[Ccpa] It seems that this digital dividend thing is happening in other states

[Ernesto Falcon]

I asked a colleague in Oregon who is on the front line on this terrible 
bill that is essentially a digital dividend argument if I could share 
their summary with this group and they ok'd it, so take a look below. 
EFF is working to help them spike it down and keep it dead, but I think 
we're looking at some sort of national campaign by a well financed group 
and we should inform our colleagues in other states where possible to 
keep an eye out. A lot of details below on their strategy.


I promised you an update on SB 703, which we have been fighting here in 
Oregon. I’m not sure how familiar you are with Hu-manity.co 
<http://Hu-manity.co>, or with other folks that are promoting a “new 
human right” where your data is your “property.” I wasn’t super aware of 
it before this bill came to Oregon, and for the last month or so I’ve 
been diving down deeper and deeper rabbit holes investigating them.

  It’s honestly really disturbing, dystopian stuff. It’s being promoted 
as altruistic, but the people behind it are already mega-rich from 
selling our data, and they are now finding a new way to disrupt the 
market so they can make even more. The really short explanation is that 
these folks want to convince us that our privacy is already lost, so we 
may as well get paid and give them a cut. And somehow the payment will 
make it totally fine that they are encouraging us to give up even more 
data. We should feel OK though, because they will make sure our data is 
secure through the use of blockchain technology. Just trust them…

  My current concern is that they are incredibly aggressive. I 
understand they have even reached out to members of our congressional 
delegation about doing something similar at the national level. Despite 
our crushing them at the Senate Judiciary hearing last week, they are 
still working the bill incredibly hard here in Oregon, reaching out to 
organizations like Planned Parenthood, SEIU, and everyone under the sun, 
trying to get people to sign on in support of the bill.

  They are also incredibly smooth talkers, and good at confusing people. 
It is amazing how many people they fooled into thinking that they have 
altruistic motives. It’s honestly hard to think of a more circular 
conversation, filled with gobbledygook and side-steps, than the 
conversations I’ve had with a co-founder of this company. He’s kind of 
amazing, and not in a great way. He also told us (myself and Chad Marlow 
at our national) multiple outright lies. Yes, I’m pretty worked up about 
it all.

  Here’s a bit more of a run-down of the bill, which you can find (along 
with testimony and such) at this link 
<https://olis.leg.state.or.us/liz/2019R1/Measures/Overview/SB703>:

  * HIPPA currently allows the sale of de-identified data for research
    purposes. It prohibits sale of personally identifiable data without
    authorization.
      o Under the current scheme, large-scale data brokers sell
        de-identified data for research in a multi-billion dollar market.
      o Note that the founder of Hu-manity.co <http://Hu-manity.co> got
        rich working for one of those brokers (Iqvia).
      o Note that one of the main purchasers of data from those brokers
        is Pfizer, who has an advisor to Hu-manity.co
        <http://Hu-manity.co>’s board of directors listed on their website.
  * This bill would prohibit the sale of de-identified data for research
    without authorization.
      o This part of the bill is well-intentioned, but also could
        seriously hinder research, and so a longer conversation about it
        is needed.
  * The bill would also explicitly allow individuals to receive
    compensation when authorization is given for sale of both
    de-identified and identifiable health info.
      o This would create a legal framework for Hu-manity.co
        <http://Hu-manity.co> to insert itself (as yet another data
        broker) into the current market where de-identified data is sold.
      o Once that happens, Hu-manity.co <http://Hu-manity.co> would be
        in an ideal position to act as a broker for the sale of
        identifiable data, because they will have set themselves up as
        the broker in the de-identified data marketplace and will have
        direct contact with all of the consumers they’ve corralled
        through that process.
      o The business model is dependent on people actually giving up
        more information than they currently do.
      o Hu-manity.co <http://Hu-manity.co> thinks this is fine, because
        people will get paid and Hu-manity.co <http://Hu-manity.co> will
        get a cut.
      o *We are convinced that their interest is not actually in
        preserving privacy. It is instead (a) getting a cut of the
        market of the sale of data, and (b) incentivizing people to sell
        even more data so they can get that cut.*
  * *They aren’t going to stop here. Their next plan is financial data,
    geolocation data, and more.*
      o As mentioned in one of the articles below, their founder has
        admitted to envisioning a world where people give up even more
        of their privacy for cash.
      o This is already popping up in another context in California,
        being promoted as a “digital dividend.”

Here are some relevant articles:

  * Article on NPR:
    https://www.npr.org/sections/health-shots/2018/10/15/657493767/if-your-medical-information-becomes-a-moneymaker-could-you-could-get-a-cut

      o Quote: “Pharmaceutical companies could potentially pay each user
        $10 a month for access to their data, Etwaru says.*The drug
        companies would also pay Hu-manity.co <http://Hu-manity.co> for
        access to these preferences.* Hu-manity.co <http://Hu-manity.co>
        is framing its for-profit business as a fight for a new human
        right.”

  * TechCrunch article:
    https://techcrunch.com/2018/07/18/hu-manity-wants-to-create-a-health-data-marketplace-with-help-from-blockchain/

      o This one gets really explicit about the fact that they want to
        make money by encouraging people to sell identifiable data. So
        rather than just de-identified data being sold, they want people
        to attach their names to the data, so they can get a cut, and as
        a result *MORE data (in quantity and type) will get sold*. This
        is actually about encouraging people to give up more information
        than is actually being sold on the market right now.

  * Medium article:
    https://medium.com/neodotlife/hu-manity-richie-etwaru-data-as-property-7986077d4d4b

      o “[The founder of Hu-manity.co <http://Hu-manity.co>] seems to be
        sincere. Like a growing number of people in tech, he predicts
        that in the near future, machines and artificial intelligence
        will do most of our work for us, and many jobs will disappear.
        All those jobless people will still need money. Selling personal
        data could be an important source of income, he suggests.”
      o “…Etwaru thinks this is a step toward a more enlightened future.
        Health records are merely the test case for Hu-manity.co
        <http://Hu-manity.co>: *Afterward comes financial data, then the
        geolocation data that your cell phone and car collect on you.*
        Eventually, the whole data universe. If anything about your
        activity has value, he says, it should be your birthright, yours
        to sell.”

-- 
Ernesto Omar Falcon
Legislative Counsel
Electronic Frontier Foundation
Office: 415 436 9333 ext. 182
Cell: 202 716 0770

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.eff.org/pipermail/ccpa/attachments/20190302/5de1e26a/attachment-0001.html>