CCPA Will Hit Dev Teams Harder Than GDPR • Hacker News Board

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#41

Post by Novashi » Thu, Jan 31, 2019, 11:53 PM UTC

figgis wrote: post #31

Novashi wrote: post #28

Earlier quoted context omitted.

>You are still processing that data. Part of processing that data involves you shipping it off... >The data is moving through your servers. So if a random company gets breached, everyone involved from cloud providers to ISPs are also responsible because they facilitated moving and storing the data and they are just hosting code? This is problematic. Cloud providers give you permission to publish code. I could positio…

>So if a random company gets breached, everyone involved from cloud providers to ISPs are also responsible because they facilitated moving and storing the data and they are just hosting code? ISP's aren't (supposed to be) "storing" that data. They are transferring bits between computers. You on the other hand are hosting a website with some sort of form that people input PII into. You are accepting that PII, whether…

>You on the other hand are hosting a website with some sort of form that people input PII into.

That's what cloud providers do! If there's a spirit-of-the-law that is supposed to protect them, this would be a good time to write that in!

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#42

Post by akamor » Thu, Jan 31, 2019, 11:55 PM UTC

gwbas1c wrote: post #4

Great article, until the end. Who uses PII in test data derived from real customers? That's just an absurd practice to begin with, and no one who takes security seriously would even consider doing this.

Hi, this is Adam. I'm a founder at Tonic.

As others have said, we've found a lot of smaller companies will test with production data because of their need/desire to move quickly. But we've also seen much much larger companies use production data in their dev/staging environments. Sometimes there will be production-like safeguards and security measures in place but not always. People shy away from practices that slow down development and testing.

We think synthetic data is the right solution for a few reasons. Most importantly, we believe it provides the right level security, while still allowing your team to be productive, i.e., your business logic and test cases still work. It also allows you to scale really easily since you effectively have a ruleset for generating data of any size. Finally, it’s a great way to share data throughout your organization and can help facilitate sales and partnerships. If you’re curious about scaling, check this post out: https://www.tonic.ai/blog/condenser-a-database-subsetting-to...

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#43

Post by lotu » Thu, Jan 31, 2019, 11:55 PM UTC

gwbas1c wrote: post #4

Great article, until the end. Who uses PII in test data derived from real customers? That's just an absurd practice to begin with, and no one who takes security seriously would even consider doing this.

People who have been hurt by the fact that synthesized data often doesn't exactly match real data.

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#44

Post by [deleted] » Thu, Jan 31, 2019, 11:57 PM UTC

carbocation wrote: post #40

kevin_b_er wrote: post #25

Earlier quoted context omitted.

Simple, you just add this to clickwrap agreement: The Parties mutually agree that any and all disputes arising from or relating to this Agreement, including the interpretation or application of this Agreement will be submitted exclusively to final and binding arbitration pursuant to the Federal Arbitration Act. The arbitration will be conducted the state of Delaware or such other location as the Parties may agree, by…

I dislike how the minute someone mentions a legal hack, the responses are "oh, are you a lawyer?" Why not consider this reply on its merits?

[deleted]

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#45

Post by kodablah » Thu, Jan 31, 2019, 11:57 PM UTC

Going into effect in a year? Seems like a business opportunity. Someone let me pay them $X and review my systems every so often and give me a seal saying I'm compliant with all these laws, and include some insurance up to $Y. Especially given the selective enforcement, there's money to be made from the chill alone. Compliance audit companies can probably just roll this into their package.

Also, I'm a bit annoyed at laws only affecting companies of a certain size. At some point right at crossing the line, there's a negative effect to having 50,001 users. (really I'm annoyed at how these data protection laws are implemented in general and I wish the discussion would be about that instead of being idealistic and only looking at the supposed intent)

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#46

Post by ChrisSD » Thu, Jan 31, 2019, 11:58 PM UTC

carbocation wrote: post #40

kevin_b_er wrote: post #25

Earlier quoted context omitted.

Simple, you just add this to clickwrap agreement: The Parties mutually agree that any and all disputes arising from or relating to this Agreement, including the interpretation or application of this Agreement will be submitted exclusively to final and binding arbitration pursuant to the Federal Arbitration Act. The arbitration will be conducted the state of Delaware or such other location as the Parties may agree, by…

I dislike how the minute someone mentions a legal hack, the responses are "oh, are you a lawyer?" Why not consider this reply on its merits?

"Legal hacks" are rarely, if ever, as clever as their proponents think. Scepticism is natural and warranted.

Judges aren't complete morons and will take a dim view of "hacks". There could be loopholes somewhere but you'd need a lawyer to spot them.

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#47

Post by IfOnlyYouKnew » Thu, Jan 31, 2019, 11:59 PM UTC

“He started worrying about data privacy after talking with a Google engineer and spent nearly $3.5 million in 2017/2018 to place an initiative on California's November ballot.”

That Google employee must be somewhat nervous these days...

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#48

Post by jordigh » Thu, Jan 31, 2019, 11:59 PM UTC

carbocation wrote: post #40

kevin_b_er wrote: post #25

Earlier quoted context omitted.

Simple, you just add this to clickwrap agreement: The Parties mutually agree that any and all disputes arising from or relating to this Agreement, including the interpretation or application of this Agreement will be submitted exclusively to final and binding arbitration pursuant to the Federal Arbitration Act. The arbitration will be conducted the state of Delaware or such other location as the Parties may agree, by…

I dislike how the minute someone mentions a legal hack, the responses are "oh, are you a lawyer?" Why not consider this reply on its merits?

Because it is super-risky to consider these things on their own merits if you are not the kind of person who regularly interacts with judges and juries. Laws are something that are applied within a particular kind of, ah, culture. You have to be familiar with the body of work of that culture and how they will likely interpret the law. Trying to interpret laws in ignorance of that culture is likely to lead to interpretations contrary to those with the power to enforce the laws, and land you in a lot of trouble.

In other words, laws aren't code or mathematics. They're not pure exercises of abstract thought to be considered in isolation. Trying to treat them that way is going to lead to trouble.

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#49

Post by Kalium » Fri, Feb 01, 2019, 12:00 AM UTC

gwbas1c wrote: post #4

Great article, until the end. Who uses PII in test data derived from real customers? That's just an absurd practice to begin with, and no one who takes security seriously would even consider doing this.

It's very easy for a small company to get in the habit of using data cloned from prod for testing. This practice, easy as it is to start, gets progressively more difficult to move away from as the application and service grow in complexity.

As a result, you get shockingly mature companies that do exactly this obviously absurd thing because it's a ton of work to stop. Work with no obvious reason to do this instead of feature work.

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#50

Post by tzs » Fri, Feb 01, 2019, 12:01 AM UTC

Groxx wrote: post #17

llukas wrote: post #3

Earlier quoted context omitted.

"up to" Are there any guidelines for determining actual compensation?

The full sentence is this fwiw: > Additionally, if a data breach occurs, the law permits consumers to recover up to $750 per incident (or actual damages, if greater). So that might just be $750 as part of a punitive fee.

It sounds more like a statutory damages thing, although note I have not read the law.

The idea with statutory damages is that determining the actual damages can be difficult and uncertain, so some laws allow plaintiffs to elect to ask for damages from a standard range, and the court will decide where damages should fall in that range based. It's basically saying "just give me about what is typical for cases like this one".