[alfredallan1]

That’s one of the most valid ideas I’ve heard - define private data as personal property.

When one looks deeper into laws like GDPR and this one, at the heart of it lies the fact that a company cannot do as it pleases with an individual’s data without said individuals consent. But given the nature of the legislation, it is not too hard for a company to simply bypass it in ways that adhere to the letter of the law but not the spirit.

If instead there were laws that defined private data as the personal property of the respective individual, the need for all this convoluted legislation would be rendered moot, since such a law would open the grounds for a variety of class action lawsuits against companies perceived to be egregiously abusive. The case law itself would set numerous precedents and eliminate the need for varied “interpretations” of one piece of legislation. IMO, this is what we should be pushing for, not more GDPR-clones which can be watered down by lobbyists.

[nostrademons]

I'd love to see private data as personal property, but in practice that's likely to run into a lot of contradictions.

The biggest problem is that most of the interesting private data is actually about relationships between multiple private individuals. If you're having a conversation with a friend on Whatsapp, is that conversation property of you, your friend, or do you each own your own messages? If it's a group conversation, is the whole conversation owned by all of the participants, or only parts of it? What if some people in the group chat aren't actually participating, but are just lurking? If you mention a company's product, does that mention belong to the company or the person mentioning it? What if instead of a product, you mention another person? What if you're quoting gossip they told you in person?

This is why Hacker News doesn't let you delete or edit posts after 2 hours, BTW. Once people have read them and replied and referenced them elsewhere, it's not really fair to other participants in the conversation to remove the words they were replying to.

Other social networks have run into real problems where people have edited their posts after many replies have been added to take the replies out of context and make them mean something totally the opposite of what their authors intended. If you own your own words, this is your right, but it's also a dickish and disruptive thing to do.

The same applies to many other types of personal data. A credit report is a list of transactions between you and various creditors. The credit bureau didn't just snoop on everything you do, that information was reported to them by the other party of the transaction. If they own the data about them, this is within their rights, but it certainly doesn't feel about it when it's used to deny the borrower further credit.

I think the current situation, where data is owned by the company or individual that collects it, is the most absurd alternative possible. But that's because our legal system is poorly structured to handle property rights where the "property" is owned by multiple firms, can be transferred easily (and surreptitiously) without the original owner losing rights, and may eventually come to harm one of the original owners.

[ckastner]

> The biggest problem is that most of the interesting private data is actually about relationships between multiple private individuals. If you're having a conversation with a friend on Whatsapp, is that conversation property of you, your friend, or do you each own your own messages? If it's a group conversation, is the whole conversation owned by all of the participants, or only parts of it?

To me, not addressing this one of the biggest flaws of the GDPR.

As a practical example: I've talked to numerous other banks, and with regards to data portability (article 20 GDPR), there is nothing even close to a consensus as to what you are allowed to give the customer with regards to his own transactions, because there are numerous parties involved.

It gets even worse: the text of the "right of access" (article 15 GDPR), in a wide interpretation, grants access to far more information than the data subject would otherwise have access to.

If person A and person B confidentially process data of C, is it really the intention of the GDPR to grant person C access to this confidential processing?

[burntrelish1273]

There's two ways to look at compromised legislation:

1. It doesn't go far enough, and sells-out to the opposition.

2. It's better than nothing, and future legislation can address it.

Holding out exclusively for 1. or settling for 2. are bad strategies. There's nothing wrong with trying to get as much in a bill as possible, but the damn corporations push back on everything for the people.

Until, as Larry Lessig / Aaron Schwartz noticed, either the political OS gets changed (unlikely) or it crashes and burns.

[AdamM12]

Until government taxes it :)