[PASSED] Data Protection Accord

[Marxist Germany]

OOC: Tbf Uan aa Boa has already stated that the definitions are nonsensical and your response appears to be no more than "bruh?"

I'd also add that the definition of personal data means that the scope of the entire proposal is incredibly narrow.

Previous advice was to go off and research GDPR. Have you done this?

OOC: Yes I have, and the definitions seem fine to me, as to personal data, I either make it overarching or narrow. There is no middleground

Edit: I also added clause 3d and moved what was previously 3d to 3f. as per this, the submission is delayed for 4 more days; which puts the new date at Wednesday.

Edit2: Hell this was based on the GDPR and the UKs Data Protection Law

[Refuge Isle]

Defines the following for the purpose of this resolution:

An "organisation" as an entity that collects data from its members or users, and isn't run by a government;

I understand that this is here because you feel a government should be able to collect data from its members, which makes for probably the weirdest way of defining an organisation that I can imagine, but effectively a country where private enterprise is illegal can skip the vast majority of this legislation, as well as any private businesses with a controlling interest from the government. How you define who is subject to this resolution is extremely important because pretty much everything you've written is based on it.

A "minor" as a person under the age of majority not going through a transitional period into adulthood;
...
Organisations from collecting or storing the personal data of any minor without the explicit consent of their guardian except when the guardian cannot be contacted and it is not in the best interests of the minor to do so, as determined by national governments, or the business is unable to verify the age of the user;

Is a thirteen year old adolescent in a position to determine whether or not it's in their best interest to allow companies to collect data on them? Or are they more likely to enter into whatever agreement it takes to let them play R u n e S c a p e ?

A "guardian" as a legal guardian of a minor or non-legally competent person, or if none exists, a biological parent;

I don't know what this very precise backflip is meant to make a loophole for, especially since a "non-legally competent person" isn't even used in this proposal, but surely we can say individual legally responsible for the protection and care of another person. Or just skip it, really, since you define "guardian" basically in terms of itself: "legal guardian." If it's not necessary to define what a legal guardian is, why not just use that in the proposal? A parent is ordinarily a legal guardian and, if they lose custody of their child(ren), someone else is the legal guardian instead of them.

Governments of member states from viewing the personal data of a user without explicit prior consent from both the organisation in possession of the personal data and the user to which the data belongs, unless the user has consented to their personal data being shared with authorities as necessary, as a condition to use the services of the organisation,

Another way to word this:

Stipulates that organisations add an additional line to the terms and conditions for their users to check through without paying attention in order to access services commonly used in modern communication.

I understand the idea behind "Well, you agreed to the terms of this thing you don't like! It was right here on page 36, fair is fair!" But, really, a better way of looking at it is allowing organisations to demand whatever they like in the terms and conditions in exchange for being able to participate in modern forms of communication. Technically, there's a choice that you can make there and a way you can live your life without any connections that pass through an organisation you don't run, but it's like getting a job without a phone number. It's possible, but a huge disadvantage. If this resolution just exempts most of it's requirements as long as the rights are given up in the ToS, what's the point of it?

or unless the data is used exclusively for journalistic purposes;

Wow, so it's actually permissible for the news to request my 2014 OKCupid dating profile and 2017 Discord chat logs without my consent to be used for "journalistic purposes?" Neat-o! Some things have the privilege of being in a part of the internet because the user knows it's behind an appropriate level of privacy, but there are such broad and unchecked exemptions in this proposal of when you're not entitled to data protection, it'll be a chilling effect instead.

or the personal data was collected for crime prevention;

This is absolutely the gateway to being able to call anything and everything a data seizure for any suspicion, racial profiling, or someone in government looking for private conversations because it's illegal to criticise the head of state. The line is especially troubling because it's written as a separate item form a search warrant, which means that a warrant is not required as long as a reasonable case can be made about how it can be used for crime prevention.

Personal data processed or stored for any purpose is not kept for longer than is necessary for that purpose

This section is so ambiguous I have no idea what it was even written to prevent, but it sounds like it can be played like a fiddle.

Since a purpose can be anything, I, Google will be storing data on you for the duration of the time that I may be able to build an advertising profile on you and market ads using this data on the sites you visit. Don't worry, we don't share your data, but you agreed to let us make money off of you in page 21 of the terms and conditions.

Organisations allow individuals to edit the personal data stored by that organisation if the users deems it incorrect;

Subject-verb disagreement.

