Silicon Valley is terrified of California’s privacy law • Hacker News Board

Re: Silicon Valley is terrified of California’s privacy law

#191

Post by mdavidn » Thu, Sep 19, 2019, 8:32 PM UTC

krapp wrote: post #176

calithrowaway wrote: post #166

How is this not a violation to the first amendment? Does the first amendment not extend as follows: (?) As a citizen don't I have the right to create a business and privately take notes on whatever I'd like to about my customers? If i run a dry cleaners and take notes about my customers, should I be obligated to disclose these notes or even the existence of these notes to my customers? I don't see why extending the d…

>I feel like the state constitution granted right to privacy does not supersede the federally mandated right to freedom of speech Gonna have to stop you there. The First Amendment doesn't mandate a right to free speech. It only prevents Congress from passing laws abridging that right. There's nothing, Constitutionally speaking, preventing states from doing so. Edit: nope, Apparently I'm wrong on this one.

That's not the case. The Bill of Rights now does largely apply to the states.

https://en.wikipedia.org/wiki/Incorporation_of_the_Bill_of_R...

Re: Silicon Valley is terrified of California’s privacy law

#192

Post by ptest1 » Thu, Sep 19, 2019, 8:34 PM UTC

dsfyu404ed wrote: post #167

ptest1 wrote: post #163

Besides the tremendous onus laws like this may place on small startups and side projects: Does anyone know how companies are supposed to comply if “user data” literally cannot be deleted? I’m thinking in the case of blockchain type applications, where one users’ actions feed into another users’ actions, and you can’t deleted user A’s actions without deleting potentially tons of other stuff and destroying the applicat…

>Besides the onus laws like this may place on small startups and side projects: Startups and side projects are a non-issue. They can just comply from the get go. It's the too small to afford compliance but too big to easily change their business model that are going to be hurt by this. However, that brings up the question as to whether those business models should be able to exist profitably in the first place.

What I’m saying is that there is more work for startups / side projects to do, not that it’s impossible. It raises the barrier.

Re: Silicon Valley is terrified of California’s privacy law

#193

Post by DanBC » Thu, Sep 19, 2019, 8:35 PM UTC

chobeat wrote: post #189

simplecomplex wrote: post #119

Earlier quoted context omitted.

“The GDPR does a lot to protect user data” As you proceed to state absolutely nothing. Before GDPR my information was in a bunch of databases managed by other people. After GDPR my information is in the same databases managed by the same people. Except now they have legalese stating this totally fucking obvious fact. Before GDPR if my information was hacked and used to hurt me, the business was not liable. After GDPR…

Dude, GDPR's effects just began. Give it time. A sudden enforcement of GDPR would destroy too many business and so it's being enforced gradually. Still, there are beginning to discuss the complete outlaw of the real time bidding in adtech because completely incompatible with the GDPR. That means destroying bilions of dollars of businesses, so they go slow until there's enough political consensus to do so without fear…

You know that GDPR is just a refinement of ideas that began over 20 years ago, right?

The EU really isn't engaged in a three decade campaign to destroy American companies.

Two nice timelines:

https://edps.europa.eu/data-protection/data-protection/legis...

https://iapp.org/resources/article/a-brief-history-of-the-ge...

Re: Silicon Valley is terrified of California’s privacy law

#194

Post by 1000units » Thu, Sep 19, 2019, 8:35 PM UTC

darawk wrote: post #172

nabnob wrote: post #52

I see a lot of comments deriding this law, can someone explain to me why these are bad things? Quoting from this article - https://techcrunch.com/2018/06/28/landmark-california-privac... - Businesses must disclose what information they collect, what business purpose they do so for and any third parties they share that data with. - Businesses would be required to comply with official consumer requests to delete that d…

> - Consumers can opt out of their data being sold, and businesses can’t retaliate by changing the price or level of service. This is something I object to. It's just fundamentally stupid and doesn't make sense. The entire premise of free exchange is that I give you my services in exchange for something of value of yours. Making it illegal to withhold services if you don't give up your data is crazy. The only reason…

Good laws put bad people out of business. I don't see the issue here.

