Silicon Valley is terrified of California’s privacy law • Hacker News Board

Re: Silicon Valley is terrified of California’s privacy law

#151

Post by tchock23 » Thu, Sep 19, 2019, 8:15 PM UTC

baq wrote: post #98

tchock23 wrote: post #76

Earlier quoted context omitted.

Not everyone has data mining and adtech as a business model. Why should people running legit online businesses that do not involve mining data be punished for unscrupulous actors in the adtech biz?

how do you suggest to solve the adtech situation without regulating all businesses?

Not really sure how - just posing that as an ideal for not punishing those who do not have that business model.

I suppose the regulation could be on the subsequent sharing/sale of user data upon capturing it, rather than the initial data collection?

Re: Silicon Valley is terrified of California’s privacy law

#152

Post by codeulike » Thu, Sep 19, 2019, 8:15 PM UTC

bcheung wrote: post #132

nabnob wrote: post #52

I see a lot of comments deriding this law, can someone explain to me why these are bad things? Quoting from this article - https://techcrunch.com/2018/06/28/landmark-california-privac... - Businesses must disclose what information they collect, what business purpose they do so for and any third parties they share that data with. - Businesses would be required to comply with official consumer requests to delete that d…

Some problematic scenarios: - How do you identify what is customer data? There may be information stored in logs somewhere. Do you now have to write log parsers to extract personal data for everything that previously you just stored for general debugging and security purposes? How do you even know all the permutations of personal data that came be stored in the logs. There are possibly infinite possible ways personal…

In Europe, we have GDPR which is broadly similar. And the answer to your question about logs is basically "Tough shit. Personal data is important and if you've been leaving it in logs all over the place then you're going to have to sort that shit out".

The Backups question is a bit more complex. One source I've seen: "According to France’s GDPR supervisory authority, CNIL, organisations don’t have to delete backups when complying with the right to erasure. Nonetheless, they must clearly explain to the data subject that backups will be kept for a specified length of time (outlined in your retention policy)."

Paired with that is that if you're keeping data (or backups) for any length of time beyond the immediate needs of the customer then you need to be able to justify it.

Re: Silicon Valley is terrified of California’s privacy law

#153

Post by noodlesUK » Thu, Sep 19, 2019, 8:16 PM UTC

wolco wrote: post #128

noodlesUK wrote: post #104

Earlier quoted context omitted.

If this is your experience buying things internationally from smaller websites, that surprises me greatly. When I purchase items from US retailers in European countries, before the item arrives, I get a little slip to pay the duties on the item. If I don’t pay, the item doesn’t arrive.

Duty is imposed at the country level. In my country things we make have additional duty but products we don't are not. I would assume importing milk might trigger 50% duty but receiving a dnakit from 23andme wouldn't.

My experience has been that I need to pay VAT, as well as any specific duties for the category of item I’m bringing in. This can be a lot, as VAT is currently 20%. I’m okay with it though. Any item I buy locally have VAT, and I think it’s unfair if you don’t charge that on imports. It’s the beauty of a VAT that it won’t hurt production if you’re reselling the goods anyway.

Re: Silicon Valley is terrified of California’s privacy law

#154

Post by allover » Thu, Sep 19, 2019, 8:16 PM UTC

bcheung wrote: post #132

nabnob wrote: post #52

I see a lot of comments deriding this law, can someone explain to me why these are bad things? Quoting from this article - https://techcrunch.com/2018/06/28/landmark-california-privac... - Businesses must disclose what information they collect, what business purpose they do so for and any third parties they share that data with. - Businesses would be required to comply with official consumer requests to delete that d…

Some problematic scenarios: - How do you identify what is customer data? There may be information stored in logs somewhere. Do you now have to write log parsers to extract personal data for everything that previously you just stored for general debugging and security purposes? How do you even know all the permutations of personal data that came be stored in the logs. There are possibly infinite possible ways personal…

> How do you even know all the permutations of personal data that came be stored in the logs. There are possibly infinite possible ways personal information can manifest in logs.

Nonsense. You write the log statements. You know what data structures you are logging.

If you're using some server's built in logging, or some logging library or middleware you don't understand, turn that off until you understand what it's logging.

Re: Silicon Valley is terrified of California’s privacy law

#155

Post by nabnob » Thu, Sep 19, 2019, 8:16 PM UTC

fbonetti wrote: post #138

JohnFen wrote: post #120

Earlier quoted context omitted.

> Will that be banned as well? I sure hope so. > Many companies, including Google would have to significantly change their pricing model if so Good. It would be even better if they have to change their business model.

Are you willing to pay to use a search engine? How much?

