It’s been a few days since the questionably named Protect America Act expired and we haven’t been killed yet. No reason we should be the same wire tapping continues unabated, but now they have to go to the FISA court which never learned the word no. But it is at least has the appearance of oversight. The court could, it if felt the need, actually require some indication of wrong doing. It probably already requires something other than a fishing expedition, thus it’s too much of a hardship to the current administration.

One of the reasons the Protect America Act expired was because congress couldn’t decide whether to give phone companies blanket immunity for its past misdeeds in giving slews of data to the government, which the government was not authorized to ask for. It’s unclear whether they broke any laws but it seem clear they had a huge failure of moral judgment. I would argue that phone companies have at least a moral if not legal obligation to act as my agents to protect my data. I suspect in a few years most people will believe this but at present it’s just wacko techies who think about the implications of other entities holding your data.

Running it through from a very basic level if an entity (used here mostly as company and/or organization) asks for and you give them your information or even if they collect this data in their normal role as service provider, it seems rational that they have incurred a basic obligation to take reasonable precautions to protect that data. At the very least you expect them to secure their systems such that the Russian mob isn’t simply using their servers as data feeds.

Most people have the expectations that an entity that they have given data will attempt to protect it. In a sense they have become our agents. In accepting our information part of the expectation is the idea that they will act on our behalf to protect it. It’s a subtle point that I don’t pretend exists in law yet, but it is how the relationship is viewed by most people if they thing about it. Part of the unspoken contract between your favorite online vendor and yourself is this idea that your data won’t escape into the wild.

I’m not so naive as to think that vendor isn’t selling my data to various third parties in one form or another. As much as I wish it weren’t true, I understand that the use of my data in the entities interests is part of the deal. For that matter I encourage the use of my data in aggregate. But we have certain expectation of who the vendor is selling our data to and for what purposes.

For example I had a retailer (rpgnow.com) sell my email address to a spammer, this violates the understanding I had with them about the acceptable use of my data. As a result I no longer do business with them.

We have already begun to see along the fringes, retailers who are competing on issues of privacy. I suspect this will become more central as the years move on. We will have companies competing on their skill at being good agents for protecting our data.

Which leads us back to the Protect America Act. These companies who collect our data for the purpose of saving money, anticipating demand, allocating capital resources and other competitive advantages, have also incurred the responsibility of acting as our agents. The government isn’t coming to me with a warrant, National Security Letter or other ‘instrument’ so I can’t verify that the ‘I’s are dotted and the ‘T’s are crossed. That falls to my agents.

Those companies now want to given immunity for falling to be good agents. The government wants to send the message that companies should ignore the law and just do whatever the people from Washington in suits tell them to. Don’t worry Washington will take care of any fallout. They want these companies to act as agents of Washington rather than agents of their customers.

We can not let this happen, we need these people to have in interest in making sure they give Washington all the data required by law, but not a bit more. They must remain motivated to make sure that everyone is operating within the constraints of the law and with proper oversight. They are acting as my agents in this regard and they have a moral obligation to protect my rights in this regard.

One day the law will reflect that.