EU Privacy Directive — Coming To the US? 180
An anonymous reader writes "An article over at ComputerWorld implies that the EU Privacy Directive, or something like it, will soon be signed into law here in the USA. The author seems to think this is a good thing, but I'm not so sure. From the article: 'We've finally come to realize that self-regulation by industry hasn't worked. The states have stepped in, creating the same situation of conflicting regulation that led to the creation of the EU privacy directive. The only question now is if the law that comes out of Congress will be a small step strictly focused on breaches, such as S.239, or whether we take the bigger step of forming a permanent committee under the FTC to monitor privacy as outlined by S.1178. Either way, the U.S. is finally moving away from the fractured environment of the past and toward a comprehensive privacy strategy.' Is it time for a national privacy law or 'Privacy Czar', or are we better off letting things be?"
Is it just me (Score:3, Insightful)
Re:Is it just me (Score:5, Funny)
I believe Czar is a Native American word meaning destined for failure.
Re:Is it just me (Score:5, Funny)
I believe Czar is a Native American word meaning destined for failure.
Y'know, based on my knowledge of history, I'd have to guess it means the same thing in Russian.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
I suspect senescence had more to do with that. That, or there are a bunch of zombie czars running around in Russia.
Re: (Score:2)
You could take that logic even further. Czar comes (like most European words for "emperor") from the name Ceasar (as in "I am Gaius of the Julii, called Ceasar!"), and we all know what happened to him*!
A more appropriate term would be "Augustus", as in "Privacy Augustus", as in "I ruled for more than 40 years, brought peace and founded the most powerful empire the world has ever seen. Bitches!"
Re: (Score:3, Interesting)
Re:Is it just me (Score:5, Funny)
Prince Albert has the same problem ... (Score:2)
Re: (Score:3, Funny)
Re: (Score:2, Funny)
I don't know about you, but I can't think of too many things worse than having my legacy associated with a meal of the vegetarian variety.
Real vegetarians won't eat a caesar salad [wikipedia.org] because of the eggs and sometimes chicken topings. Of course to have a legacy you would have to have offspring, and this is slashdot where leaving your mothers basement is not only strictly prohibited, it's highly discouraged.
Re: (Score:3, Informative)
----
As for worse things to be associated with than salads, try surgical procedures. Messy.
Re:Is it just me (Score:4, Informative)
Re: (Score:3, Funny)
Silly poster, fish and chicken don't count* - only the cute animals.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Most of us already know that. Though, I occasionally have to tell people about the anchovy thing. You can find Worcestershire sauce with no anchovies, but you have to look very hard. As a pretty strict lacto-ovo vegetarian, there's quite a few products I avoid outright.
Most forms of gelatin is animal derived (an amazing amount of yogurt
Re: (Score:2)
Re: (Score:2, Funny)
Re: (Score:2)
I dunno about chicken toppings (not in a true caesar sald), but, there are anchovies in the dressing when made the real way.
Re: (Score:2)
You might want to check Julius Caesar's history, then move on to the Russian Czars.
Re:Is it just me (Score:4, Insightful)
I mean what western leader thinks he's above the law... oh right.
Anyways, why not follow the British example and refer to everyone as a minister?
Re: (Score:2)
Actually we have "Czars" as well (although I presume we copied the idea from somewhere else). I think the idea is that a Czar is someone given complete authority to deal with a particular issue, or at least that's what it is meant to sound like.
Also a minister in the UK must be a member of parliament.
Re: (Score:2)
Re: (Score:2)
Emperor, not caesar or autocrat (Score:2)
Just to make one thing clear here: "Czar" comes etimologically from "caesar", just like the German word "Kaisar". Both mean "emperor". And emperors are (usually) autocrats. But that doesn't mean that every word related to "caesar" means autocrat.
And not even all emperors are autocrats. I believe Japan's power is firmly in the hands of a democratically elected government nowadays, for example. Just like kings and queens aren't autocrats anymore.