Re: Silicon Valley is terrified of California’s privacy law

#195

Post by ptest1 » Thu, Sep 19, 2019, 8:36 PM UTC

chobeat wrote: post #180

ptest1 wrote: post #163

Besides the tremendous onus laws like this may place on small startups and side projects: Does anyone know how companies are supposed to comply if “user data” literally cannot be deleted? I’m thinking in the case of blockchain type applications, where one users’ actions feed into another users’ actions, and you can’t deleted user A’s actions without deleting potentially tons of other stuff and destroying the applicat…

For the 1) you just don't commit data in the blockchain itself. You can commit an ID that points to external data and drop these external data if requested. This clearly looks like an anti-pattern but putting personal data in an immutable data structure is an anti-pattern too, since those data don't belong to you. What if a bank put the gold of their customers in a concrete pillar instead of a vault? Fuck the back, I…

Again, the GitHub example is a good one. I have some commits in Django core from years ago. What if I “request” my data be deleted from GitHub? What are they supposed to do? If they rewrite the history it will destroy the project; and if anyone can rewrite the history in the future it leaves projects open to hostile actions.

I suppose the argument would have to be made that it’s not personal data; it’s an act of public publishing or something. So in this case it’s akin to me publishing a blog and other people quoting it years later. I can delete the original blog but not the reprints in newspapers or quotes.

Or that it stops becoming “your” data and becomes instead “the other user’s” once eg the Django project accepts the PR. So you can delete user A’s PR but not the Django project’s now-integrated copy. I think this rationale makes the most sense. After all, someone could still have the repository on their computer and push it back to GitHub again.

I realize this is an edge case that doesn’t apply to 99.9999% of companies, but as an engineer I find it interesting!

Edit: after thinking this through more, I suspect that e.g. GitHub could argue they comply as long as they delete User A’s repo. Subsequently integrated PRs, etc wouldn’t have to be deleted because they could argue they’re no longer User A’s.

I kinda feel like if language to allow this was added to the law explicitly it would be open to abuse, so I suppose this kind of thing has to remain vague and open to interpretation in e.g. the courts if someone is being nasty.

Re: Silicon Valley is terrified of California’s privacy law

#196

Post by danShumway » Thu, Sep 19, 2019, 8:37 PM UTC

nabnob wrote: post #52

I see a lot of comments deriding this law, can someone explain to me why these are bad things? Quoting from this article - https://techcrunch.com/2018/06/28/landmark-california-privac... - Businesses must disclose what information they collect, what business purpose they do so for and any third parties they share that data with. - Businesses would be required to comply with official consumer requests to delete that d…

I've commented in the past that the privacy community is diverse. I divide the community into (at least) two major groups:

- People who believe that privacy means being able to anonymously use services.

- People who believe that privacy means being able to control what other people do with data about you.

These are not compatible views, and they often conflict with each other -- both philosophically and practically.

If you believe you should be able to compel a business to delete data you gave them, then necessarily there needs to be a way for that business to confirm your identity and link you to that data. You become more concerned with this idea of "owning" information about yourself.

If you believe you should be able to do everything anonymously, then it becomes much harder to control information after it's been leaked. You can't implement things like geo-locking users because what you do with the information doesn't matter -- just collecting it is a problem.

If you're in the "everything should be anonymous" crowd, you're also less likely to agree with efforts like Right to Be Forgotten; you may even reject the idea of data ownership entirely. For someone in the "I control my own data" crowd, the Right to Be Forgotten is absolutely critical -- it's one of the most important safeguards we have against a future where everything is permanently indexed forever.

I'm oversimplifying, but at the moment, the majority of pure-tech solutions for privacy are on the "everything should be anonymous" side, and (at least for the moment) most legislative solutions are falling into the "you should control your own data" side. That leads to conflict. Not always, but sometimes.

