Slashdot Mirror
Privacy Advocates Oppose Aussie Data Breach Laws
schliz writes "This week, Australia's Attorney-General released a discussion paper about introducing laws that would force companies to notify members of the public any time personal information about that customer falls into the wrong hands. California introduced similar mandatory data breach notification laws in 2003, but Australian privacy advocates are now opposing the move, saying it's a decade too late."
It doesn't make the data more secure but perhaps the exposure will shame companies into better security.
Since when is "public safety" the root password to the Constitution?
So one privacy advocate doesn't understand the difference between knowing that organisations are culpably cavalier with sensitive data (we know that already), and knowing *which* organisations are culpably cavalier with sensitive data (so that people can avoid doing business with them), and somehow his flawed argument makes the frontpage of slashdot?
...data security is such an issue (or at least it should be) that breaches should be notified, not least to incentivise companies to make sure that data is secure. This is me, a privacy advocate saying; this is better late than never. Yes, they should have done it a decade ago, but this game of one-upmanship the so-called privacy advocates at large are playing saying "Fuck you, we're not listening to you any more because you should have done this long ago!" only serves to damage the campaign.
Operation Guillotine is in effect.
Since when has security and privacy even been the same things. The companies now, jizz data to anyone who'll pay for it. Even banks sell financial data these days, telecoms is a data selling field day. None of these things would be 'notified' as a data breach, since they're normal data selling business.
So not only is it a deflection, a way of heading off a decent privacy law, it would give people a false sense of privacy. They hadn't been notified their data had been lost because it hadn't been lost, it had been sold. It had been stripped of the name and sold in aggregate, it had been handed over to any random man in uniform on a random claim.
They've had a massive expansion of data requests, none of those would be notified, the only people who find out about those are if there is a trial and that data is used as evidence. Every bogus request is done in secret. What kind of notification law is that?
I tought there are some real arguments against the law in TFA, but there's only whining how it's too late. Well it certainly won't help data exposures before the passing of the law, but I don't know of any event that made such a regulation obsolete. It is in fact still very common for corporations to lose loads of personal data because they are too lazy to protect it. A law like this may not be effective enough to change that, but definitely not because it's 'too late'. It's as actual as ever.
I don't think that TFA is against it - i read it with a high dose of sarcasm. The headline is very misleading. But then again this is /.
"However, notifying customers of a data breach by unauthorized entities, could allow those customers to take steps to monitor their credit and or make the company liable if something damaging happens from it."
A valid point, but the article argues that the law doesn't go far enough, and is simply a token law to DELAY a decent privacy law. Why can't we have a decent privacy law that also has notification?
rtb61 below points out that the law enforcement requests should be notified if they don't use them for investigation within a time limit. Why can't a privacy law have that too?
Why can't a privacy law protect your telecoms data. Verizon seem to think they can spy on your every action and sell that data. Australia likely has the same thing. Why can't that be outlawed?
Why can't we have penalities for losing customer data? Decent expensive painful penalities that will cause companies to spend money ensuring their data is protected, who in their company gets access, who they allow access to?
From the article:
"Privacy advocates and security specialists alike are opposed to mandatory data breach reporting. The reason is that it's being used as an excuse to hold off what is now clearly necessary."
Is this Attorney-General could be the most disliked Attorney-General in Australian History? Does she think throwing the public a morsel will distract them as she beats them to death with a stick? Good luck with that.
http://www.canberratimes.com.au/opinion/politics/roxons-calls-on-slippers-crudities-show-questionable-judgment-20121017-27rgz.html
http://www.crikey.com.au/2012/10/18/how-not-to-launch-a-public-debate-by-the-a-gs-department/
http://www.crikey.com.au/2011/10/20/asio-reels-in-a-g-line-on-illegal-fishing-hook-line-and-sinker/
... perhaps it's time to start making it illegal for companies to compile personal data in the first place!
How much data besides an identifier is really needed?
So how late is too late?
I read the opinion piece and...well..it's stupid. He says it's a good thing, but it's too late and will take too long to implement so lets just not do it at all. Insert car analogy here is one so wants...
We should always strive to improve even if we're a bit late to do so. A better late then never approach I think is best most of the time...Yes I know, there is plenty of times too late is too late.
The mind boggles, maybe someone else here can shed light on why? Maybe there is a better alternative now?
I'm not going to lie..things with clock speeds turn me on...
Those of us who were around as scientists, engineers, and programmers back in the 1980's and '90's committed a collective epic fail of foresight when we didn't insist on "privacy by design" standards from the outset. In our headlong rush to connectivity and interoperability, we built systems that were ripe for commercial, governmental, and criminal data mining, and did not effectively campaign for legal safeguards or adequately forewarn the general public. We were, in our heady world of fast-paced progress and self-congratulation, irresponsible. Yes, we had our heroes trying to sound a warning, but they were too few and went unheeded. The rest of us just let it happen.
The cow has long been out of the proverbial barn. The best we can hope for is to corral the cow to some extent, and warn people about wild cows.
We as professionals owe a duty to the public to scream from the hilltops at every opportunity that There is no privacy on the internet! of any real sort, and make it clear that it is both naive and utopian to expect any. The power of money and government, and the avarice of criminals, have made it so and there can be no going back.
The analogy I use is that of walking out one's front door. You are in clear sight. Do not open your wallet if you want no one to see what's in it. Do not speak publicly if you desire confidentiality. You are in public every time you access the internet as much as every time you step out to the pub. Act accordingly.
New laws are indeed too late. There is no legal time machine to roll back what has already been done.
Scruting the inscrutable for over 50 years.
My understanding of their position, with which I don't agree, is that passing a weak law now would serve as an excuse to not pass a strong one. By way of comparison, CAN-SPAM is so weak it basically legalizes spam. If CAN-SPAM did not exist, there would be pressure to pass a (better) law. CAN-SPAM takes the pressure off and they feel the new privacy rule would do the same, reduce the motivation for having a good law. As I said, I don't necesarily agree, but I understand their reasoning.
Sounds like somebody needs to get over the fact that people still give a fuck, and fuck himself off a tall building.