Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

California passes bill to make it easier to delete data from data brokers

latimes.com

Post reply on HN
Print view View original

121–130 of 154 posts

Re: California passes bill to make it easier to delete data from data brokers

#121

Post by lesuorac »

Simulacra wrote: post #86

Perhaps I'm a radical, but if you do not have a current ongoing direct relationship with the company, then that company should not be able to store and sell your private data. I realize this is probably very contrary to Silicon Valley business models, but I think the issue requires a hard line or else people will just violate it.

I mean what if I want to outsource payroll to say Equifax?

That would require sharing private data about employees with Equifax so that they're able to handle paying them.

Or if I want to ship a package to somebody; can I not give a 3rd party (DHL) the recipients address?

I like your idea but I think it needs some refinement. Perhaps just a time restriction; although I'm sure DHL would love to keep a photo proving that the package was delivered for a year.

Re: California passes bill to make it easier to delete data from data brokers

#122

Post by bob1029 »

I've gained a tremendous amount of respect for PII while selling software to banks.

My position on this type of data is that I am simply a temporary custodian over it. The identifiable person owns this information. I recognize it as pure liability for us. All downside in our business models.

We go out of our way to keep this stuff out of our systems. We spent the better part of a month talking about various architectures that would "keep the mess over there" (aka inside the bank's 'secure' environment).

The closest we get to liability is storing salted & hashed PII so that we can correlate business keys within sessions. If we find a piece of PII actually makes it through our layers of redaction, it is treated similar to production going down. Our entire team is trained to respond to a PII incident as if it were a radiation leak at a nuclear power plant.

Re: California passes bill to make it easier to delete data from data brokers

#123

Post by appplication »

johndhi wrote: post #118
appplication wrote: post #116

Earlier quoted context omitted.

It doesn’t cost much at all for companies to have infrastructure to delete user data. That’s just a cascading delete in any relational table. Poof, data gone in a single query. Sure, some systems are slightly more complex but deleting data is one of the easier challenges for any company to solve. What costs money is companies trying to figure out how to work around legal requirements, obfuscate this option from users…

This hasn't been my experience. Do you work in a large company? My experience has been that there are heaps and piles of data including (or potentially including, unstructured) personal information. And lots of reasons why complete deletion isn't possible - because certain other information nearby the personal information is necessary for business purposes (like submitting invoices), or because the person requesting…

I work at one of the largest, and have also worked at startups and in between.

Having PII littered about in ways that aren’t easily deletable is quite a canary. Companies with these issues are the same companies that end up with data breaches due to their cavalier treatment of user data. Perhaps these companies should be grateful they have a regulatory body ensuring they don’t fall too far behind the basic data stewardship practices the rest of the industry has in place.

Re: California passes bill to make it easier to delete data from data brokers

#124

Post by contravariant »

phendrenad2 wrote: post #93
contravariant wrote: post #92

Earlier quoted context omitted.

Not sure you know what CPPA stands for. Your objection makes little sense.

It stands for the California Privacy and Protection Agency, right?

Yeah turns out it was my reading comprehension that failed in this instance...

Re: California passes bill to make it easier to delete data from data brokers

#127

Post by [deleted] »

AdmiralAsshat wrote: post #83

This will be great! ...for California! Anyone who thought that California's "Do Not Sell My Data" requirements would cause websites to tamp down on the data collection nationwide were sorely disappointed when sites simply implemented an IP Address check to only display the option if they were in California. Other states followed suit, and sites amended their logic to show the banner in California, Virginia, etc. They…

[deleted]

Re: California passes bill to make it easier to delete data from data brokers

#128

Post by ptmcc »

bob1029 wrote: post #122

I've gained a tremendous amount of respect for PII while selling software to banks. My position on this type of data is that I am simply a temporary custodian over it. The identifiable person owns this information. I recognize it as pure liability for us. All downside in our business models. We go out of our way to keep this stuff out of our systems. We spent the better part of a month talking about various architect…

This is the path to enlightenment. The best way to protect PII is to ruthlessly minimize it in your system.

Better for compliance and better for customer security. And get to avoid whole sections of scrutiny and review when infosec comes knocking.

Re: California passes bill to make it easier to delete data from data brokers

#129

Post by happytiger »

If spying on people is the “lifeline of our digital economy,” maybe that needs to change.

Seems like a deeply positive step towards allowing people sovereignty over their own identities, albiet their identities in digital forms, which is deeply humanistic and a core of a less evil civil cyberpunk future.

Re: California passes bill to make it easier to delete data from data brokers

#130

Post by happytiger »

ptmcc wrote: post #128
bob1029 wrote: post #122

I've gained a tremendous amount of respect for PII while selling software to banks. My position on this type of data is that I am simply a temporary custodian over it. The identifiable person owns this information. I recognize it as pure liability for us. All downside in our business models. We go out of our way to keep this stuff out of our systems. We spent the better part of a month talking about various architect…

This is the path to enlightenment. The best way to protect PII is to ruthlessly minimize it in your system. Better for compliance and better for customer security. And get to avoid whole sections of scrutiny and review when infosec comes knocking.

As someone who’s dealt with vast troves of PII, you clearly speak from deep experience.
Post reply on HN