Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

USA needs law 'a lot like GDPR' says Salesforce CEO Marc Benioff

theregister.co.uk

Post reply on HN
Print view View original

211–220 of 231 posts

Re: USA needs law 'a lot like GDPR' says Salesforce CEO Marc Benioff

#211

Post by hannasanarion »

methodover wrote: post #204
hannasanarion wrote: post #187

Earlier quoted context omitted.

If you actually read up on the "right to be forgotten" you will see that "free speech" is always an exception to it. You cannot demand to be forgotten in order to censure others.

The American interpretation of “free speech” is much more broad than in the EU. Here, laws banning hate speech or flag burning or corporate campaign donations are unconstitutional for example. Libel lawsuits are much harder to pull off here as well. A law requiring businesses and individuals to delete any personal data at the request of the data subject, as the GDPR requires, would have to be extremely narrowly writt…

GDPR doesn't require that you do that. GDPR has other exceptions that you could plead very easily: undue hardship, archival, public interest, compliance with other laws, scientific research, and establishing legal claims. What would you need my name for if not one of those?

Re: USA needs law 'a lot like GDPR' says Salesforce CEO Marc Benioff

#212

Post by mnm1 »

dnomad wrote: post #69
wyldfire wrote: post #3

A consumer protection law like GDPR would probably be a good thing for US, but it's hard not to see this as SFDC saying, "As a multibillion-dollar SaaS vendor, we welcome regulation that might slow down or prevent a competitor from unseating us."

What you don't realize is that the lawlessness around user data hurts big corporations too. If you're a big corporation collecting significant data than you've taken on a significant liability but the nature of this liability is amorphous. How much will it cost you if your data gets hacked? What will be the impact if you share the data with a partner and the partner gets hacked? How much can you share in your api? Wh…

Or, in the US, you can just make your customers sign arbitration agreements and deal with it on a case by case basis without incurring any significant penalties. See Equifax, Yahoo, Apple, and pretty much every data breach ever. If those companies didn't have arbitration agreements, it's only because they are behind the curve on this trend of doing an end run around the judicial system. Sorry, I fail to see how this hurts big businesses in any of the ways you list.

Re: USA needs law 'a lot like GDPR' says Salesforce CEO Marc Benioff

#213

Post by aoeusnth1 »

wooter wrote: post #87

as an american, no thank you. compelled speech is not okay

Is the HIPAA[1]'s privacy rule compelled speech? Do you believe corporations have a right to unlimited surveillance derived from their right to free speech?

[1] See https://en.wikipedia.org/wiki/Health_Insurance_Portability_a...

"The Privacy Rule gives individuals the right to request a covered entity to correct any inaccurate PHI."

"The Privacy Rule requires covered entities to notify individuals of uses of their PHI. Covered entities must also keep track of disclosures of PHI and document privacy policies and procedures."

Re: USA needs law 'a lot like GDPR' says Salesforce CEO Marc Benioff

#214

Post by DanBC »

SamReidHughes wrote: post #167
DanBC wrote: post #119

Earlier quoted context omitted.

GDPR can't do that either.

It does do that.

No. Here's the full text of the right to erasure. Pay attention to all the reasons given for why processors can ignore the request to erase data.

https://gdpr-info.eu/art-17-gdpr/

But then look at para 3.

> Paragraphs 1 and 2 shall not apply to the extent that processing is necessary:

> for exercising the right of freedom of expression and information;

Re: USA needs law 'a lot like GDPR' says Salesforce CEO Marc Benioff

#215

Post by DanBC »

methodover wrote: post #204
hannasanarion wrote: post #187

Earlier quoted context omitted.

If you actually read up on the "right to be forgotten" you will see that "free speech" is always an exception to it. You cannot demand to be forgotten in order to censure others.

The American interpretation of “free speech” is much more broad than in the EU. Here, laws banning hate speech or flag burning or corporate campaign donations are unconstitutional for example. Libel lawsuits are much harder to pull off here as well. A law requiring businesses and individuals to delete any personal data at the request of the data subject, as the GDPR requires, would have to be extremely narrowly writt…

> If I do business with you and write down your name, the GDPR requires that I delete your name if you ask me to (and even if you don’t if our relationship ends).

No, it really really doesn't.

https://gdpr-info.eu/art-17-gdpr/

> The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

> the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

> the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing;

> the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2);

> the personal data have been unlawfully processed;

> the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;

> the personal data have been collected in relation to the offer of information society services referred to in Article 8(1).

Re: USA needs law 'a lot like GDPR' says Salesforce CEO Marc Benioff

#216

Post by DanBC »

bmelton wrote: post #79
dbasedweeb wrote: post #53

Earlier quoted context omitted.

Please if you can, give one example of a European government jailing someone for a thought crime. To save us both time and aggravation please keep the actual definition of “thought crime” in mind, and don’t conflate it with something people actually did .

