Slashdot Mirror
Democratic Senators Propose 'Privacy Bill of Rights' To Prevent Websites From Sharing Or Selling Sensitive Info Without Opt-In Consent (arstechnica.com)
Democratic Senators Edward J. Markey (D-Mass.) and Richard Blumenthal (D-Conn.) today proposed a "privacy bill of rights" that would prevent Facebook and other websites from sharing or selling sensitive information without a customer's opt-in consent. The proposed law would protect customers' web browsing and application usage history, private messages, and any sensitive personal data such as financial and health information. Ars Technica reports: Markey teamed with Sen. Richard Blumenthal (D-Conn.) to propose the Customer Online Notification for Stopping Edge-provider Network Transgressions (CONSENT) Act. You can read the full legislation here. "Edge providers" refers to websites and other online services that distribute content over consumer broadband networks. Facebook and Google are the dominant edge providers when it comes to advertising and the use of customer data to serve targeted ads. No current law requires edge providers to seek customers' permission before using their browsing histories to serve personalized ads. The online advertising industry uses self-regulatory mechanisms in which websites let visitors opt out of personalized advertising based on browsing history, and websites can be punished by the Federal Trade Commission (FTC) if they break their privacy promises.
The Markey/Blumenthal bill's stricter opt-in standard would require edge providers to "obtain opt-in consent from a customer to use, share, or sell the sensitive customer proprietary information of the customer." Edge providers would not be allowed to impose "take-it-or-leave-it" offers that require customers to consent in order to use the service. The FTC and state attorneys general would be empowered to enforce the new opt-in requirements. The bill would require edge providers to notify users about all collection, use, and sharing of their information. The bill also requires edge providers "to develop reasonable data security practices" and to notify customers about data breaches that affect them.
The Markey/Blumenthal bill's stricter opt-in standard would require edge providers to "obtain opt-in consent from a customer to use, share, or sell the sensitive customer proprietary information of the customer." Edge providers would not be allowed to impose "take-it-or-leave-it" offers that require customers to consent in order to use the service. The FTC and state attorneys general would be empowered to enforce the new opt-in requirements. The bill would require edge providers to notify users about all collection, use, and sharing of their information. The bill also requires edge providers "to develop reasonable data security practices" and to notify customers about data breaches that affect them.
The consent shouldnâ(TM)t be for using or sharing your data, it should be for collecting it in the 1st place
A good effort in principle but ultimately worthless, all websites/apps will do is add "you explicitly consent to allow X" in their TOS and carry on as usual. a firmer action would be to make any TOS that is over 1 A4 page long legally invalid.
This will never happen as there are simply to many of the politicians from both sides on the take from the parties that make billions a year from our stolen/ proffered data. I like the concept but in the end regardless of who controls the government this will never make it out of committee.
let me laugh even harder.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
What if it's required to use the service?
Presumably the bill doesn't cover data already farmed without consent, only further farming from now on.
It could be argued that FB has farmed as much data as possible already (since its popularity is more or less shrinking now). Zuck's move is "I got mine, now let's make sure nobody else gets hands on it".
Reminder that this discussion isn't about privacy, but straight competition between data brokers. Massive, and accurate human behavior corpuses, of which FB is one of the largest repository will be monetized in machine learning models soon enough.
I also wonder if google search will become pay service now, or what?
These rules should apply to all businesses (and people) who obtain private information for a particular purpose.
This is, at best, a half measure.
-- Tigger warning: This post may contain tiggers! --
The proposed US legislation looks weak compared to the EU General Data Protection Regulation (GDPR). Why should people in the US have weaker protection? Facebook and other data collectors should be required to conform to a GDPR equivalent in the US and North America.
I know I'm posting as ac here, but still...
bet both testicles and $20k to $5 this never makes it to the floor for a vote. it's just a gesture to make it look like government works for the Plebeians (net worth less than a few million and not a politician).
This bill is a freaking joke
The principle excuse trotted out for stripping away privacy protections from ISPs, was that those protections didn't apply to websites or other tech firms. So protecting peoples' privacy wasn't fair or something... I didn't really follow that argument, but I don't think that was the point. They just needed some nonsense that they could repeat over and over again until some people started to believe it.
Now we have a bill doing the opposite, I'm interested to see the argument they make in opposition to this one. Granted, since they're not overturning an existing rule they don't need to work as hard in justifying it, so they'll probably just trot out one of their old standbys. Something like: "Regulations bad! Thog smash responsible government!"
However, I would love it if they just flipped that shit around and went full doublethink on us.
Customer Online Notification for Stopping Edge-provider Network Transgressions (CONSENT) Act
Initially I balked at the introduction of a new bullshit term like "edge-provider", but that's a mighty fine acronym.
And why do online services get specific punishment? Why not apply this to grocery stores? I don't want HyVee telling anyone I buy 10lbs vats of mayonnaise. (don't judge me).
How about we extend "Browsing history" to the real world. I don't think we want companies tracking and who entered their store and what they looked at. The age of ubiquitous cameras, face-recognition, and customer databases is upon us. With a high enough resolution camera, they could even track where your eyeballs are pointed.
Do you want a list of everyone who ever entered a gun store? Do you want to see who shops at the thrift-mart AND the ... gucci-emporium? Do you want your health insurance provider to know how often you stop at McDonalds?
If you're going to squawk at Facebook abusing "customer" data, you might as well take a closer look at the potential abuse of everyone else's databases.
Incumbent politicians also benefit more than challengers from ubiquitous data scraping because they already have more power to influence shady/corrupt social-media decision-makers such as Fuckerburg - making those pols already in power loathe to give that up.
When I read the definition of "edge service" it's suspiciously specific, but [excuse]my imagination is tired right now[/excuse]. What kinds of things are not edge services under this bill? (i.e. Who bought an exemption?)
