[PASSED] Data Protection Accord

[Kenmoria]

“Clause 2a should have an ‘or’ in place of the ‘and’.”

"That is the intended word ambassador, it's in case an unconscious stroke patient cannot consent to having their name and age collected for example."

“I meant the second ‘or’, that refers to cases in which it is allowable to not contact a minor’s guardian. Apologies for the ambiguity.”

[Marxist Germany]

OOC: Title updated.

[The Macaronesia]

Representative,

first of all, let me congratulate your redaction team for this brilliant proposal. I am sure, in representation of my Nation, that if this proposal becomes a resolution it will improve dramatically customer protection.

Nevertheless, I have a two considerations I would want to present and, if necessary, propose some minor changes.

1. At the last draft I cannot see a clause on judicial investigation for accessing collected data. I mean, the Prohibits #d affects to Governments, which can only access data under consent of the user. But some cases, specially when digital crimes has been commited, where digital footprints can only be founded at ISP's servers. If we take the draft literally, the judge must ask the user to access his digital footprints and, if the user denies it -which is expectable in presence of a crime-, the judge cannot access the data without disobeying this resolution.
   
   So, if the aforesaid case is not contempled in the draft, I suggest to reform the Prohibits by appending a new clause:

   'Nevertheless, if national legislation provides a judge can authorize the access to collected data in the scope of an investigation, as long as the collected data is related to the suspected crime and no other right or freedom of the investigated are affected, the above clause 2.d is not applicable'.

   
   
2. Sometimes, celerity in transferring data from one organization to another is necessary to permit the user to switch from one products or services provider to another, and for this reason some providers may delay the transfer of personal data, even under user's order, to difficult the switch and retain the user against his will.
   
   In my opinion, this condition is absolutely necessary to ensure another scope of customers protection, which is freedom of choosing and leaving providers.
   
   So, if you think this amendment can improve your draft, I would suggest two changes:
   
   A new prohibit:

   'Organisations from retaining personal data, when the user has asked to transfer them to another organisation, for the purpose of obstructing the user's freedom to chose whom contract'

   ;
   
   And a new Mandate:

   'Organisations to take the reasonable measures to ensure data transfer under user's request is performed within 24 hours, or in a longer term under justified causes'

I honestly feel these two proposals can improve the draft and boost customer protection to a further level. So, please consider both proposals and feel free to debate the convenience or unconvenience of any or both of them.

[Marxist Germany]

Representative,

first of all, let me congratulate your redaction team for this brilliant proposal. I am sure, in representation of my Nation, that if this proposal becomes a resolution it will improve dramatically customer protection.

"Your compliments are generous ambassador, thank you."

1. At the last draft I cannot see a clause on judicial investigation for accessing collected data. I mean, the Prohibits #d affects to Governments, which can only access data under consent of the user. But some cases, specially when digital crimes has been commited, where digital footprints can only be founded at ISP's servers. If we take the draft literally, the judge must ask the user to access his digital footprints and, if the user denies it -which is expectable in presence of a crime-, the judge cannot access the data without disobeying this resolution.

"Ah apologies ambassador, I forgot to add an 'or' before "a valid warrant", I shall fix this immediately. As to your suggestion, "national legislation" is quite liable to abuse so I do not think it is a good change to make."

Sometimes, celerity in transferring data from one organization to another is necessary to permit the user to switch from one products or services provider to another, and for this reason some providers may delay the transfer of personal data, even under user's order, to difficult the switch and retain the user against his will.

In my opinion, this condition is absolutely necessary to ensure another scope of customers protection, which is freedom of choosing and leaving providers.

So, if you think this amendment can improve your draft, I would suggest two changes:

A new prohibit:

'Organisations from retaining personal data, when the user has asked to transfer them to another organisation, for the purpose of obstructing the user's freedom to chose whom contract'

;

And a new Mandate:

'Organisations to take the reasonable measures to ensure data transfer under user's request is performed within 24 hours, or in a longer term under justified causes'

"These suggestions sound reasonable, and your reasoning behind them is quite convincing, I shall be making changes accordingly, however I would like to point out that 24 hours may be a one-size-fits-all issue and instead I will leave it up to member-states to determine the period of time required. Thank you again for your suggestions and feedback."

