Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CCPA Will Hit Dev Teams Harder Than GDPR

tonic.ai

Post reply on HN
Print view View original

51–60 of 179 posts

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#51

Post by eridius »

carbocation wrote: post #40
kevin_b_er wrote: post #25

Earlier quoted context omitted.

Simple, you just add this to clickwrap agreement: The Parties mutually agree that any and all disputes arising from or relating to this Agreement, including the interpretation or application of this Agreement will be submitted exclusively to final and binding arbitration pursuant to the Federal Arbitration Act. The arbitration will be conducted the state of Delaware or such other location as the Parties may agree, by…

I dislike how the minute someone mentions a legal hack, the responses are "oh, are you a lawyer?" Why not consider this reply on its merits?

Probably because anyone who isn't a lawyer has no hope of considering this reply "on its merits".

My gut feeling is this "legal hack" wouldn't work, because if it did someone would have used it by now against some other law that provides for damages, and someone else would have figured out how to neuter the hack. Which is to say, there's probably an existing law that prevents this hack from working. But you'd need a lawyer to be able to say whether that's true or not.

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#52

Post by magicalhippo »

gwbas1c wrote: post #4

Great article, until the end. Who uses PII in test data derived from real customers? That's just an absurd practice to begin with, and no one who takes security seriously would even consider doing this.

Funny you should ask. This just popped up the other day over here in Norway:

https://www.dagensmedisin.no/artikler/2019/01/27/brukte-virk...

In summary, when doctors were testing a new electronic patient journal system, they used real social security numbers (our version of them). And just for kicks they tested in production, so the persons used got all kinds of prescriptions for stuff they didn't need etc.

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#53

Post by truesy »

IMO the biggest difference between CCPA and GDPR is that GDPR does not distinguish between large and small companies. Everyone needs to comply. At least with CCPA you can bootstrap a company and not have this be another thing you need to worry about, on day 0

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#54

Post by jordigh »

ChrisSD wrote: post #46
carbocation wrote: post #40

Earlier quoted context omitted.

I dislike how the minute someone mentions a legal hack, the responses are "oh, are you a lawyer?" Why not consider this reply on its merits?

"Legal hacks" are rarely, if ever, as clever as their proponents think. Scepticism is natural and warranted. Judges aren't complete morons and will take a dim view of "hacks". There could be loopholes somewhere but you'd need a lawyer to spot them.

One of the most famous "legal hacks", Richard Stallman's copyleft, had to be rewritten by a lawyer. rms wrote GPLv1 by himself and you should never use it. GPLv2 is the version that was actually vetted by a lawyer.

A similar thing happened with Perl's Artistic License. Its version 2 is basically also a lawyer-approved rewrite.

In other words, hackers, don't try this at home. There are professionals who can do this for you.

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#55

Post by coldacid »

jboy55 wrote: post #27
munk-a wrote: post #8

Earlier quoted context omitted.

Small companies that are just starting out may use real data in test environments since it's a bit easier than using mocked data... Honestly this really only holds for companies that also avoid unit/integration tests (which will generally require that data to support the tests be explicitly mocked in some manner) Since this involves computers nothing above is a hard rule, but it goes along with my experience.

The $25 million revenue limit would be a pretty good guide from 'small'. Typically there are a lot of changes around that mark, one of which should be to stop using Customer data insecurely.

Except that revenue limit is just one term of an OR clause. If you hit any of those three listed points, CCPA comes down on you. No revenue at all but 50k unique visitors, and it applies.

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#56

Post by coldacid »

truesy wrote: post #53

IMO the biggest difference between CCPA and GDPR is that GDPR does not distinguish between large and small companies. Everyone needs to comply. At least with CCPA you can bootstrap a company and not have this be another thing you need to worry about, on day 0

No, just once you reach 50k visitors to your site.

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#58

Post by ghayes »

jarvuschris wrote: post #37

Counting an IP address as PII is kind of crappy, you need a court order to turn an IP alone into PII. Operators should be free to log traffic at the network level, PII should only come into play once you're asking someone to provide personal information.

Could you salt and perform a one-way hash on the IP address and store that? It would alleviate a large amount of leakage issues while still giving you uniqueness counts.

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#59

Post by coldacid »

AnthonyMouse wrote: post #32
fooey wrote: post #29

Earlier quoted context omitted.

The criteria is a "one or more of the following" not a combination of them all So if you make more than $25 million, OR your have more than 50k users or devices, OR you make more than 50% of your money selling data

Seems like the second one is the real problem. "50K users or devices" is less than 0.02% market share, even if you have only US customers, and for businesses with margins in the $1/user/year range it doesn't even cover one full time employee. You can end up with that many users on a side project all of a sudden if it gets posted to the front page of a site like this one.

And it doesn't even have to be users in the signed-up sense if you simply have access logging turned on for your web server; 50k unique IPs would be enough.

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#60

Post by nickpeterson »

jordigh wrote: post #54
ChrisSD wrote: post #46

Earlier quoted context omitted.

"Legal hacks" are rarely, if ever, as clever as their proponents think. Scepticism is natural and warranted. Judges aren't complete morons and will take a dim view of "hacks". There could be loopholes somewhere but you'd need a lawyer to spot them.

One of the most famous "legal hacks", Richard Stallman's copyleft, had to be rewritten by a lawyer. rms wrote GPLv1 by himself and you should never use it. GPLv2 is the version that was actually vetted by a lawyer. A similar thing happened with Perl's Artistic License. Its version 2 is basically also a lawyer-approved rewrite. In other words, hackers, don't try this at home. There are professionals who can do this fo…

I find it somewhat sad that law is basically a guild where arcane language is used to gatekeep what should be a much more straightforward exercise.
Post reply on HN