Feds may tighten privacy protections The Obama administration is reportedly considering a stepped-up approach to enforcing privacy on the internet that includes new laws and the creation of a new post to make sure they are enforced. According to an article published Friday in The Wall Street Journal, the strategy is expected to be unveiled in a report to be …
@"do-not-track tool that people could use to remove themselves from online surveillance by marketers and others"
I get the sinking feeling that tool will be about as effective with marketers as the spam email cancel web pages, which have been around for years, where you insert your email address in them, to cancel the spam, only to get 10 times more spam. :(
I have zero trust of anything marketers are connected with. They are completely without morality, empathy or ethics. They have absolute single minded greedy contempt for everyone. Just look at Phorm to see what absolute bastards they are like. Would anyone really trust Phorm to delete its data! ... plus they would use this tool as an excuse to spy even more, saying things like, "oh yes people can delete their data, so its ok government, that we get more of peoples data". Yeah right.
"and the creation of a new post to make sure they are enforced."
This guarantees the regulations will be toothless then. They need to be laws not regulations, with the full weight of huge fines and criminal penalties or they will be a joke. There is already an infrastructure to ensure laws are enforced. Personally I think an important provision is not to preempt citizens from the right to sue. That way when (not if) the government fails to enforce the laws those affected to file suit in conjunction with the EFF or other parties.
I would bet that the regulations will be written in such a way that this is prevented though, so when a Republican administration declines to enforce the law in all but the most egregious cases consumers will have no recourse. That's the typical government path - create regulations and an entire infrastructure to administer them, then do little more than investigate and cajole the violators. How about a minimum fine of $100 per person/record for violations, "accidental" or not. One million customers 'accidentally' violated? That would be a significant deterrent.
"While details remain slim, the proposal in some ways resembles legislation being mulled by the European Commission that would bestow citizens with a “right to be forgotten” that effectively would allow them to demand that their data be deleted."
What about the data retention directive? Not much point being forgotten by marketers if the state continues to hold all the data. And in the UK how long do you think it will be before the government decides that data retained has commercial value and starts selling it?
When a customer processes a transaction through a website, their details and the details of the transaction are recorded in a database. Now because of data-retention laws (in Australia and presumably similar laws in the US and UK) we have to keep that data for a minimum of 7 years.
Not only that, but there is the issue of orphan records. For example, Customer X purchases Product Y and this purchase is recorded in Transaction Z. This transaction record contains a foreign key pointing to X and Y, so if either X or Y are deleted, Z becomes an orphan record with foreign keys to non-existent records. This situation quickly becomes a DBA's worst nightmare.
Consequently, records have to be retained to keep the database intact. When a customer is "Deleted", what actually happens is that a "deleted" flag is set in the customer's record but the data is retained to preserve the database integrity. Also, we have to keep it for 7 years because if the Tax Office audits us we have to be able to show details, including who bought what, when, and for how much, for that period of time.
So if legislation like this passes, it's going to be a screaming problem for DBAs everywhere. Not only is it going to conflict with existing data-retention and taxation legislation, but enforcing it is going to leave databases with orphaned records. I hope that the legislators take this into account when they're drafting the bill for this law.
I think the point is to prevent the retained data from being used for behavioural tracking and surveillance. Nobody is advocating commercial transactions to be deleted or corrupted, that would be stupid. What's being discussed is the storage of this information as part of a customer tracking system. *Those* records are the ones being contemplated for deletion.
Leave it to a developer to over-analyse the problem and miss the actual business requirements.
DISCLAIMER: I am a developer too.
-dZ.
"deleted" and "scrubbed from all possible disk records" are 2 very different things man.
They're certainly not expecting you to purge a customer record from your systems down to the block on disk, let alone pull backup tapes that might have that record too... They're talking about hitting the delete key and MARKING it as deleted, simply such that a user who looks it up won't find the record (except maybe to SEE it was deleted, in case someone tries to add the record back later), or so it won;t pull in reports, and so unassociated fields not needed can be cleared. (you might need to keep a name, address, and phone number ON record such to ensure you NEVER call that person, but this can easily be considered a "deleted" record so long as its marked as "do not use" and can not be accessed by employees outside of IT).
The idea here is to make them stop using and selling your records. That's something we can, within reason, police, especially if there's a national system like a do-not-call for the internet.... Having internal audits to scan your databases for "deleted" records is beyond the scope (or concern) of the government.
The idea of this new office is exactly this: to determine what IS reasonable and feasible, to come up with simple streamlined laws covering not just how to get rid of data but controlling how you get it in the first place, to give consumers avenues to complain to, and a system to "opt-out" into, and to set newer, easier to enforce, and much stricter penalties for those who abuse consumers.
Great, today I purge you from my database. I not only remove your data by making the fields as blank, I master the DB, then perform a compaction, completely removing your data from the database. Tomorrow, while importing a list of customer leads from other processes, from a partner or 3rd party you have not yet reached out to to delete, or because you bought something in a specific store, or because you signed up for another something, your record is included in that import, now its BACK in my database, and I have no record there to indicate to ignore that record, and you;re right back in my marketing list.
If I don't keep at least SOME identifying data about you, how can i guarantee you won;t get added back into my database through absolutely legitimate means? Especially if you had an account at one point, and laws say I have to keep you on file for 7 years because an audit might happen later.
"Deleted" and "purged" are 2 different things. Its VERY easy for me to keep a database of records that people (and more importantly reports, mailings, auto-dialers, and other automated processes) CAN NOT SEE. By keeping your name, address and phone number, I can assure you that you will never be called again, and that I'll not sell your data or trade it, and even if some other firm gives me your data in a marketing pack, it will not be re-marked as active. As long as associates can't access your record, there's no harm in me having it. Lets face it, I got it initially somehow, if I purge it, it WILL COME BACK!!!
Now, the associated data: anything not required to be kept by other laws (transactions, accounts, etc) that goes beyond the simple record used to ensure i can be identified in a "do not market too" data record, THAT content should be able to be purged. Demographic information, associated data, tracking information, this should all be able to be purged.
Personally, I don't care if a website knows I went there. I don't even care if websites share that information (unless i told them not to ). I don't even care if you have my name, number, address, etc, even if I've never been a customer. That's just data, the vast majority of which is public record at that. All i care about is "DO NOT MARKET TO ME." and we can get along just fine. As far as targeted marketing, I actually think that's better than generic marketing. They get a higher return rate from advertisers, making more services available to me at no charge. I can just as easily ignore a web advert as i can one on TV (if not easier). If you throw it in my7 face and keep me from seeing the rest of the page, i just won't go back to your site, ad then where's your return visit revenue and what good was all that targeted analysis and data mining?
If I have to see adds, I'd rather they be at least potentially based on what you think I'd like to see, instead of vaginal creams. If I unsubscribe, it should be permanent. If I say don;t call, you don't ring my phone. Give me a place to post my addresses and numbers and make it easier for everyone to know that.
Now, how to police it? Simple... Put out a few hundred phone numbers and a few thousand e-mail addresses that don't really exist. Change them randomly. Keep the marketers guessing. "Is this a real, validated person I'm about to contact, who has not previously asked me not to call them, or is this a number the Fed put out there to catch me not keeping up with the no-marketing registry, and it's gonna cost me $10K if I e-mail it?" is a DAMNED powerful business motivation, and very easy for the fed to monitor, VERY easy.
disclaimer: I'm just an IT guru, I have no association with a marketing, collections, or other firm that would actually cal you, ever. This above is purely hypothetical...
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
