Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CCPA Will Hit Dev Teams Harder Than GDPR

tonic.ai

Post reply on HN
Print view View original

131–140 of 179 posts

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#131

Post by AnthonyMouse »

pkaye wrote: post #70
AnthonyMouse wrote: post #32

Earlier quoted context omitted.

Seems like the second one is the real problem. "50K users or devices" is less than 0.02% market share, even if you have only US customers, and for businesses with margins in the $1/user/year range it doesn't even cover one full time employee. You can end up with that many users on a side project all of a sudden if it gets posted to the front page of a site like this one.

50K California customers.

So less than 0.13% market share then.

Assuming you have any way to reliably identify which state your users are in -- which means we're back to "privacy regulations" encouraging companies to collect more data on their users.

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#132

Post by benjiweber »

thaumaturgy wrote: post #74
jarvuschris wrote: post #37

Counting an IP address as PII is kind of crappy, you need a court order to turn an IP alone into PII. Operators should be free to log traffic at the network level, PII should only come into play once you're asking someone to provide personal information.

There's been a lot of FUD surrounding the logging of IP addresses for network diagnostic and abuse purposes as a violation of GDPR (and now CCPA), but I'm not aware of any cases where that alone was sufficient to cripple a business. Until I hear otherwise, I'm going to gamble that for now that's not the kind of reckless mishandling of personal information that regulators are trying to crack down on.

The GDPR means you need a lawful basis for processing the data. Not that you can't process it at all.

There's lots of talk about consent as a basis for processing. For lots of purposes "Legitimate Interests" is likely a better basis. You'll have to perform a legitimate interests assessment and be able to justify that the potential negative impact of your processing is outweighed by the benefits.

The ICO has a interactive tool for selecting a basis for processing https://ico.org.uk/for-organisations/resources-and-support/l... with links to more information.

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#133

Post by yowlingcat »

tptacek wrote: post #130
yowlingcat wrote: post #125

Earlier quoted context omitted.

EDIT: Taking the L on this one.

You might take a second to click on 'carbocation's name and see what his background is. I think you've missed some subtext.

EDIT: Taking the L on this one.

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#134

Post by ThrustVectoring »

dmitriid wrote: post #129

Can we stop talking about how privacy laws are hitting devs, and start talking how they will benefit people? Boohoo, poor devs need to finally pay attention to people’s private data.

You need to talk about both costs and benefits when discussing public policy. Otherwise, you end up with a ton of terrible policy that looks good due to an obvious tangible benefit, but nets out to more harm than good.

For example, minimum bedroom sizes for rental units. Seems nice to have enough space to live comfortably, right? End result though is the $20M apartment complex has 35 units instead of 40, and is only built later when rents have gone up to make the project make sense financially, exacerbating a housing shortage.

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#135

Post by jdc »

taherchhabra wrote: post #128
michaelbuckbee wrote: post #116

Earlier quoted context omitted.

Lots of comments here about how IPs aren't PII b/c they can change, etc. I'm not arguing that, but consider that there is an entire _industry_ around using IPs to specifically target people, companies and households that is effective enough for businesses to write large checks to them. Household IP Targeting - https://www.vicimediainc.com/ip-targeting-direct-mail-intern... Or even just your ISP (who for sure know you…

The amount of information that can be found using your ip address https://clearbit.com/attributes (refer only the reveal api)

I just signed up for the trial and Reveal turns up nothing on my home IP address.

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#136

Post by droithomme »

sheeper wrote: post #107
jarvuschris wrote: post #37

Counting an IP address as PII is kind of crappy, you need a court order to turn an IP alone into PII. Operators should be free to log traffic at the network level, PII should only come into play once you're asking someone to provide personal information.

Another note... Per 1798.140(c)(1)(B), CCPA applies to a business that receives PII of =>50k consumers for the business’ commercial purposes . Which might not apply to access logs kept purely for diagnostic purposes.

A commercial purpose of ours is keeping the web site up.

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#137

Post by dbdjfjrjvebd »

wilg wrote: post #35
kevin_b_er wrote: post #25

Earlier quoted context omitted.

Simple, you just add this to clickwrap agreement: The Parties mutually agree that any and all disputes arising from or relating to this Agreement, including the interpretation or application of this Agreement will be submitted exclusively to final and binding arbitration pursuant to the Federal Arbitration Act. The arbitration will be conducted the state of Delaware or such other location as the Parties may agree, by…

Oh are you a lawyer?

OP needs to be not just a lawyer, but your lawyer. I.e. someone who is accountable to you if their advice is wrong.

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#138

Post by Angostura »

ehnto wrote: post #88
jarvuschris wrote: post #37

Counting an IP address as PII is kind of crappy, you need a court order to turn an IP alone into PII. Operators should be free to log traffic at the network level, PII should only come into play once you're asking someone to provide personal information.

Yeah it is odd. You decided to hit my server, I should be able to record the occurance. How am I suppposed to deflect DoS attacts if I can't maintain a list of nefarious IPs. I know that's a fairly low tech attack, but they still happen constantly. Is Fail2Ban no longer compliant? I wouldn't be surprised if some policies pertaining to record keeping in some sectors contradict that requirement as well.

You can do all those things under GDPR as they are required for the running of the service

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#139

Post by anticensor »

Novashi wrote: post #97
DiabloD3 wrote: post #94

So, devil's advocate here: why not just require your ToS to state that if the user is from the state of California, that they are to not use the service and find a local alternative? It is a state law, they can't hassle you if you're not Californian and do not service their target market. Most of America doesn't live there, and California seemingly doesn't want you to do business there.

>So, devil's advocate here: why not just require your ToS to state that if the user is from the state of California, that they are to not use the service and find a local alternative? Silently redirect them to a similar-enough site run by a partner company that's based in another state/country.

That would be considered an anticompetitive behaviour.

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#140

Post by dmitriid »

ThrustVectoring wrote: post #134
dmitriid wrote: post #129

Can we stop talking about how privacy laws are hitting devs, and start talking how they will benefit people? Boohoo, poor devs need to finally pay attention to people’s private data.

You need to talk about both costs and benefits when discussing public policy. Otherwise, you end up with a ton of terrible policy that looks good due to an obvious tangible benefit, but nets out to more harm than good. For example, minimum bedroom sizes for rental units. Seems nice to have enough space to live comfortably, right? End result though is the $20M apartment complex has 35 units instead of 40, and is only…

Let’s look at the cost, shall we?

Invasive and pervasive surveillance. Private and sensitive data sold wholesale not even to the highest bidder, but to anyone.

Hell, when news about NSA surveillance broke, it was a huge scandal that was the focus of attention of all media for more than a year. Now Facebook alone is reported to have the same level of maliciousness and willfull ignorance on a monthly basis, and it’s business as usual.

So yes, I don’t give a rat’s ass about the “poor developers” who couldn’t get their shit together and provide privacy and security to the common people. And who now pretend they are being unfairly punished by governments.

And yes, I’m a developer myself.

Post reply on HN