Slashdot Mirror
New Privacy Laws In Asia May Cripple Data-Centric Outsourcing
bizwriter writes "Think privacy issues are a pain when they affect consumers? Get ready for the grandfather of all corporate computing headaches. Big privacy-law changes in India and China are about to turn data-processing outsourcing into a hurdle-leaping, paperwork-generating mess."
From the perspective of someone who prefers their privacy I'm not seeing a problem.
If by "Big privacy-law changes" you mean they're going to have some, then yes that will make it harder for companies to just offshore data processing to these countries and not worry about what happens. How on Earth you can try and paint that as a bad thing for those of us who actually, you know, like having privacy after our details are farmed off to some offshore data processing facility is beyond me.
>A company must get written consent by letter, fax, or email for the collection of data.
Fucking awesome.
>People can opt out at a later time and withdraw their consent.
Fucking awesome
>There are significant restrictions on disclosing personal data to third parties.
Fucking awesome.
>When a person has given consent for the transfer of data, or itâ(TM)s necessary by contract, a company can only send the data to an organization that provides the say level of security as the Indian regulations.
People have the right to review their data and to correct it.
Fucking awesome.
The only people who have a problem with this are the ones who are intent on anally-raping your and my personal information with no reach-around.
So when do we get this in the States?
--
BMO
Maybe, but I think the EU should have done this long ago. The "safe harbour" regulation, where companies in the US promise to stick to EU law, is not worth the paper it is written on. Of course the NSA, FBI, DHS and some other three letter agencies have access, and maybe even more people.
The only way to keep data safe is to keep it under one jurisdiction. It is a sad state of affairs, but it is an accurate description of reality.
I don't see what the problem with the new laws is. They make it somewhere between uneconomical and impossible for companies to archive personal data (about me and you and others) forever without a well-defined use. What's the big deal?
For a long time there's been the hope in every company, that if they archive every piece of personal data, including every search term I've ever used and every cookie ever in my browser and everything I've ever bought at the grocery store or drugstore while using a credit card or loyalty card, that somehow this would pay off to them monetarily. They've already been paying money and effort to store this data probably without any obvious benefit to them. If these new regulations drive home the point that there's no point in storing all that useless information because of regulatory costs, what they'll do is simply stop storing it. No problem. Their IT suddenly becomes much more efficient because they are doing useless storage and archiving. They'll probably get a higher profit margin as a result.
It's kind of scary. At many big non-IT companies, IT costs have risen to as much as 6% to 10% of their cost of doing business. This is simply unsustainable. As IT technologies improve, IT should become a cheaper and smaller part of every company. Not get more and more expensive.
Yeah I think that's great. Indian outsourcing companies are basically making it hard for companies to ever get their data back. So either they will need knowledgeable staff in the USA to pull all their data off the Indian systems or it stays in India forever.
Good. About time US companies realize, make India your IT center you are subject to Indian IT law.
Provided we can meet the standards of the customers in India and China
politicians are like babies' nappies: they should both be changed regularly and for the same reasons
. . . this seems to be European.
The new rules outlined in TFA appear to basically ensure the level of "informational self-determination" that is supposed to be granted to EU citizens according to their court of human rights.
In that respect it could simply be what's required to keep that kind of business coming from Europe.
That's because China has one "authority" for all information to start with - the government.
Currently, such information "control" is only a wet dream in Congress.
@Mindless Drivel: 100% of Twitter posts ever Tweeted.
Not exactly. Privacy does not exist in the US because neither the businesses nor the government wants it. The business like to collect whatever they want, ignoring some percentage of wrong data (so who cares that Mr. Smith cannot get a cable subscription, because of some wrong data somewhere), because it's more economical to ignore that than to allow the persons affected to correct it.
And the government loves it because between Patriot Act, ...., and legal interpretation (e.g. emails stored on an external email server loose the expectation of privacy), the government gets access to stuff they would not be able get normally.
Simple to solve that one. Express the fine as a percentage of global revenues, like the EU does for anti-competitive practices. Notice how US companies do try to appease EU regulations in this area. Notice that the US companies most affected, e.g. ad networks, are already trying to appease the EU privacy regulations. (E.g. masking IP addresses in data collected and so on.)
Before we all jump on the bandwagon and cheer about how great this is, let's see how well the new laws are enforced before we get too excited. That is with respect to the Indian laws, which are already enacted or seem close to being so. As far as China goes, let's see what the actual laws are going to be, and how well they are going to be enforced.
There are a lot of bureaucrats in both countries with deep pockets. And both of these countries are ranked pretty far up there in terms of the Corruption Perception Index. At least compared to North America and Europe. Which is why American and Canadian companies probably like doing business over there; and why European companies probably wish they could. At least North America and Europe will now be playing on the same level now... once they pay their bribes.
-- I ignore anonymous replies to my comments and postings.
The only way to keep data safe is to keep it under one jurisdiction. It is a sad state of affairs, but it is an accurate description of reality.
Bzzzt. The only way to keep data safe is to not hand it over to some other party in the first place. These laws are great and all, but the lobbyists can get them changed next year and now all of that data that people have given up under the impression of safety is fair game for full exploitation.
When information is power, privacy is freedom.
...only outlaws will have your data? :-)
An alternative David Brin-like transparent society suggestion to make data mining go both ways:
"The need for FOSS intelligence tools for sensemaking etc. "
http://pcast.ideascale.com/a/dtd/76207-8319
That said, I'm not against privacy laws... But I can wonder what the unintended consequences may be.
For example, is HIPAA really helping make medicine better? Example:
http://crazymer1.wordpress.com/2010/01/10/hipaa-laws-unintended-consequences/
"Anyone whose loved one suffers from severe mental illness has most likely run smack dab into the HIPAA laws when they try to help their loved one. The way they stand right now, HIPAA Laws (Health Insurance Portability and Accountability Act of 1996) are a hindrance rather than a help for the severely mentally ill population."
Sometimes trying to regulate into law what should be the product of a health life-affirming culture is not a great idea in the end. Our culture has lots of problems, including with respect for privacy, but it is not clear that laws are the best way to solve these problems.
A big part of these problems, for example, relate to economic uncertainty if you are seen in a bad light. With something like a "basic income", privacy issues at least in some areas might not be as important. So there may be other more fundamental ways to address some of these issues. related:
http://basicincome.iovialis.org/e00.html
Another big issue is simply a broad imbalance of economic power, which might be addressed in part to a return to a 92% progressive tax rate, as the USA had a few decades ago in its boom years. Or, perhaps more corporate charter revocations when corporations do not put the public interest first, as used to be routine a century or two ago?
More on 21st century enlightenment, from the RSA:
http://www.youtube.com/watch?v=AC7ANGMy0yo
A 21st century issue: the irony of technologies of abundance in the hands of those still thinking in terms of scarcity.
"did I mention that in practice Apache's default configuration is illegal?"
It is not. It is only that you should consider Apache logs as containing personal data and take care of them accordingly. As long as you plan to use those logs for its obvious purpose (technical maintenance) you don't need explicit consent: it is implicit by the fact you reached them with your browser.
"Notice how the EU has forced most (even US-based) ad networks to work around that by at least masking the last byte of the address."
That's only a mid-true: add servers collect IP address in order to process them as personal data (i.e. to focus their message), so they need explicit consent for collecting them: they don't get explicit consent for that, they can't collect them. Quite simple.