Great article, until the end. Who uses PII in test data derived from real customers? That's just an absurd practice to begin with, and no one who takes security seriously would even consider doing this.
It would surprise you.
CCPA Will Hit Dev Teams Harder Than GDPR
21–30 of 179 posts
Re: CCPA Will Hit Dev Teams Harder Than GDPR
#22I like the general idea and I like that it specifically applies only to organizations with more than $25 million in revenue. Give small startups a break.
Does the GDPR also have a lower limit like this? It should.
Re: CCPA Will Hit Dev Teams Harder Than GDPR
#23>Process personal information of >50k consumers, households or devices >Derive >50% of revenue from selling PII So if I forward all of the data to another company outside of CA, does my company count as processing data? What if the code that forwards that data is written by another company and I'm just hosting it on my site? Everything goes through their code and I'm paid to just setup a website to host their code. M…
> So if I forward all of the data to another company outside of CA, does my company count as processing data?
You are still processing that data. Part of processing that data involves you shipping it off...
> What if the code that forwards that data is written by another company and I'm just hosting it on my site? Everything goes through their code and I'm paid to just setup a website to host their code.
You are as responsible, if not more, in making sure that compliance is met. You are the one hosting the code. The data is moving through your servers.
> Maybe I do collect info in CA but I sell the data for $1, but the company also buys some consulting services for the actual price of that data that I'm selling them?
That's just being a jerk. But better hope you don't pass the 50k mark...
Re: CCPA Will Hit Dev Teams Harder Than GDPR
#24Earlier quoted context omitted.
"up to" Are there any guidelines for determining actual compensation?
Presumably it's a scale from "Leaked (e-mail) adresses" to "Leaked nude photographs".
Presumambly the upper end of the scale would be closer to identity theft with total asset loss and fraudulent lines of debt, which is likely would occur if eg google got hacked.
Re: CCPA Will Hit Dev Teams Harder Than GDPR
#25> if a data breach occurs, the law permits consumers to recover up to $750 per incident This is great!
Simple, you just add this to clickwrap agreement:
The Parties mutually agree that any and all disputes arising from or relating to this Agreement, including the interpretation or application of this Agreement will be submitted exclusively to final and binding arbitration pursuant to the Federal Arbitration Act. The arbitration will be conducted the state of Delaware or such other location as the Parties may agree, by a single arbitrator in accordance with the substantive laws of the State of Delaware.
Boom. No more pesky California law.
Re: CCPA Will Hit Dev Teams Harder Than GDPR
#26Earlier quoted context omitted.
Many small companies take this approach. Usually it’s lower-risk PII. Some small companies will refuse to use generated data if it takes even a minute more to generate it vs import it from production. In the consulting world I’ve seen multiple examples of companies complaining bitterly about other security minded consultants efforts to improve security and privacy through even small amounts of additional development…
I have seen it done in a small company to check if a query will run too slow in production. Take a copy of the biggest database. Run query, see what happens, delete copy.
It's probably more often that the query is just run against production in the first place.
Making a copy is probably more effort than most developers out in the wild are going to make.
Re: CCPA Will Hit Dev Teams Harder Than GDPR
#27Great article, until the end. Who uses PII in test data derived from real customers? That's just an absurd practice to begin with, and no one who takes security seriously would even consider doing this.
Small companies that are just starting out may use real data in test environments since it's a bit easier than using mocked data... Honestly this really only holds for companies that also avoid unit/integration tests (which will generally require that data to support the tests be explicitly mocked in some manner) Since this involves computers nothing above is a hard rule, but it goes along with my experience.
The $25 million revenue limit would be a pretty good guide from 'small'. Typically there are a lot of changes around that mark, one of which should be to stop using Customer data insecurely.
Re: CCPA Will Hit Dev Teams Harder Than GDPR
#28>Process personal information of >50k consumers, households or devices >Derive >50% of revenue from selling PII So if I forward all of the data to another company outside of CA, does my company count as processing data? What if the code that forwards that data is written by another company and I'm just hosting it on my site? Everything goes through their code and I'm paid to just setup a website to host their code. M…
> So if I forward all of the data to another company outside of CA, does my company count as processing data? You are still processing that data. Part of processing that data involves you shipping it off... > What if the code that forwards that data is written by another company and I'm just hosting it on my site? Everything goes through their code and I'm paid to just setup a website to host their code. You are as r…
>You are still processing that data. Part of processing that data involves you shipping it off...
>The data is moving through your servers.
So if a random company gets breached, everyone involved from cloud providers to ISPs are also responsible because they facilitated moving and storing the data and they are just hosting code?
This is problematic. Cloud providers give you permission to publish code. I could position myself to allow another company to publish code on my popular website to collect data and my role is basically no different than a cloud provider. We don't have to agree that is what it's specifically for, I just need to give them access to upload their own code for whatever expensive fee.
Re: CCPA Will Hit Dev Teams Harder Than GDPR
#29I like the general idea and I like that it specifically applies only to organizations with more than $25 million in revenue. Give small startups a break. Does the GDPR also have a lower limit like this? It should.
The criteria is a "one or more of the following" not a combination of them all
So if you make more than $25 million, OR your have more than 50k users or devices, OR you make more than 50% of your money selling data
Re: CCPA Will Hit Dev Teams Harder Than GDPR
#30> if a data breach occurs, the law permits consumers to recover up to $750 per incident This is great!
good time to make a bot that signs up for things