11–20 of 382 posts
> My name is Maya Mishina, and I am a resident of Novosibirsk, Russia. If i received such an email, I would mark it as spam and move on with my life. Why did this blogger take it seriously? Does she take other forms of spam so seriously? I do feel for her stress and anxiety, but I also have to question her mental ability to filter noise. Life must be quite stressful for her overall.
> My name is Maya Mishina, and I am a resident of Novosibirsk, Russia. If i received such an email, I would mark it as spam and move on with my life. Why did this blogger take it seriously? Does she take other forms of spam so seriously? I do feel for her stress and anxiety, but I also have to question her mental ability to filter noise. Life must be quite stressful for her overall.
Which even if it is completely nonsensical and has no basis in law, could cost thousands of dollars to hire a lawyer and file a response to a statement of claim.
If you have ever seen the experiences of people who have been sued by sovereign citizens/freeman-on-the-land/"this is an admiralty flag" people, it would help to better understand the context I'm viewing it in.
> My name is Maya Mishina, and I am a resident of Novosibirsk, Russia. If i received such an email, I would mark it as spam and move on with my life. Why did this blogger take it seriously? Does she take other forms of spam so seriously? I do feel for her stress and anxiety, but I also have to question her mental ability to filter noise. Life must be quite stressful for her overall.
I was contacted by my system administrator about this email, even though we chat roughly once a year; we get a lot of spam too but a legal threat is something you need to keep an eye on.
Yes but you still need to be judicious and critical.
How did anybody think it was appropriate to distress random human subjects by sending what appears at first glance to be a thinly veiled legal threat?
I wouldn't be surprised if most boilerplate CCPA request templates out there included the same wording. It's like when I send a FOIA request and put at the bottom, "this law says you are supposed to respond in X days," everybody knows that's the law already its just there to sound a bit more formal and like I actually care about the outcome. Obviously there is not going to be time or money for the vast majority of such technical violations to go to court. Would a study not be able to send out FOIA requests and study how long the responses took after including that verbiage because it's a "legal threat"?
To Whom It May Concern,
We are researchers at Princeton University conducting a study of how websites are implementing the EU and UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). We are reaching out to you because this email address is provided as a contact on the website [mydomain].
Your website may be required to implement one or both of GDPR and CCPA, and we would appreciate if you would answer a few brief questions about your privacy practices.
1) Does [mydomain] implement GDPR or CCPA? If not, could you please explain why? If you are uncertain about whether [mydomain] is required to implement these laws or answer questions like ours, we have included informative resources at the end of this email.
2) If you implement GDPR or CCPA, do you process data access requests from individuals who are not residents of the EU or UK (for GDPR) or who are not residents of California (for CCPA)?
3) If you implement GDPR or CCPA, do you process data access requests via email, a website, or telephone? If via a website, what is the URL?
4) If you implement GDPR or CCPA, what personal information must a user submit for you to verify and process a data access request?
5) If you implement GDPR or CCPA, what personal information do you provide in response to a data access request?
Thank you in advance for your answers to these questions. If there is a better contact for questions about privacy practices on [mydomain], I kindly ask that you forward my request to them.
Sincerely, Ross Teixeira
----------
We offer these resources about GDPR and CCPA for your convenience. Please note that we cannot provide legal advice about whether [mydomain] is required to implement these laws or respond to our questions like ours about GDPR and CCPA practices.
* Article 3 of the GDPR, which specifies coverage: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...
* European Data Protection Board guidance on GDPR coverage: https://edpb.europa.eu/our-work-tools/our-documents/guidelin...
* California Attorney General guidance on CCPA coverage: https://oag.ca.gov/privacy/ccpa#sectiona
* Section 1798.140 of the California Civil Code, which specifies the businesses that CCPA covers: https://leginfo.legislature.ca.gov/faces/codes_displaySectio...
I've thought about starting a blog a few times, and I had the exact same thought. While it's very easy to make a static website and store in on a CND to make it scale to billions of requests, it's very hard to create a moderation system that scales.
Edit: It's not that hard to see that there are potentially some social problems here e.g. "the message is easily construed as a legal threat" or "the message was mass mailed in a spam-like nature". However, my comment is in response to the title of the blog post which implies that the webmaster believes there's an ethical problem that this "experiment" was even run in the first place. For the purpose of this thread, assume the email was worded perfectly and the university was very thoughtful and deliberate in who they contacted. I'm interested in discussing the ethics behind how a perfectly legal and reasonable thing can in one case be ethical and another case be unethical simply by virtue of the context in which the action was carried out.
How did anybody think it was appropriate to distress random human subjects by sending what appears at first glance to be a thinly veiled legal threat?
The problem I have with saying this is a threat is that a best the threat of a lawsuit is at best hypothetical--if and only if some response is required by that law, and that response is not given, then you could see it as a threat. And most people writing that would have no reason or resources to dedicate to some frivolous lawsuit as a result. Obviously no one would sue for getting a response a couple days late, it…
It reads to me like the first message as a toehold in the door, from somebody who intends to litigate frivolously against the person they're sending it to.
> My name is Maya Mishina, and I am a resident of Novosibirsk, Russia. If i received such an email, I would mark it as spam and move on with my life. Why did this blogger take it seriously? Does she take other forms of spam so seriously? I do feel for her stress and anxiety, but I also have to question her mental ability to filter noise. Life must be quite stressful for her overall.
> I have a few questions about your process for responding to California Consumer Privacy Act (CCPA) data access requests
This is the worrying part.
> My name is Maya Mishina, and I am a resident of Novosibirsk, Russia. If i received such an email, I would mark it as spam and move on with my life. Why did this blogger take it seriously? Does she take other forms of spam so seriously? I do feel for her stress and anxiety, but I also have to question her mental ability to filter noise. Life must be quite stressful for her overall.
Fully agreed. I'm shocked she gave a random unsolicited emailer the time of day. Most problems are ones we create for ourselves. Responding to spam and then feeling like you've been the victim of some injustice that the spam didn't say "hey, I'm not really spam, I'm grad-student flavored spam" is quite a take. Here's a tip for anyone not running a business: If your response is legally required, it'll come in the phys…