CCPA Will Hit Dev Teams Harder Than GDPR

#1

Post by icoe » Thu, Jan 31, 2019, 10:09 PM UTC

CCPA Will Hit Dev Teams Harder Than GDPR
tonic.ai

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#2

Post by lxe » Thu, Jan 31, 2019, 10:48 PM UTC

> if a data breach occurs, the law permits consumers to recover up to $750 per incident

This is great!

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#3

Post by llukas » Thu, Jan 31, 2019, 10:50 PM UTC

lxe wrote: post #2

> if a data breach occurs, the law permits consumers to recover up to $750 per incident This is great!

"up to"

Are there any guidelines for determining actual compensation?

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#4

Post by gwbas1c » Thu, Jan 31, 2019, 10:53 PM UTC

Great article, until the end.

Who uses PII in test data derived from real customers? That's just an absurd practice to begin with, and no one who takes security seriously would even consider doing this.

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#5

Post by chmod775 » Thu, Jan 31, 2019, 10:53 PM UTC

llukas wrote: post #3

lxe wrote: post #2

> if a data breach occurs, the law permits consumers to recover up to $750 per incident This is great!

"up to" Are there any guidelines for determining actual compensation?

Presumably it's a scale from

"Leaked (e-mail) adresses"

to

"Leaked nude photographs".

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#6

Post by nixpulvis » Thu, Jan 31, 2019, 10:53 PM UTC

"It defines de-identified as “information that cannot reasonably identify, relate to, describe, be capable of being associated with, or be linked, directly or indirectly, to a particular consumer.”"

I'd love to know what they mean by reasonable... I've seen some demos of tech that can do some pretty amazing things at de-de-identifying.

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#7

Post by fuzzy2 » Thu, Jan 31, 2019, 10:57 PM UTC

ot: What's wrong with this website? It loads super slow and behaves very weirdly on my iPhone.

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#8

Post by munk-a » Thu, Jan 31, 2019, 11:00 PM UTC

gwbas1c wrote: post #4

Great article, until the end. Who uses PII in test data derived from real customers? That's just an absurd practice to begin with, and no one who takes security seriously would even consider doing this.

Small companies that are just starting out may use real data in test environments since it's a bit easier than using mocked data... Honestly this really only holds for companies that also avoid unit/integration tests (which will generally require that data to support the tests be explicitly mocked in some manner)

Since this involves computers nothing above is a hard rule, but it goes along with my experience.

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#9

Post by llukas » Thu, Jan 31, 2019, 11:03 PM UTC

chmod775 wrote: post #5

llukas wrote: post #3

Earlier quoted context omitted.

"up to" Are there any guidelines for determining actual compensation?

Presumably it's a scale from "Leaked (e-mail) adresses" to "Leaked nude photographs".

I don't mind my nude photographs. I mind if somebody takes loan in my name and dumb bank would send it to collections.

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#10

Post by icoe » Thu, Jan 31, 2019, 11:04 PM UTC

nixpulvis wrote: post #6

"It defines de-identified as “information that cannot reasonably identify, relate to, describe, be capable of being associated with, or be linked, directly or indirectly, to a particular consumer.”" I'd love to know what they mean by reasonable... I've seen some demos of tech that can do some pretty amazing things at de-de-identifying.

So, huge caveat (I'm NOT a lawyer), but right now most interpretations seem to suggest that masking and synthesizing would constitute appropriate deidentification even if a motivated adversary could reverse engineer given appropriate time and resources. Again, this is something that will likely be clarified over time.