Not literally, but the legal framework would be very similar to copyright. Any third party that wants to use private information for any purpose must get explicit consent from the data subject, for example, by paying them for a year-long limited license to use the personal information for certain purposes only.
There could be certain privacy rights that it would be illegal to contract away, so perhaps it is not legal for a company to sell personal data to third parties -- if they want the data, they have to contract with the data subject themselves. This framework would support "data co-ops" or "data unions" that collectively represent groups of data subjects and bargain on their behalf.
There are some complications and drawbacks to my proposal, for example, lots of private information involves multiple parties and they would have to somehow negotiate. But something along these lines would really help put the power back on the other foot.
Luckly, it's a decent article and pertinent to the discussion, so you'll get an upvote... but for the people reading the thread:
> REGULATING DATA AS PROPERTY: A NEW CONSTRUCT FOR MOVING FORWARD
> JEFFREY RITTER AND ANNA MAYER
I think (2017-02-22) that user data should be treated in much the same way as nuclear raw materials. I would suggest considering a User Data Non-Proliferation Treaty along the lines of https://en.m.wikipedia.org/wiki/Treaty_on_the_Non-Proliferat...
In places where there are reasonable privacy protections, there is a distinction made between regular people and public figures. Perhaps public figures get weaker protections under this proposal as well?
Let's assume we are going to go ahead with this idea. (FWIW, I think targeting collection and storage it is the right starting point.)
Would it make more sense to make it a criminal offence, a civil one or both? The word "illegal" usually refers to criminal, not civil law. However the comment refers to "civil penalties". Should we think about who is going to enforce the law, who will pay the cost of that enforcement and how unauthorised collection and storage may be discovered. Who enforces criminal law? Who enforces civil law?
Even if the company has zero intention of selling that data anywhere else, it’s literally a bare minimum requirement to be able to not go bankrupt and layoff all their employees from failing to competition or failing to correctly measure and respond to intricate market signals.
I am a deeply privacy conscious person, but it does annoy me when the counter response to data brokerage or selling personal data is to go way too extreme in the other direction and vilify or try to make illegal the huge amount of data capture that is completely, non-optionally required at a basic minimum level for any modern business to have any hope of not failing.
More importantly though, less technological tracking of customers in the past totally does not matter at all.
What matters is if your competitors have access to these tools. This is a reality of modern business so unless a data law perfectly eliminates this possible data capture for all businesses, any business that does capture that data will have huge advantages over competitors.
- Make it a legal requirement to display on the website what optimisation techniques are used and what metrics are optimised.
- Create recommendation systems/search engines/web browsers as a public good, with utilities that are more humane and as such reduce the effects of addictive and harmful software in the medium term.
- Legislate on psychoactive software with the same fiduciary responsibility and oversight as applied to doctors and surgeons.
It seems like a particularly difficult law to enforce, and the unusually high penalties give these companies an unusually strong motivation to be as aggressively unaccommodating as possible, since every enforcement action is an existential threat.
These companies are already big enough that normal legal proceedings against them are difficult... GDPR proceedings are going to be impossible.
Here is a better framework:
- Make it illegal to collect or store personal information on anyone you don’t have an active business relationship with.
- All personal data collection should require an opt in. The definition of opt in is that it takes at least one more manual step to opt in than opt out, and that the options must be presented with equal prominence.
- Selling or purchasing services based on third parties personal information counts as selling or buying the information in the eye of the law.
- Buying and selling personal information would be illegal unless the person explicitly authorizes the transfer each time the data is transferred.
- Civil penalties for breaking the law would range between 1-10% of global income per transaction, with a cap of 20% of annual gross income per month. (So one mistake doesn’t completely destroy the company, but ignoring the law does). Class action waivers or binding arbitration would be disallowed. (Unless the person whose information was sold could choose the arbitration agency after the fact.)
- Authorizing the transfer of information must not be a requirement to receive some other service, etc.
- A central registry of all opt ins would be available so individuals could audit their opt ins, and with enough information to assign blame for fraudulent opt-ins (and to protect buyers/sellers when one side of the transaction falsified an opt in). This would also have a single page to people to cancel all of their existing opt ins.
That would start to solve the problem.