[Desmosthenes and Burke]

[*]Prohibits:

1. Organisations from collecting or storing the personal data of any minor without the explicit consent of their guardian except when the guardian cannot be contacted and it is not in the best interests of the minor to do so, as determined by national governments, and the business is unable to verify the age of the user;
2. Organisations from collecting or storing personal data from any individual without their explicit consent except for crime prevention, such as CCTV cameras, unless the individual cannot consent and the personal data is required for an emergency, or unless the data is used exclusively for journalistic purposes;
3. Organisations from using personal data collected from any individual to intentionally and maliciously cause harm or severe distress to the individual the data belongs to;
4. Governments of member states from viewing the personal data of a user without explicit prior consent from both the organisation in possession of the personal data and the user to which the data belongs, unless the user has consented to their personal data being shared with authorities as necessary, as a condition to use the services of the organisation, or a valid warrant has been issued and the personal data was collected for crime prevention;
   whom contract;

Ambassador, we have a few questions in regards to the bolded sections above:

1. Could "valid warrant" be replaced with the phrase "judicial order" or something substantially similar? A warrant is an item that is particular solely to the common law, while those of us who practice according to the civil law tradition have orders issued by "instructing" (investigating) judges and/or have search powers as part of the official judicial act of commencing an investigation into a person. It would also cover administrative state proceedings in front of tribunals where, even at common law, the judge cannot actually issue a warrant. Also, we believe, even at common law, you subpeona a third party for information, not serve it with a search warrant.

2. In regards to the second bolded portion, after a warrant or other official court order has been issued, why is it relevant what the information was originally collected for? One's employer does not (usually?) collect addresses or financial details for the purposes of crime prevention, but the tax bureau may nevertheless try to get that information anyway, and it seems...counter-productive to refuse if the judicial system has agreed.

[Marxist Germany]

[*]Prohibits:

1. Organisations from collecting or storing the personal data of any minor without the explicit consent of their guardian except when the guardian cannot be contacted and it is not in the best interests of the minor to do so, as determined by national governments, and the business is unable to verify the age of the user;
2. Organisations from collecting or storing personal data from any individual without their explicit consent except for crime prevention, such as CCTV cameras, unless the individual cannot consent and the personal data is required for an emergency, or unless the data is used exclusively for journalistic purposes;
3. Organisations from using personal data collected from any individual to intentionally and maliciously cause harm or severe distress to the individual the data belongs to;
4. Governments of member states from viewing the personal data of a user without explicit prior consent from both the organisation in possession of the personal data and the user to which the data belongs, unless the user has consented to their personal data being shared with authorities as necessary, as a condition to use the services of the organisation, or a valid warrant has been issued and the personal data was collected for crime prevention;
   whom contract;

Ambassador, we have a few questions in regards to the bolded sections above:

1. Could "valid warrant" be replaced with the phrase "judicial order" or something substantially similar? A warrant is an item that is particular solely to the common law, while those of us who practice according to the civil law tradition have orders issued by "instructing" (investigating) judges and/or have search powers as part of the official judicial act of commencing an investigation into a person. It would also cover administrative state proceedings in front of tribunals where, even at common law, the judge cannot actually issue a warrant. Also, we believe, even at common law, you subpeona a third party for information, not serve it with a search warrant.

2. In regards to the second bolded portion, after a warrant or other official court order has been issued, why is it relevant what the information was originally collected for? One's employer does not (usually?) collect addresses or financial details for the purposes of crime prevention, but the tax bureau may nevertheless try to get that information anyway, and it seems...counter-productive to refuse if the judicial system has agreed.

"This feedback has been taken into account and the draft will be updated."

[Marxist Germany]

OOC: Bumping this again, will be looking into submission next Monday if no feedback is given.

[Ithania]

[OOC]

I'm afraid I can't dedicate the attention I'd like to give at the moment. While I'm unsure if I could offer any suggestions that are helpful, I'd like to try.

That said, I feel there are two things that can be suggested quite quickly. To begin with, I believe there's a tiny spelling error in "received" at 2(d) (currently I believe it reads "recieved").

Second, I'd suggest that 2(f) should be rewritten. In its current form, "freedom to chose whom contract" appears grammatically incomplete/incorrect due to the tense and the lack of prepositions.

If it'd be acceptable, I'd like to recommend something vaguely akin to "organisations from obstructing a user's freedom of contractual choice by purposefully frustrating the transfer of personal data to another organisation, when said transfer is requested by the relevant user;"

I'd guess that phrasing has glaring problems but my time tonight is a little limited. I just hope there's something helpful in that idea. I also guessed at the intent when writing it, so I'm very sorry if I misread it.

