[PASSED] Data Protection Accord

[Marxist Germany]

OOC: Call it something else but convention? That's almost as annoying as titles starting with "on". It's an act on data protection, so just go with Data Protection Act? Or just simply "Data Protection". It's supposed to be a title, not a description.

OOC: I dislike adding "act" in a title, and Data Protection is an incomplete phrase. I personally like the current title and the UN regularly uses it.

OOC: Submitting this next hour because I see no reason not to. Any complaints should be made now not at vote.

(OOC: I’m just about in the time limit; there should either: not be a comma after ‘user’ in clause 3d, or one after ‘non-user’ as well. Personally, I prefer the former option.)

Done.

[Araraukar]

the UN regularly uses it.

OOC: One of the reasons I dislike it, because of how differently NSWA and RLUN work.

[WayNeacTia]

the UN regularly uses it.

OOC: One of the reasons I dislike it, because of how differently NSWA and RLUN work.

This is also not a convention. A convention is a treaty, and thus members don't vote on it, they sign it. This is a bill.

[Marxist Germany]

OOC: One of the reasons I dislike it, because of how differently NSWA and RLUN work.

This is also not a convention. A convention is a treaty, and thus members don't vote on it, they sign it. This is a bill.

OOC: Any nicer suggestions?

[WayNeacTia]

This is also not a convention. A convention is a treaty, and thus members don't vote on it, they sign it. This is a bill.

OOC: Any nicer suggestions?

Data Protection Act. That title pretty much sums up what the proposal does.

[Marxist Germany]

OOC: Any nicer suggestions?

Data Protection Act. That title pretty much sums up what the proposal does.

OOC:Without act in the end because thats lazy and uncreative

Edit: Data Protection Protocol?
Accord on Data Protection?
Data Protection Accord?

[WayNeacTia]

Data Protection Act. That title pretty much sums up what the proposal does.

OOC:Without act in the end because thats lazy and uncreative

Whatever. This is going to get crushed at vote any way. Not saying that to be discouraging, it's just the way it works.

[Marxist Germany]

OOC:Without act in the end because thats lazy and uncreative

Whatever. This is going to get crushed at vote any way. Not saying that to be discouraging, it's just the way it works.

OOC: It was passed the first time and was defeated by a margin less than 5% the second time.

[Kenmoria]

Data Protection Act. That title pretty much sums up what the proposal does.

OOC:Without act in the end because thats lazy and uncreative

Edit: Data Protection Protocol?
Accord on Data Protection?
Data Protection Accord?

(OOC: ‘Protecting Personal Data’?)

[Marxist Germany]

OOC:Without act in the end because thats lazy and uncreative

Edit: Data Protection Protocol?
Accord on Data Protection?
Data Protection Accord?

(OOC: ‘Protecting Personal Data’?)

OOC: We have already used that, lets be more creative! I think Protecting Consumer Data is a good title

[Kenmoria]

(OOC: ‘Protecting Personal Data’?)

OOC: We have already used that, lets be more creative! I think Protecting Consumer Data is a good title

(OOC: That works - I genuinely forgot that Protecting Personal Data had already been used.)

[Marxist Germany]

OOC:Since I want to maximise time in queue, I'll be submitting this tomorrow immediately after the minor update. That's about over 4 extra valuable hours than if I submit now.

[Maowi]

Believing that collecting non-essential data without consent is violation of the right to privacy,

OOC: Would feel better to me with 'a' or 'in' before 'violation'. (Also, is the bolding really necessary?)

Noting that most minors are not fully capable of comprehending the risks of the decisions made on matters of privacy,

Maybe would flow better as 'the risks associated with decisions made' etc.

A "non-user" as a person that hasn't used the services of, or isn't a member of, an organisation that has or is storing personal data belonging to that individual;

I think you should change the first 'or' to 'and'; otherwise you have overlap between the definitions of 'user' and 'non-user'.

[*]Organisations from collecting or storing data from any user, or non-user, without their explicit consent except for crime prevention such as CCTV cameras, unless the user, or non-user cannot consent and the data is required for an emergency, or unless the data is used exclusively for journalistic purposes;

This could just read 'organisations from collecting or storing data from any individual' and 'unless the individual cannor consent'. If you decide not to do that, remove the comma after 'user' both times and 'non-user' the first time. Also add a comma after 'crime prevention'.