Re: (Score:2)
It depends on whether whatever religious order you've been indoctrinated into uses the word 'minister'. Mine did/does. When I was young I thought Margaret Thatcher was the head of the Church of Scotland.
Czar means Caesar (Score:2)
Re: (Score:2)
NotNot who's there? I don't know, Who?
Who's the guy in the picture with Bush in China?
Putin Bush is in the other picture in Russia.
I don't know, who is putin in a bush in Russia or China in a picture.
At least a picture doesn't stink up everyplace making it unbearable, and unlivable.
I hope there is never a passport required to leave this earth.
I keep my towel close, my thumb up, and my beer mug full
REMEMBER, I am an old guy
Re: (Score:3, Informative)
Incidentially, I just read my current issue of The Economist, and they have a leader (op-ed piece) about absurd titles. You can read it online at http://www.economist.com/opinion/displaystory.cfm? story_id=9339915 [economist.com].
My favourite sentence from that piece: "What next? Führers, Caudillos, Duci, Gauleiters and Generalisimos must be due for a comeback."
Re: (Score:2)
Still wouldn't mind being the "nipple tsar". I mean, somebody (apparently) has to do it.
Re: (Score:2)
It's just there in an attempt to make every libertarian reading this story goes into a screaming rage about evil government controls, and starts posting flamebaits like crazy. Slashdot needs discussion to generate ad revenue, you know. Besides, political discussions provide the most insightful comments and the creationism-bashimg flamebaits provide the most amusing perversions of science and logic (on both sides).
That said, it is a pretty sad attempt.
By the time this thing... (Score:5, Insightful)
Re: (Score:3, Insightful)
"We've finally come to realize that self-regulation by industry hasn't worked."
This is some serious disinformation here. Self-regulation by the tech industry worked just fine until the government began allowing business and corporate interests to affect its subsidies, grants, and funding. It was in the transferral of the power to self regulate from the researchers who created the technology to the Wall Street entities which began government appointed overseers and distributors of the technology that the ability to self-regulate was lost.
There is no problem with self-regulation in t
How's the weather in Libertine Fantasy-land? (Score:3, Insightful)
I think you meant to put a colon after the word here. It makes more sense that way.
I mean, do you honestly believe that there has ever been some mythical time in US history in which businesses happily kept to themselves and acted like gentlemen in the best interests of their customers before some swi
Re: (Score:2)
The IT industry and all modern privacy concerns are significantly younger than this. There has been no time at which the IT industry has not existed in a climate of bought and sold influence and corporate welfare. After all, the modern IT industry was born from the likes of IBM and
Re: (Score:2)
I mean, other than to say that the industry would self-regulate privacy better than the government would, what other meaning can be ascribed to this?
The EU Privacy Directive (Score:2)
Read a nice summary of it here. [wileyrein.com] It prevents a lot of the data mining and reselling that goes on in this country. If you don't feel that it's been good for anything but providing corporate welfare (...as a largely unfunded mandate), please let me know where it's failed and stripped citizens' rights.
It is already "watered down..." (Score:5, Insightful)
The US bill does nothing to prevent a corporation from deliberately disclosing whatever they want to whomever they want - it's focused exclusively on securing those transactions from third parties.
The law is summed up in this paragraph:
I have a thing about my Social Security number - I only give it to those who require it to fulfill legal mandates. That includes my employer, who has decided (without my permission, and despite my express denial) to give it to a health care provider. This proposed law does nothing to prevent that.
I want them to be prevented from "selling or transferring" my confidential information, without my voluntary consent (no consent as a condition of employment, etc.).
That's not "watered down..." (Score:4, Insightful)
Re: (Score:3, Insightful)
Re: (Score:2)
Except for data gathered about you as you move about the city during your days? I guess where you go and when isn't something you take as a privacy matter....completely ok to let yourself be monitored at all times by CCTV, eh? Or, do they ask you for your written permission anytime some constable wants to review t
Re:It is already "watered down..." (Score:5, Insightful)
Maybe one reason why i had trouble finding a job right out of college.