When I have the time, I'll be reading the drafting thread to see if a potential issue about broad definitions has been addressed too. Specifically, I feel the circular referencing between the definitions of "user" and "organisation" can be reasonably read as applying to personal contexts.

For example, the collecting and sharing of information within a household for the purposes of life management. In cases like that, I feel residents/family/friends can easily be regarded as "members," "entity" is inclusive of almost anything, the context isn't primarily government controlled, it involves the act of collecting data, any information gathered would commonly qualify as "personal data" due to being identifiable, etc.

I hope I find that this has been addressed because I find the vagueness and inter-reliant definitions a teensy bit worrying.

Ordinarily, I'd avoid this kind of dictionary navelgazing. I'd interpret words like "organisation" in a way that tries to give effect to intent, in a way that seems reasonable, in a way that avoids unintended harm, or by using plain meaning. Sadly, I feel the act of creating a unique definition for the resolution precludes that option. I hope I'm just being excessively cautious with my interpretation.

Anyhoo, hopefully those were helpful.

[Marxist Germany]

OOC: Fixed grammar and spelling, I will give your third concern a bit more thought.

[Marxist Germany]

OOC: Imo families would not be classified as organisations and guardians would be consenting for the minors anyways.
Added 3e

[Kenmoria]

“I think clause 3f needs some changing. A user might deem it incorrect that they have been convicted of fraud, even when this is in fact true. I suggest ‘Organisations allow users to edit data stored on them by the organisation if the data stored is incorrect’.”

[Marxist Germany]

“I think clause 3f needs some changing. A user might deem it incorrect that they have been convicted of fraud, even when this is in fact true. I suggest ‘Organisations allow users to edit data stored on them by the organisation if the data stored is incorrect’.”

"That is an unobjectionable edit, I have made changes accordingly."

[Republic Of Vox]

As the saying goes, third time is a charm!

Data Protection Accord

Category: Regulation | Area of Effect: Customer Protection | Proposed by:Germany

---

The World Assembly,

Lauding the previous efforts of this assembly to protect privacy rights through previous legislation such as GA #213 Privacy Protection Act,

Recognising every individual's right to reasonable privacy,

Believing that collecting non-essential data without consent is a violation of the right to privacy,

Noting that most minors are not fully capable of comprehending the risks associated with decisions made on matters of privacy,

Seeking to introduce more restrictions regarding the ability of non-governmental organisations to collect data from their customers without consent,


Hereby,

1. Defines the following for the purpose of this resolution:
   1. An "organisation" as an entity that collects data from its members or users, and isn't primarily run by a government;
   2. A "minor" as a person under the age of majority not going through a transitional period into adulthood;
   3. A "guardian" as an individual legally responsible for the protection and care of a minor;
   4. "personal data" as data that can be used to identify an individual;
   5. A "user" as an adult, or a child going through a transitional period into adulthood, as determined by national governments; who uses or has used the services of, or is a member or has been a member of, an organisation;
2. Prohibits:
   1. Organisations from collecting or storing the personal data of any minor without the explicit consent of their guardian except when the guardian cannot be contacted and it is not in the best interests of the minor to do so, as determined by national governments, and the business is unable to verify the age of the user;
   2. Organisations from collecting or storing personal data from any individual without their explicit consent except for crime prevention, such as CCTV cameras, unless the individual cannot consent and the personal data is required for an emergency, or unless the data is used exclusively for journalistic purposes;
   3. Organisations from using personal data collected from any individual to intentionally and maliciously cause harm or severe distress to the individual the data belongs to;
   4. Organisations from storing received personal data from other organisations without the prior explicit consent of the user the data belongs to;
   5. Organisations from sharing the personal data of a user without their prior explicit consent;
   6. Organisations from retaining personal data, when the user has asked to transfer them to another organisation, for the purpose of obstructing the user's freedom of contractual choice;
   7. Governments of member states from viewing the personal data of a user without explicit prior consent from both the organisation in possession of the personal data and the user to which the data belongs, unless the user has consented to their personal data being shared with authorities as necessary, as a condition to use the services of the organisation and the personal data collected was for crime prevention, or a judicial order has been issued;
3. Mandates that:
   1. Organisations provide fully detailed information on how they will use or share a user's personal data to the user explicitly when they interact with the organisation for this first time and when a major change to the data collection or usage policy has been made;
   2. Organisations enable individuals to view the personal data that the organisation holds on them unless the release of the personal data would compromise the privacy or well-being of others;
   3. Personal data processed or stored be removed from the database of the organisation if the data is no longer relevant to the services used by the user, or if the user ceases to use the services of or ceases to be a member of, the organisation; unless the user, consents to that explicitly and clearly, or unless there is a clear and compelling safety or disciplinary reason to do otherwise such as loans, transactions, or disciplinary records;
   4. Organisations allow individuals to request the removal of their personal data, and act upon these requests, unless it falls under an exception mentioned in clause 3c above;
   5. Organisations remove personal data of a user if the organisation is informed of the user's death, subject to exceptions in clause 3c;
   6. Organisations allow users to edit data stored on them by the organisation if the data stored is incorrect;
   7. Organisations take reasonable measures to ensure the personal data being stored by the organisation is not accessed by unauthorised persons;
   8. Organisations take reasonable measures to ensure the transfer of personal data under a user's request is performed in a reasonable time frame, subject to national legislation;
4. Declares that an organisation can prohibit a person from using the services of or joining the organisation if the individual does not consent to the personal data collection policy of the organisation, or if the user provides falsified personal data.