Governments of member states from viewing the data of a user without the explicit prior consent from both the organisation in possession of the data and the user to which the data belongs, unless the user has consented to their data being shared with authorities as necessary, as a condition to use the services of the organization;

Get rid of 'the' before 'explicit prior consent'. Also change 'organization' to 'organisation' for consistency (and also because American spelling is inferior )

Organisations provide information on how they will use or share a user's data to the user explicitly when they interact with the organisation for this first time or when a major change to the data collection or usage policy has been made;

Change 'or' to 'and'; otherwise, an organisation can the user the info upon first interaction and then make massive changes and not notify them at all.

Organisations enable users, and non-users, to view the data that the organisation holds on them unless the release of data would compromise the privacy or well-being of others;

Again, why not change this to 'individuals'?

Personal data processed or stored for any purpose is not kept for longer than is necessary for that purpose unless the user, or non-user, consents to that explicitly and clearly, unless there is a clear and compelling safety or disciplinary reason to do otherwise such as loans, transactions, or disciplinary records;

And again ...

Organisations allow users and non-users to request the removal of their personal data, and act upon these requests, unless it falls under an exception mentioned in clause 3c above;

... and again.

Organisations take reasonable measures to ensure the data being stored by the orgnisation is not accessed by unauthorized persons;

I believe you meant 'unauthorised'.

Declares that, an organisation can prohibit a person from using the services of, or joining the organisation if the user does not consent to the data collection policy of the organisation, or if the user provides falsified data.

Remove the first comma and either remove the second or add another after 'joining'. Also, I would recommend changing 'user' to 'individual' as they may not actually have used the services or become a member of the organisation yet.

[Marxist Germany]

Believing that collecting non-essential data without consent is violation of the right to privacy,

OOC: Would feel better to me with 'a' or 'in' before 'violation'. (Also, is the bolding really necessary?)

OOC:Yes, I like the bolding.

[*]Organisations from collecting or storing data from any user, or non-user, without their explicit consent except for crime prevention such as CCTV cameras, unless the user, or non-user cannot consent and the data is required for an emergency, or unless the data is used exclusively for journalistic purposes;

This could just read 'organisations from collecting or storing data from any individual' and 'unless the individual cannor consent'. If you decide not to do that, remove the comma after 'user' both times and 'non-user' the first time. Also add a comma after 'crime prevention'.

I always have trouble placing commas in the right place.

Get rid of 'the' before 'explicit prior consent'. Also change 'organization' to 'organisation' for consistency (and also because American spelling is inferior )

Indeed, Hail British English!

Again, why not change this to 'individuals'?

Personal data processed or stored for any purpose is not kept for longer than is necessary for that purpose unless the user, or non-user, consents to that explicitly and clearly, unless there is a clear and compelling safety or disciplinary reason to do otherwise such as loans, transactions, or disciplinary records;

And again ...

Organisations allow users and non-users to request the removal of their personal data, and act upon these requests, unless it falls under an exception mentioned in clause 3c above;

... and again.

Due to a complaint made by TNPs ministry, and because pedantry. Changes shall be made.
submission threat trick worked again...

[Bananaistan]

OOC: 1. Why is personal data defined but half the operative clauses refer only to data?
2. 2b v 2d: Criminal caught on CCTV doesn't consent to the government to their data being used by the government. Hey presto. Off scot free.
3. 2a. We're just a web service. We cannot contact anyone's parent. Even if we could, we've no way of verifying who's who. So this won't apply to us. Or it brings all web commerce to an end.
4. 2d. I'm a tax evader. I don't consent to my bank telling the government anything. Hurrah. No tax for me!
5. 3a. We're some tech company and you use our service. Instead of fully detailing our privacy policy as per RL, we'll just tell you that our server is located in Ballygobackwards. That's information on how we "use or share a user's data". Hurrah. That's 3a complied with.
6. 1d. What about partial data that doesn't identify anyone but if used with other data could identify someone?

Just some issues. I get the feeling that there have been too many incremental changes because you've been trying to satisfy everyone, EG "users and non-users" in 3b and 3d.

[Marxist Germany]

OOC: 1. Why is personal data defined but half the operative clauses refer only to data?

OOC:Good call, I'll change that

2. 2b v 2d: Criminal caught on CCTV doesn't consent to the government to their data being used by the government. Hey presto. Off scot free.

That couldve potentially caused this to fail again, thanks, I shall make changes.

3. 2a. We're just a web service. We cannot contact anyone's parent. Even if we could, we've no way of verifying who's who. So this won't apply to us. Or it brings all web commerce to an end.

I seem to remember adding an exception for such cases, guess I am adding it again.