[Marxist Germany]

Defines the following for the purpose of this resolution:

An "organisation" as an entity that collects data from its members or users, and isn't run by a government;

I understand that this is here because you feel a government should be able to collect data from its members, which makes for probably the weirdest way of defining an organisation that I can imagine, but effectively a country where private enterprise is illegal can skip the vast majority of this legislation, as well as any private businesses with a controlling interest from the government. How you define who is subject to this resolution is extremely important because pretty much everything you've written is based on it.

OOC: I could change this to "primarily owned", but then governments can loophole this by owning 51% of the organisation. But it is better than the current definition. And yes it is intended that the government is mostly unaffected by this. That is a subject for another resolution

A "minor" as a person under the age of majority not going through a transitional period into adulthood;
...
Organisations from collecting or storing the personal data of any minor without the explicit consent of their guardian except when the guardian cannot be contacted and it is not in the best interests of the minor to do so, as determined by national governments, or the business is unable to verify the age of the user;

Is a thirteen year old adolescent in a position to determine whether or not it's in their best interest to allow companies to collect data on them? Or are they more likely to enter into whatever agreement it takes to let them play R u n e S c a p e ?

A thirteen year old falls under the definition of user, and it is not the responsibility of the business to babysit children.

A "guardian" as a legal guardian of a minor or non-legally competent person, or if none exists, a biological parent;

I don't know what this very precise backflip is meant to make a loophole for, especially since a "non-legally competent person" isn't even used in this proposal, but surely we can say individual legally responsible for the protection and care of another person. Or just skip it, really, since you define "guardian" basically in terms of itself: "legal guardian." If it's not necessary to define what a legal guardian is, why not just use that in the proposal? A parent is ordinarily a legal guardian and, if they lose custody of their child(ren), someone else is the legal guardian instead of them.

Yes, I will certainly change the definition of guardian.

Governments of member states from viewing the personal data of a user without explicit prior consent from both the organisation in possession of the personal data and the user to which the data belongs, unless the user has consented to their personal data being shared with authorities as necessary, as a condition to use the services of the organisation,

Another way to word this:

Stipulates that organisations add an additional line to the terms and conditions for their users to check through without paying attention in order to access services commonly used in modern communication.

I understand the idea behind "Well, you agreed to the terms of this thing you don't like! It was right here on page 36, fair is fair!" But, really, a better way of looking at it is allowing organisations to demand whatever they like in the terms and conditions in exchange for being able to participate in modern forms of communication. Technically, there's a choice that you can make there and a way you can live your life without any connections that pass through an organisation you don't run, but it's like getting a job without a phone number. It's possible, but a huge disadvantage. If this resolution just exempts most of it's requirements as long as the rights are given up in the ToS, what's the point of it?

It is the user's fault for not reading the ToS, when you apply for a job, are you not supposed to read the contract?

or unless the data is used exclusively for journalistic purposes;

Wow, so it's actually permissible for the news to request my 2014 OKCupid dating profile and 2017 Discord chat logs without my consent to be used for "journalistic purposes?" Neat-o! Some things have the privilege of being in a part of the internet because the user knows it's behind an appropriate level of privacy, but there are such broad and unchecked exemptions in this proposal of when you're not entitled to data protection, it'll be a chilling effect instead.

This is a dilemma I really dont know how to solve, on one hand, journalists who record events will have to blur out every single face or other personal data, and on the otger hand we have a situation like the one you described, do you have any suggestions?

or the personal data was collected for crime prevention;

This is absolutely the gateway to being able to call anything and everything a data seizure for any suspicion, racial profiling, or someone in government looking for private conversations because it's illegal to criticise the head of state. The line is especially troubling because it's written as a separate item form a search warrant, which means that a warrant is not required as long as a reasonable case can be made about how it can be used for crime prevention.

This is another problem I have faced, any suggestions?

Personal data processed or stored for any purpose is not kept for longer than is necessary for that purpose

This section is so ambiguous I have no idea what it was even written to prevent, but it sounds like it can be played like a fiddle.

Since a purpose can be anything, I, Google will be storing data on you for the duration of the time that I may be able to build an advertising profile on you and market ads using this data on the sites you visit. Don't worry, we don't share your data, but you agreed to let us make money off of you in page 21 of the terms and conditions.

I added this to mandate that businesses delete the data stored if its purpose has been served.

Organisations allow individuals to edit the personal data stored by that organisation if the users deems it incorrect;

Subject-verb disagreement.

Fixed.

And thus, ladies and gentlemen, submission date has been delayed until further notice.

