Wrangling Over Proposed Privacy Laws Continues

zurab writes "USA Today reports several U.S. lawmakers introduced a long-awaited privacy bill Wednesday that would allow U.S. businesses to share information about customers who have not explicitly forbidden them to do so. And one of the supporters of this bill - the beloved Mr. Boucher."

Comments

Privacy and personal information...

[crc32]

should be property rights held by individuals. This allows a more perfect market, because the information would be more closely protected than this bill provides. As Larry Lessig explains in his book Code, Privacy as a property right allows those who don't care about privacy to get what they want, while those who have considerable concerns to seriously protect themselves. Any other scheme will deny the fact that privacy concerns differ between different segments of society.

Re:Opt out policy

[jsmyth]

You might think this is funny, but the doubleclick opt-out was exactly this. You had to click through several layers, including one page which solely consisted of a rant on how it is actually in your benefit to allow them to track your usage, and then you have to confusingly click to disagree with their policy, get to the last page, which made a tiny little change to a cookie. Would've been much quicker to print the instruction: Change the number in our cookie to OPT-OUT and it'll be fine.

Look what happened to doubleclick...

Real Privacy Legislation

[MartinB]

Compare and contrast that travesty with UK Data Protection Act 1998. To summarise

Anyone processing personal data must comply with the eight enforceable principles of good practice. They say that data must be:

• fairly and lawfully processed;
• processed for limited purposes;
• adequate, relevant and not excessive;
• accurate;
• not kept longer than necessary;
• processed in accordance with the data subject's rights;
• secure;
• not transferred to countries without adequate protection.

Personal data covers both facts and opinions about the individual. It also includes information regarding the intentions of the data controller towards the individual, although in some limited circumstances exemptions will apply. With processing, the definition is far wider than before. For example, it incorporates the concepts of 'obtaining', holding' and 'disclosing'.

The Full explanation of the principles can be found here

(source: http://www.dataprotection.gov.uk/principl.htm)

Note that last point - the US at present does not have 'adequate protection' (ie protection to an equivalent level). This proposed bill takes it further away.

Something else to note - the enforcement of this will only get stricter when the new Data Protection Commissioner takes office.