[Shelved] Advancing Individual Privacy Act

[Tinhampton]

This is a much shorter (and hopefully less confusing) redraft of last year's ill-fated FoI Simplification Act.

Even after the FoIA Reform Act's passage last month, what is now Section 7.4, Clause 25 of the Legal Code continues to require that no player's "name, IP address, physical address or location, phone number, place of employment or education, appearance, social media accounts[,] health status, both mental and physical; financial status; personal tragedies; changes in personal status such as marriage, divorce, pregnancy, birth, or death; and other similar information" be disclosed in an FoI request.

I support the principle that such private information should not be disclosed through FoI. However, I still do not see the point in keeping these examples in law - which effectively rule out the nonconsensual disclosure of all substantiative or non-trivial IRL information about any player via FoI - when a blanket ban on such nonconsensual disclosure of personal information would both be shorter and much more clear-cut.

~~~~~~~~~~

Advancing Individual Privacy Act

Section 7.4, Clause 25, of the Legal Code shall be amended as follows:

25. For the purposes of this section, classified information is that which fits any of the below definitions:

• Real-life information about a current or former NationStates player which that player has not explicitly consented to making public.
• Information that, upon being made public, would jeopardize any ongoing military or intelligence operations; or jeopardize the security of units and agents participating in them, or be harmful to the diplomatic interests, military interests, or security of The North Pacific.
• Information that, upon being made public, would jeopardize Security Council operations in response to threats and attempted coups.

Spoiler: Markup

25. For the purposes of this section, classified information is that which fits any of the below definitions:

• Real-life information about any NationStates player from which there is a risk of inferring that player's real-life identity and which has not willingly been disclosed to the public, including, but not limited to, an individual's name, IP address, physical address or location, phone number, place of employment or education, appearance, social media accounts, and other knowledge about a player, unless the player in question provides explicit consent for this information not to be considered private.
• Real life information about any NationStates player for which there exists a reasonable real life expectation of privacy or discretion, including, but not limited to, health status, both mental and physical; financial status; personal tragedies; changes in personal status such as marriage, divorce, pregnancy, birth, or death; and other similar information, unless the player in question provides explicit consent for this information not to be considered private.
• Real-life information about a current or former NationStates player which that player has not explicitly consented to making public.
• Information that, upon being made public, would jeopardize any ongoing military or intelligence operations; or jeopardize the security of units and agents participating in them, or be harmful to the diplomatic interests, military interests, or security of The North Pacific.
• Information that, upon being made public, would jeopardize Security Council operations in response to threats and attempted coups.

 

[bootsie]

""Any real-life information about any NationStates player, whether or not currently playing NationStates, which that player has not explicitly consented to making public."

This sounds awkward when reading it out, I don't know if it's just my interpretation or not.

Perhaps it would be better as:

""Any real-life information about a current or former NationStates player that they have not explicitly consented to making public."

 

[Pallaith]

This basically boils down to eliminating specific examples, since the law is actually the same with or without them. Typically people use specific examples in law to make the lines very clear and to assist with enforcement if they feel there’s a danger in enforcement being sloppy or done improperly. Essentially, taking extra care to protect that which they want protected. Maybe someone can find wiggle room with the phrase “real life info” either by claiming something isn’t or by claiming something is that normally wouldn’t be restricted. Having done this process though, I can say that great care is taken to err on the side of caution, so ultimately you just have to decide the examples are good form or not.

 

[Tinhampton]

I'd note that the definitions in the FoI act that I wish to strike out and replace already refer to A. "Real-life information about any NationStates player from which there is a risk of inferring that player's real-life identity and which has not willingly been disclosed to the public" and B. "Real life information about any NationStates player for which there exists a reasonable real life expectation of privacy or discretion."

