Slashdot Mirror
New Privacy Laws In Asia May Cripple Data-Centric Outsourcing
bizwriter writes "Think privacy issues are a pain when they affect consumers? Get ready for the grandfather of all corporate computing headaches. Big privacy-law changes in India and China are about to turn data-processing outsourcing into a hurdle-leaping, paperwork-generating mess."
From the perspective of someone who prefers their privacy I'm not seeing a problem.
Considering that these are the two main offenders in regards to privacy violations.
...keeping employment within their own borders, without imposing illegal tariffs.
worldmobilenet.com -- World Prepaid Wireless Internet plans
If by "Big privacy-law changes" you mean they're going to have some, then yes that will make it harder for companies to just offshore data processing to these countries and not worry about what happens. How on Earth you can try and paint that as a bad thing for those of us who actually, you know, like having privacy after our details are farmed off to some offshore data processing facility is beyond me.
Laws that force the use of domestic data centers. No business for you, western world.
We're in a trade war. We're getting our clocks cleaned.
>A company must get written consent by letter, fax, or email for the collection of data.
Fucking awesome.
>People can opt out at a later time and withdraw their consent.
Fucking awesome
>There are significant restrictions on disclosing personal data to third parties.
Fucking awesome.
>When a person has given consent for the transfer of data, or itâ(TM)s necessary by contract, a company can only send the data to an organization that provides the say level of security as the Indian regulations.
People have the right to review their data and to correct it.
Fucking awesome.
The only people who have a problem with this are the ones who are intent on anally-raping your and my personal information with no reach-around.
So when do we get this in the States?
--
BMO
I don't see what the problem with the new laws is. They make it somewhere between uneconomical and impossible for companies to archive personal data (about me and you and others) forever without a well-defined use. What's the big deal?
For a long time there's been the hope in every company, that if they archive every piece of personal data, including every search term I've ever used and every cookie ever in my browser and everything I've ever bought at the grocery store or drugstore while using a credit card or loyalty card, that somehow this would pay off to them monetarily. They've already been paying money and effort to store this data probably without any obvious benefit to them. If these new regulations drive home the point that there's no point in storing all that useless information because of regulatory costs, what they'll do is simply stop storing it. No problem. Their IT suddenly becomes much more efficient because they are doing useless storage and archiving. They'll probably get a higher profit margin as a result.
It's kind of scary. At many big non-IT companies, IT costs have risen to as much as 6% to 10% of their cost of doing business. This is simply unsustainable. As IT technologies improve, IT should become a cheaper and smaller part of every company. Not get more and more expensive.
Provided we can meet the standards of the customers in India and China
politicians are like babies' nappies: they should both be changed regularly and for the same reasons
There isn't much substance about reporting requirements or analysis of how companies will comply in the article.
It sounds like healthy experimentation frankly. If companies still make more money there, then we'll know these laws were perfectly reasonable. If specific industries like dating sites or banks stop placing call enters in India, or if Facebook pulls out of China, then we'll see the exact consequences.
The Christian religion has been and still is the principal enemy of moral progress in the world. -- Bertrand Russell
From the article:
That is how it is in most parts of europe, e.g. in germany. So what is your complaint?
angel'o'sphere
Cost free eBook I read (by iBook/Kobo/Amazon/ObookO/Gutenberg etc.): "The Green Odyssey" by Philip Jose Farmer.
. . . this seems to be European.
The new rules outlined in TFA appear to basically ensure the level of "informational self-determination" that is supposed to be granted to EU citizens according to their court of human rights.
In that respect it could simply be what's required to keep that kind of business coming from Europe.
There's a clause in the UK Data Protection Act which says "data may only be exported out of the EEA if the receiving country has similar laws on data protection", and I suspect it exists in other EEA countries too. They may be aiming to comply with that.
It should rather telling that the peoples republic of China has better privacy protection laws than the United States does.
With our near total lack of security and privacy, Chinese and Indian companies will be moving their data centers over here.
I think it's sad that two countries, not exactly poster children for their defense of human rights, are pushing the security and privacy laws one would have thought should have originated here.
To me it's more of a sad testimony on us than them.
That's our life, the big wheel of shit. - The Fat Man, Blue Tango Salvage
Well, while it seems to have superficial differences the Indian law (as described here) is rather similar to the EU data protection directive.
Tiny issues include:
- the form of the consent. One has to see how that is being handled, but consent to handle personal information is required in the EU too.
- some issues are also around what is a person-linked information. IPv4 addresses are ruled sometimes so, sometimes not. IPv6 addresses almost for sure will be person-linked. Did I mention that in practice Apache's default configuration is illegal? Notice how the EU has forced most (even US-based) ad networks to work around that by at least masking the last byte of the address.
- The right to know what a company stores about you, where it got that information from, and to correct wrong entries is rather natural. Depending upon where you ask in the EU data protection is considered either law, constitutional law, or a basic human right.
- The only thing that has made this in the past "easier to ignore" is that the EU considers US companies that pledge to keep their laws to be legal targets of at least some personal information. (Notice that EC2 expanded first with data centers into the EU, because of data protection laws in the EU).
- Notice that gmail/gapps are illegal to use (at least businesses) in a good part of the globe. E.g. even Canadian entities have decided not to use Google's offerings because of Canadian privacy laws. Basically the US approach of NO privacy (or actually privacy only in some niches, like HIPAA) is costing US business revenue. It will only get worse with time.
and I'm going to be cleaning coffee spray off it for a week. Now if you'll excuse me, I've got articles to read about death panels, abortion, gay marriage, supply side economics; plus a local tea party rally to attend (but not national, musn't have those fellas split the vote and let progressives in office).
