[ABANDONED] Protection of Stored Transactions

[Barfleur]

Protection of Stored Transactions
Category: Regulation | Area of Effect: Consumer Protection | Proposed by: Barfleur

---

The World Assembly,

Understanding that in the present day, many forms of business involve the sharing of personal information between buyer and seller by way of telephones, computers, and related technologies, and that this is only likely to become more common as business practices evolve;

Acknowledging that this is a perfectly legitimate form of business, and should neither be prohibited nor unduly impeded;

Observing, however, that such practice is open to being abused by a person who gains access to freely provided information, and uses such information to intimidate, harass, proposition, or surveil the subject of such information;

Hereby:

1. Defines, for the purposes of this resolution, a "stored transaction" as any piece of information which--

1. contains the name, age, date of birth, address, sex (including gender identity), sexual orientation, species, or race of any individual;
2. was obtained, with the consent of the individual in question, as part of the purchase or sale of goods or services, or during the negotiation of such purchase or sale, or upon solicitation in a manner which explicitly or implicitly communicated that such solicitation was for commercial purposes; and
3. is not otherwise protected information, under national or international law;

2. Prohibits any person from--

1. improperly or unlawfully accessing a stored transaction;
2. transmitting a stored transaction, or any relevant and material component thereof, to a third party without the consent of the individual for whom the stored transaction relates;
3. using a stored transaction to--
   
   1. place any person in fear that such person or any other person will be subjected to physical, psychological, or reputational harm, whether as a condition of blackmail or extortion or for any other reason;
   2. surveil or follow the movements of any person;
   3. gain knowledge as to the financial, housing, or relationship status of any person with intent to commit a crime against such person or to discriminate against such person in matters of employment or the provision of goods or services; or
   4. carry out a social or romantic relationship with any person without such person initiating such relationship; or
4. disclosing the contents of a stored transaction, or any identifiable part thereof, with the intention of causing reputational harm to the individual named, including harming such individual's likelihood of being elected or appointed to any public office; and

3. Permits the accessing, transmission, or use of stored transactions in a manner which would otherwise violate section 2 when such access, transmission, or use is part of a good-faith effort to locate a person who is believed to be in danger, or as part of a law enforcement effort to aid in the apprehension or detection of criminal activity.

As always, any feedback would be appreciated. I have not abandoned my pervious proposal, though I don't know when I will submit it. Certainly not for some time, as I am very busy at the moment and will likely be more so in coming weeks.

[Bananaistan]

OOC: What does this do that GAR#481 doesn't do?

[Bears Armed]

OOC: What does this do that GAR#481 doesn't do?

For reference, G.A. Res#481.

[Barfleur]

OOC: What does this do that GAR#481 doesn't do?

OOC: GA#481 section 2 only applies to non-governmental actors (see the definition of "organisation" in section 1(a), whereas this proposal would close the loophole which imposes no such restrictions on state-run and state operated industries. In addition, GA#481 does not cover using personal data to surveil a victim without the victim's knowledge, nor transmitting personal data to a third party so that party can use it to commit any act against the individual that would be illegal under GA#481 if done by the organization that collected the data. Finally, a not unreasonable interpretation of GA#481 would hold that its mandates and prohibitions apply to the actions of an organization that collects data, and not the actions of any member or employee of an organization who does legitimately access the data but misuses it for malicious purposes.