Speaker 1: Brought to you by the reinvented two thousand twelve camera.
Speaker 1: It's ready. Are you didn't touch? With technology? With tech
Speaker 1: Stuff from how stuff works dot com. Hello, everyone, welcome
Speaker 1: to tech Stuff. My name is Chris Polette and I
Speaker 1: am an editor at how stuff works dot com. Sitting
Speaker 1: across from me as as usual as senior writer Jonathan Strickland.
Speaker 1: It was a pleasure to burn And that was a
Speaker 1: short quote. Yes, short and to the point. Today we're
Speaker 1: going to talk about the Consumer Privacy Bill of Rights. Yes. Um,
Speaker 1: A lot of people probably don't know that that we're
Speaker 1: even that there is even is such a thing or
Speaker 1: such a thing being proposed, I should say, um, but
Speaker 1: we have talked about privacy many times on the podcast. Um,
Speaker 1: something that a lot of people are willing to give up,
Speaker 1: at least in part um, thanks to all the cool
Speaker 1: stuff that you can get on the Internet if you're
Speaker 1: willing to give people your personal information. And really, in
Speaker 1: some cases it's not even that you get cool stuff,
Speaker 1: it's just that there's been an avenue created where you
Speaker 1: can share personal information, and that's what people have done.
Speaker 1: You know, It's it's it's kind of crazy. It's a
Speaker 1: sort of stuff where the thing the kind of information
Speaker 1: that you wouldn't think to share in, say, necessarily a letter,
Speaker 1: Which is interesting because the letter, there's there's some privacy
Speaker 1: guarantees to things that are that passed through the United
Speaker 1: States Postal Service that you do not get the same
Speaker 1: guarantee necessarily when you publish it online. And of course
Speaker 1: online allows for in many cases a much wider variety
Speaker 1: of people to get a chance to get their papers
Speaker 1: on that information. That that's true, and it's also a
Speaker 1: good point, I think to point out that, uh, the
Speaker 1: Consumer Privacy Bill of Rights is something that is being
Speaker 1: suggested here in the United States, and not every um,
Speaker 1: not every country in the world has the same guarantees
Speaker 1: on postal service privacy, and some some countries already have
Speaker 1: legislation in place that does address privacy concerns as far
Speaker 1: as the internet's concerned. So this is kind of a
Speaker 1: it's sort of codifying behaviors and best practices that a
Speaker 1: lot of people I think have assumed we're in place already.
Speaker 1: But in this case, it's saying, let's write this down,
Speaker 1: get in black and white, uh, potentially put it into
Speaker 1: law and then make it an enforceable list of guidelines
Speaker 1: so that companies that handle private information are doing so
Speaker 1: in a responsible manner and a transparent manner, as it
Speaker 1: turns out, right, right, Well, we've talked about many of
Speaker 1: the companies involved in this uh in this first round
Speaker 1: of privacy negotiations with the United States government. Um and
Speaker 1: we've we've also handled a lot of these issues before.
Speaker 1: We've talked about things like um uh cookies and other
Speaker 1: information that is recorded about you when you visit places
Speaker 1: on the internet or websites, I should say, um and
Speaker 1: and basically the idea of being that uh, you know,
Speaker 1: as we are moving farther into the twenty first century,
Speaker 1: it is becoming more commonplace for us to share stuff
Speaker 1: about us, and people are are tracking us in ways
Speaker 1: that um that we're sort of you know, impossible really
Speaker 1: without the the use of the internet. Yeah, and and
Speaker 1: a lot of people are unaware of that tracking, even
Speaker 1: though in many cases the terms for that sort of
Speaker 1: tracking are laid out in uh somewhere yeah. Right, there's
Speaker 1: like usually a spot somewhere on a website or service
Speaker 1: where you can learn how the information you give to
Speaker 1: that cider service is used and whether or not it's
Speaker 1: shared with other entities, and uh, there's there's almost always
Speaker 1: some sort of terms of service that spell this out,
Speaker 1: although very few of us take the time to either
Speaker 1: find or read that, even if it's presented right in
Speaker 1: front of us. I mean, I know, I've been guilty
Speaker 1: of scrolling all all the way down so I can
Speaker 1: check I have read this and I agree yes, when
Speaker 1: really it just means I have scrolled down and found
Speaker 1: the checkbox. Well it Uh, it's one of those things
Speaker 1: that a lot of us have done, especially when we've
Speaker 1: received an invitation to a hot new social network or
Speaker 1: something like that, where we've we've there's been some hype
Speaker 1: builds up at the beginning. Um, and then you get
Speaker 1: your and then you get your address and it says,
Speaker 1: you know, hey, Jonathan, please go ahead sign up for
Speaker 1: an account. You're in the beta, And you go on
Speaker 1: and you fill it out as fast as you can.