Is there any reason why my proposed broader definition of "Any real-life information about any NationStates player" (of any nature) would be more problematic in comparison?

 

[Pallaith]

I'd note that the definitions in the FoI act that I wish to strike out and replace already refer to A. "Real-life information about any NationStates player from which there is a risk of inferring that player's real-life identity and which has not willingly been disclosed to the public" and B. "Real life information about any NationStates player for which there exists a reasonable real life expectation of privacy or discretion."

Is there any reason why my proposed broader definition of "Any real-life information about any NationStates player" (of any nature) would be more problematic in comparison?

I can’t think of any. This seems, as I said, to be entirely a preference thing. People either prefer to be specific with that list or they prefer the simpler language. I can’t see a problem either way, since they mean pretty much the same thing.

 

[Kronos]

I like the phrasing Bootsie suggested. I would take away the "any" beginning the provision so it would read as:

"Real-life information about a current or former NationStates player that they have not explicitly consented to making public."

The "any" beginning the provision feels like its getting a free ride without providing anything extra. Without the "any" there the scope of the provision remains the same, where reading "Real-life information" is interpreted to mean all real-life information unless the law were to say otherwise.

Though similar to what Pallaith has already mentioned, whether the "any" at the beginning is there or not it doesn't change the scope of the new phrasing because they mean the same thing. Taking out the "any" is simply my preference.

 

[Lord Dominator]

I agree roughly with what Pallaith is saying, I don’t see a need to remove the specific examples (considering they’re a “including but not limited to” idea) in favor of the short and very general idea of the proposal.

 

[Tinhampton]

This is still being drafted. I have adopted Kronos' proposed wording, with some aesthetic changes. (The old wording was preserved by Bootsie.)

----------

The section of the FoI Act I propose to amend (hereinafter "Clause 25") already prohibits the disclosure of real life information about a player through FoI request, where disclosure would:
1. pose "a risk of inferring that player's real-life identity" (if it "has not willingly been disclosed to the public"), or
2. violate that player's "reasonable real life expectation of privacy or discretion,"
3. "unless the player in question provides explicit consent for this information not to be considered private."

Clause 25's standards, in conjunction with the examples (which I omit here), already prohibit the nonconsensual disclosure of most RL info about players; what is left is generally insignificant or not known to the FoI handlers. These handlers, however, must still make fairly subjective judgment calls about whether any given piece of information would introduce a "risk" of doxxing or fall short of a "reasonable... expectation of privacy."

My proposed Clause 25 would prohibit the publication of "real-life information about a current or former NationStates player which that player has not explicitly consented to making public." I believe that this is a simpler, clearer and fact-based standard which requires much less elaboration: either a piece of information is a piece of "real life information about a... player" or it is not. (Likewise, either "that player has not explicitly consented to" publicising it or they have - although this standard is generally present in the current Clause 25 too.)

 

[Simone]

Sorry are we talking about IRL or in character here?

 

[Zyvetskistaahn]

I would be minded to vote against this proposal.

I don’t really see the harm done by including the example lists. They are all pretty obvious things that I would hope would be on people’s minds when considering disclosure but if they aren’t then the lists seem like a healthy reminder to me. If there is something substantial that isn’t addressed then I would support it being added but I don’t think I would support removing the lists.

As to the change in wording, I would agree with Pallaith that I don’t think it is likely to make much of a difference and that this is something approached cautiously in my experience. That said, I do wonder if the new wording could encourage some overzealous redaction (or complaints about a lack thereof) if some relatively trivial but still real life information we’re at issue. An example I am thinking of which comes up a lot in NationStates is time zones, the fact that two players aren’t in the same time zone (even if neither time zone is identified) is real life information but it doesn’t really reveal anything meaningful. I think it would be somewhat unfortunate if it was felt that a fine tooth comb had to be taken to all records to redact information like that (or more trivial). Disclosure, particularly for the executive, is regarded as a pretty intensive responsibility already and I wouldn’t want to discourage it when the current standard appears to be working and applied with appropriate rigour.