This seems to be the crux of their argument, and I find it convincing:
> Passing comprehensive privacy legislation would be a major public good–but APRA no longer can be called comprehensive. Civil rights guardrails are essential for consumer trust in a system that allows companies to collect and use personal data without consent. The new draft strips out anti-discrimination protections, AI impact assessment requirements, and the ability to opt-out of AI decision-making for major economic opportunities like housing and credit. We cannot abide a regime that would perpetuate, in the words of Dr. Ruha Benjamin, a form of ‘Jim Code’: ‘the employment of new technologies that reflect and reproduce existing inequities.’
If the systems recreate existing inequalities, then we haven't solved these issues in real life. How can we solve these issues comprehensively?
Seems a better approach is pass privacy protections, then pass laws addressing specific things as we have solutions for them. The AI impact assessment would be better in an AI specific bill that tackles other AI issues too (like law enforcement or government use, what types of systems should require human in the loop, etc).
I think any talk of anti-discrimination falls way too far behind the bar.
Privacy is an incredibly basic and fundamental right. If there is any provision for data collection without consent ("AI" or otherwise), then that right is violated. No amount of "guardrails" can recover that violation.
I don’t find it convincing at all. Why do privacy protections need to be coupled to anti discrimination language? Pass them as a separate bill, and start with blanket protections on privacy, explicit consent, a ban on data brokers who operate without end user consent, and transparency around how data is obtained. This just looks like an uncontroversial and obvious good (privacy) is being bogged down with politically loaded riders.
> The new draft of APRA also creates a massive loophole for personal data collected and used on an individual’s device. Tech companies would be able to do almost anything they want with data that stays on a personal device–no data minimization rules, no protections for kids, no advertising limits, no transparency requirements, no civil rights safeguards, and no right to sue for injured consumers. As AI and computing become more powerful, allowing more processing to occur on a device, this loophole will grow. As a result, this draft of APRA is weaker than state laws it is preempting.
That hardly amounts to an uncontroversial and obvious good—I would say regardless of your feelings on the anti discrimination provisions that it should be the uncontroversial to reject this legislation.
It depends on how you define what data must stay on the device. You see this all the time with data processing.
Individual actions and usernames are recorded. Let’s call that personal data. That has to stay on the device.
But what if I also ran a “collect usage metrics” process that ran once a week and summarized your actions, removed your username and replaced it with a random GUID, and otherwise painted a profile of how you used my software over the last seven days?
Is that summary level data still considered protected? Can I send that back to my servers without telling you, or if I add a settings toggle for “share usage data to help improve our products”, is that ok?
At what point does data become generic enough to not be personal?
While I agree with their aim and their reasoning on this bill with regard to the fact that it has been unacceptably weakened, I take issue with this quote:
"the core purpose of privacy: to ensure that who we are cannot be used against us unfairly."
No. Privacy is an end in itself. It is a human right. Falling back to economic justifications weakens the foundation of fighting for privacy.
It’s changing the subject in order to narrow the discussion.
Statement: I support the right to wear pants.
Response: The core purpose of pants are economic, safety and consent. You can use this necklace to wear your wallet, phone and keys around your neck. We promise to keep the thermostat at 72F, and that we will not do anything without your consent. No pants for you.
Agree. This does seem like authors have confused privacy (the right to control one's own data) with anonymity (the right to remain unknown). I wonder where their interpretation of privacy comes from.
Yeah -- if I don't want to be known to another person I shouldn't have to be regardless of whether that person derives a benefit from knowing me. This is what it means to innately have a right like liberty or privacy. There is no grounds whatsoever for taking it away, and nobody has granted it to you on any grounds whether economic or moral.
They're the exact same thing. There's no point to privacy if there's no reason for having it. Simply declaring it a human right is worthless if you can't justify why it is one.
> by the argument that indefinite detention would unfairly limit our ability to obtain an auto loan?
No. It is justified by arguments like without it the state could delay your trial indefinitely keeping you in legal limbo (and possibly incarcerated) for as long as they want which would effectively negate your right to trial. They exact justifications used vary by country.
Your rhetoric is clever, but I see a hole in it. Indefinite detainment is a logical consequence of lacking a right to a speedy trial, but is not identical to it.
I think it is in fact quite apt to say that the right to a speedy trial is to indefinite detainment as the right to privacy is to your information being used against you. Both are material consequences of lacking those rights.
We aren't talking about other rights. We're talking about this one. And THIS particular right is rooted in the fourth, fifth, and ninth amendments but isn't actually found in the constitution as a singular entity and wouldn't be codified until the 1960s. Guess which court case created that right in the first place? Griswold v Connecticut. Guess which one was overturned along with Roe v Wade because there's no explicit mention of a right to privacy in the Constitution? Same one.
The basis for the right which was, in part, ABSOLUTELY rooted in the idea that the because people and governments have a tendency to discriminate against you based on what you believe, then as long as you do not disclose your interests publicly, there should be no basis for discrimination. And why is this discrimination so important when NOT dealing with the government (which are nothing but glorified property protection rackets)?
Economics. Specifically, trade. That thing that mankind has been doing since before we've actually had recorded history? Whether it's bartering or seashells or labor or whatever, it's an essential part of being human, because it's how you get things you need to survive.
