[6r17]

Whether there is a single app or not doesn't really matter - i'm more concerned about the database itself and the inter-connectivity between them and most importantly by which control acceptance protocol we abide between states.

The idea that we want a single database or a network without any kind of control is frightening me

[delusional]

What do you mean by "control" here? It's my understanding that EU law afford citizens the right to correct data that is wrong about them.

[choo-t]

The problem is not about the data being correct or not, it's about its existence in the first place.

Why would you correct data about you very own surveillance ?

[grey-area]

Governments need to identify citizens. They currently do this via paper records and extensive digital databases that those tie into. They will in future do this via digital records/tokens but this won’t change much.

Some amount of id verification and surveillance is of course required for a government to function, the question should be more what is allowed and what is not.

[delusional]

Is all data about you "surveillance". When your doctor produces a medical record after your visit, are they "surveilling" you? How about when the railway company stores your travels to bill you later?

I'll assume your answer is no, and I that case surely you must see the value in that medical record being correct.

[choo-t]

Are you equaling mass surveillance to a doctor keeping track of your health for diagnostic accuracy purpose ?

Concerning the railway example, they only need to store how much I owe them, not my travels. Storing travel history on their end is already surveillance.

Data keeping purpose and consents are what make something surveillance or not. Forcing every citizen to use ID to access the web is surveillance plain and simple.

[delusional]

> Are you equaling mass surveillance to a doctor keeping track of your health for diagnostic accuracy purpose ?

No, I am legitimately asking to clarify your position, hence why I assumed you wouldn't call that surveillance. The point was for us to agree that the right to correct data is a meaningful and useful right to have.

Once we've clarified that, the rest of the arguments comes down on the separation of "surveillance" from "record keeping", a separation you attribute to "Data keeping purposes and consents". That aligns with current EU law, and I largely agree with treating that as a separation point. If you have a valid purpose, either by law or by duty to your customer, you get to keep records necessary to fulfill that need. I would note that these "duty to your customer" clauses are usually pretty broad and would, I imagine, allow the railroad company to keep and process your travel record for fraud prevention purposes.

The issue we encounter is what a valid "data keeping purpose" is, and if we trust our public institutions and infrastructure to govern that question. Especially when the potential data processors is a government agency. This I'm entirely uninterested in debating that question with a rando on HN. We likely live in two very distinct regulatory frameworks and have vastly different local governments. There's no basis for us to agree here.

I would however end by noting that the two clauses of your statement

> Data keeping purpose and consents are what make something surveillance or not.

and

> Forcing every citizen to use ID to access the web is surveillance plain and simple.

Are in tension with one another. Clause 1 opens up for the idea that there exists valid "non-surveillance" record keeping, and that the distinction of such record keeping from surveillance requires determination of consent and purpose. Clause 2 then foregoes that determination and just presupposes the argument. All ID checks are definitionally surveillance irrespective of purpose and consent.

In the current legal framework, government derives it's unilateral consent from the vote. If the law passes in a democratic system then it is, by that very process, a consensual and valid purpose.

[choo-t]

> Are in tension with one another. Clause 1 opens up for the idea that there exists valid "non-surveillance" record keeping, and that the distinction of such record keeping from surveillance requires determination of consent and purpose. Clause 2 then foregoes that determination and just presupposes the argument.

"Forcing" highlights the lack of consent, the distinction is still present.

> In the current legal framework, government derives it's unilateral consent from the vote. If the law passes in a democratic system, then it is, by that very process, a consensual and valid purpose.

Absolutely not. Being voted in a parliament doesn't mean citizens consented to it.

Simple example: compulsory military enrollment vs voluntary military enrollment. Only one of them derive from consent, even if both derive from a law discussed in parliament.

[harvey9]

Since you are bringing a semantic argument you might like to know that your doctor does in fact surveil you, hence the term "public health surveillance"

[delusional]

I have never heard the term "public health surveillance" and it's hypothetical use has no bearing on my argument.

[6r17]

I mean that there is a big difference between a state automatically providing your data to any other state while having "their database disconnected" - and a human operator in the loop and an administrative verification of the appropriate access ;

For example this would allow a state to refuse access to the PI of their citizens for cases that are not administratively documented. This forces the access audit sufficiently that a malign actor cannot simply request data for a citizen without having probable cause ; another vector we want to protect ourselves against is simply the psycho/sociopaths that have access to these data without surveillance.

[hiciu]

Whats your source for the database sharing claim?

The way I understand it is more like tls certs, with each country managing their own root cert.