Re: (Score:2)
AFAIK, however, they don't prevent a business from making "you granting them permission to disclose information however they please" from being a condition of doing business with them.
All you wind up with is that the organisations who you really don't want being cavalier with such information (like banks) hiding a clause in the small print which broadly says "We may ship your data to thir
There's a big question here. (Score:2, Interesting)
There's a line in the movie "Absence of Malice" which sums up the problem of government regulators very neatly, even if it wasn't intended that way: "Have you given any thought to what you'll do after government service?"
Re: (Score:2)
Re: (Score:2)
Privacy Laws are a Good Thing (Score:3, Funny)
The key here will be that the laws need to be broad enough to deal with the rapidly changing business methods as well as provide room for companies to try different methods of achieving the results. At some point you can push companies far enough that they will then try to advertise on how great their privacy is versus some other company, so it's good to set the bar and allow companies to rise above it as well as just meeting it.
Depends (Score:3, Interesting)
http://www.computerworld.com/action/article.do?co
Anyways, it doesn't matter what the US signs into law if there is no meaningful oversight, penalties and enforcement.
I also can't imagine that the business lobby isn't going to scream and shout about the expense involved with implementing true EU style reforms.
One alternative to all these expensive-to-implement laws is to make it an opt-in industry. By the time they're done culling out all the people who don't want to be in the database (a one-time event), EU style privacy laws won't cost all that much to implement.
Re: (Score:3, Interesting)
It can, actually. If the American people believe they have a legal right to privacy, and expect it, then eventually oversight, penalties, and enforcement will come around, even if they don't start out in place.
Sometimes we have to aim for gradual cultural shifts if we can't immediately obtain sweeping and effective legislation.
Don't worry, every time their's a Czar... (Score:2)
Then why do we want a Privacy Czar? (Score:2)
Re: (Score:2)
It's good enough.. (Score:2)
Yeah, right! (Score:4, Funny)
What's the problem? (Score:3, Insightful)
I was going to start to argue *for* another contender on the side of the little guy, but I think I just talked myself out of it.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
the lines in the privacy field need to be drawn (Score:5, Insightful)
now, when there is the technology to collect, store and correlate all kinds of data about very many people by just about any entity with a minor budget, and there are no clear rules about what is okay and what is not, it is easy for the individual to be a target of abuse by a more powerful group (be that government, a large company, or some foundation), and it is almost impossible for the individual to counter-balance such groups, as data collection seems, in the absense of rules, quite legal, and, depending on the profile, the person may not be in a position to make a strong stand. so, it is pretty obvious that some levelling of the playing field is in order, and that it should be made a law, so that it has teeth.
to me the reasonable minimum would be the ability of a person to see the information an entity has amassed on them, and to be able to remove parts of their profile or (that being un-possible for some reason) the whole profile at any time, at least from a private organization. exceptions from that rule should be considered carefully, and introduced on a demonstrated need basis.
this will probably kill a few tabloid publications, and decrease the availability of movie star pictures on the internet though
Re:the lines in the privacy field need to be drawn (Score:5, Funny)
Re: (Score:2)
Preemption (Score:3, Insightful)
Done right, these laws get the Legislature some headlines for the voters while effectively insulating the campaign contributors from the risk of being held liable for doing what the Act theoretically prohibits.
Thought experiment: what would either Act have done in the case of HP spying on private parties?
You trust this crap? (Score:3, Insightful)
So today privacy is good, but last week.... (Score:2)
Re: (Score:2)
You may as well argue about terrorism and child porn. Personally, I'm tired of emotive arguments. Hearing one is a pretty sure fire ac
Re: (Score:2)
Having trouble with depression in your past doesn't necessarily mean you can't be trusted to responsibly own a firearm...
To make sure (Score:2)
Privacy Czar? (Score:2)
No thanks.
