are almost indistinguishable. We know that the hacking involves mental puzzle solving, subterfuge, probing and discovering systems, the danger of being found, dealing with active and passive defences etc. So they illustrate these elements visually. Because from the storytelling perspective what matters is not how it is done (person typing in commands into the command line) but what action do they represent. The emotional content.
How would you want it handled? Why would that be better? In what sense would it be better? (Would it be better story telling? Or would it be better for society at large?)
I tell you a bigger problem with movie language: corrupt police officers. Certain kind of crime genre requires that the police is either corrupt or incompetent. Because if they were neither the whole premise of the movie would be solved by the hero walking to the police and making a report and the baddies would be caught, end of story. But that is bad story telling. It is not interesting to watch. So in these kind of movies corrupt and/or incompetent police is a requirement. Which over represents police corruption/incompetence in crime movies which has real-world implications. It slowly corrodes society where people expect less from police, less surprised when corruption or incompetence is reported, and makes people less likely to turn to the police with their problems. That's very bad. I'm not sure how stylised "hacker battles" are bad in the same sense, but maybe you thought more about that than me?
> correcting when someone oversimplified concepts.
But what is the oversimplification? We exchanged multiple comments over this and I still don't understand your point. The article doesn't say that "private data" is literally "human organs". It is not recommending that you should do an immunological compatibility test before you hear someone's private data, or that you should transport private data in a chilled container. That would be clear nonsense. Instead it recommends that legislature could ban the trade of private data. Like how we ban the trade of human organs. That is what the article says. Which of this is "oversimplified"?
And, yes, like in your example with the corrupt police officers, these analogies pollute the Overtone window, and when you actually want to bring in better ones you're stuck since the public has to first get unstuck and then convinced of your ones.
> Which of this is "oversimplified"?
A problem I have with the organ analogy for instance is that it fails to explain that there are plenty of reasons for data to be transferred to multiple providers if it's required for business operations. It's the selling and abusing part that's wrong. Is it really closer to prostitution here, where giving something away for free in a controlled setting is fine, it's just that selling it is a problem?
At the same time, sharing data with third parties should be done responsibly, and they should allow you to delete it once you bring it on their platform to run some analysis for instance.
Maybe holding onto data is like babysitting or schooling? You're entrusted with someone's child, have some autonomy on how to behave with them and can even take the kids to the park, but they're never yours.
Thanks as well, hopefully I managed to be a bit clearer.
You need analogies for people who are less technically savvy, like most legislators.
You don't need to have a PhD in computer science to understand what data is and what can be done by aggregating and reselling it. You just need some intelligence, curiosity and honest interest in the issue. If you pass laws on technology, maybe spend 30 hours and learn basic Python.
When people are treated as not able to understand a complex argument, you'll get a population that can't even digest most basic arguments.
Analogically its the same as not being allowed to sell your vote.
Like this one, from math/computer science major who became marketing consultant:
https://en.wikibooks.org/wiki/Lentis/%22Data_is_the_new_oil%...
To hold it up as some sort of exemplar isn't smart.
But yes, having private organizations as middlemen is not good. That's why my organs will not be put to use when I die.
Yes. That is the case in the US at least.
The other debate that inevitably crops up is ethics, similar to the debate around surrogate pregnancies, we are already seeing women from piss poor countries taking up one of the most serious health challenges there is for rich Western women - women that just don't want to risk their bodies getting fucked up permanently by pregnancy.
We would regard being paid to donate blood (!) as rather distasteful. We do not have a lack of donors and I do not know a single heathy person who hasn't voluntarily donated blood at some time in their life.
NHS blood donation teams regularly set up temporary donation centres in shopping precincts, library's, universities and workplaces, so you can pop in and donate blood whenever is convenient for you. The only payment you get is a cup an tea and a biscuit afterwards. And the feeling you may have helped saved a life.
I'll let somebody else make the comments about medical capitalism in the USA.
https://nhsbtdbe.blob.core.windows.net/umbraco-assets-corp/2...
That sounds like a social circle thing. I’d be surprised if UK overall rate cracks 50%
[1] https://www.bbc.com/news/uk-england-leeds-54731724 [2] https://www.linkedin.com/pulse/red-blood-cell-shortage-engla...
There is still no need for payment (aka bribes) my capitalist friend.