Speaker 1: You get the privacy agreement, You scroll down to the bottom,
Speaker 1: you click the agree, but and then the pop up
Speaker 1: comes up are you sure you agree? And click and
Speaker 1: you just scream, let me get to the print these yeah, yep,
Speaker 1: and they can uh, you know, you think about it,
Speaker 1: they can put the absolutely, they don't even have to
Speaker 1: bother to lie to you because they know that you know,
Speaker 1: you're gonna go ahead and click. Okay, they know they say,
Speaker 1: we're going to share this stuff about you. You're okay
Speaker 1: with that, right? All right? Then they the people aren't
Speaker 1: going to read it, and the one person of the
Speaker 1: people who do read it are gonna agree anyway because
Speaker 1: they don't want to be left out. Well, you might
Speaker 1: get there, you go, you always have like that one
Speaker 1: guy who's who's screaming out you don't want to do this,
Speaker 1: and and that one guy might be right. You know,
Speaker 1: it doesn't We're not saying that one guy is a
Speaker 1: crazy person standing out screaming out that we're all you
Speaker 1: know sheep, but that one guy may very well have
Speaker 1: a point. And the whole reason why this has come
Speaker 1: around is because there's more scrutiny now on companies, particularly
Speaker 1: big internet companies that have been collecting private information, and
Speaker 1: some of that scrutinious because we've had some pretty public
Speaker 1: uh security breaches like information, you know, personal information being
Speaker 1: breached by hackers and then distributed, so things like you know,
Speaker 1: personal information with addresses, maybe even credit card information that
Speaker 1: kind of stuff has shocked people. So that's this is
Speaker 1: partially in response to that, but it's also in response
Speaker 1: to trends like search engines keeping track of your search
Speaker 1: history and then using that information to market it to advertisers,
Speaker 1: so that these advertisers can target people who are who
Speaker 1: have have certain behaviors because they they'll say, oh, this
Speaker 1: person tends to search for these sort of topics. That
Speaker 1: means that they're probably interested in these sort of products
Speaker 1: or services. Therefore, if we serve up ads to that
Speaker 1: person that advertise those kind of products and services, they're
Speaker 1: more likely to go ahead and buy them. And so
Speaker 1: it's a whole idea of the more information you have
Speaker 1: about your target are the audience, the more effective you
Speaker 1: can be when you are advertising to them. Uh. We've
Speaker 1: also seen this used. There's been scrutiny from some fairly
Speaker 1: recent stories. Did you see the story about how target
Speaker 1: UH was able to identify Yes, okay, so there's a story.
Speaker 1: We'll we'll give some background here. Okay, it's it's it's
Speaker 1: a story that definitely has some controversy around it. All right, So, uh,
Speaker 1: target had created a very effective system to identify customers. UH,
Speaker 1: and and kind of get an idea of what that customers.
Speaker 1: So life status was based upon their shopping habits right right. Um, specifically,
Speaker 1: they were looking for people who were about to have
Speaker 1: a baby. Yes, And one of the reasons why this
Speaker 1: was the case you might say, well, you know, why
Speaker 1: not people who are getting ready by an h D
Speaker 1: t V. Well, as it turns out, the people who
Speaker 1: are about to have kids are um people uh tend
Speaker 1: to get in habits, and so they buy the same
Speaker 1: brands of laundry detergent and clothing and things like that
Speaker 1: for years and years and years. So what advertisers want
Speaker 1: to do is they want to find ways to get
Speaker 1: you to switch brands over to their thing. But as
Speaker 1: it turns out, this time when people are about to
Speaker 1: have kids is a prime time for people to switch
Speaker 1: because um, things are changing drastically in their life. They
Speaker 1: start considering it's not just someone who needs a crib
Speaker 1: and someone who needs a high chair, and someone who
Speaker 1: needs uh you know, uh diapers and things like that
Speaker 1: baby supplies. It's it's for everything and you have, you know,
Speaker 1: you have another life that you have to consider. And
Speaker 1: this is this is the needs of a baby are
Speaker 1: different than the needs of an adult, and so you're
Speaker 1: you start looking at things like, all right, well, is
Speaker 1: this detergent going to be too is this is this
Speaker 1: is not going to be good for my baby? Should
Speaker 1: I Should I go with something that's going to be
Speaker 1: more gentle or you know, they're lot of different considerations,
Speaker 1: and Targets got well, gigs and gigs and gigs of
Speaker 1: data about customer behaviors, and so there's a huge amount
Speaker 1: of market research that has sort of indicated what behaviors
Speaker 1: are suggests that a person is going to have a
Speaker 1: baby that when you start seeing these changes, that's a
Speaker 1: very good indicator that that person is planning on the
Speaker 1: fact that they're going to have a child. So, in
Speaker 1: this case, Targets sent some electronic coupons to a to
Speaker 1: a young lady, a teenager, who who had exhibited some
Speaker 1: of these new behaviors, right, and the new behavior has
Speaker 1: triggered at the algorithm that says, hey, this person is
Speaker 1: expecting expecting, and they're going to go ahead and automatically
Speaker 1: send this stuff out right. And the problem here was
Speaker 1: that this young lady had not divulged the information about
Speaker 1: her her status to her father, and her father's saw
Speaker 1: the coupons from Target and sent a very angry email
Speaker 1: to a Target manager and said, uh, you know, why
Speaker 1: are you saying this about my daughter? How dare you?
Speaker 1: This is you know, insensitive? Um are you trying to
Speaker 1: encourage her to have a baby? She's far too young?
Speaker 1: And then the manager was trying to find a way
Speaker 1: to respond to this angry father when later on another
Speaker 1: email came in from the father who said, I had
Speaker 1: a discussion with my daughter. It turns out there were
Speaker 1: some things going on I didn't know about. Uh, this
Speaker 1: was not the way I would have liked to have
Speaker 1: found out, but I was in the wrong. But this
Speaker 1: really brought a lot of attention towards the practice of
Speaker 1: using customer information to react proactively, which in some cases
Speaker 1: you would think that's that's kind of cool, you know,
Speaker 1: It's it's a little creepy in a way that that
Speaker 1: the retailer knows that kind of information about you just
Speaker 1: based upon your your habits. But then you realize you
Speaker 1: are giving the retailer information by the way you shop,
Speaker 1: that just just by the way you shop. It's not
Speaker 1: even your name or your address or any of that.
