Prison time, hefty fines for data privacy violations: draft U.S. Senate bill

Post by tptacek » Sun, Nov 04, 2018, 8:13 PM UTC

throwawayou812 wrote: post #207

tptacek wrote: post #205

Earlier quoted context omitted.

This proposal doesn't require companies to do formal internal compliance reviews. It's not SOX or GLBA. For most startups, the legal overhead here would probably amount to a few phone calls with a lawyer. My read is that it's less onerous than the California privacy statute that already covers a huge fraction of tech startups. We do both security and privacy engineering work for our clients, most of whom are encumber…

That's just not accurate. You should read pages 26-33 in detail. It wants external auditors to come in, and while consultation with a lawyer isn't required , companies would offensively have to use them to review everything they do, lest they be found non-compliant. That could easily range into hundreds of hours of legal work.

Post by CamelCaseName » Sun, Nov 04, 2018, 8:14 PM UTC

setr wrote: post #169

r00fus wrote: post #153

Earlier quoted context omitted.

Contracting it out still seems to bypass the regulation

Tbh thats still a better outcome than the status quo isn’t it: a single hack is now limited in damage, and multiple are required to do the equivalent of todays scenarios

Post by throwawayou812 » Sun, Nov 04, 2018, 8:19 PM UTC

tptacek wrote: post #211

throwawayou812 wrote: post #207

Earlier quoted context omitted.

That's just not accurate. You should read pages 26-33 in detail. It wants external auditors to come in, and while consultation with a lawyer isn't required , companies would offensively have to use them to review everything they do, lest they be found non-compliant. That could easily range into hundreds of hours of legal work.

I believe I'm one of the "auditors or independent technical experts" this bill refers to (trust me, we don't need Wyden's help getting work), and for the most part the only time we talk to client legal is when we're negotiating our contract. Note also the "if reasonably possible" attached to getting external assessment.

Post by adventured » Sun, Nov 04, 2018, 8:28 PM UTC

codegeek wrote: post #119

I read this and immediately thought "oh shit, yet another regulation for a small bootstrapped software business where we try to be honest while the big guys will still find a way to circumvent it". Thankfully, I looked into the fine print and was wrong. This bill is only for Corporations that do over $50,000,000 in revenues or higher OR (EDITED from AND) have info on at least 1,000,000 or more customers. Of course, I…

Post by throwawayou812 » Sun, Nov 04, 2018, 8:30 PM UTC

tptacek wrote: post #218

throwawayou812 wrote: post #215

Earlier quoted context omitted.

You're referring to that specific provision, but again you aren't considering the fact that any business interested in complying will have to have an attorney review the law, and then review all aspects of their business, software implementation, and policies/procedures in order to ensure they are compliant. That's not a requirement of the law, but how else can they ensure that they are compliant?

At this point, we've scaled back the argument from "this bill would kill startups" to " any bill would kill startups". That's a coherent position, but not one we can reasonably hope to debate about between each other.