The fallacy is that compliance = privacy (Score:4, Interesting)
How many times have you had a company ask for ridiculously invasive information for your protection . Similar results will be incurred here. Currently asking information is at best spotty in legality and because of this you have a certain level of push back available to you when they request it. (No I will not give my sons grade school his SSN) however once a law like this goes into play it creates an aura of safety that once an organization appears to comply with it, the loss of your personal data no longer is a high level of liability for them. As a result your privacy is reduced to a level of cookie cutter actions that never get questioned because, 'everyone knows it meets legal requirements'.
Re: (Score:2)
What's in your... errrr, the Offshore guys wallet? (Score:2)
These laws don't make sense unless the countries/regions also want to deal with how the data is disseminated.
I just got off the phone dealing with someone from my phone company's customer service centre... in India. He was very helpful, so don't get me wrong but... It was disconcerting to know he could check my credit card number. I am sure many/most offshore call centre's employees are honest, but I have to wonder about how this privacy crap matters when we allow corporations to send our private infor
Now quickly! (Score:2)
just wait wait for it..
HIPPA didn't work (Score:3, Informative)
I'm also easy to impersonate.
Meanwhile, if she follows the law, my own wife has no ability to get the info. WTF?
My blood relatives should be able to get inheritable disease records. People who lived with me during the past year should be able to get contagious disease records. Anybody sharing finances with me (or recently, as with an ex-spouse) should be able to get billing records.
So HIPPA has pretty much made everything worse for me. I don't need more of the same.
Author didn't read the proposed bill (Score:2)
The author of the original article clearly didn't read the S.1178, "A bill to strengthen data protection and safeguards, require data breach notification, and further prevent identity theft" [loc.gov], the bill they're citing. And nobody else here seems to have read it either.
First, it's not anything like the European Privacy Directive. It has nothing to do with privacy. It's about leaks of information useful for identity theft and about credit reporting. It's actually another one of those bills designed to re
EU could learn from US too (Score:3, Informative)
* The citizen may request information of what data is kept
* The citizen may require incorrect data to be corrected
* The citizen may require data to be deleted
Further, data must not be shared with states outside EU unless the EU has recognized these as providing adequate protection of personal data. US is not on the list (but Canada is) which is the reason of the current conflict over passenger data on transatlantic flights.
But, the EU directive lacks one think: Supervision. There is no controls implemented, no prior certification of data processing entities, no posterior audit to ensure that data protection is adequately implemented, not even common standards on how data must be protected. AND, there is no obligation to publicly announce data breaches.
Certifying data processing entities and then granting these authorization to handle data is cumbersome and expensive and won't ever happen - fine. But, some control system should be established, and standards or guidelines should be made. Why is there no requirement to encrypt personal data when stored in a non-controlled environment (say mobile devices) and not in use?
And after the data retention directive, which seems also to be on the road into US law, why did they not set strict requirements on protection of these data to ensure that they are only available for the purpose of the retention - investigation of terrorism? Why may companies retain such traffic data and store it unencrypted?
At the very least, we could learn from the many US states that require companies to advice customers about data breaches and risk of abuse.
Re: (Score:2)
http://eur-lex.europa.eu/LexUriServ/LexUriServ.do? uri=CELEX:31995L0046:EN:HTML [europa.eu]
In 95/46/EC you have Article 6.e stating that data must be stored for no longer than needed in order to process the data for the purposes the data was collected. Article 7.a requires consent of the data subject or 7.b that processing is required to perform a task on the request of the data subject.
Which, I deduce, means th
A good thing (Score:4, Insightful)
Something which facilitates this is the missing privacy directive. Companies are much more careless with YOUR data if they can't be held accountable. This, of course, makes it easier for criminals to get your data.
Well, it would be a good thing if thy hadn't watered it down already..
Re: (Score:2)
In the US, the data belongs to the entity that collects it.
In the EU, the data belongs to the person it represents.
Once that difference sinks in, you'll see that all the rest is just a derivative of it.
If the information belongs to you, the organizations collecting it need your authorization to do anything with it (especially share it) and are responsible if they lose it (as it belongs to you and they are only safe-keeping it).
T
Re: (Score:2)
Do you have numbers behind that claim?