Speaker 1: As long as they have some sort of customer identifier
Speaker 1: number that is attached to you, even if they don't
Speaker 1: know your name, if it's just, if it's just this
Speaker 1: number designates this particular shopper, and this particular shopper has
Speaker 1: behaved in this way, then they can start to draw
Speaker 1: conclusions about what's going on in your life. Now, there's
Speaker 1: a leap here really that has to be made, uh
Speaker 1: for for Target or really any of these other retailers,
Speaker 1: because they're far from alone and do it. Then when
Speaker 1: when we're using this, we're simply using Target as an example,
Speaker 1: it's not that they are unique in this at all. Yeah,
Speaker 1: they are one of many, many retailers who do this, UM,
Speaker 1: But there's there's a leap that needs to be made here.
Speaker 1: Now Target is not collecting or or any of these
Speaker 1: companies in general. We'll just say a retailer not necessarily
Speaker 1: collecting this stuff. To identify Jonathan Strickland as being somebody
Speaker 1: who particularly likes a specific brand of coffee, they want
Speaker 1: to know that number, you know, whatever his customer number
Speaker 1: is at the retailer likes these products, he's more inclined
Speaker 1: to buy this than that UM, and they want to
Speaker 1: give him a positive experience. So they are trying to
Speaker 1: tailor the the customer experience as much as they can. Um.
Speaker 1: When I go to example Target, UM, when the little
Speaker 1: coupon prints out, when I, uh, you know, swipe my
Speaker 1: card and we get our our stuff that we get there, UM,
Speaker 1: the coupon printer will print out something a coupon for
Speaker 1: something that I've bought, and not necessarily on this shopping trip.
Speaker 1: They've gotten very good at um printing out stuff that
Speaker 1: it's specific to what I buy with them. And so
Speaker 1: it's not that it's not that they're trying to breach
Speaker 1: somebody's privacy. The leap here is that it could be
Speaker 1: used to find out information about Jonathan Strickland or Chris
Speaker 1: poll At personally. Yes, UM, so yeah, it's it's it's
Speaker 1: it's a delicate matter on how you handle that personal information.
Speaker 1: Whether that means that you know, you don't want to
Speaker 1: make your customers feel like they are being spied upon,
Speaker 1: that that is a bad outcome, and then also you
Speaker 1: want to make sure that whatever the information you have
Speaker 1: is secure and and preferably in most cases not connected
Speaker 1: to an individual by name or other personal identification, so
Speaker 1: that there might be an a customer profile on you,
Speaker 1: but that profile does not directly link to your identity. Well,
Speaker 1: think about companies like Netflix or Amazon dot Com that
Speaker 1: make recommendations based on things that you've bought before or
Speaker 1: or consumed before and in the case of Netflix, something
Speaker 1: you've watched um and they make recommendations. That's something that
Speaker 1: we tend to value about those services. It makes it
Speaker 1: them collecting that information makes it more enjoyable. Yeah, they're
Speaker 1: curating their their collections for us so that it's less
Speaker 1: work for us. And then it's it's the joy of
Speaker 1: discovery seems so much more palpable because you don't have
Speaker 1: to go through, you know, a five thousand movie titles
Speaker 1: before you find one that actually sounds interesting to you.
Speaker 1: So let's get back over to the actual privacy Bill
Speaker 1: of Rights. Now, the idea of of legislating our rights
Speaker 1: to privacy isn't new in the United States. It kind
Speaker 1: of began in the late nineteenth century. So the eighteen
Speaker 1: nineties is about when we really started to, uh, look
Speaker 1: at ways of protecting privacy through US law. Apart from
Speaker 1: the guarantees that are in the Constitution that state you know,
Speaker 1: your your guarantee against unlawful search and seizure when it
Speaker 1: could be an entire episode all on its own, and
Speaker 1: in fact, I think we have talked about that on
Speaker 1: its own. But anyway, Uh, it's that's not a new idea,
Speaker 1: but the idea of trying to create this this uh
Speaker 1: privacy set of guidelines for the online world is new
Speaker 1: because it's it's a different kind of exchange of information
Speaker 1: than we've had in the past. And so the actual
Speaker 1: documents of the Consumer Privacy Bill of Rights, they're their
Speaker 1: online so you can go and read them yourselves if
Speaker 1: you want to. The it's quite detailed. Yeah, there's it's
Speaker 1: the actual Bill of Rights themselves. That that that's probably
Speaker 1: about I think it's fourteen pages of text just for
Speaker 1: the Bill of Rights. And then there's a lot more about, um,
Speaker 1: how will that be enforced or how could it be enforced?
Speaker 1: Because this is not this is not being enacted into
Speaker 1: United States law yet. That's something that's being discussed. It's
Speaker 1: a proposal, and this is a proposal coming from President
Speaker 1: Obama's administration. It's not even it's not coming out of Congress.
Speaker 1: So this would have to go into Congress to be
Speaker 1: debated and tweaked and destroyed, and then rebuilt and then
Speaker 1: either passed or not passed, and then go to the
Speaker 1: President who would then either signed it into law or not.
