NationStates

Protecting Personal Privacy

Category: Regulation | Area of Effect: Customer Protection | Proposed by:Marxist Germany

---

The World Assembly,

Disgusted by the lack of legislation regarding the ability of organisations to collect data from their customers without consent;

Discerning every individual's right to privacy;

Deducing that collecting data without consent is violation of the right to privacy;

Describing that most minors are not fully mentally mature and are not capable of comprehending the risks of the decisions they're making on their own without the help of their guardian(s);


Hereby,

1. Defines the following for the purpose of this resolution:
   1. An "organisation" as any entity that collects data from its members or users, and isn't directly run by a government;
   2. A "minor" as any sapient being under the age of majority;
   3. An "adolescent" as any minor going through a transitional period into adulthood as defined by a government of a member-state;
   4. A "guardian" as any legal guardian of a minor, or if none exists, a biological parent;
   5. "Personal Data" as any data that can be used to identify a sapient individual;
   6. A "user" as any sapient being who uses or has used the services of, or is a member of, an organisation;
2. Denies:
   1. Organisations from storing the personal data of any non adolescent minor without the explicit consent of their guardian except when the guardian cannot be contacted or it is not in the best interests of the minor to do so, as determined by national governments;
   2. Organisations from collecting data from any user, or non-user, without their explicit consent except for crime prevention;
   3. Organisations from using personal data collected from any individual to intentionally and maliciously cause harm or severe distress to the individual the data belongs to;
   4. Governments of member states from viewing the data of a user without the explicit prior consent from both the organisation in possession of the data and the user to which the data belongs unless:
      1. The data is subject to a subpoena for litigation discovery to which the user is not a party;
      2. The data is subject to a valid warrant during criminal investigation, or;
      3. The user places the data's contents or subject matter at issue as a party in a civil dispute;
3. Demands that:
   1. Organisations provide information on how they will use a user's data to the user explicitly when they interact with the organisation for this first time or when a major change to the data collection policy has been made;
   2. Organisations enable users, and non-users, to view the data that the organisation holds on them unless the release of data would compromise the well-being of the individual or others;
   3. Personal data processed for any purpose is not kept for longer than is necessary for that purpose unless the user, or non-user, consents to that explicitly and clearly;
   4. Organisations allow users, and non-users to request the removal of their personal data, and act upon these requests unless there is a clear and compelling safety or disciplinary reason to do otherwise such as loans or criminal records;
4. Declares that an organisation can prohibit a person from using the services of, or joining the organisation if the user does not consent to the data collection policy of the organisation;
   
   
5. Dictates that member states:
   1. Make a private right of action against organisations that do not follow the provisions established in this resolution;
   2. Establish statutory damages as remedies if the damages are enough to be dissuasive.

Co-authored with Kenmoria

Imperium Anglorum wrote:So, first, all the issues identified in the repeal.

Marxist Germany wrote:

Imperium Anglorum wrote:So, first, all the issues identified in the repeal.

OOC:Yes

Edit:Tweaked 2d, still looking for a workaround for the child issue

Kenmoria wrote:that children can have legitimate reasons to not have available the consent of their guardian, for example in cases of child abuse. This can be solved by adding in an exception for when the guardian is not available to contact or it would not be in the best interest of the child for them to be to contacted.

Imperium Anglorum wrote:

Kenmoria wrote:that children can have legitimate reasons to not have available the consent of their guardian, for example in cases of child abuse. This can be solved by adding in an exception for when the guardian is not available to contact or it would not be in the best interest of the child for them to be to contacted.

One might also want to consider the possibility that adolescents simply should not require the approval of their parents to be on Facebook. To require that sets a somewhat ridiculous standard for parental involvement in absolute trivia.

Marxist Germany wrote:OOC:that's actually the law in EU countries, one can't use twitter until they're 16 because one needs parental consent.

Marxist Germany wrote:OOC:that's actually the law in EU countries, one can't use twitter until they're 16 because one needs parental consent.

Marxist Germany wrote:

Imperium Anglorum wrote:One might also want to consider the possibility that adolescents simply should not require the approval of their parents to be on Facebook. To require that sets a somewhat ridiculous standard for parental involvement in absolute trivia.

OOC:that's actually the law in EU countries, one can't use twitter until they're 16 because one needs parental consent.