[WayNeacTia]

What exactly is the hurry with this? Flaws have been identified, and keep popping up shortly before you submit. Perhaps you should let it cool for a while.

OOC: It has been up for over 2 weeks with no feedback

And? You were advised by several people to slow down. All you are going to wind up doing is poisoning the well on this subject, and I can pretty much assure you if this passes it will be repealed very quickly once again. Give it time to fester. You need to understand that it is a marathon, not a sprint. You have multiple drafts up that you are working on, but focusing solely on none of them. Too me it seems you are throwing as much shit against the wall as possible and hoping something will stick. I tend to go out of my way to vote against resolution authors like that, even if they have a great proposal.

Food for thought.

[Kenmoria]

“In clause 1d, what other type of individual is there? If they aren’t sapient, they aren’t an individual.”

[Marxist Germany]

OOC: It has been up for over 2 weeks with no feedback

And? You were advised by several people to slow down. All you are going to wind up doing is poisoning the well on this subject, and I can pretty much assure you if this passes it will be repealed very quickly once again. Give it time to fester. You need to understand that it is a marathon, not a sprint. You have multiple drafts up that you are working on, but focusing solely on none of them. Too me it seems you are throwing as much shit against the wall as possible and hoping something will stick. I tend to go out of my way to vote against resolution authors like that, even if they have a great proposal.

Food for thought.

OOC:

And thus, ladies and gentlemen, submission date has been delayed until further notice.

Yes, I know its a marathon not a sprint, which is why Ive been working on this for 7 months

“In clause 1d, what other type of individual is there? If they aren’t sapient, they aren’t an individual.”

"This shall be shortly fixed, alongside some major changes."

[WayNeacTia]

OOC:

And thus, ladies and gentlemen, submission date has been delayed until further notice.

Yes, I know its a marathon not a sprint, which is why Ive been working on this for 7 months

No you haven't. You passed it and it was insta-repealed. That should have been a sign right there. You still have "last call" in your title. To me that screams that submission is close. I can tell you right now, this will not pass, and if it does, it will be repealed yet again.

[Marxist Germany]

OOC:

Yes, I know its a marathon not a sprint, which is why Ive been working on this for 7 months

No you haven't. You passed it and it was insta-repealed. That should have been a sign right there. You still have "last call" in your title. To me that screams that submission is close. I can tell you right now, this will not pass, and if it does, it will be repealed yet again.

OOC: There is no last call in the title?

Last edited by Marxist Germany on Sat Oct 12, 2019 12:08 pm, edited 37 times in total.

by Wayneactia » Sat Oct 12, 2019 12:17 pm

[WayNeacTia]

No you haven't. You passed it and it was insta-repealed. That should have been a sign right there. You still have "last call" in your title. To me that screams that submission is close. I can tell you right now, this will not pass, and if it does, it will be repealed yet again.

OOC: There is no last call in the title?

Last edited by Marxist Germany on Sat Oct 12, 2019 12:08 pm, edited 37 times in total.

by Wayneactia » Sat Oct 12, 2019 12:17 pm

You edited it while I was composing my post. My comment still stands.

[Marxist Germany]

OOC: Yes, I know this has many flaws, which is why I will not be submitting this for a while, until December or Mid November.

[WayNeacTia]

OOC: Yes, I know this has many flaws, which is why I will not be submitting this for a while, until December or Mid November.

See you are still setting hard deadlines. Instead of announcing your intentions, why not let it sit for a while, and then submit it out of the blue when everyone has forgot about it? Patience is a virtue.

[Marxist Germany]

OOC: Yes, I know this has many flaws, which is why I will not be submitting this for a while, until December or Mid November.

See you are still setting hard deadlines. Instead of announcing your intentions, why not let it sit for a while, and then submit it out of the blue when everyone has forgot about it? Patience is a virtue.

OOC: Deadlines should get people to put in feedback before it's too late, it's worked several times for me, submitting it after everyone has forgotten about it would mean grievous errors discovered during vote.

[Refuge Isle]

OOC: I could change this to "primarily owned", but then governments can loophole this by owning 51% of the organisation. But it is better than the current definition. And yes it is intended that the government is mostly unaffected by this. That is a subject for another resolution

I have no idea why. A resolution can easily tackle these topics without presupposing that any government action will be good and leaving a slim crack in the door for someone to develop Protecting Consumer Data (from their previously unregulated governments).

A thirteen year old falls under the definition of user, and it is not the responsibility of the business to babysit children.

