Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Data Brokers

oag.ca.gov

Post reply on HN
Print view View original

21–30 of 80 posts

Re: Data Brokers

#21

Post by dialfordollars »

hbcondo714 wrote: post #5

> a “data broker” is in the business of aggregating and selling data about consumers with whom the business does not have a direct relationship I had to make a few clicks to find the definition, more details here (scroll down to section 1c): http://leginfo.legislature.ca.gov/faces/billTextClient.xhtml...

Lot of companies still need to register.

* LinkedIn - Sell your data via Sales Navigator

* ZoomInfo - Scrape your email account and sell the data to other businesses - https://www.zoominfo.com/business/about-zoominfo/privacy-pol...

* DiscoverOrg

* Clearbit - Browser extension scrapes your emails for data and they sell it to others via their "free browser-based add-ons, extensions, or plug-ins" - https://clearbit.com/privacy

* Hunter.io - Scrape people data from your browsing activities to resell.

* Demandbase

Re: Data Brokers

#22

Post by yalogin »

Is there a condensed version of the bill somewhere for lazy people like me?

I am looking to know -

- What the legal obligations of a data broker are.

- What are the legal obligations of sites/services that use them on their pages and enable them to get user data

Re: Data Brokers

#23

Post by waterheater »

yalogin wrote: post #22

Is there a condensed version of the bill somewhere for lazy people like me? I am looking to know - - What the legal obligations of a data broker are. - What are the legal obligations of sites/services that use them on their pages and enable them to get user data

According to 1798.99.80(d), a data broker is defined as "a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship."

The bill explicitly says the following entities are not considered data brokers: consumer reporting agencies, financial institutions, and insurance companies. (I'll note that this is a summary; the bill states more specifically those entities covered. However, the categories are generally correct.)

So, to the questions.

> What are the legal obligations of a data broker?

According to 1798.99.82(b), the obligations are two:

1) The data broker must register with the Attorney General and pay the annual registration fee.

2) The data broker must provide the state with the name of the data broker; its primary physical, email, and internet website addresses; and any additional information or explanation the data broker chooses to provide concerning its data collection practices.

> What are the legal obligations of sites/services that use them on their pages and enable them to get user data?

The bill does not directly state any obligations. In my read, the key part of the definition of a data broker lies in the lack of a direct relationship to a consumer. A business can still sell customer information to a data broker, but I believe this would then fall under the purview of CCPA (which appears to be corroborated by the final line of this bill.) This bill seems targeted toward those who solely acquire information through other, indirect collection means.

My read of this bill (I'm not a lawyer) tells me the state understands the present value of data brokers and doesn't want to eliminate the industry with crushing regulations. However, we know there's plenty of corruption, greed, and lack of ethics among data brokers. Requiring entities to publicly declare their brokering of data seems like a reasonable way for government to reduce these issues.

Consider a restaurant which operates without a license. A license is good because the city knows of the existence of the restaurant. If the city was not aware of the existence of the restaurant, they could not, say, reliably send in health inspectors. Restaurant cleanliness is clearly a good thing since it reduces the potential for food-borne illnesses. I can envision similar analogous benefits from licensing data brokers.

----

Sources:

http://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?...

Re: Data Brokers

#24

Post by SpicyLemonZest »

oferzelig wrote: post #12
advisedwang wrote: post #9

Earlier quoted context omitted.

The law[1] specifically excludes " A consumer reporting agency to the extent that it is covered by the federal Fair Credit Reporting Act (15 U.S.C. Sec. 1681 et seq.)." [1] http://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?...

So what pains does this legislation solve? To me it seemed outrageous that a company I had no dealings with, accumulated data on me without my consent, and above all - their data was breached. I thought that's what this legislation was trying to address.

It is. But as a credit bureau, Equifax was already subject to some data protection regulations from the federal government - that's a large part of why they could even get in trouble in the first place. Due to details of constitutional structure in the US, California's general data protection law can't legally be applied to companies that are already subject to a federal data protection law.

Re: Data Brokers

#25

Post by Klonoar »

Skimming the bill is frustrating (readability doesn't seem to be a strong suite with govt sites) and a question comes to mind: does this basically only apply to California businesses, or any entity who has consumer data on California residents, or...?

I'm all for it, just wish that tidbit was more clear I guess.

Or maybe I'm just not reading it correctly, who knows.

Re: Data Brokers

#26

Post by santa_boy »

The real estate online industry is a significant data broker. Zillow, Realtor, Redfin, AirBnb etc have lead generation platforms that, I guess, fit into the definition of a data broker.

Re: Data Brokers

#27

Post by SpicyLemonZest »

JumpCrisscross wrote: post #18
barbecue_sauce wrote: post #15

Earlier quoted context omitted.

I would say they're technically not data brokers because they collect data directly from an agreed upon relationship with a consumer, and they do not sell the data itself but rather productize it for advertisers.

> they collect data directly from an agreed upon relationship with a consumer Facebook builds shadow profiles. Those involve no direct relationship with the surveilled.

But there's no evidence that the information they gather on non-users is shared with third parties, even in indirect ways like the ad-targeting information. (I don't necessarily reject the term "shadow profile", but it's important to remember that it's an activist term; there's no reason to expect that they have similar formats or uses to the non-shadow profiles.)

Re: Data Brokers

#28

Post by bryan_w »

JumpCrisscross wrote: post #18
barbecue_sauce wrote: post #15

Earlier quoted context omitted.

I would say they're technically not data brokers because they collect data directly from an agreed upon relationship with a consumer, and they do not sell the data itself but rather productize it for advertisers.

> they collect data directly from an agreed upon relationship with a consumer Facebook builds shadow profiles. Those involve no direct relationship with the surveilled.

Even if that was true,

> they do not sell the data itself

Selling seems like an important part of brokering

Re: Data Brokers

#29

Post by whtifbru »

What about businesses that aggregate api data, if you use 2-3 data brokers are you a data broker? Seems to me only the source should register but the i think theres a lack of definition there. So every user who uses a api with consumer demographics and sells data should register as a data broker?

Re: Data Brokers

#30

Post by parsimo2010 »

dialfordollars wrote: post #21
hbcondo714 wrote: post #5

> a “data broker” is in the business of aggregating and selling data about consumers with whom the business does not have a direct relationship I had to make a few clicks to find the definition, more details here (scroll down to section 1c): http://leginfo.legislature.ca.gov/faces/billTextClient.xhtml...

Lot of companies still need to register. * LinkedIn - Sell your data via Sales Navigator * ZoomInfo - Scrape your email account and sell the data to other businesses - https://www.zoominfo.com/business/about-zoominfo/privacy-pol... * DiscoverOrg * Clearbit - Browser extension scrapes your emails for data and they sell it to others via their "free browser-based add-ons, extensions, or plug-ins" - https://clearbit.com/…

I don't know about the others, but I'm not sure LinkedIn qualifies. They have a direct relationship because people have profiles that they voluntarily created.

It might be different if they were selling information from shadow profiles that they created from other people sharing their contact lists, but I don't think they are selling that.

Post reply on HN