"Believe me!" -- Donald Trump
This is just another sideways attack on Trump. It's almost like they didn't know that Facebook makes their money by ads and selling your personal information as it says on their consent form.
One of Obama's greatest strengths in his 2012 campaign was data driven microtargeting of ads. The republicans weren't able to target nearly as efficiently. There was news at one point of their econometrics system failing altogether. Where did that info come from that the Democrats used so successfully? Many, many sources likely including Facebook.
This bill is BS.
This is, quite literally, an attempt by Congress to make a law limiting the Freedom of Speech: prohibiting them from telling others something they've learned... Learned without any prior promise not to tell others...
If the Amendment protects the right of newspapers to publish state secrets , why wouldn't it also protect "social media" companies' right to publish our private little ones?
In Soviet Washington the swamp drains you.
Once something digital is out of your control it is gone. Everything from electronic medical records to the new AC/DC cd. Gone. Trying to regulate it into a box is futile. Collecting, copying, storing, sending costs almost nothing. No barrier. Everything will eventually be leaked or hacked.
The answer is to keep the electronic records/data from being created in the first place (offline storage= very very good). That means someone like me will never use or touch Facebook and will block every IP address connected to Facebook. Even if that means I can't watch a few videos.
How will this work with eCommerce websites using PayPal checkout (or Stripe, or Moneris, or...)?
Users/Customers are stupid, they have no idea how it all works. Are we going to need to add notices explaining how payment gateways work to checkout pages for US customers? How will this affect conversions/sales? Customers will not understand, be scared off, and will just go to Amazon instead (probably why this legislation is being proposed, like most law, it is likely bought and paid for).
Politicians should not be allowed anywhere near this. They are not qualified to draft such legislation.
Senator: Do you even understand how serious the data privacy breach is here? It's almost as if your entire business model is simply selling private data to anyone for any reason regardless of user settings. If Facebook doesn't get it together we will regulate each and every one of your competitors into bankruptcy! Are you even listening to us Mr. Zuckerberg?
Would every website with user profiles be required to pay for a privacy monitor to be stationed at their offices and datacenters, same way commercial fishermen have to pay for compliance officers to monitor their catches?
This is a neat trick to get techs running to fill the dems reelection coffers!
Truly great legislation needs a cutesy acronym. But it's too bad they can't call it Little Billy's Law or something with real bathos.
This will end up being some variant of: "You want to see hot naked girls? We'll even share your stats with them, you gorgeous hunk! Just click OK!"
How will this work with eCommerce websites using PayPal checkout (or Stripe, or Moneris, or...)?
Users/Customers have no idea how it all works. Are we going to need to add notices explaining how payment gateways work to checkout pages for US customers? How will this affect conversions/sales? Customers will not understand, be scared off, and will just go to Amazon instead (probably why this legislation is being proposed, like most law, it is likely bought and paid for).
Politicians should not be allowed anywhere near this. They are not qualified to draft such legislation.
Local Governments, State Governments, Federal Governments all gather information in the USA. These Governments ALL Sell this information to Business. Will this Bill stop the Governments from sharing PII and HIPPA information without an Opt-In decision from the persons/citizens? If not, this Bill is a publicity stunt!
fuck off ivan
The double opt in... how well did that work?
[($)]
Privacy Policy:
You don't have any.
Click OK to continue.
See https://www.eugdpr.org/
Attempts to legislatively say: "Thou Shalt NOT" will probably be ineffective when the underlying economy strongly favors collecting, storing, and using private information.
The most effective legal protections against invasive data collection are to change the economy of personal information. This sounds harsh and invasive, but it may be the only workable protection from widespread privacy threats and manipulation.
For example, we can increase the expense of collecting, storing and exchanging personal data by:
Then we must work to harden our society against the manipulative effects of collected personal data. This is a continual challenge. Things we might consider include:
Ultimately, dealing with the problem of privacy abuse and invasive data collection will take much more than a legislative "Thou Shalt Not".
Too little and too late. If it ever becomes law, it will change nothing.
Edge providers would not be allowed to impose "take-it-or-leave-it" offers that require customers to consent in order to use the service.
My first thought was "Here comes the TOS people have to sign to use the service. And this will be buried in the middle of millions of pages somehow."
I am American and many people are saying that making privacy a right will hurt the economy and should not happen.
First, these jokers get grandiose and call it a bill of rights. Next they limit it to "edge" providers so "non-edge" providers (ATT etc) aren't regulated. Then they allow the collection and only limit the distribution.
What a sick joke.
All we need is some basic protections. All we need is some actual representation in our government. The foul corruption is plain as day.
It takes legislators years to tumble to the fact that something is out of control.
If we're discussing a "Privacy Bill of Rights" then let's get real about it. Congress needs to grow a pair and address the 4th Amendment violations happening as proven in the Snowden leaks. Also regulating data miners like Facebook is a good idea, but let's not forget the 1000lb monster in the corner.
I think this is a great idea, as long as no government institution is exempted.
It's a joke. Everyone already opts in when they agree to EULA or privacy notice. This law will change nothing, because nearly everyone will still thoughtlessly opt in.
Opt in is not the answer. It might be an answer for spam emails or texts, but not for this. Data collection needs to have laws saying EXACTLY what is permitted and what is forbidden. Not "informed" decision-making that is really a no-op.
http://yuhongbao.blogspot.ca/2...
How about having something similar for the information that the government gathers -- without the person's consent -- for one purpose that is used for another?
And don't say it never happens. Here's some reminders of one especially awful one. Census Bureau. Japanese. FDR. Internment camps.
And simple failure to safeguard information. Sensitive personal information about me is now in China, thanks to the federal government's failure. And of millions of others, of course.
There's no time like the present. Well, the past used to be.