This is absolutely a good thing! (Score:2)
In 1972, Elliot Richardson was the Sec'y of HEW under Nixon. He commissioned one of the first reports on data privacy, which was shaping up to be a great thing. Then he left to become Attorney General to providee some moral credibility during Watergate, and Cap Weinberger (the mentor of Don Rumsfeld and Dick Cheney among others) came in and gutted the report's recommendations.
What was left was a report that said data privacy is a HUGE problem, and recommended a numbe
Re: (Score:3, Funny)
Re: (Score:2)
Not at all, I would imagine, since their courts hold that one has no legal expectation of privacy in a public place.
Sort of like ours in the U.S., actually. And having recently moved from one of the most heavily-surveilled cities [wikipedia.org] per capita (thanks to these folks [wikipedia.org]), I'm pretty familiar with the applicable laws, although your mileage may vary by state.
Of course, since the privacy law in question doesn't apply to surveillance cameras anyway, methinks you're just taking a cheap shot at our friends across the p
Re: (Score:2)
Is it flamebait if the question was rhetorical? Apparently one moderator thought so. (A subsequent moderator apparently thought "flamebait" was an overrating.)
I meant to say that while privacy protection against private interests is all well and good, I'm getting more and more concerned about privacy protection against government intrusion. I'
Re: (Score:2)
Re:Gaaah!! Go, go fist of death! (Score:4, Insightful)
You may not want your government monitoring your privacy. They already do.
In the UK, I do not want companies invading my privacy and it is made difficult for them to do so.
Re: (Score:3, Interesting)
I must have missed something. Yeah, it's difficult for the man at the local newsagents to demand your name, DOB, NI number and inside leg measurement then sell it to the highest bidder when you go in to buy your daily paper, but it's a different story for banks, building societies and property rental agencies - most of whom I'd be dubious about trusting with too much information.
Generally in the UK they don't
So, who really worries you more? (Score:5, Insightful)
This is puzzling.
Re:Gaaah!! Go, go fist of death! (Score:5, Informative)
I know almost nothing about the EU Privacy Directive, but I think the UK's Data Protection Act implements all or part of it, and I have a basic understanding of this. Please note my knowledge is very limited, there may be factual errors in my post, I'm not a lawyer.
The Data Protection Act restricts what an organisation can do with any personal data (such as your address), which it processes.
For example, the organisation:
See http://www.direct.gov.uk/en/RightsAndResponsibili
Re: (Score:2, Insightful)
The problem, even in Europe are -of course, corporations lobbying States, so the laws are not so-so on them.
"can only use your data for the purposes stated when you gave them the data."
But the law won't forbid putting the customer on such a position but to sign agreement for almost any purpouse (while there are quite a lot of laws about abusive clauses in contracts, I have yet to see one contract without the default "you agree on the cesion of your personal data for whatever
Re: (Score:2)
Also, permission has to be given by the individual explicitly, it's an opt-in and not an opt-out.
Oh, and unlike the first DPA, the second version covers paper copies of information as well.
Re: (Score:2)
Basically, you would be authorizing the collection and distribution that goes on today anyway. Except now there w
Re: (Score:2)
Re: (Score:2)
Guess he wishes he was in Dixie. (Score:2)
Me: What about the interstate commerce clause and the Civil War?
AC: LAH LAH LAH LAH LAH! I'M NOT LISTENING!
Re: (Score:3, Insightful)
No matter what laws are passed, unless there is cooperation from both the ISPs and foreign governments spam isn't going anywhere anytime soon.
Re: (Score:2)
We're probably talking about a few billion in revenue here, so it isn't a small change. It would also affect (if not eliminate) the concept of a "finance company". Add a few more billion to this.
What would you do? Require a new g
Re: (Score:2)
Re: (Score:2)
This looks generally good, except for this one part:
I would like to this amended to say: "have fixed personal information policies".
Lots of web sites have pretty good privacy policies, but they generally contain a line the the effect of "we reserve the right to update this policy...please check this page for the latest version". What's to stop a site from updating it's policy to say "We pwn j00r data, and now we