> if a data breach occurs, the law permits consumers to recover up to $750 per incident This is great!
"up to" Are there any guidelines for determining actual compensation?
It would be decided in a civil court, most likely.
CCPA Will Hit Dev Teams Harder Than GDPR
11–20 of 179 posts
Re: CCPA Will Hit Dev Teams Harder Than GDPR
#12Great article, until the end. Who uses PII in test data derived from real customers? That's just an absurd practice to begin with, and no one who takes security seriously would even consider doing this.
We used a similar trick, not for testing, but the ability to download the prod database and debug things locally. We hit scaling issues before PII, so coworker built a system to generate real-ish DBs with only one customer's data. And then in a future version, sensitive fields were filtered or replaced with mock data. Not sure if there are better, less engineering effort ways of doing this, but it was a great tool when debugging.
Re: CCPA Will Hit Dev Teams Harder Than GDPR
#13Great article, until the end. Who uses PII in test data derived from real customers? That's just an absurd practice to begin with, and no one who takes security seriously would even consider doing this.
Sadly it's much more common than you might imagine.
Re: CCPA Will Hit Dev Teams Harder Than GDPR
#14ot: What's wrong with this website? It loads super slow and behaves very weirdly on my iPhone.
Apologies. We're using wix right now. We'll be moving off shortly.
Re: CCPA Will Hit Dev Teams Harder Than GDPR
#15Great article, until the end. Who uses PII in test data derived from real customers? That's just an absurd practice to begin with, and no one who takes security seriously would even consider doing this.
Many small companies take this approach. Usually it’s lower-risk PII.
Some small companies will refuse to use generated data if it takes even a minute more to generate it vs import it from production. In the consulting world I’ve seen multiple examples of companies complaining bitterly about other security minded consultants efforts to improve security and privacy through even small amounts of additional development time.
Re: CCPA Will Hit Dev Teams Harder Than GDPR
#16Great article, until the end. Who uses PII in test data derived from real customers? That's just an absurd practice to begin with, and no one who takes security seriously would even consider doing this.
I've seen that at an insurer...
Re: CCPA Will Hit Dev Teams Harder Than GDPR
#17> if a data breach occurs, the law permits consumers to recover up to $750 per incident This is great!
"up to" Are there any guidelines for determining actual compensation?
The full sentence is this fwiw:
>Additionally, if a data breach occurs, the law permits consumers to recover up to $750 per incident (or actual damages, if greater).
So that might just be $750 as part of a punitive fee.
Re: CCPA Will Hit Dev Teams Harder Than GDPR
#18>Process personal information of >50k consumers, households or devices
>Derive >50% of revenue from selling PII
So if I forward all of the data to another company outside of CA, does my company count as processing data?
What if the code that forwards that data is written by another company and I'm just hosting it on my site? Everything goes through their code and I'm paid to just setup a website to host their code.
Maybe I do collect info in CA but I sell the data for $1, but the company also buys some consulting services for the actual price of that data that I'm selling them?
Re: CCPA Will Hit Dev Teams Harder Than GDPR
#19Re: CCPA Will Hit Dev Teams Harder Than GDPR
#20Great article, until the end. Who uses PII in test data derived from real customers? That's just an absurd practice to begin with, and no one who takes security seriously would even consider doing this.
Many small companies take this approach. Usually it’s lower-risk PII. Some small companies will refuse to use generated data if it takes even a minute more to generate it vs import it from production. In the consulting world I’ve seen multiple examples of companies complaining bitterly about other security minded consultants efforts to improve security and privacy through even small amounts of additional development…
I have seen it done in a small company to check if a query will run too slow in production. Take a copy of the biggest database. Run query, see what happens, delete copy.