I'm aware of your inane definitions, that was not the content of my question. The content of my question was "Do you believe that random twelve and thirteen year olds who may technically be recognised by their government to be in adolescence have the available knowledge and self-awareness to be able to determine if it is in their best interests for an online organisation to collect, profit, or use to generate a profit, data on themselves? Or did you write in something that has very strange applications just so you, personally, would be able to use NationStates in your IC world? This isn't an argument theme that I'm too interested in, but it comes across as nonsensical for nations wondering how in the world a young adolescent would suddenly be as able to make a decision that a lot of adults don't really understand the scope of. The use of the "minor" and "user" definitions in this draft are entirely based around the ability to demonstrate cognizant agency to enter into contracts so that the (read: any) use of that data is legally justified.

Another way to word this:

Stipulates that organisations add an additional line to the terms and conditions for their users to check through without paying attention in order to access services commonly used in modern communication.

I understand the idea behind "Well, you agreed to the terms of this thing you don't like! It was right here on page 36, fair is fair!" But, really, a better way of looking at it is allowing organisations to demand whatever they like in the terms and conditions in exchange for being able to participate in modern forms of communication. Technically, there's a choice that you can make there and a way you can live your life without any connections that pass through an organisation you don't run, but it's like getting a job without a phone number. It's possible, but a huge disadvantage. If this resolution just exempts most of it's requirements as long as the rights are given up in the ToS, what's the point of it?

It is the user's fault for not reading the ToS, when you apply for a job, are you not supposed to read the contract?

Having actually had some thirteen or fourteen jobs over a vast territory in my life, and having read all of the paperwork that's a part of being hired, I can safely say that none of my employers have ever asked to collect more data on me than is required by law to complete tax filings. No company I've ever worked for has requested the ability to share all of that information with advertisers and spam email marketing agencies, or any other manner of bad behaviour that is absolutely a cornerstone for the way that social media operates. Somehow, in a data protection proposal, you're saying that you either sign your life away to these companies that you're unwilling to regulate, or you just don't use any service or communicate with anyone ever. In 2019, there are fifty million places to get a job, but a dozen social media companies.

Imo, the weakest parts of your drafts have been [title that says strong thing] followed by [legal text with glaring exceptions to make strong thing unnecessary to enforce]. If every mandate in this proposal can be opted out by companies who force their users to opt them out via the ToS, by all means stand on your moral high ground saying they agreed to it all as four companies with literally billions of users do whatever they please with the social monopoly. A shit thing happening, but users being compelled to go along with it because of the disenfranchisement of not is when regulation should be happening.

This is absolutely the gateway to being able to call anything and everything a data seizure for any suspicion, racial profiling, or someone in government looking for private conversations because it's illegal to criticise the head of state. The line is especially troubling because it's written as a separate item form a search warrant, which means that a warrant is not required as long as a reasonable case can be made about how it can be used for crime prevention.

This is another problem I have faced, any suggestions?

Don't separate the two if you must include the exceptions at all? The minimum you could do is force governments to play by their own rules and get a warrant every time.

I added this to mandate that businesses delete the data stored if its purpose has been served.

Again, if a purpose can be anything, including never concluding because selling your data is always a purpose or having a standing character profile on you for crime prevention is a purpose, then what's the point of it? It does nothing if an organisation doesn't want it to.

OOC: Deadlines should get people to put in feedback before it's too late, it's worked several times for me, submitting it after everyone has forgotten about it would mean grievous errors discovered during vote.

tbh, I just had a couple hours with nothing to do. I planned on glancing at the definitions in the proposal before moving on, but I ended up writing a post that was longer than I expected. Nothing really to do with deadlines, just a slow day.

[Marxist Germany]

A thirteen year old falls under the definition of user, and it is not the responsibility of the business to babysit children.

I'm aware of your inane definitions, that was not the content of my question. The content of my question was "Do you believe that random twelve and thirteen year olds who may technically be recognised by their government to be in adolescence have the available knowledge and self-awareness to be able to determine if it is in their best interests for an online organisation to collect, profit, or use to generate a profit, data on themselves? Or did you write in something that has very strange applications just so you, personally, would be able to use NationStates in your IC world? This isn't an argument theme that I'm too interested in, but it comes across as nonsensical for nations wondering how in the world a young adolescent would suddenly be as able to make a decision that a lot of adults don't really understand the scope of. The use of the "minor" and "user" definitions in this draft are entirely based around the ability to demonstrate cognizant agency to enter into contracts so that the (read: any) use of that data is legally justified.

