Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Californians' data deletion requests, DROP, become enforceable Aug. 1

nbcsandiego.com

Post reply on HN
Print view View original

71–80 of 106 posts

Re: Californians' data deletion requests, DROP, become enforceable Aug. 1

#71

Post by tomhow »

testing22321 wrote: post #64
tomhow wrote: post #52

Earlier quoted context omitted.

> dang told me “tough luck” He (nor I) would never write that or anything like it. What we always say is that we aim to find a compromise between a user's wish for their entire history to be erased and the rest of the community's expectation that when they participate in discussion threads, those threads will persist unadulterated into the future. We are always willing to redact PII and do other things to prevent peo…

Dang said exactly that. What’s your email, I’ll forward it. Changing my username to something random doesn’t help, because it’s trivial to find a comment or two that make it clear that random user ID is me, and then you can see all my comments. There are two much better approaches. 1. Make every single comment of mine a new random user if so they’re all separate. 2. Make the user id of everyone who has ever asked for…

My email is the same as Dan's. hn@ycombinator.com. Yes you can forward it and I'll read it straight away.

We can't necessarily do the exact things you've asked, because it makes all the discussion threads you participated in incoherent. We can take reasonable steps to disassociate personally-identifying comments from others.

> Please help. Death threats are not fun, especially when you have a 2 year old daughter. There is a 100+ page forum thread of people betting on when I (real name, real person) am going to die. Just saying that somewhat Doxxes me.

This sounds terrible, and of course we don't want anything like that for you. It's just not clear (and I still haven't received an email from you so I can't look into the details of the case) how the actions you're specifying that we need to take on HN will fix this issue on some other website. I don't know any details other than the limited information you're sharing here. I can't find any emails about this matter linked to the username you're commenting from here.

Re: Californians' data deletion requests, DROP, become enforceable Aug. 1

#72

Post by cindyllm »

testing22321 wrote: post #65
vlovich123 wrote: post #33

Earlier quoted context omitted.

What kind of topics/comments did you make that got you death threats? Really want to make sure I stay away from such topics.

I don’t want to doxx myself. There is a 100+ page forum thread of people betting on when I’m going to die. Redditors have commented in public “I wish he did die”, etc etc

[dead]

Re: Californians' data deletion requests, DROP, become enforceable Aug. 1

#73

Post by Y-bar »

ryandrake wrote: post #53

As good intentioned as it is, I don't like the wording used around this law. "Request" and "Ask" and "please delete my information." Notice that regular users have to "ask nicely" but when it's something like the DMCA, which benefits corporations, they use "takedown notices" and "demand letters." I don't want to ask data brokers, pretty please with sugar on top. I want to be able to demand they do it, and require the…

https://www.law.cornell.edu/wex/request

https://munley.com/tag/request/

I’m not a US lawyer, but the word ”request” seems like it has a solid legal basis and can be used to compel action.

Re: Californians' data deletion requests, DROP, become enforceable Aug. 1

#74

Post by tomhow »

testing22321 wrote: post #67
tomhow wrote: post #49

Earlier quoted context omitted.

We take users' privacy seriously and have had a consistent policy for years. If anyone is worried about personally identifying information, we're always happy to redact the PII and reassign comments/posts to an anonymous account. The only thing we don't do is wholesale wipe someone's entire history from HN, because it guts the threads and ruins them for everyone else who participated and who might find them interesti…

> If anyone is worried about personally identifying information, we're always happy to redact the PII and reassign comments/posts to an anonymous account This is the identical line dang fed me, and what he did is useless. It changes nothing. Stop saying you’ll go out of your way to help users when you clearly won’t. Changing my username on all my old comments to some other username is not enough. It’s trivial to figu…

We go to great effort to find the right balance between a user's need for privacy and the community/public benefit in keeping threads intact and coherent (moving every one of a user's comments to a different username makes the threads incoherent).

On a case-by-case basis we can move a selection of comments to a separate username. We of course don't want anyone to be in danger.

Re: Californians' data deletion requests, DROP, become enforceable Aug. 1

#75

Post by mindslight »

tomhow wrote: post #71
testing22321 wrote: post #64

Earlier quoted context omitted.

