I was part of a human subject research study without my consent • Hacker News Board

Re: I was part of a human subject research study without my consent

#191

Post by MaulingMonkey » Sun, Dec 19, 2021, 7:47 AM UTC

smsm42 wrote: post #160

dqv wrote: post #92

Earlier quoted context omitted.

They weren't just asking questions. From the email: >My questions are about your process for when I do submit a request. It's really easy to read this as "I am going to be submitting a request." >I look forward to your reply without undue delay and at most within 45 days of this email, as required by Section 1798.130 of the California Civil Code. So I'd say there is some legal threat here.

That code talks about businesses, and not just any businesses, but ones with revenue over $25M: https://oag.ca.gov/privacy/ccpa#sectiona Random blogger who's not a business does not have any connection to this. It's more like if I tell you I'll sue you for murder, high treason and collusion with the Martian invasion, is it really a legal threat? There's literally no legal way for me to sue anybody like that.

A baseless legal threat is still a legal threat, and that legal threat may well merit the time and energy to hire a lawyer to verify the baselessness of said threat, and to file the motion to dismiss should a lawsuit be filed despite the baseless cause of action, lest one suffer a default judgement on account of a failure to respond.

Re: I was part of a human subject research study without my consent

#192

Post by dqv » Sun, Dec 19, 2021, 7:47 AM UTC

smsm42 wrote: post #160

dqv wrote: post #92

Earlier quoted context omitted.

They weren't just asking questions. From the email: >My questions are about your process for when I do submit a request. It's really easy to read this as "I am going to be submitting a request." >I look forward to your reply without undue delay and at most within 45 days of this email, as required by Section 1798.130 of the California Civil Code. So I'd say there is some legal threat here.

That code talks about businesses, and not just any businesses, but ones with revenue over $25M: https://oag.ca.gov/privacy/ccpa#sectiona Random blogger who's not a business does not have any connection to this. It's more like if I tell you I'll sue you for murder, high treason and collusion with the Martian invasion, is it really a legal threat? There's literally no legal way for me to sue anybody like that.

That’s an FAQ for consumers. It’s not legally binding.

>These FAQs provide general consumer information about the CCPA and how you can exercise your rights under the CCPA. They are not legal advice, regulatory guidance, or an opinion of the Attorney General. We will update this information periodically.

I understand that someone can do cursory research and be overly confident in their understanding of a law that spans 46 pages. I hope you can understand that people can be underconfident in their understanding of a law that spans 46 pages, is bound by the entirety of a state’s statutes and case law, and feel overwhelmed by someone asking for a response on their compliance with said law. Regardless of what their interpretation of the original email should or shouldn’t be.

>It's more like if I tell you I'll sue you for murder, high treason and collusion with the Martian invasion, is it really a legal threat? There's literally no legal way for me to sue anybody like that.

Comparing a reasonable fear that one may not be in compliance with a complex legal system to something absurd does not invalidate that fear.

Re: I was part of a human subject research study without my consent

#193

Post by dendriti » Sun, Dec 19, 2021, 7:49 AM UTC

radu_floricica wrote: post #184

quadrifoliate wrote: post #48

A lot of people mocking the author or others for being scared and worried are basically blaming the victim here, and I would like them to stop. The nature of legal practices in the USA is such that the answers to "Are you totally in the clear legally?" and "Will you lose significant amounts of money proving in random courts that you are in the clear legally?" are often both yes. As a result, any researchers who send…

This I think is a typical example of having to hold two opposite thoughts at the same time. Yes, it's a bad thing to do, it's pretty obvious that it'll scare the bejesus out of some people and even worse, have some chilling effect. On the other hand the pendulum on ethical boards has gone waaaay in the other direction to the point where a lot of very useful research doesn't get done. The most vivid example being that…

This is an interesting take. What "very useful research" is being blocked by which IRBs?

FWIW, the author of the essay at the link you provided seems deeply ignorant of why IRBs exist. "Mere resident doctors weren’t allowed to do studies on their own. They would probably screw up and start building concentration camps or something. " really?

Re: I was part of a human subject research study without my consent

#194

Post by smsm42 » Sun, Dec 19, 2021, 7:51 AM UTC

TedDoesntTalk wrote: post #8

> My name is Maya Mishina, and I am a resident of Novosibirsk, Russia. If i received such an email, I would mark it as spam and move on with my life. Why did this blogger take it seriously? Does she take other forms of spam so seriously? I do feel for her stress and anxiety, but I also have to question her mental ability to filter noise. Life must be quite stressful for her overall.

Gives you a pause when you realize smart people probably wouldn't believe an email saying their SSN was arrested and they need to buy $500 in Amazon gift cards and send to this address to avoid being arrested by the FBI - but they totally believed a random person in Novosibirsk has rights to demand their attention and them performing various time-consuming tasks because some California law says so. I can't say such reputation for California laws is totally unearned (look up prop 65 if you want to know more on how insane it is).