4. 2d. I'm a tax evader. I don't consent to my bank telling the government anything. Hurrah. No tax for me!

This would not work because the bank has to tell the government and the user has to consent to that. Unless the nation allows banks to refuse to provide information to the government.

5. 3a. We're some tech company and you use our service. Instead of fully detailing our privacy policy as per RL, we'll just tell you that our server is located in Ballygobackwards. That's information on how we "use or share a user's data". Hurrah. That's 3a complied with.

I will add "fully detailed", that should fix this.

6. 1d. What about partial data that doesn't identify anyone but if used with other data could identify someone?

The problem with making this change is that people will complain that basically any data collected can partially be used to identify someone. What do you think Kenmoria?

Just some issues. I get the feeling that there have been too many incremental changes because you've been trying to satisfy everyone, EG "users and non-users" in 3b and 3d.

[/quote]
This is true, user and non-user is unnecessary pedantry, I will be using 'individuals' instead and removing the 'non-user' definition as it is unnecessary and easily discernible.

[Kenmoria]

6. 1d. What about partial data that doesn't identify anyone but if used with other data could identify someone?

The problem with making this change is that people will complain that basically any data collected can partially be used to identify someone. What do you think [nation]Kenmoria?[/nation]

(OOC: I think it’s fine as it is. Although this does mean the definition is slightly under-inclusive, there’s still room for member nations to impose additional restrictions on data that can identify someone when used in conjunction with other data. The alternative, it being over-inclusive, means that member nations can’t loosen restriction without violating WA law.)

[Marxist Germany]

The problem with making this change is that people will complain that basically any data collected can partially be used to identify someone. What do you think [nation]Kenmoria?[/nation]

(OOC: I think it’s fine as it is. Although this does mean the definition is slightly under-inclusive, there’s still room for member nations to impose additional restrictions on data that can identify someone when used in conjunction with other data. The alternative, it being over-inclusive, means that member nations can’t loosen restriction without violating WA law.)

OOC: Yeah, Id say under restricting is better than over restricting.

[Marxist Germany]

OOC: Submission in 10 minutes, any further comments should be posted now.

[Araraukar]

OOC: Title is much better and you got rid of the "user or non-user", so that's good.

[Marxist Germany]

OOC: ...and submitted

[Araraukar]

OOC: ...and submitted

OOC: Good luck.

[Uan aa Boa]

This is a mess. It defines adolescents as users but clause 2a applies to all minors, so if this passes kids will no longer be able to have a login on social media or any other site until they reach the age of majority without getting explicit consent from their parents. That was the reason you introduced the incredibly vague definition of an adolescent in the first place, but in this version you've forgotten to use it.

Clause 2d would prevent the police from accessing a suspect's or a missing person's bank or phone records since that data was not collected for the purpose of crime prevention.

Your definition of organisations as entities that "systematically" collect data means that these rules won't stop short-term abuses of data by entities that don't do so systematically. This is equivalent to have road traffic laws that only apply to people who drive a car regularly.

I would urge everyone to vote against this.

[Evil Dictators Happyland]

"I'm not sure why governments are exempt from most of this resolution even though totalitarianism is alive and well, but either way, full support. The rich can already afford to guard their data; this resolution merely extends that security to the working class, and it does not appear to infringe on anyone's rights in the process."

EDIT:
"Yes, this is an imperfect bill, and it could be dramatically improved. However, it should be noted that few bills that are defeated ever come back with a truly better version, and even the ones that do are invariably flawed themselves (this resolution itself is an example of such a rewrite). If this august body were to reject every imperfect bill, then nothing would ever be passed."

[Marxist Germany]

This is a mess. It defines adolescents as users but clause 2a applies to all minors, so if this passes kids will no longer be able to have a login on social media or any other site until they reach the age of majority without getting explicit consent from their parents. That was the reason you introduced the incredibly vague definition of an adolescent in the first place, but in this version you've forgotten to use it.

Clause 2d would prevent the police from accessing a suspect's or a missing person's bank or phone records since that data was not collected for the purpose of crime prevention.

Your definition of organisations as entities that "systematically" collect data means that these rules won't stop short-term abuses of data by entities that don't do so systematically. This is equivalent to have road traffic laws that only apply to people who drive a car regularly.

I would urge everyone to vote against this.

1. Adolescents are not defined as minors in this proposal, they are users.
2. Use a warrant
3. This is an issue on my end, but Its a very minor issue that could be fixed with additional national law.