EU Privacy Directive — Coming To the US?

An anonymous reader writes "An article over at ComputerWorld implies that the EU Privacy Directive, or something like it, will soon be signed into law here in the USA. The author seems to think this is a good thing, but I'm not so sure. From the article: 'We've finally come to realize that self-regulation by industry hasn't worked. The states have stepped in, creating the same situation of conflicting regulation that led to the creation of the EU privacy directive. The only question now is if the law that comes out of Congress will be a small step strictly focused on breaches, such as S.239, or whether we take the bigger step of forming a permanent committee under the FTC to monitor privacy as outlined by S.1178. Either way, the U.S. is finally moving away from the fractured environment of the past and toward a comprehensive privacy strategy.' Is it time for a national privacy law or 'Privacy Czar', or are we better off letting things be?"

Comments

Is it just me

[kensai]

or has this whole "Czar" thing been way overused.

Re:Is it just me

[Bellum Aeternus]

Czar is an English spelling of a Russian word meaning caesar - which means autocrat. So what they're saying when they label somebody a czar is that his a leader who's above the law and with absolute authority. Seems to me, that in the "free" West, terms like czar should avoided for so many reasons.

I mean what western leader thinks he's above the law... oh right.

Anyways, why not follow the British example and refer to everyone as a minister?

By the time this thing...

[Anonymous Coward]

...ever makes it into US law (if ever), it will be so watered down and ineffective that it might as well not even exist. The corporations who now run the USA will not stand for it.

Re:By the time this thing...

[HomelessInLaJolla]

"We've finally come to realize that self-regulation by industry hasn't worked." This is some serious disinformation here. Self-regulation by the tech industry worked just fine until the government began allowing business and corporate interests to affect its subsidies, grants, and funding. It was in the transferral of the power to self regulate from the researchers who created the technology to the Wall Street entities which began government appointed overseers and distributors of the technology that the ability to self-regulate was lost.

There is no problem with self-regulation in the industry. The problem is that the industry is not allowed to self-regulate due to special interest groups and politicians' own greed and egos affecting the funding and legislative favoritism.

the lines in the privacy field need to be drawn

[siddesu]

in the past, as near as maybe 20-30 years ago, privacy was not a huge issue, because it wasn't so easy and cheap to amass data. of course, files on people have always existed, but they were specialized and compartmentalized, and not easy to correlate and analyse. nevertheless, some governments (mostly associated with ex-communist countries) are known to have excelled at collection, storage and retrieval of files on people, even if they only used paper. these files were very successfully used to make people behave in certain ways.

now, when there is the technology to collect, store and correlate all kinds of data about very many people by just about any entity with a minor budget, and there are no clear rules about what is okay and what is not, it is easy for the individual to be a target of abuse by a more powerful group (be that government, a large company, or some foundation), and it is almost impossible for the individual to counter-balance such groups, as data collection seems, in the absense of rules, quite legal, and, depending on the profile, the person may not be in a position to make a strong stand. so, it is pretty obvious that some levelling of the playing field is in order, and that it should be made a law, so that it has teeth.

to me the reasonable minimum would be the ability of a person to see the information an entity has amassed on them, and to be able to remove parts of their profile or (that being un-possible for some reason) the whole profile at any time, at least from a private organization. exceptions from that rule should be considered carefully, and introduced on a demonstrated need basis.

this will probably kill a few tabloid publications, and decrease the availability of movie star pictures on the internet though :(

It is already "watered down..."

[msauve]

if you read the bill, it's nothing like the EU privacy laws. The EU laws protect a person's privacy, requiring their permission to disclose personal information (among other things).

The US bill does nothing to prevent a corporation from deliberately disclosing whatever they want to whomever they want - it's focused exclusively on securing those transactions from third parties.

The law is summed up in this paragraph:

A covered entity shall develop, implement, maintain, and enforce a written program for the security of sensitive personal information the entity collects, maintains, sells, transfers, or disposes of, containing administrative, technical, and physical safeguards

I have a thing about my Social Security number - I only give it to those who require it to fulfill legal mandates. That includes my employer, who has decided (without my permission, and despite my express denial) to give it to a health care provider. This proposed law does nothing to prevent that.

I want them to be prevented from "selling or transferring" my confidential information, without my voluntary consent (no consent as a condition of employment, etc.).

Re:It is already "watered down..."

[ducomputergeek]

I've been asked for my SSN before on job applications and have told them, I'll put it on a W-4 when hired and you can't force me to give it to you because by law the only people I am required to give it out to is the Federal Government.

Maybe one reason why i had trouble finding a job right out of college.

Re:Gaaah!! Go, go fist of death!

[Gonoff]

You may not want your government monitoring your privacy. They already do.

In the UK, I do not want companies invading my privacy and it is made difficult for them to do so.

That's not "watered down..."

[overshoot]

The US bill does nothing to prevent a corporation from deliberately disclosing whatever they want to whomever they want - it's focused exclusively on securing those transactions from third parties.

That is, as you point out, the whole purpose of the Act. It's not "watered down" -- it's specifically designed to enable exactly what you cite (letting corporations do whatever they damn well please with your personal data) without interference from annoying State privacy laws.

So, who really worries you more?

[C10H14N2]

On a daily basis, do you protect your valuables and confidential records because you're afraid of a public official confiscating them or some random private citizen busting in and stealing them? Strangely enough, the primary reason we have government in the first place is to guard against the latter (whether through policing, the courts or recognition of property rights in general). Yet, people are /far/ more careless with their information and property in the hands of other private interests over whom they have virtually no control than they are with their public counterparts over whom they have direct control.

This is puzzling.

A good thing

[Kirth]

Guess why the USA has such a tremendous problem with "identity theft"? A much bigger one than in Europe?

Something which facilitates this is the missing privacy directive. Companies are much more careless with YOUR data if they can't be held accountable. This, of course, makes it easier for criminals to get your data.

Well, it would be a good thing if thy hadn't watered it down already..