"those entrusted with our privacy often don't have much incentive to respect it"

I love this man (no, not McLovin). He accurately describes what I think is the greatest problem with the current practices regarding how information about people is treated today.

The title of this post is a quote from his article. To recap, Schneier is saying that the organizations who are keeping records about you, do not have an incentive to protect that data from 'other uses'. In fact, I supose their only incentive to safeguard your data is to ensure continuation of their own business. As long as they have the data which describes you, they couldn't care less what happens next with it. Spreading, leaking, selling of your representation is all fine, as far as they are concerned. It doesn't hurt, so why care.

However, the article then continues to describe how laws and policies can be created or improved, as to better protect the individual's privacy. Great stuff, but for me, laws and policies are a sign of trouble in itself. Please allow me to explain.

The only option available right now for protecting the people being represented in remote systems, is to create artificial incentives in the form of laws (so bad behavior can be punished); Sometimes the fear for bad publicity (eg. a memory stick lost leading to public scandal, see the 'oh dear' section below right) is seen as a reversed incentive. However, it is probably much more efficient to let the PR department handle those cases after they take place. You lose again.

As in most cases where laws and 'after the fact' measures are instated, the actual problem is that such mishaps can occur at all. To prevent this, laws try to tell organizations that manage your data, what society finds desirable and undesirable behavior.

This is a totally powerless situation for the individual being represented by the data kept by those organizations. The only things you can do once you trust your data to remote system are:

• hope for the best, and have full confidence that the 'privacy policy' is adequately upheld.
• sue when your identity leaks, through some fault or intentionally via data sales to third parties. I don't think this has much effect in real life, and again, the damage is already done by that time

The only real option to stay in control is to not entrust anyone with your personal data, but that would mean you would be deprived of most basic services such as telephone, electricity and ahem, twitter. ;)

Or, if Santa ever grants my wish, you could have a personally controlled data set which all those organizations need to refer to if they need to know something. A total inversion of data flow. Instead of you handing out your representation to be kept in remote systems, the service providers would be granted (by you) access to some appointed data store (selected by you) to request access to certain bits of your personal profile (created and shaped by you).

Empowerment of the individual by means of technological innovation would help people to take ownership and control of their representations, rendering the whole policy discussion moot. The current power imbalance would be fundamentally reshaped.

See also my little rant 'My representation in remote systems, the present'.

Hi...

I'm still alive... It's just that my attention is being spread out over so many things, sometimes one of my 3 gazillion projects suffers from neglect. I know, I know, but I'm ok with it, so sue me ;)

Btw, the book I'm writing on the Egosphere subject is coming along nicely. Stay tuned.

My representation in remote systems, the present

Warning: rant ahead....


I, the one represented, allow you, the receiver of information about me, needed to fulfill a service for me, to acquire and store indefinitely, some attributes describing me as an individual, in the hope you will record them accurately and use them solely for the purpose as intended in our agreed initial context.

From there on, I have no control over the system you use to store these records, describing me. Any subsequent change which I wish to effect (an act of self expression, creating my self representation) can only be realized with your consent. Any error or conscious mis-representation is not noticed by me directly. You can alter data representing me at will, thereby doing dishonor to my intentions, without me even knowing it happened. I am not consulted or notified if such change should occur.

I am powerless to express myself unless my intentions are reflected in your records. Once acquired, you value the recorded version, supposed to be representing me, above my subsequent direct communication of my intentions (as in, 'no sir, our computer says here bla bla bla'), even though I should be considered the ultimate authority in describing myself.

Even when it were entirely feasible and economical to consult me each and every time you need to acquire some information of me, you prefer to use the version in your system as it was recorded once in the past. That may be out of date, or not reflecting my current intentions in some way, but you don't really care. You don't verify or check at regular intervals with me. I can try and fix your records (which, for you, are the truth about me, but for me, they are not), but you might not let me, or you are incapable because of "call-center issues".

To make things worse, I have this issue with 200 different organizations, each treating me the same way as you did above, thus leaving me practically powerless to express my intentions across them all. (even a single one is hard, let alone 200). Such is the way I am reflected in society, through the eyes of the many organizations that deal with me: Disparate views, often not consistent, and not governed by my intentions. I am most incapable of expressing my desired representation in a consistent manner, such that it reflects the way I wish to be known. Where is the justice in that?

Oh and by the way, could you take more care with my data?