Speaker 1: So here's some of the the the language from the
Speaker 1: bill itself and the the introduction. There's like an introduce
Speaker 1: there's like a foreword and introduction and executive summary every
Speaker 1: single section of this. By the way, when you read
Speaker 1: that first paragraph, feels like the opening paragraph to a
Speaker 1: college student's term paper. So it's like you're having to
Speaker 1: read five different openings of a term paper before you
Speaker 1: get to the content. But I'm gonna I'll read a
Speaker 1: little bit here. This is This kind of explains the
Speaker 1: reason why the administration felt like this was necessary. Citizens
Speaker 1: who feel protected from misuse of their personal information feel
Speaker 1: free to gauge in commerce, to participate in political process,
Speaker 1: or to seek needed healthcare. This is why we have
Speaker 1: laws that protect financial privacy and health privacy, and that
Speaker 1: protect consumers against unfair and deceptive uses of their information.
Speaker 1: This is why the Supreme Court has protected anonymous political speech,
Speaker 1: the same right exercise by the pamphleteers of the early
Speaker 1: Republican today's bloggers. So this was sort of there. There.
Speaker 1: The argument by the administration saying that privacy is a
Speaker 1: very important component in life. It's something that we need
Speaker 1: in order to feel that we can securely pursue very
Speaker 1: important matters in our lives without without the fear of
Speaker 1: that information falling into the wrong hands, are being misused
Speaker 1: in any way, or or being used to lie to us.
Speaker 1: You know, once people find out more about us, they
Speaker 1: start to learn what we're vulnerable to, and further on
Speaker 1: it goes. These rights give consumers clear guidance on what
Speaker 1: they should expect from those who handle their personal information
Speaker 1: and set x aspectations for companies that use personal data.
Speaker 1: I call him these companies to begin immediately working with
Speaker 1: privacy advocates, consumer protection enforcement agencies, and others to implement
Speaker 1: these principles in enforceable codes of conduct. My administration will
Speaker 1: work to advance these principles and work with Congress to
Speaker 1: put them into law. With this Consumer Privacy Bill of Rights,
Speaker 1: we offer the world a dynamic model of how to
Speaker 1: offer strong privacy protection and enable ongoing innovation in new
Speaker 1: information technologies. One thing should be clear. Even though we
Speaker 1: live in a world in which we share personal information
Speaker 1: more freely than in the past, we must reject the
Speaker 1: conclusion that privacy is an outmoded value. It has been
Speaker 1: at the heart of our democracy from its inception, and
Speaker 1: we need it now more than ever. I think that's
Speaker 1: a shot across the bowl of a certain social networking founder.
Speaker 1: Do you know who I'm talking about? Does he have
Speaker 1: curly hair and really disagrees with a pair of twin Yes?
Speaker 1: And he also he so can explain the excitement of
Speaker 1: a logarithmic scale in great detail at a press conference. Yes,
Speaker 1: we're talking about Mark Zuckerberg, who who infamously at this
Speaker 1: point a couple of years ago, said that he felt
Speaker 1: that he thought he thought that privacy was dying out
Speaker 1: as a social norm. Now, what he meant by that
Speaker 1: was that the average person no longer really seemed to
Speaker 1: feel that privacy was that important, or rather, they didn't
Speaker 1: feel inhibited in any way from sharing information that perhaps
Speaker 1: a generation ago people would never have pushed out to
Speaker 1: the public. So it's not exactly a direct contradiction, because
Speaker 1: what Zuckerberg was saying was that we just don't feel
Speaker 1: as as uh, we don't feel the need to keep
Speaker 1: stuff back as much as we used to. It's not
Speaker 1: that we should ignore privacy concerns. More, it was more
Speaker 1: that we just don't see it as being as important
Speaker 1: as we used to. Uh. Meanwhile, people have proven that
Speaker 1: Zuckerberg feels very differently about his own personal privacy because
Speaker 1: they've breached it multiple times and he has not found
Speaker 1: it very amusing. And again I don't think that was
Speaker 1: his point. I don't think his point was that we
Speaker 1: shouldn't worry about privacy. It was more that people in
Speaker 1: general just don't seem to find it as important. Well,
Speaker 1: it's one of those situations too, I think where it
Speaker 1: sort of ended up as a SoundBite type of thing.
Speaker 1: He said it in the public, in a public forum,
Speaker 1: and and uh, it's you know, hey, it's a quote.
Speaker 1: It's a direct quote, so well, not exactly what you
Speaker 1: just said, but just to clarify in case somebody writes
Speaker 1: in sure, but yeah, he did say those things, and
Speaker 1: people said, hey, you know, Mark says privacy is dead,
Speaker 1: and which was definitely an oversimplification of what he was saying.
Speaker 1: But but also, you know, it's when you're speaking off
Speaker 1: the cuff, it's also really easy to give a sound
Speaker 1: bite that doesn't entirely absolute what you're thinking exactly. We've
Speaker 1: We've had that same situation here many many times. So
Speaker 1: let's get into the actual Bill of rights. I guess yeah,
Speaker 1: I figure it's probably UM, although it's kind of thick
Speaker 1: in places. We should probably get into the specific provisions.
Speaker 1: There are seven I believe that are are UM where
Speaker 1: they're trying to to work with people to make this happen. Yeah,
Speaker 1: they're there. The the language refers to them as PHIPS,
Speaker 1: f I, P P S PHIPS because they are fair
Speaker 1: Information Practice Principles or philps. Yeah. I I actually skimmed
Speaker 1: ahead and was reading and I started seeing references to PHIPS,
Speaker 1: and it was before I saw what the breakout was
Speaker 1: for the acronym. And I had many enjoyable moments trying
Speaker 1: to come up with what PHIPS could stand for. None
Speaker 1: of them, none of them were right, by the way, anyway.