Re: I was part of a human subject research study without my consent

#195

Post by quadrifoliate » Sun, Dec 19, 2021, 7:55 AM UTC

seanhunter wrote: post #136

dcow wrote: post #17

Can someone help me understand the ethical problem here? If I as an ordinary citizen contacted the webmaster with a similar worded email, the result would have been the same. The fact is that this “experiment” did not create any more or additional stress than is created for normal citizens/businesses simply engaging in normal legal activities. If submitting such a request has the potential to cause such undue stress,…

Well for starters they are lying and misreprenting themselves and the basis for their query. They say they are a data subject from Nice and represent that they are going to make a request under the CCPA. In actual practise they are a researcher from Princeton. If you don't think that's an ethical problem then I don't see it's worth discussing further. When you say "If I as an ordinary citizen..." you essentially make…

Also, the text on the page reads as tone-deaf enough for me to wonder if it's deliberately written to misrepresent the nature of the study activities to people on the IRB who are unfamiliar with technology. A quick Googling for everyone on the Stanford IRB Committee [1] shows Kyle Jamieson [2] as the only CS person – everyone else seems to be a clinician, scientist, or administrator.

> As part of the study, we are asking public websites about their processes for responding to GDPR and CCPA data access requests. We attempt to identify a website's correct email address for data access requests through an automated system.

You cannot "ask a website" and a website doesn't have a "correct email address". Given the targeted nature of the emails, I have trouble believing that these phrases were written in good faith by someone who understands that they are emailing the webmaster for a website, and expect an answer within a reasonable timeframe.

----------------------------------------

[1] https://ria.princeton.edu/Human-Research/Committee

[2] https://www.cs.princeton.edu/~kylej/

Re: I was part of a human subject research study without my consent

#196

Post by Sophira » Sun, Dec 19, 2021, 7:56 AM UTC

tantalor wrote: post #52

avalys wrote: post #40

Earlier quoted context omitted.

I didn't see a legal threat in the original email.

> ... as required by Section 1798.130 of the California Civil Code.

Also, while not a legal threat, "My questions are about your process for when I do submit a request." strongly implies an intent to submit a legal CCPA request in the future. Using "if" instead of "when" would have somewhat mitigated this, although it still comes across as somebody trying to find a loophole.

Re: I was part of a human subject research study without my consent

#197

Post by a-dub » Sun, Dec 19, 2021, 7:56 AM UTC

am i missing something? i don't see anything about research or studies in the original email.

maybe it's a legitimate inquiry?

maybe it's performance art? (does the blog post have to be taken down if a right to be forgotten request is filed?)

does the ccpa even apply to hobby or non-revenue generating endeavors?

Re: I was part of a human subject research study without my consent

#198

Post by kube-system » Sun, Dec 19, 2021, 7:57 AM UTC

brabel wrote: post #190

seanhunter wrote: post #136

Earlier quoted context omitted.

Well for starters they are lying and misreprenting themselves and the basis for their query. They say they are a data subject from Nice and represent that they are going to make a request under the CCPA. In actual practise they are a researcher from Princeton. If you don't think that's an ethical problem then I don't see it's worth discussing further. When you say "If I as an ordinary citizen..." you essentially make…

> they are lying and misreprenting themselves The police does that quite often to catch criminals. Sometimes they also target innocent people, is that ethical? People on HN don't usually lie, I hope, but most "misrepresent" themselves using anonymous accounts, sometimes claiming to be more than they actually are (I know, shocking). Emails you receive are more likely to be scams than not. If you're like the author and…

Academic research has a well established and formal set of ethics rules.

These rules are not as established or strict for other professions.

Re: I was part of a human subject research study without my consent

#199

Post by lisper » Sun, Dec 19, 2021, 7:57 AM UTC

My take: yes, a researcher misrepresented who they were. But that misrepresentation had nothing to do with the alleged harm. I see no reason to believe that the writer's reaction would have been any different if the request had been a completely legitimate one, which it very well could have been. The actual substance of the request was polite, non-threatening, and potentially legitimate. If the writer had bothered to do even a few minutes of research, she would have realized that the cited law did not apply to her and the requester was simply wrong when they said that it was. A panic attack was IMHO an extreme overreaction. Solicitations are sent out under false pretenses all the time by people with far more sinister motives. I think it's reasonable to expect adults in today's world to be able to take such things in stride and not freak out about them (or at least do a little bit of homework before freaking out).

Re: I was part of a human subject research study without my consent

#200

Post by dghlsakjg » Sun, Dec 19, 2021, 7:58 AM UTC

dcow wrote: post #17

Can someone help me understand the ethical problem here? If I as an ordinary citizen contacted the webmaster with a similar worded email, the result would have been the same. The fact is that this “experiment” did not create any more or additional stress than is created for normal citizens/businesses simply engaging in normal legal activities. If submitting such a request has the potential to cause such undue stress,…

The researcher invented false identities, and then used them to imply a legal requirement to expend labor and respond without notifying the recipient that they were just doing a study for academia. There are plenty of things you are allowed to do as an ordinary citizen that are considered unethical in an academic context.

As an absurd example of something that is highly unethical, but perfectly legal: research into whether certain images or colors on protest signs are likely to elicit a response. You choose military funerals as the protest site. In the US the right to protest at a funeral has been confirmed by the courts. This would still be an unethical action.

Many companies, including ones that I’ve worked for, that received a message like this would take it VERY seriously and expend some expensive resources (lawyers and programmers) to discover that ccpa does not apply and that they aren’t required to respond.

A more ethical way to gather this data would have been to be honest about identity and purpose, Notify the recipient that their response would be anonymized and never used against them, and to inform them that a response is not required.