Stealth Writer vs Walter Writes

Laws have not been able to catch up with technology that eats data.

While governments around the world are celebrating unprecedented privacy laws and policies, researchers and privacy advocates say the legislation isn't adapting to contemporary practices in data gathering, and has some big holes in its protections.

The EU GDPR and California Consumer Privacy Act among rising state and national laws give new powers to individuals to obtain, erase, and restrict the use of their data. But critics contend that such safeguards, in many instances, amount to little more than a window-dressing exercise.

Consent is one of the main issues. Most privacy regimes are based on the premise that users will agree to a practice of the collection of data after a disclosure of those activities. In fact, only a small number of people read long privacy statements – and even then, not many people know what they mean. One oft-quoted study found it would take an average citizen weeks of work to read all the policies he or she is exposed to in a year. Consent banners, on the other hand, can be intentionally made to target users to click on "accept.

Another source of difficulties lies in enforcement. Insurance regulators are always underfunded in terms of the number of companies they supervise. Proceeds from investigations can be lengthy and, although large in absolute dollars, they may be a tiny fraction of the revenue generated by large-scale technology companies. There are companies that view penalties just as another cost of business upon their services.

The boundaries of the internet complicate things, as well. Data moves across jurisdictions in milliseconds; law and authority end at nation-states. Repeatedly, however, contentions have surfaced regarding the transfer of European data to the U.S., which has put businesses (and users) on hold.

The law is running behind technology. There is a lot of information around of what privacy laws should and shouldn't cover, but with innovation in data analysis, those "de-identified" records can actually be re-identified when combined with other data sets. An algorithm's inferences -- whether it is predicting health, wealth or political views -- are fuzzy areas of law given the algorithms are created, not provided, by the user.

At the same time, large data collection categories cannot be processed by the current rules. Data brokers maintain dossiers that are compiled using publicly available information, app activity and information purchased about individuals, and generally have little direct connection to those whose information they are profiled. Ownership of private data by the government presents more questions as agencies can at times purchase data that otherwise they would require a warrant to access.

Instead, privacy experts want to give privacy dynamics a rewrite, emphasizing data minimisation over individual consent as a way of controlling what companies can collect and do in the first place. Some of the solutions being called for would make some practices illegal, like the sale of data on sensitive locations.

Industry groups say that strict regulations could prevent the innovation needed and put an excessive onus on small businesses. As artificial intelligence grows, the need for training data will grow, probably triggering stronger arguments on the matter.

At present, it's up to people to safeguard themselves, experts say, and few are realistically prepared to do so.

**Laws Protecting Digital Privacies Are Slowly Being Outpaced By The Amount Of Data That Companies Are Collecting From Technology Users**

While legislators around the world have been celebrating the passage of landmark digital privacy legislation, privacy advocates and researchers are warning that those laws cannot keep pace with the way we currently gather and use our data. As a result, there are many areas where the law does not provide adequate protection for users' personally identifiable information (PII).

Recent state and federal laws give consumers the right to review, delete, and restrict companies from using consumer PII. However, most critics of these laws believe that the protections being offered by these laws are more symbolic than actual.

A primary challenge facing all forms of digital privacy regulation is the issue of informed consent. While nearly all forms of online privacy regulation attempt to establish a connection between a company collecting consumer PII and obtaining the consumer's permission to do so, it is well established that most consumers do not actually read or comprehend privacy policies. One widely-cited study found that if one were to spend an average of just five minutes per day reading each and every privacy statement a typical Internet user encounters during the course of a single calendar year, he/she/they would be required to spend approximately two full months of work time solely to accomplish this task. Furthermore, even when consumers are presented with a consent banner, most simply click "yes" in order to continue accessing the service.

Another barrier to enforcing meaningful digital privacy regulation is the fact that regulatory bodies are grossly underfunded compared to the number of entities they regulate. Regulatory investigations into alleged violations of digital privacy law can take multiple years to complete. Even then, fines issued to violators tend to be based upon a percentage of revenue that may not be material enough to impact a major technology firm's bottom line. Additionally, some of the largest technology firms view fines as merely a normal operating expense.

Finally, the international nature of the Internet creates additional obstacles to enacting effective digital privacy regulation. Because data travels internationally at speeds measured in milliseconds, regulatory jurisdiction stops at national boundaries. For example, numerous times disputes regarding the transfer of personal data from Europe to the U.S. have resulted in invalidation of previously negotiated agreements and created uncertainty for both businesses and end-users.

In addition to regulatory challenges, the rapid technological advancements occurring in the area of big data analytics and artificial intelligence are rendering outdated much of the language contained within current digital privacy laws. Current laws generally define "personally identifiable information" (PII) as any information that could reasonably be used to identify an individual. However, recent advancements in big data analytics have allowed companies to create profiles of individuals who had previously been anonymized by linking together various datasets. Moreover, inferences made by algorithms concerning an individual's health, financial status, politics etc., exist in a gray area of law as they represent something derived from a combination of publicly available sources, app usage patterns, credit reports etc. versus data provided directly by an individual.

Additionally, several types of data collection activities are taking place which are beyond the scope of current digital privacy regulations. For instance, data brokerages are compiling comprehensive dossiers containing information on virtually every aspect of an individual's life through a variety of means including; public records searches, app usage data, information purchases etc. without having any direct relationship to the individual(s) being profiled. Similarly, government acquisition of commercially-held data has raised serious concerns as governments are able to purchase information that would normally require a warrant to acquire.

Advocates of digital privacy advocate for a paradigmatic shift in the manner in which digital privacy is regulated away from requiring individuals to provide explicit consent prior to data collection towards limiting the type and quantity of data collected by companies prior to collection (data minimization). Advocates also propose banning certain types of data-related activities entirely (e.g. sale of sensitive location data).

On the other hand, industry representatives argue that overly restrictive data collection limitations will hinder future innovations in technology and disproportionately harm small businesses due to compliance costs associated with implementing complex regulatory requirements. This battle is expected to escalate as AI continues to drive ever-increasing demands for high volumes of quality training data.

Currently, experts agree that until legislative bodies create and implement better digital privacy laws, individuals will bear the responsibility for protecting their own digital information -- a burden that few possess sufficient knowledge or resources to assume.