Speaker 1: That's that's that's tangential. Well. One of the first is uh,
Speaker 1: the individual control of your personal information. Basically, they're saying
Speaker 1: that you you should be the one in charge of
Speaker 1: whether or not you give this information away and what
Speaker 1: happens to it. So essentially, what this is saying is
Speaker 1: that whenever you are signing up for any sort of service,
Speaker 1: or or a site or whatever that when they the
Speaker 1: company or organization asks for your information, you have the
Speaker 1: right to either give the information or not give the information.
Speaker 1: And furthermore, you can actually uh dictate how that information
Speaker 1: will be used. So in other words, um, you know,
Speaker 1: if you give the information to the company, if you
Speaker 1: choose to do it, uh, you should still be able
Speaker 1: to say, hey, you know, I want I'm giving this
Speaker 1: information to you, but I'm doing it so that you
Speaker 1: can do this set of things and nothing beyond that
Speaker 1: set of things. So that's interesting. I'm wondering how how
Speaker 1: well that will be enforced. Uh. And a lot of these,
Speaker 1: by the way, we're going to go through them all,
Speaker 1: but a lot of these are going to kind of
Speaker 1: overlap each other or complement each other, so there will
Speaker 1: be some some similarities throughout these these these uh rights,
Speaker 1: these fips. Yes, yes, Now the second is transparency. So
Speaker 1: so what they're saying is the company should tell you
Speaker 1: upfront or during the entire time that you have an
Speaker 1: account with them that exactly how your information is going
Speaker 1: to be used. Um and and for what means? They
Speaker 1: also privacy and security? Yes, yes, they also the security
Speaker 1: was what I was going to address. They also have
Speaker 1: to let you know how your data is going to
Speaker 1: be protected, because yeah, it's Again that's one of the
Speaker 1: reasons why this this this legislation or proposed guidelines. I
Speaker 1: guess I shouldn't say legislation proposed guidelines. It's why they were.
Speaker 1: Part of the reason why they exist is because people
Speaker 1: when they are signing over information to a company, a
Speaker 1: lot of us just kind of a him that it's
Speaker 1: sort of sitting in a database somewhere, but that's it,
Speaker 1: like it's not doing anything else and it's completely secure.
Speaker 1: That's not always the case. I mean, you want to
Speaker 1: know if if your information is can be encrypted, is
Speaker 1: it being saved in plain text? Plain text, by the way,
Speaker 1: is what we call a bad thing. Um, encrypted is better? Uh,
Speaker 1: And when it's being used between companies, like if we're
Speaker 1: talking about information that ultimately is going to be used
Speaker 1: in order to get advertisers to send you information or
Speaker 1: to post ads on the site that you're visiting all
Speaker 1: the time, you want to make sure that, however they
Speaker 1: are conveying your information to the advertiser, that it's secure. Yes,
Speaker 1: and they need to make sure that that is easily
Speaker 1: understood and easily available to to check out. So that's
Speaker 1: the whole transparency issue. Then there's respect for context, and
Speaker 1: this is one of those that sort of sounds a
Speaker 1: little bit like in an overlap because what they're saying is, um,
Speaker 1: let's say you've agreed to their the company's terms. Um,
Speaker 1: the company should respect that you've agreed to those terms. So, um,
Speaker 1: you've agreed to let your information be shared with select advertisers,
Speaker 1: but they shouldn't go out and give it to and
Speaker 1: sell your name to random mailing lists because within you've
Speaker 1: had the context of I'm signing up for this, within
Speaker 1: these boundaries, and they're saying you can't take it past that.
Speaker 1: That's very good. And then the next is security, which
Speaker 1: of course I've just chatted about. But this way that
Speaker 1: you know, the transparency is letting you know how and
Speaker 1: and uh, your data is being protected. This is actually
Speaker 1: saying protect the data. Yeah, because it says that consumers
Speaker 1: have a right to secure and responsible handling of personal data.
Speaker 1: So this is this is actually putting it on those
Speaker 1: sites and services to make sure that the information you
Speaker 1: give them is protected reasonably from a sort of intrusion
Speaker 1: or it could be anything from a hacker hacking their
Speaker 1: way into the servers, to someone walking into the company
Speaker 1: and physically taking a machine out of the company because
Speaker 1: that has happened. You know, we we often think when
Speaker 1: we're thinking about stealing information, we often think about the
Speaker 1: whole Hollywood style where the cute, nerdy chick is sitting
Speaker 1: down at a at a laptop and after about uh,
Speaker 1: you know, I don't know, thirty seconds of typing on
Speaker 1: a keyboard and then you just you know, you see
Speaker 1: like the little progress bar filling up and as the
Speaker 1: USB drive is is getting all the information. Meanwhile the
Speaker 1: security guys are closing in. Will she get away? Well,
Speaker 1: I'm watching, um yeah, where hels their team? You know,
Speaker 1: Chloe Man. Anyway, So the other way you could do
Speaker 1: it is you could have like a big guy named
Speaker 1: Al just walks into the building, picks up a computer
Speaker 1: and leaves, and then just all the information on the
Speaker 1: computer is right there by the way. It does not
Speaker 1: he does not have to be called out, nor does
Speaker 1: he have to be a big guy. I'm here from
Speaker 1: the computer cleaners. Okay, it's right over there. Yeah exactly. Yeah.