It's important to keep in mind that even though the privacy movement is aligned on many issues, there is no binary "pro" or "anti" privacy, because there's disagreement from privacy advocates on both where we're going and how to get there. In this case, California's law is very much a "control my data" law. Points like, "Businesses would be required to comply with official consumer requests to delete that data" conflict with the way that "be anonymous" privacy advocates see the world.

Re: Silicon Valley is terrified of California’s privacy law

#197

Post by HillaryBriss » Thu, Sep 19, 2019, 8:37 PM UTC

briffle wrote: post #111

nabnob wrote: post #52

I see a lot of comments deriding this law, can someone explain to me why these are bad things? Quoting from this article - https://techcrunch.com/2018/06/28/landmark-california-privac... - Businesses must disclose what information they collect, what business purpose they do so for and any third parties they share that data with. - Businesses would be required to comply with official consumer requests to delete that d…

I see a lot of comments deriding this law, can someone explain to me why these are bad things? Jeff Hammerbacher: ‘The best minds of my generation are thinking about how to make people click ads… That sucks.’ Those best minds are now having to change the way they generate revenue..

I'm definitely not against it, but my guess is the best minds will now be put to work figuring out how to defeat, avoid, mitigate this regulation.

Re: Silicon Valley is terrified of California’s privacy law

#198

Post by ashelmire » Thu, Sep 19, 2019, 8:37 PM UTC

darawk wrote: post #172

nabnob wrote: post #52

I see a lot of comments deriding this law, can someone explain to me why these are bad things? Quoting from this article - https://techcrunch.com/2018/06/28/landmark-california-privac... - Businesses must disclose what information they collect, what business purpose they do so for and any third parties they share that data with. - Businesses would be required to comply with official consumer requests to delete that d…

> - Consumers can opt out of their data being sold, and businesses can’t retaliate by changing the price or level of service. This is something I object to. It's just fundamentally stupid and doesn't make sense. The entire premise of free exchange is that I give you my services in exchange for something of value of yours. Making it illegal to withhold services if you don't give up your data is crazy. The only reason…

> - Consumers can opt out of their data being sold, and businesses can’t retaliate by changing the price or level of service.

> - Businesses can, however, offer “financial incentives” for being allowed to collect data.

This just means your service always costs money, but you can refund the full amount for allowing you to collect data.

Re: Silicon Valley is terrified of California’s privacy law

#199

Post by chroma » Thu, Sep 19, 2019, 8:38 PM UTC

JohnFen wrote: post #120

aeternum wrote: post #102

Earlier quoted context omitted.

I don't think lawmakers have thought through the ramifications. Here are a few: Way too hard to enforce, the definition of 'customer data' is going to be a constantly moving target. Does every click count? How about aggregated clicks important for general product optimization? What constitutes 'selling' user data? Very few companies actually sell your data, instead they place ads based on your data. Will that be bann…

> Will that be banned as well? I sure hope so. > Many companies, including Google would have to significantly change their pricing model if so Good. It would be even better if they have to change their business model.

I don't understand this mentality. If someone is fine giving a company some information, and the company uses that to give them a better product, where is the harm? And what right do you have to stop those two parties from voluntarily exchanging goods and services?

Re: Silicon Valley is terrified of California’s privacy law

#200

Post by paulmd » Thu, Sep 19, 2019, 8:39 PM UTC

nabnob wrote: post #123

briffle wrote: post #111

Earlier quoted context omitted.

I see a lot of comments deriding this law, can someone explain to me why these are bad things? Jeff Hammerbacher: ‘The best minds of my generation are thinking about how to make people click ads… That sucks.’ Those best minds are now having to change the way they generate revenue..

When I first wrote that comment, it was at -2 after three minutes. Which is interesting because usually HN users claim they care about privacy.

Oh hell no, HN users are largely startup types who are all-in on adtech/tracking tech and metrics for building their businesses.

There is an incessant amount of whining about GDPR for example, and how "confusing" the regulations supposedly are. What it comes down to is many HN denizens are doing things that are explicitly prohibited by these data collection laws and want to continue doing the things that have been outlawed.

As they say, it is difficult to get a man understand something when his salary depends on his not understanding it.