Here is a question for the MemeStreams community.. If you were proposing legislation for laws governing how venues can collect and user information from IDs, what would you propose?

[ this is obviously a growing concern, especially if we start migrating to smart card based id's in the future. i'm glad the wired article brought that up, because it's likely to have a place in our wallets soon enough. The major security concerns of these systems has been debated in the smartcard space for years (Schnier has a lucid intro to the vulnerabilities on his web site), and they're nontrivial to resolve. Legislation will help, but only insofar as laws can mandate system criteria and transparency which enable the kinds of security and privacy we, as consumers, want to have. i think the smart cards are going to have to integrate a means for card holder verification of the data transaction... for instance, the bartender swipes, and an LCD on the card indicates that their system requested your age, gender, address, & phone number, so you deny the request, or enable only the age & gender to be transmitted... the card only transmits after you enter a pin (or biometric id if we're already dreaming) validating the transaction. thus, the terminal can't get more than you allow it to. Legislation could be used to enforce the kinds of data various requestors have a right to require (i.e. the law establishes that a bar has no explicit right to know anything other than your age, and can't deny you for failing to provide other information). That may be legally troublesome... i'm no lawyer, but we already say that places can't refuse you on the basis of color or gender, so maybe not such a great leap. smartcards have other issues in situations where the cardholder can't be trusted with the data inside, but we resolve a lot of those kinds of issues already with credit cards, and i see no fundamental reason why they can't be worked out in SC's, plus they're ancillary to this particular discussion. -k]

Wired News: Great Taste, Less Privacy