Speaker 1: That's social engineering, and that happens way more frequently than
Speaker 1: the whole. Let's breach this thing by you know, brute
Speaker 1: forcing the password. Social engineering is much more effective if
Speaker 1: you can walk up and talk to somebody and convince
Speaker 1: them that you are the person who needs to do
Speaker 1: this one particular thing. It's amazing how frequently that works.
Speaker 1: What happened to number seventeen? Oh it's the cleaners. What
Speaker 1: do you mean, the cleaners that had all our customer
Speaker 1: dad on it? What one? Access and accuracy five? And basically,
Speaker 1: people have a right to be able to get to
Speaker 1: their personal data and make changes to it if they
Speaker 1: need to make sure it's correct. Um, so, things like
Speaker 1: if you have changed your address, or if you've changed
Speaker 1: an important status in your life. You've gotten married, or
Speaker 1: maybe you've got divorced, or maybe you've had kids or
Speaker 1: you know, it's complicated. Yeah, yeah, it's it's the Facebook.
Speaker 1: It's complicated, but it's where you want to be able
Speaker 1: to go in there and make those changes so that
Speaker 1: the information is still accurate. And um yeah, I mean
Speaker 1: that just makes sense. And I think most companies tend
Speaker 1: to do that, I mean, because they want to have
Speaker 1: the most accurate information about you. It doesn't do them
Speaker 1: any good if the information they have about you is
Speaker 1: on a date, you know, that's not the reason they
Speaker 1: don't care. Ultimately, I think most of these companies don't
Speaker 1: really care about your personal information on a on a
Speaker 1: personal level at all. It's not like they're trying to
Speaker 1: spy on you to figure out what you are doing
Speaker 1: in any you know, for any nefarious purposes. Uh. It's
Speaker 1: all about profit really when it comes down to it,
Speaker 1: or some in some cases, it's about trying to tailor
Speaker 1: the experience so that it is the most meaningful to you,
Speaker 1: which is feels a little more altruistic, but ultimately it
Speaker 1: does come down to dollars and cents and not so
Speaker 1: much of we're watching you sorry stuff they don't want
Speaker 1: you to know shout out. And then there's um one
Speaker 1: of my favorites, focused collection, which is basically saying we're
Speaker 1: not going to collect or the company is not allowed
Speaker 1: to collect anything else other than the stuff it needs
Speaker 1: to do its job. Yeah. So in other words, if
Speaker 1: you sign up for a coupon site, let's say a
Speaker 1: coupon service, Yeah, that's going to deliver coupons that are
Speaker 1: of interest to you, uh and are applicable to you
Speaker 1: in your region. So we're talking about something like group on, right, Okay,
Speaker 1: something like group on where you sign up, and part
Speaker 1: of group on is that you tell it where you live,
Speaker 1: because you know, it doesn't want to send you coupons
Speaker 1: for a place that's a thousand miles away. It doesn't
Speaker 1: do you any good. And you tell group on what
Speaker 1: you're interested in, so that way it's sending you relevant coupons.
Speaker 1: Because if you are really interested in outdoor adventures, but
Speaker 1: you don't have a whole lot of interest in pottery,
Speaker 1: then you don't want to keep getting you know, invites
Speaker 1: to go take another pottery class. You know that's just
Speaker 1: not that's not what you care about. Well, then that
Speaker 1: information makes perfect sense for a group on to pull
Speaker 1: from you. You know, your address or your zip code
Speaker 1: or whatever, your the region you are in, and what
Speaker 1: you're interested in, but other things might not matter so
Speaker 1: much like it would, it wouldn't matter for the service
Speaker 1: the group on is providing to you. So things like
Speaker 1: the names of all your relatives, your social Security number,
Speaker 1: your birth date, your driver's license number, this kind of
Speaker 1: information is not relevant to the service Groupon is providing,
Speaker 1: and therefore, according to this bill of rights, group on
Speaker 1: should not ask you for it, nor should you feel
Speaker 1: compelled to share it, because why would they need that
Speaker 1: to do what they do. You're you're never gonna let
Speaker 1: me live down that pottery skydiving class, are you? You know? Uh?
Speaker 1: He tells me that it was always supposed to be
Speaker 1: an ash tray, but I am absolutely certain that originally
Speaker 1: that wasn't going to be an urn Like, oh, let's
Speaker 1: move on. So one of the things that they're talking
Speaker 1: about embracing is something that UH that has been around
Speaker 1: for a while now, the do not Track technology, which
Speaker 1: is really less of a technology and more of an
Speaker 1: agreement UM. In a way, it's sort of like a
Speaker 1: gentleman's agreement between an advertiser and UH and the the
Speaker 1: customer UM, and the technology behind it is browser based,
Speaker 1: so UH UM Firefox, the most recent versions of Firefox
Speaker 1: have do not Track in there, and Mozilla baked it
Speaker 1: in there so that you could say, hey, i'm It's
Speaker 1: basically a little information that goes along with a query
Speaker 1: first site that says I don't want to be tracked,
Speaker 1: and you you go to visit, you know, my wonderful
Speaker 1: sandwich dot com, and you know, if my wonderful sandwich
Speaker 1: dot com decides that now that lunch is over, they
Speaker 1: want to know what else, what other kinds of foods
Speaker 1: you like? Um, you know they don't have to participate
Speaker 1: in the agreement at all, but you've already told them
Speaker 1: that you don't want to. Now, if they're behaving responsibly,
Speaker 1: they might say all right, no, no, we know, we
Speaker 1: know you're just looking for lunch, No big deal. Um.