Dang said exactly that. What’s your email, I’ll forward it. Changing my username to something random doesn’t help, because it’s trivial to find a comment or two that make it clear that random user ID is me, and then you can see all my comments. There are two much better approaches. 1. Make every single comment of mine a new random user if so they’re all separate. 2. Make the user id of everyone who has ever asked for…

My email is the same as Dan's. hn@ycombinator.com. Yes you can forward it and I'll read it straight away. We can't necessarily do the exact things you've asked, because it makes all the discussion threads you participated in incoherent. We can take reasonable steps to disassociate personally-identifying comments from others. > Please help. Death threats are not fun, especially when you have a 2 year old daughter. The…

It seems like you should be able to do a middle ground that preserves the commenter identity in each individual thread, while destroying the links across different threads.

For example, reserve the usernames 'deleted-xxxx' where x is a number. Then when someone wants their history obliterated, loop over every thread they have commented in. For each thread, choose a random number deleted-xxxx and assign that username to every comment of theirs in that thread.

Thus comments in the thread remain linked with one another, other deleted users in the thread remain distinct, and comments in one thread aren't linkable to a user's comments in another thread (perhaps lamentable, but required for unlinking spilled personal info in the general case)

(I chose random numbers rather than incrementing so that one can't start making inferences about users based on deletion order)

Re: Californians' data deletion requests, DROP, become enforceable Aug. 1

#77

Post by ooterness »

ryandrake wrote: post #53

As good intentioned as it is, I don't like the wording used around this law. "Request" and "Ask" and "please delete my information." Notice that regular users have to "ask nicely" but when it's something like the DMCA, which benefits corporations, they use "takedown notices" and "demand letters." I don't want to ask data brokers, pretty please with sugar on top. I want to be able to demand they do it, and require the…

I always liked the archaic form, "You are hereby requested and required to [insert naval orders here]." It's asking very politely, for now, but also making it clear that declining will result in jail or worse.

I don't know if it's apocryphal, but it shows up in the Hornblower novels and at least one episode of Star Trek.

Re: Californians' data deletion requests, DROP, become enforceable Aug. 1

#78

Post by jboggan »

hedora wrote: post #60

Does this apply to Google, car companies, etc, or did they bribe in exceptions for themselves (like California grocery stores did for the Do Not Sell My Personal Information law)? Also, who gets the $200/day? If I issue a drop request, wait 145 days, then buy my data from brokers, do they have to pay me $20,000 per record they return?

Well the CPPA (state regulator) just hit General Motors with a $12.75M fine for selling data to two registered data brokers, and made the brokers who received the data delete it all: https://ccpa.world/enforcement/gm-onstar-smart-driver

Does it apply to Google? Well that's an interesting question. I think the answer is yes but the practical matter is that the CPPA is going to get some legal precedent and some more lawyers on staff before they take on Google. At the current number of requests in the DROP platform they could determine Google is an unregistered data broker and fine them $25B+, but I don't think they are going to do that this year.

I think within 36 months they will take the legal victories from prosecuting the first set of unregistered data brokers and apply it to the real players in the data ecosystem. At least, that's what I would do if I were Michael Macko.

Re: Californians' data deletion requests, DROP, become enforceable Aug. 1

#79

Post by jboggan »

hackernud3s wrote: post #3

What about unregistered data-brokers? I would he happy to sign up to webhooks for when someone wants to delete data. Problem is though, you'd be revealing more data about them than I probably have by sending it.

Do you think you could be an unregistered data broker? You should probably reach out to me directly so I can give you more targeted advice.

All of the requests are SHA-256 hashvalues, they aren't transmitting any usable information in the process of sending the deletion requests.

Re: Californians' data deletion requests, DROP, become enforceable Aug. 1

#80

Post by testing22321 »

tomhow wrote: post #74
testing22321 wrote: post #67

Earlier quoted context omitted.

> If anyone is worried about personally identifying information, we're always happy to redact the PII and reassign comments/posts to an anonymous account This is the identical line dang fed me, and what he did is useless. It changes nothing. Stop saying you’ll go out of your way to help users when you clearly won’t. Changing my username on all my old comments to some other username is not enough. It’s trivial to figu…

We go to great effort to find the right balance between a user's need for privacy and the community/public benefit in keeping threads intact and coherent (moving every one of a user's comments to a different username makes the threads incoherent). On a case-by-case basis we can move a selection of comments to a separate username. We of course don't want anyone to be in danger.

It seems like you’re more concerned about keeping threads from years ago coherent than you are about my wishes and safety.

Middle ground: on any given topic change all my comments to some random user I’d, then a different one for every topic.

threads will stay coherent, but people won’t be able to follow my old user name around topics for 14 years.

I’ll send an email in the morning. I have to sleep.

Post reply on HN