Prevent Mass Surveillance by Prohibiting Data Sales

Citizens of the United States should be able to exercise control over their own data: their conversations they have on social media sites and through online communications, the data collected by software on their phones and vehicles, their address, phone number, among other things. A reasonable person should expect to have their data remain private unless and until they choose to disclose it to the parties they choose.

Currently, your internet service provider, cell phone provider, and massive advertising conglomerates sell your data (what you purchase, how often, where you go, what kind of car you have, what websites you visit) for pennies on the dollar. This presents several issues.

1.) Most importantly, the ability for private entities to collect this data means that this corporate surveillance can easily be handed over to any number of benign entities or malicious actors, with no recourse. Anyone who wished to steal social security numbers en masse merely has to wait until a significant breach occurs (as in the case of Fidelity in the past 48 hours).

2.) This ability for virtually any service provider you interact with to sell your data is effectively a workaround for the 4th amendment. If you have no expectation of privacy in the purchases you make, in your communications and documents and the travel you engage in, surveillance by corporate or government actors is not just enabled, but inevitable.

Policy Proposal:

  • For consumer products (including software, vehicles, telecommunications services, insurance policies, etc), require that companies explicitly do not share consumer data.

  • Affirm that purchase records, transactions and the communications related to those actions or generated by regular use of a service have 4th amendment protections, and shall not be passively gathered, aggregated or stored for the purpose of selling to third parties.

  • In the event of a database breach, if consumer data is stolen that was accrued by purchasing large datasets, require the entity that was breached to pay damages to the consumers affected.

3 Likes