France convicted 12 pro-Palestine activists for wearing "Boycott Israel" T-shirts. Azhar Ahmed, a British Muslim, was charged with treason, and ordered to pay a fine and complete community service because of a Facebook post he made wishing "All soldiers should DIE & go to HELL" Herve Eon was convicted in France for insulting former French President Nicolas Sarkozy by holding a sign that said “get lost, jerk” And, des…

> Azhar Ahmed, a British Muslim, was charged with treason, and ordered to pay a fine and complete community service because of a Facebook post he made wishing "All soldiers should DIE & go to HELL"

https://www.judiciary.gov.uk/wp-content/uploads/JCO/Document...

Re: USA needs law 'a lot like GDPR' says Salesforce CEO Marc Benioff

#217

Post by ThomPete »

realusername wrote: post #175
ThomPete wrote: post #165

Earlier quoted context omitted.

The law could simply punish those who do harm. All you are getting now is further boltering for those you end up being gamed to sign up for. I understand the pupose and intent of the law but it could have been done much more elegantly. Those who want to missuse your data will still do that they will just find another way to do it.

> The law could simply punish those who do harm That's exactly what the GDPR is doing I feel, you get punished for data misuse, it looks a good idea to reduce this kind of abuse. > All you are getting now is further boltering for those you end up being gamed to sign up for. I did not get gamed to sign up, they just scrapped my data and added me to their database, I did not do any action and they did not made me sign…

No, it also requires companies to make a lot of bureaucratic exercises. If it only punished for misuse and didn't put the bureaucratic burden on companies I would have no problem with that. It's that it makes it burdensome for a lot of companies who are aren't actually misusing your data. This is my main argument and GDRP is only the beginning now EPR is going to be implemented making it even harder to make it work in a digital economy.

Re: USA needs law 'a lot like GDPR' says Salesforce CEO Marc Benioff

#218

Post by ThomPete »

hannasanarion wrote: post #186
ThomPete wrote: post #12

For big companies, this is a small problem to implement. For small companies, it's a big problem. I am all for protecting the consumer but GDPR is going too far with what I would call optics rather than actual consumer protection. I.e. things that look and sounds like they are protecting the user when they are really just adding more bureaucracy to the companies.

How is it a big problem? What about GDPR is so hard to implement? Is it really that difficult to not collect data on people that you don't need?

It's not that simple.

When a company collects data often times it's not to misuse it but to improve the experience for the user.

Again I have no problem with people being fined for misusing data I just don't see how this is going to hinder that it will, however, make it way more burdensome for companies to do anything innovative because they are suddenly liable. On the other side users who then end up actually agreeing one giving away data suddenly ends up much weaker because they gave consent. So it's just going to make things way more muddy IMO.

Re: USA needs law 'a lot like GDPR' says Salesforce CEO Marc Benioff

#219

Post by SamReidHughes »

hannasanarion wrote: post #195
SamReidHughes wrote: post #191

Earlier quoted context omitted.

Who decides newsworthy? Their subscriber list is newsworthy if they deem it so.

First, the company decides whether the request needs to be complied with or not, and if the user doesn't like that decision, they can complain to the regulators who may choose whether the refusal is worth looking into.

Regulators.

Re: USA needs law 'a lot like GDPR' says Salesforce CEO Marc Benioff

#220

Post by methodover »

hannasanarion wrote: post #211
methodover wrote: post #204

Earlier quoted context omitted.

The American interpretation of “free speech” is much more broad than in the EU. Here, laws banning hate speech or flag burning or corporate campaign donations are unconstitutional for example. Libel lawsuits are much harder to pull off here as well. A law requiring businesses and individuals to delete any personal data at the request of the data subject, as the GDPR requires, would have to be extremely narrowly writt…

GDPR doesn't require that you do that. GDPR has other exceptions that you could plead very easily: undue hardship, archival, public interest, compliance with other laws, scientific research, and establishing legal claims. What would you need my name for if not one of those?

Maybe I want to remember your name because, let's say, I want to pray for all my customers every Sunday. Or perhaps I want to try and memorize all my customer's names so I can use your name when I see you come in my shop. Or perhaps to track patterns of purchases by my customers. Or perhaps because I think it's important to have a track record of everyone I've sold to, and when, for purposes to be discovered later down the line that I can't think of right now.

In America, I don't need a reason for writing your name down. In the EU on the other hand, all personal data needs to be deleted, unless a specific government-approved exemption applies, as you said.

Quoting the US Supreme Court, in Chicago v. Mosley, 1972:

> Above all else, the First Amendment means that government has no power to restrict expression because of its message, its ideas, its subject matter, or its content. To permit the continued building of our politics and culture, and to assure self-fulfillment for each individual, our people are guaranteed the right to express any thought, free from government censorship [1]

I'm pretty sure that if the GDPR was copied and pasted into a US law, the Right to be Forgotten would be struck down as unconstitutional very quickly.

1. https://supreme.justia.com/cases/federal/us/408/92/case.html

Post reply on HN