Again, we do not assign rights for which we cannot find a real purpose. You cannot be a functioning human being in a society without economic activity, whether you perform it or someone performs it on behalf of you.
Please don't misunderstand me, I'm not against statements of the form "this right is valuable because...". But I don't like this idea that fundamental human rights must have practical justifications.
For example, I like how the Declaration of Independence says "We hold these truths to be self-evident, that all men are created equal, that they are endowed by their Creator with certain unalienable Rights, that among these are Life, Liberty and the pursuit of Happiness." There's no attempt to justify them, just a plain statement that "GFY, obviously we have these rights".
As to privacy in particular, I don't think it's a stretch to interpret (4th am) the "right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures" as articulating support for our modern concept of privacy.
Sure, today's corrupt politicized SCOTUS could decide to interpret it otherwise. But it seems naive to think that justification based on fear of discrimination is going to prevent that disreputable politicized SCOTUS from interpreting it to some ends (i.e. outcomes favored by the parties lavishing upon them tangible gifts), no matter how well you argue it.
So, sure, go ahead, argue for our rights on any basis you can find. I hope you succeed.
The ability to violate people's privacy in the time of the Founders was much, much smaller than it is now. The Founders never could have envisioned such an all-encompassing surveillance machine as the one driving the world now. Of course they didn't codify a right to privacy. They didn't have to worry about every single group of people they interacted with to want to vacuum up every single piece of data they can.
Respectfully disagree. Having to demand "justification" for basic human rights allows a wedge to be placed to remove basic human rights that aren't "justified" to the satisfaction of the person deciding whether or not a basic human right is "justified".
Before HN gets triggered by the word 'discrimination' they're not talking exclusively about skin culture/identity politics, they're talking about all forms of discrimination - which is precisely what privacy rights are supposed to do.
Discrimination cannot be avoided by hiding who we are. Removing discrimination requires actively exercising merit in spite of information bias. As long as we have humans with different skin colours, biases will continue to exist. Discrimination occurs when bias informs a decision where it is not a factor.
Any sign of the latest draft they're referring to? I didn't see a link in the post. The May 23 Innovation-Data-Commerce markup?
I'd be interested to see what kind of non-discrimination provision was removed. A rule against discriminating against people for exercising their privacy rights, like we see in the California Consumer Privacy Act, GDPR, &c.? Or a more general, civil rights-style prohibition, perhaps incorporating a list of protected classes?
They mention the new draft could be weaker than state laws it would preempt. I take it that's most likely a reference to California law. But it comes after discussion of a loophole they see for on-device data, not the part of about non-discrimination.
It makes sense for a civil rights organization to want strong nondiscrimination language in a federal privacy bill. But I'm not sure we've seen those bundled in one law and passed before. We have with AI-specific legislation. If the APRA is turning into more of an Omnibus Big Tech Bad Behavior bill, AI regs included, that might make political sense.
I htink there were three key sections that got cut out:
1) "A covered entity or service provider may not collect, process, retain, or transfer covered data in a manner that discriminates in or otherwise makes unavailable the equal enjoyment of goods or services on the basis of race, color, religion, national origin, sex, or disability." This was hugely important, it was sa major victory to get a bipartisan committee majority supporting similar language in APRA's predecessor ADPPA.
2) Requirements for algorithmic impact assessments by large companies (I forget the exact threshold).
3) A requirement to let people opt-out of consequencial automated decisions (with some exceptions), somewhat similar to California's CCPA.
Is this a case of perfect being the enemy of good?
I don't know anything about the legislation, but the linked article's main complaint seems to be that anti discrimination language was removed from the bill. Ok. I don't understand all the issues involved with that, or what that language was.
Regardless, is it still good without that? Does it increase our privacy rights? Why not move the needle in the right direction and then lobby for additional things?
Anti-discrimination is the meat of this. We shouldn't allow opaque AI systems to be used as justification for discriminatory actions. Without anti-discrimination they will certainly be used in this way.
While it has some good features (data minimization) it's also got some major weaknesses -- for example state attorneys general say they wouldn't be able to enforce it, it preempts existing stronger privacy laws in states like California and Illinois (and potentially Washington to some extent), EFF's warned about some big loopholes, etc. And that was even before these latest changes.
> Why not move the needle in the right direction and then lobby for additional things?
Two reasons. Preemption not only weakens some existing laws, it keeps states from passing future stronger laws -- so it caps protections. And, politicially, no privacy law in the US has ever been strengthened by Congress (or state legislatures) ... so, it's very unlikely that the lobbying for additional things will have an affect.
> Passing comprehensive privacy legislation would be a major public good–but APRA no longer can be called comprehensive. Civil rights guardrails are essential for consumer trust in a system that allows companies to collect and use personal data without consent. The new draft strips out anti-discrimination protections, AI impact assessment requirements, and the ability to opt-out of AI decision-making for major economic opportunities like housing and credit. We cannot abide a regime that would perpetuate, in the words of Dr. Ruha Benjamin, a form of ‘Jim Code’: ‘the employment of new technologies that reflect and reproduce existing inequities.’