Co-authored by Kenmoria

We agree.

[Marxist Germany]

OOC: Please refrain from quoting a wall of text just to reply with 1 line.


Ive trimmed the proposal a bit because I was 50 characters above the limit.

[Araraukar]

Believing that collecting non-essential data without consent is a violation of the right to privacy,

OOC: Shouldn't this read "essential data" instead? I mean, my favourite food is non-essential data for most businesses' purposes, so it would be one and same if my bank had maksalaatikko in a file for me. But my favourite pizza would be quite a bit more essential to my nearest pizzeria, and I might object to them filing that info away without asking me. Same, my insurance company likely wouldn't get anything out of knowing my favourite author, but if I had some Madventures style hobby, it might be essential to them as they might raise the price I pay for my accidents insurance.

[Marxist Germany]

Believing that collecting non-essential data without consent is a violation of the right to privacy,

OOC: Shouldn't this read "essential data" instead? I mean, my favourite food is non-essential data for most businesses' purposes, so it would be one and same if my bank had maksalaatikko in a file for me. But my favourite pizza would be quite a bit more essential to my nearest pizzeria, and I might object to them filing that info away without asking me. Same, my insurance company likely wouldn't get anything out of knowing my favourite author, but if I had some Madventures style hobby, it might be essential to them as they might raise the price I pay for my accidents insurance.

OOC: Fixed, if there is no more feedback I intend to submit tomorrow

[Marxist Germany]

OOC: I have delayed the submission due to an inability to campaign currently. I will submit this on Saturday hopefully.

[The JELLEAIN Republic]

B seems somewhat vague ...

1b


o3b makes your data viewable to others (clarification)o

[The JELLEAIN Republic]

2c why severe distress only ?

[The JELLEAIN Republic]

Perhaps 2 a should have more or,s and less ands

[The JELLEAIN Republic]

What is the jatificarion for 2 be, couldn’t a better way of saying g so thing like that is they can do so on their property for a reasonable expectation of privacy or so thing like that .. ?

[Marxist Germany]

OOC: I dont understand what you're saying, please speak understandable English, and dont quadruple post as it is spam.

[Separatist Peoples]

What is the jatificarion for 2 be, couldn’t a better way of saying g so thing like that is they can do so on their property for a reasonable expectation of privacy or so thing like that .. ?

You can put all four of those posts into one post. You should do so moving forward. If you post multiple times in a row, you could be spamming.

[The JELLEAIN Republic]

2b prior consent seems somewhat abusable


2g seems kinda loose

3b lets others view your data? (Clarification)

3c is rife with holes

3e so it is. Or the responsibility of the origination to learn of the persons death like a sweep of data bases? How will that affect media accounts and such ...

3f has TONS of abuse possibility (you sign a contract for us to correct you, or, bank I auctally have 3 mil in this account) (4 doesent change that much)

“Reasonable action in 3 g and h Varys by country I guess but it still seems like an a usable front...



That’s it I think for now ...

Hopefully a contribution if one can get past my horrible autocorrected English.

[The JELLEAIN Republic]

What is the jatificarion for 2 be, couldn’t a better way of saying g so thing like that is they can do so on their property for a reasonable expectation of privacy or so thing like that .. ?

You can put all four of those posts into one post. You should do so moving forward. If you post multiple times in a row, you could be spamming.

Sorry, I guess your right

Putting all stuff into above post edit()