Speaker 1: But now they're they're trying to uh, they're trying to
Speaker 1: get more people to embrace that. And I know that
Speaker 1: Google has said it will add that to Chrome um
Speaker 1: as well. So you know this this may end up
Speaker 1: being part of the technology that helps support this this legislation,
Speaker 1: and it becomes legislation. And this falls into what is
Speaker 1: the final FIP, which is accountability. Yes, and accountability is
Speaker 1: all about the fact that the wording in the actual
Speaker 1: document is that consumers have a right to have personal
Speaker 1: data handled by companies with appropriate measures in place to
Speaker 1: assure they adhere to the Consumer Privacy Bill of Rights.
Speaker 1: And that's that's what we're talking about here, is that
Speaker 1: you know, you have a right to uh, to be
Speaker 1: able to use a browser that's not going to necessarily
Speaker 1: collect all that information without you knowing it, or not
Speaker 1: even a browser. But like search engines. You know, again
Speaker 1: we're talking about Google here, mainly other search engines too,
Speaker 1: But you know, if you're using Google and you're searching
Speaker 1: for stuff all day long like some of us, you know,
Speaker 1: I do it all day long. That's my job is
Speaker 1: you know, search information and pull it together and write articles. Um.
Speaker 1: Then you know, you'd like to have a little more
Speaker 1: control over that so that you don't have all these
Speaker 1: different potential companies and organizations having access to your personal
Speaker 1: information and making decisions about you over which you have
Speaker 1: no control. So it's nice to have that kind of
Speaker 1: power as an individual. And but fairly recently there have
Speaker 1: been some reports about how companies like Google have signed
Speaker 1: on with this, saying that this is this is a
Speaker 1: great idea, and you might think this this these guidelines
Speaker 1: sound like they could potentially, you know, put a dent
Speaker 1: in some business here. Well, there are a couple of
Speaker 1: reasons why or a couple of reasons why Google and
Speaker 1: other companies like Google might be behind the guidelines that
Speaker 1: aren't exactly like, yes, we also believe in privacy, uh
Speaker 1: not to say that that motivation isn't there. It may
Speaker 1: very well be, but there are other alternative reasons why
Speaker 1: they might be behind this, and one of those is that, well,
Speaker 1: it's a good PR move to say customer privacy is
Speaker 1: one of our main concerns as well, and we want
Speaker 1: to make sure that we're doing the right thing, so
Speaker 1: that's a good PR move. Another is this isn't legislation.
Speaker 1: It's not baked into law, so there's no real danger
Speaker 1: in saying sure, as opposed to opposing it, because there
Speaker 1: was actual legislation in California for a state, uh, legislation
Speaker 1: that would kind of approach the same sort of subject
Speaker 1: matter as these this this bill of rights, and companies
Speaker 1: like Google were very much non in favor of it.
Speaker 1: So when it when it moved to the actual legislation phase,
Speaker 1: there was a lot more opposition. Now right here where
Speaker 1: it's not where it's a great idea, but it's not
Speaker 1: really enforceable, not from a legal standpoint. It could be
Speaker 1: enforceable if companies took it upon themselves to enforce it
Speaker 1: on their own practices, but there's no teeth behind it
Speaker 1: right now. Uh, there's nothing dangerous about saying, sure, let's
Speaker 1: do it, So there's that as well. And you know, again,
Speaker 1: I don't want to I don't want to say that
Speaker 1: any company has a particular motivation. I'll just say that
Speaker 1: the behaviors when it was in California legislation debate and
Speaker 1: the behaviors when it's in a proposal that doesn't have
Speaker 1: any legal backing to it are different. That's what I'm saying. Yeah,
Speaker 1: So we were talking a little bit about about how
Speaker 1: things will be enforced, and the Federal Trade Commission would
Speaker 1: be the department of the United States government that would
Speaker 1: be responsible for making sure that UH companies behave themselves
Speaker 1: and and follow the guidelines set forth and this um
Speaker 1: uh in this document and UH, well you know, I
Speaker 1: don't know how much they'd be able to do that.
Speaker 1: That's the problem. See, at this point, this document is
Speaker 1: not as as Jonathan pointed out, it's not legislation. It's
Speaker 1: not a proposed legislation. It's really more of a set
Speaker 1: of guidelines. So what the legislation would be would be
Speaker 1: actually more about how it would be enforced, and it
Speaker 1: would it would set forth those uh instructions on how
Speaker 1: they would move going forward. And keep in mind that
Speaker 1: if this were to enter uh, legislation like if it
Speaker 1: was if it would if it enters that as, then
Speaker 1: the changes that would be made to the language would
Speaker 1: possibly be quite drastic, and it could be that the
Speaker 1: outcome is completely different than what this proposal is. So
Speaker 1: that's it's pretty much a guarantee, even not completely different,
Speaker 1: but significantly different. Yeah. Yeah, well I think uh, I
Speaker 1: think the idea behind it is sound. There are are
Speaker 1: several of the UM agencies that have been UM outspoken
Speaker 1: in rights, including the Electronic Frontier Foundation. UH, they're all
Speaker 1: about that, yes, and they basically said, hey, we like
Speaker 1: the idea behind it, were interested to see what's going
Speaker 1: to happen. So UM, it will be interesting to see
Speaker 1: how it goes forward and how whether or not it
Speaker 1: inspires others and UH and other places to create similar
Speaker 1: legislation and maybe curtail some of this or or you know,
Speaker 1: give people a good idea of how their information is
Speaker 1: being used. And honestly, I think that is probably the biggest,
Speaker 1: UM most useful thing that would come out of that too,
Speaker 1: because people really want to use these services UM and companies,
Speaker 1: you know, everybody's sort of an agreement, but it would
Speaker 1: be nice to know how information is being stored and
Speaker 1: exactly what's being collected and then not that excess information
Speaker 1: is not being used um and and retained if it
Speaker 1: it doesn't need to be there in the first place.