OOC: I can't do much about this, member states can decide if 12 is the age of adolescence or 15, or any other age if it fits the definition of transitioning to adulthood.

It is the user's fault for not reading the ToS, when you apply for a job, are you not supposed to read the contract?

Having actually had some thirteen or fourteen jobs over a vast territory in my life, and having read all of the paperwork that's a part of being hired, I can safely say that none of my employers have ever asked to collect more data on me than is required by law to complete tax filings. No company I've ever worked for has requested the ability to share all of that information with advertisers and spam email marketing agencies, or any other manner of bad behaviour that is absolutely a cornerstone for the way that social media operates. Somehow, in a data protection proposal, you're saying that you either sign your life away to these companies that you're unwilling to regulate, or you just don't use any service or communicate with anyone ever. In 2019, there are fifty million places to get a job, but a dozen social media companies.

Imo, the weakest parts of your drafts have been [title that says strong thing] followed by [legal text with glaring exceptions to make strong thing unnecessary to enforce]. If every mandate in this proposal can be opted out by companies who force their users to opt them out via the ToS, by all means stand on your moral high ground saying they agreed to it all as four companies with literally billions of users do whatever they please with the social monopoly. A shit thing happening, but users being compelled to go along with it because of the disenfranchisement of not is when regulation should be happening.

The only clause that actually has an exception based on ToS agreement is 3c.

Don't separate the two if you must include the exceptions at all? The minimum you could do is force governments to play by their own rules and get a warrant every time.

Done.

Again, if a purpose can be anything, including never concluding because selling your data is always a purpose or having a standing character profile on you for crime prevention is a purpose, then what's the point of it? It does nothing if an organisation doesn't want it to.

Do you suggest removing the clause entirely as it is redundant in the presence of 3d? I think that's the way it should be done.

[Refuge Isle]

Again, if a purpose can be anything, including never concluding because selling your data is always a purpose or having a standing character profile on you for crime prevention is a purpose, then what's the point of it? It does nothing if an organisation doesn't want it to.

Do you suggest removing the clause entirely as it is redundant in the presence of 3d? I think that's the way it should be done.

Or specify what these purposes are, who defines them, or what their limits are. My interpretation is that the difference between 3c and 3d is whether or not companies should delete your data at some point, or if it always needs to be manually requested by the user, which is useful. There's probably some possible wording where the data is tied to whether a user account exists by their own desire (not maintained in secret), whether or not they're still actively using the services, and whether keeping old data is relevant to their current use of services within the organisation?

[Marxist Germany]

Do you suggest removing the clause entirely as it is redundant in the presence of 3d? I think that's the way it should be done.

Or specify what these purposes are, who defines them, or what their limits are. My interpretation is that the difference between 3c and 3d is whether or not companies should delete your data at some point, or if it always needs to be manually requested by the user, which is useful. There's probably some possible wording where the data is tied to whether a user account exists by their own desire (not maintained in secret), whether or not they're still actively using the services, and whether keeping old data is relevant to their current use of services within the organisation?

OOC: I'll make changes shortly.

[Marxist Germany]

OOC: Apologies for double posting, but just wanted to say that changes have been made, currently, the clause is really wordy and hard to read, so I think it would be better to divide it into two lists for each exception/reason.

[Marxist Germany]

OOC: Bump, statement above stands.

[Grug Island]

WHAT HELL IS "DATA"

[Kenmoria]

WHAT HELL IS "DATA"

(OOC: Common words don’t need to be defined by authors.)

[Marxist Germany]

WHAT HELL IS "DATA"

(OOC: Common words don’t need to be defined by authors.)

OOC: I think he was rping a caveman... and personal data is defined anyways.

[Araraukar]

Or are they more likely to enter into whatever agreement it takes to let them play R u n e S c a p e ?

OOC: Oi! Though big props for getting the capitalization right, you should really have used some reference to games from Google Play Store. There was one that literally asked for the permission for the Chinese government to collect very detailed dataon me and keep it for minimum of two years. Or Google, which in Gmail small print basically says it reserves the right to read your emails whenever it wants, not notifying you.

[Marxist Germany]

"I reread this multiple times to ensure that no loopholes exist, if other ambassadors can make some revisions as well that would be excellent."

[Kenmoria]

“Clause 2a should have an ‘or’ in place of the ‘and’.”

[Marxist Germany]

“Clause 2a should have an ‘or’ in place of the ‘and’.”

"That is the intended word ambassador, it's in case an unconscious stroke patient cannot consent to having their name and age collected for example."