Those aren't the only two options. Duckduckgo shows you ads based on your search terms.

Re: Silicon Valley is terrified of California’s privacy law

#156

Post by t_dunks » Thu, Sep 19, 2019, 8:16 PM UTC

dmitriid wrote: post #90

bpodgursky wrote: post #60

Earlier quoted context omitted.

Our EU employees could not file expense reports for months, because our expense management software (FROSCH or something) could not figure out GDPR compliance. Soooo I kinda suspect you're talking with absolutely no first-hand experience.

I’ve now been at three large multinational companies who have gone through GDPR process. It’s not easy or simple for an established company, but it’s not impossible. Additionally: - before GDPR most EU countries already had similar laws (e.g. data protection laws in Sweden). Sometimes for decades - GDPR gave two years to become compliant All in all everyone had two to twenty years to become compliant. Those who didn’…

This is a terrible line of reasoning. GDPR came AFTER the expense software, so blaming the company for not forwardly thinking about an non-existant regulation is ridiculous.

Re: Silicon Valley is terrified of California’s privacy law

#157

Post by opportune » Thu, Sep 19, 2019, 8:17 PM UTC

FussyZeus wrote: post #23

throawayuk55po wrote: post #16

We need to have a conversation about jurisdictions in the digital age. The way governments have decided that having a website accessible in a country makes you liable to respect the law of this country is a convulted and hacky notion that has been accepted way too fast. The physical establishment rule was the only sound approach. The fact that some countries started to lose shouldn't have allowed them to rewrite the…

> We need to have a conversation about jurisdictions in the digital age. The way governments have decided that having a website accessible in a country makes you liable to respect the law of this country is a convulted and hacky notion that has been accepted way too fast. You know if you turn that around and say "How come we have to respect the laws of every country we do business in?" it sounds a lot more self servi…

The issue is that with the internet, the default option is “available everywhere” whereas basically any other commercial thing is only available in a physical location, because that’s where the good is being sold/ the service is being offered. The main thing similar to tech is media, but even if someone in a country where some media content is banned is caught consuming that media, the consumer is punished rather than the producer.

I am actually in favor of privacy regulations. But there are two major issues that most people don’t understand

- Compliance is not easy if you do anything much more complicated than serve a static website. Basically anything business related will have PII. And you can introduce PII accidentally with things like logging, putting it in places it shouldn’t be

- Because the internet is open by default you need to comply with basically every single regulation on the planet, and the burden is fully on you to know how and why you comply with those regulations. (Some places will just firewall you, which in many ways is better, but others just want to make money off you)

Re: Silicon Valley is terrified of California’s privacy law

#158

Post by [deleted] » Thu, Sep 19, 2019, 8:17 PM UTC

bcheung wrote: post #132

nabnob wrote: post #52

I see a lot of comments deriding this law, can someone explain to me why these are bad things? Quoting from this article - https://techcrunch.com/2018/06/28/landmark-california-privac... - Businesses must disclose what information they collect, what business purpose they do so for and any third parties they share that data with. - Businesses would be required to comply with official consumer requests to delete that d…

Some problematic scenarios: - How do you identify what is customer data? There may be information stored in logs somewhere. Do you now have to write log parsers to extract personal data for everything that previously you just stored for general debugging and security purposes? How do you even know all the permutations of personal data that came be stored in the logs. There are possibly infinite possible ways personal…

[deleted]

Re: Silicon Valley is terrified of California’s privacy law

#159

Post by SamReidHughes » Thu, Sep 19, 2019, 8:18 PM UTC

morganherlocker wrote: post #75

Lot's of (mis)information floating around regarding CCPA. I recommend taking the time to read the actual text[1]. The text is not particularly long or dense. There has been a lot of speculation about complex compliance procedures, but the main thrust of the bill is to provide users with information about how their data is collected, who it is shared with, and the rights to prevent certain types of selling or sharing…

> (4) Exercise free speech, ensure the right of another consumer to exercise his or her right of free speech, or exercise another right provided for by law.

Well, thanks for the link. For example, informing people that a user is located in a dormitory in The Netherlands sounds like free speech to me. So is location tracking information exempt from deletion?

Re: Silicon Valley is terrified of California’s privacy law

#160

Post by [deleted] » Thu, Sep 19, 2019, 8:18 PM UTC

nabnob wrote: post #52

I see a lot of comments deriding this law, can someone explain to me why these are bad things? Quoting from this article - https://techcrunch.com/2018/06/28/landmark-california-privac... - Businesses must disclose what information they collect, what business purpose they do so for and any third parties they share that data with. - Businesses would be required to comply with official consumer requests to delete that d…

[deleted]