Speaker 1: At least that's my opinion. I agree entirely. All well,
Speaker 1: and uh yeah, it'll be you know, we'll have to
Speaker 1: see how this turns out. I mean, the whole argument
Speaker 1: about privacy and what people should be uh, what's reasonable
Speaker 1: for us to expect us consumers, how much of that
Speaker 1: responsibility falls on us versus the the entities that are
Speaker 1: gathering our information. That debate is going to go on
Speaker 1: for a while, probably forever. It'll it'll switch back and
Speaker 1: forth quite a bit. But it's just to remember that
Speaker 1: when you go and you sign up for these things,
Speaker 1: whether it's a social networking site or an even an
Speaker 1: app that you might put on a smartphone, keep in
Speaker 1: mind that a lot of these companies, you know, they're
Speaker 1: they're making some serious cash off your personal information. Personal
Speaker 1: information is the digital currency, right and so uh, you know,
Speaker 1: just do a little thinking about that, some critical thinking
Speaker 1: about how your information is going to be used. And
Speaker 1: really it comes down to, right now, are you okay
Speaker 1: with that? And if you are okay with that, if
Speaker 1: you if you trust the source and you feel that
Speaker 1: your information is in capable hands and you don't mind
Speaker 1: it being used for advertising purposes or whatever, then you're fine.
Speaker 1: If you feel that it's not the right thing for you,
Speaker 1: then you might want to, you know, give a second
Speaker 1: thought to actually joining that side or or engaging that service.
Speaker 1: It's a tough you know, it's a of choice to
Speaker 1: make sometimes because sometimes we just want something so badly
Speaker 1: that we're willing to uh to cut some corners that
Speaker 1: could potentially come back to haunt us and uh, you know,
Speaker 1: and then there are cases where we have no control
Speaker 1: over it whatsoever. Like the Epsilon hack is a good
Speaker 1: example where you know, the consumers who had their information
Speaker 1: stolen in the Epsilon hack weren't dealing with Epsilon directly.
Speaker 1: They were dealing with companies that were customers of Epsilon.
Speaker 1: And so you know that that was one of those
Speaker 1: things that was really tough, a really tough situation because
Speaker 1: if you you might trust the company you're doing business with,
Speaker 1: but you don't necessarily know what companies they're doing business with, right,
Speaker 1: and a lot of people who signed up for that
Speaker 1: didn't realize they were signing up for that because um,
Speaker 1: by and large, the companies that had their information stored
Speaker 1: with Epsilon were retailers, and people had signed up for
Speaker 1: loyalty cards not realizing that, uh or I guess probably
Speaker 1: not thinking about the idea that hey, they're going to
Speaker 1: put this on a computer somewhere and that computer could
Speaker 1: be hacked and my personal information could be taken. Um
Speaker 1: not like signing up for an account on a computer
Speaker 1: where you're saying, I am entering this information into the
Speaker 1: computer myself. Um. So there was a bit of an
Speaker 1: intermediary there where you're going, oh, well, I'm giving I
Speaker 1: filled this out by hand, and I handed it to
Speaker 1: the guy at the service desk, and he gave me
Speaker 1: a card that I'm going to go use and buy
Speaker 1: some groceries. Now. Yeah. Yeah. To the average consumer, it
Speaker 1: probably felt more like using a coupon. Yeah, and then
Speaker 1: put clip a coupon out of a piece of paper
Speaker 1: and you you you use it when you buy something
Speaker 1: you know that's not attached to you at all, and
Speaker 1: it's between you and this real retailer. Well, as it
Speaker 1: turns out, all those retailers are working with this one company,
Speaker 1: yeah that had massive databases and yes, yeah, so it's
Speaker 1: it's a sticky issue and it's gonna be it's just
Speaker 1: gonna get more and more important because again, like the
Speaker 1: whole visibility of of security hacking has increased over the
Speaker 1: last i'd say, like five or ten years, and uh,
Speaker 1: it doesn't look like the hackers are giving up anytime soon. Right.
Speaker 1: So anyway, well, that's our discussion about the Consumer Privacy
Speaker 1: Bill of Rights. Uh it we'll see whether or not
Speaker 1: it's ever put into law, and if it turns out
Speaker 1: to be an effective piece of legislation, all of that's
Speaker 1: still in question. If you guys have any ideas for
Speaker 1: topics that we should cover here on tech Stuff, please
Speaker 1: let us know. You can email us. Our address is
Speaker 1: tech stuff at Discovery dot com, or you can sume
Speaker 1: us a message via Twitter or Facebook or handle. There
Speaker 1: is tech Stuff hs W and Chris and I will
Speaker 1: tell you again really soon. Be sure to check out
Speaker 1: our new video podcast, Stuff from the Future. Join how
Speaker 1: Stuff Work staff as we explore the most promising and
Speaker 1: perplexing possibilities of tomorrow. The house Stuff Works I find
Speaker 1: app has a right download it today on iTunes, brought
Speaker 1: to you by the reinvented two thousand twelve camera. It's ready,
Speaker 1: are you