Marxist Germany wrote:Defines ... A "Business" as any entity that trades goods or services and is aimed at achieving a profit;

Uan aa Boa wrote:

Marxist Germany wrote:Defines ... A "Business" as any entity that trades goods or services and is aimed at achieving a profit;

OK, so Data Trap Inc sets up a subsidiary organisation called Loophole & Co that doesn't trade goods or services and doesn't attempt to achieve a profit. Loophole & Co is not a business for purposes of this resolution, so it can collect and process any personal data it wants, free from any restrictions other than clause 3c (which is entirely toothless if the stated purpose of data processing is "so that we know everything about you.")

Assuming that Data Trap Inc can view Loophole & Co's data without storing it (a technical IT challenge, but doable) it can freely use data on minors (avoiding 2a) and data that was gathered without consent (avoiding 2b). Loophole & Co can share data with the government (avoiding 2d) and need not allow users to view the stored data (avoiding 3b) or acknowledge any requests to delete it (avoiding 3d).

2c and 3a still take effect, but while Data Trap Inc now has to tell you what it's doing with your data you can't do anything to stop them.

Also, without any consideration of subsidiaries, 2c appears to prevent businesses from trying to collect money owed to them, since being pursued for bills you can't pay is a well documented cause of harm and severe distress.

Aclion wrote:Bad faith AF.

Uan aa Boa wrote:

Marxist Germany wrote:Defines ... A "Business" as any entity that trades goods or services and is aimed at achieving a profit;

OK, so Data Trap Inc sets up a subsidiary organisation called Loophole & Co that doesn't trade goods or services and doesn't attempt to achieve a profit. Loophole & Co is not a business for purposes of this resolution, so it can collect and process any personal data it wants, free from any restrictions other than clause 3c (which is entirely toothless if the stated purpose of data processing is "so that we know everything about you.")

Assuming that Data Trap Inc can view Loophole & Co's data without storing it (a technical IT challenge, but doable) it can freely use data on minors (avoiding 2a) and data that was gathered without consent (avoiding 2b). Loophole & Co can share data with the government (avoiding 2d) and need not allow users to view the stored data (avoiding 3b) or acknowledge any requests to delete it (avoiding 3d).

2c and 3a still take effect, but while Data Trap Inc now has to tell you what it's doing with your data you can't do anything to stop them.

Also, without any consideration of subsidiaries, 2c appears to prevent businesses from trying to collect money owed to them, since being pursued for bills you can't pay is a well documented cause of harm and severe distress.

Marxist Germany wrote:

Uan aa Boa wrote:OK, so Data Trap Inc sets up a subsidiary organisation called Loophole & Co that doesn't trade goods or services and doesn't attempt to achieve a profit. Loophole & Co is not a business for purposes of this resolution, so it can collect and process any personal data it wants, free from any restrictions other than clause 3c (which is entirely toothless if the stated purpose of data processing is "so that we know everything about you.")

Assuming that Data Trap Inc can view Loophole & Co's data without storing it (a technical IT challenge, but doable) it can freely use data on minors (avoiding 2a) and data that was gathered without consent (avoiding 2b). Loophole & Co can share data with the government (avoiding 2d) and need not allow users to view the stored data (avoiding 3b) or acknowledge any requests to delete it (avoiding 3d).

2c and 3a still take effect, but while Data Trap Inc now has to tell you what it's doing with your data you can't do anything to stop them.

Also, without any consideration of subsidiaries, 2c appears to prevent businesses from trying to collect money owed to them, since being pursued for bills you can't pay is a well documented cause of harm and severe distress.

OOC:Loophole & Co doesn't sell a service ir trade so it won't receive any customers

Marxist Germany wrote:OOC:I can't seem to be able to fix that

Kenmoria wrote:

Marxist Germany wrote:OOC:I can't seem to be able to fix that

(OOC: Try prohibiting a business from viewing data obtained from a secondary source if there is cause to suspect that the secondary data did not meet the standards laid out by this proposal.)

Uan aa Boa wrote:Better yet, make the rules apply to everyone who stores and processes personal data. This is certainly what the EU system does. Why should non-profits, fundraising appeals, churches, political parties or random members of the public get to make unregulated use of personal data anyway?

Araraukar wrote:

Uan aa Boa wrote:Better yet, make the rules apply to everyone who stores and processes personal data. This is certainly what the EU system does. Why should non-profits, fundraising appeals, churches, political parties or random members of the public get to make unregulated use of personal data anyway?

OOC: ^This.

Kenmoria wrote:“3a doesn’t make any qualifications on when this is to be offered nor for what is precisely meant by it. I interact with many businesses in one form of another every day, and don’t really want to be told every time one collects data on me. This especially applies online, where research may involve hundreds of commercial websites, and I have need to have each term and condition read to me.”