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
the cost savings are always much higher than any penalties, so you just ignore the laws. The only place this isn't true is medical because the AARP actually takes care of it's voting block. Besides, even if you're breaking these laws you're liable to be fined in India, where the currency exchange make it dirt cheap to pay. This doesn't really matter.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
Im actually surprised about this, this is the first I am hearing about it. I live in India and I didn't hear squat even though I don't read papers end to end an article like this on the first few pages would have caught my eye. Now that I search through our national dailies I still cant find it. Looks like they pushed it through on the quiet.
As a US company, I want even playing field. As a US consumer this is awesome! The last company I worked for did backups for banks and courts etc., and their server room was built in a concrete vault. The main selling point was ... "do you know where your data is?".
Before we all jump on the bandwagon and cheer about how great this is, let's see how well the new laws are enforced before we get too excited. That is with respect to the Indian laws, which are already enacted or seem close to being so. As far as China goes, let's see what the actual laws are going to be, and how well they are going to be enforced.
There are a lot of bureaucrats in both countries with deep pockets. And both of these countries are ranked pretty far up there in terms of the Corruption Perception Index. At least compared to North America and Europe. Which is why American and Canadian companies probably like doing business over there; and why European companies probably wish they could. At least North America and Europe will now be playing on the same level now... once they pay their bribes.
-- I ignore anonymous replies to my comments and postings.
I'll bet the public does not know about 90% of the security disasters that have already been caused by offshoring IT. Even the huge disasters that have been disclosed get very little attention in the pop-media.
Especially what India did. We want the same laws here in Europe. No selling of Information to third parties, no lending etc without proper authorization. Yes that may complicate outsourcing. Well who cares? And to the extensive paper work. There is a possible way out of it. International agreements, so data from Europe can still be transfered to India without additional paper work, because India and Europe belong to the same trust zone.
Nevertheless I do not want my information sold. Who ever does that, shall be punished (in forms of lots of money) which has to be payed to the state of course.
...only outlaws will have your data? :-)
An alternative David Brin-like transparent society suggestion to make data mining go both ways:
"The need for FOSS intelligence tools for sensemaking etc. "
http://pcast.ideascale.com/a/dtd/76207-8319
That said, I'm not against privacy laws... But I can wonder what the unintended consequences may be.
For example, is HIPAA really helping make medicine better? Example:
http://crazymer1.wordpress.com/2010/01/10/hipaa-laws-unintended-consequences/
"Anyone whose loved one suffers from severe mental illness has most likely run smack dab into the HIPAA laws when they try to help their loved one. The way they stand right now, HIPAA Laws (Health Insurance Portability and Accountability Act of 1996) are a hindrance rather than a help for the severely mentally ill population."
Sometimes trying to regulate into law what should be the product of a health life-affirming culture is not a great idea in the end. Our culture has lots of problems, including with respect for privacy, but it is not clear that laws are the best way to solve these problems.
A big part of these problems, for example, relate to economic uncertainty if you are seen in a bad light. With something like a "basic income", privacy issues at least in some areas might not be as important. So there may be other more fundamental ways to address some of these issues. related:
http://basicincome.iovialis.org/e00.html
Another big issue is simply a broad imbalance of economic power, which might be addressed in part to a return to a 92% progressive tax rate, as the USA had a few decades ago in its boom years. Or, perhaps more corporate charter revocations when corporations do not put the public interest first, as used to be routine a century or two ago?
More on 21st century enlightenment, from the RSA:
http://www.youtube.com/watch?v=AC7ANGMy0yo
A 21st century issue: the irony of technologies of abundance in the hands of those still thinking in terms of scarcity.
This is excellent stuff! I'm especially impressed with India.
I really don't understand that this can be reported as "paperwork-generating mess". What nonsense.
These might look good on paper, but just wait till our bureaucracy & police start interpreting this in their usual ways and start arresting random big shot CEOs from google India, facebook India or the various ISPs due to 'hate speech' posted by users etc. and all this jacks up the 'cost of doing business' (ie greasing palms) by a huge amount. And no user will really be able to take any action against any corporate because obviously our administration sees them as having more potential of pay offs. Very soon IT as a sector will become like our Real Estate sector - unimaginably corrupt - builders pay off nearly 20% of building/land costs to various govt depts and then obviously pass on these costs, as well as inordinate time delays, to the poor home buyers.
My concern with the law as an Indian is that the law prevents disclosure of bank accounts, details of phone records. There were two major incidents in the recent past. A disclosure of information by some journalists on tapes between industrialists and politicians. The other relating to swiss bank accounts which assange is about to post to Wikileaks.
Under the current rules both of these will be information which is provided as a result of breach of privacy. No news outlet can post such information without breaking these IT act rules. Essentially it's a gag order. You can argue it's in the public domain. However public domain is validly so if the information is provided or available as a result of disclosure by a party who is authorized to make such disclosure. So even if X were to leak such information, news outlet Y cannot host it on their IT systems or distribute it.
Essentially made for the corrupt by the corrupt.
Move on people.
Would that count as an economic recovery "green shoot"?
The article links to another article written by actual lawyers. In India's law, guess what counts as sensitive personal data, that required written consent to retrieve, store, and manage?
Passwords.
That's right: authentication is illegal in India without prior written consent.
(I imagine this part of the law will either get clarified, changed, or will simply not get enforced except when authorities need a trumped-up charge to justify going afer someone they don't like, but still.)