Data Portability vs Transfer - Owning your data is a right
Dennis has a great Still Born post regarding Dataportability.org, he notes via information from Thomas, that the European Data Protection Act makes such data transfer between third parties legally dubious. The point here is that we would all like to be able to move ‘Our’ data between services, however in doing so through such third parties such as Facebook or Google (facilitated by datapotability.org standards) one could inadvertantly be treading on other individual’s Data Protection concerns.Ben Metcalfe comments on Mike Butcher’s post
'Hmmmm does depend on where your business is located though.
If you are an EU registered company, or have a EU subsidery then juristiction could apply.
However, and frankly, a US originated company with no local office in EU doesn’t to comply with any EU rules.
Also, it does depend on what is considered ‘personal’. Unique ID’s that represet a friend, and friend meta data may not constitute personal data. There’s a court case in here to be had.
More long term, there’s also some debate to be had on whether person-to-person tranfer of data, facilitated by a 3rd party could be relaxed, etc.
I don’t think EU law is a blocker to all this myself.'
Here transfer by individuals (say their personal desktop/phone address books) between themselves and colleagues could still be on a sticky wicket in my opinion as individuals are often businesses themselves or at least acting on behalf of them.
However the concept of data portability (as opposed to data transfer) does still hold water, the problem here is the third party and the third party tactic. I personally think that all such data should be the possession of the owner (or subject in these examples), access to parts of this information should be provided by the subject to the third party or other individual according to the subjects own rules. Note this is access not transfer, no right is given on duplication of the information. Here is a concrete example to explain what I mean:
As an individual I can open an AWS (Amazon web service account) as can any other individual or legitimate third party. I could them create a FOAF page that describes myself and personal information, it could also describe my colleagues anonymously (as ids/uris/references) that point to their own FOAF files/pages. They can grant me access to the information, as I can to them using the AWS access controls. If this was more granular using say other RDF pages of which FOAF is a subset I could control and share my personal information to my hearts content. What is more, as long as no third party actually stored copies of the information they were given access to, they would be operating within the the Data Protection Act.
In fact if this took place a whole ecosystem could grow up around tools for social networking etc..
P.S. This isn’t a post about promoting FOAF or RDF, I use these standards merely as examples, in reality the data could be any agreed standard.
I am sure this idea could work, and would be preferable to storing your information with a third party social network.
*Update - The data should also include a license, including modification/duplication/usage sections similar to GPL that spell out the exact usage/derivation terms of the data. These terms should support the basic premise behind data protection and privacy goals.
*Update 2 Prime has been around for a couple of years and they seem to have tackled a lot of this at the ontology and technology level, their work combined with OpenId/Auth and the licensing above could easily provide the basis of a solution (Thanks to Thomas for the heads up on Prime).
*Update 3 here is a good preso on Prime at W3
Re: Data Portability vs Transfer - Owning your data is a right
thanks for dropping by.
I think portability standards are a good idea. But I think they should be architected with privacy principles in mind. I'd suggest that folks read Kim Cameron from Microsoft on Identity, because that is what this is all about. I've just applied to join the group, so perhaps I can add some input,
But it really needs the best minds in the world on this stuff though, as it is damn messy. There is very little black and white, it is complex shades of grey.
My original post was very high level, there is a lot more to this, as I mentioned on the techcrunch UK post from Mike.
Facebook is subject to EU privacy law, as it processes data originating in the UK. Facebook is well aware of these obligations, hence its membership of the Safe Harbour.
Re: Data Portability vs Transfer - Owning your data is a right
'I think portability standards are a good idea. But I think they should be architected with privacy principles in mind. I'd suggest that folks read Kim Cameron from Microsoft on Identity, because that is what this is all about. I've just applied to join the group, so perhaps I can add some input..'
Agreed, although when I had comments and send email regarding Infocards and Microsofts Federated identity schemes to Kim I never received an answer so didn't follow it up. But basically it's the same principle I am playing on here, but without having to buy into a particular vendors scheme. In most cases the standards are out there. For example Amazon could take OpenId and use AWS to provide OpenId identity provision with teh features I mention. Indeed anyone could do such a thing. I use Amazon in the example because they already have the infrastructure. they have also done their Data Protection Homework which is why they operate a seperate European facility to comply with European data legislation. This was the result of feedback around AWS from developers like ourselves and our clients/collaborators that were looking at using AWS.
'But it really needs the best minds in the world on this stuff though, as it is damn messy. There is very little black and white, it is complex shades of grey. '
Yup I think some are there and more are waking up to the cause, I just wish operators like Google/Facebook ect.. would think a bit more openly about these things.
'My original post was very high level, there is a lot more to this, as I mentioned on the techcrunch UK post from Mike.'
I read this and others, it not like this hasn't come up before either, luckily now however more people are paying attention to it thanks to yours and others efforts.
'Facebook is subject to EU privacy law, as it processes data originating in the UK. Facebook is well aware of these obligations, hence its membership of the Safe Harbour.'
I love the basic driving ideas behind this, it's a good way to think about the issue.
regards
Al
Re: Data Portability vs Transfer - Owning your data is a right
Now that doesn't mean I agree entirely on their mechanisms or implementations shown by Prime, rather I think any development in this area (particularly in Europe) should build on the work they have already accomplished.
Personally think the combination of OpenId, OAuth, Primes work and a data agnostic service like AWS could actually provide a solution., but it would probably need a personal privacy license/s in order to insure compliance.
I am quite sure that a service bound to a non data agnostic (facebook, Google, Microsoft etc..) service provider or vendor is likely to fail, both on trust and privacy, The contract has to be person (the subject) centric not vendor centric.