I think we need to expand regulations around consent of data subjects. Today we sometimes argue over whether a data subject has meaningfully given consent for a specific use of their data for something other than the core product that generated it. Once that consent is given, maybe the data subject has some right to be forgotten in principle, but understanding how their data is actually being used in order to withdraw consent is really hard and messy.
What if every use of a customer's data which is presented back to them (e.g. from a marketing email from a firm you've never directly interacted with to targeted ad you see in an app or on web page) has to give you a link a report showing what data sources contributed to it, and which parties controlled it, along with "revoke consent" links?
There's also a right to get the data they have on you and to who it was sold and to revoke the "consent". It's practically useless because of how it gets maliciously implemented.
But presumably you're aware when you're shown an ad ... so requiring the application which uses the data to present info about the data provenance and controllers would give data subjects a better opportunity to withdraw consent from those uses. But I suppose you might not know if your data was used against you in the form of not offering you a better loan rate which your neighbor was offered, for example.
I use adblock religiously, so luckily buying my data is mostly waste of money to them.
There's an obvious existing solution to this: do not track headers. But they didn't want it that way because it wouldn't have left enough loopholes to keep people giving their data against their consent.
Every piece of data you create could be considered a copyrighted act, owned by you.
Businesses love to post signs that they are not liable for XYZ damage that may occur to your property. Often times this is not true. When you entrust your property to a business you have an expectation that they will provide reasonable care and security to that property and that it will be returned to you in the same condition. It doesn't matter that they have signs or contracts saying you're releasing them from liability. Negligence on their part is always a cause for liability. Unfortunately businesses have better lobbyists so this will never come to pass as law.
There is another problem as well. Sometimes the government requires a certain information to be collected but only of a certain class of people. Businesses then will enforce that across everyone. The mind's numbed robots you're dealing with will simply refuse you service because you're not complying with their policy even though the law doesn't require this. I can give you an example that I had a couple weeks ago and this is the first time it's ever happened to me. When traveling to the United States covid contact tracing information is still required to be collected for people who are not citizens or lawful permanent residents and maybe one other class of people. Visitors tourists etc are required to provide contact information and a location where they're staying. This is very clear when you go look up travel information and it always lists that this information is required except for citizens etc. this time when I was flying Delta and Korean Air they asked me for this information and I told them that I do not have to provide it because I am a US citizen and you can validate that because I have a US passport. They told me it was required for them to collect it and to refer to border controls policies and the cdc's policies. So I pulled it up on my phone the government website and showed them that this is not required of US citizens. Apparently Delta and sky teams policy recently changed that they require this information of all people traveling to the United States without exception. They showed me their internal memo that did not list the exceptions but curious enough it did list the government websites that should be referred to for more information on why they're collecting it. Those same websites that list that citizens do not have to provide this.
This is the kind of violation that should cause an airline to be shut down because they are refusing re-entry into someone's home country for a policy that has nothing to do with the law. Of course there is no escalation point no one to call You're simply stuck overseas refused to give a boarding pass for your flight.
This seems obviously like an excuse to track where people have been rather than the stated purpose.
What if you don't have a cell phone, you then are unable to return home?
For the United States that's what they're requiring of non-citizens phone number and address where you're staying. Of course US citizens and lawful permanent residents are exempt from that. Just like US citizens and lawful permanent residents are exempt from using facial recognition for international flights. US citizens and lawful permanent residence are exempt from a lot of border control policies. The border control people generally understand this but it's these companies that don't care and want to blindly collect the information that's the real problem. They are becoming a proxy for an overbearing government.
So, the regs would have to say something like, you can share this data to any one you contract with and anyone they contract with and on and on but it can only be used for X, Y, and Z and suspect it's impossible to define XYZ both in a way that "protects your data" and in a way that lets companies provide these 3rd party services.
To be more concrete. If my doctor uses MedRecords as the company that provides their patient tracking serice, and MedRecords uses AWS to store the data then I effectively have to give permission to my doctor, to MedRecords, and to Amazon. Further, the fact that I paid with a CCard means some data is send to Visa or Mastercard and to the bank the card is with so we're up to 5 companies. Some doctors have equipment that itself uses the cloud like say a modern MRI or CAT scanner. So with those companies and their providers were up to probably1 10 companies
My point being, this seems like a hard problem.
I wonder if there is some other solution like, make it illegal to use the data for marketing or insurance rates but otherwise it's ok to share for "legitimate business purposes" (lol)