Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Massachusetts bans sale of precise location data in new privacy rights bill

techcrunch.com

Post reply on HN
Print view View original

51–60 of 65 posts

Re: Massachusetts bans sale of precise location data in new privacy rights bill

#51

Post by dylan604 »

nullc wrote: post #33
jboggan wrote: post #13

California very quietly passed AB-1542 last week which includes precise location data, health data, SSNs, etc. I expect many states to follow suit. Related, General Motors got hit with a $12.75M fine for reselling OnStar location data last month: https://ccpa.world/enforcement/gm-onstar-smart-driver

The FTC settlement with GM allows GM to sell precise location as long as it's anonymized by attaching it to anonymous identifiers rather than personal info. It also allows non-precise location (e.g. zipcode/census-block) attached to identifying information. Apparently no one at the FTC is smart enough to realize if Bob and anonid both move through the same sequence of approximate locations that the anonid is Bob. Or…

Selling anonymized precise location of a car that spends ~half the day at a residential location sure will make it impossible to de-anonymize that data.

The FTC under this administration that just doesn't care about people and only care about helping corporations.

Re: Massachusetts bans sale of precise location data in new privacy rights bill

#53

Post by m463 »

later in the article it said not only selling, but sharing.

important because "sharing" is much more prevalent than "selling" data.

that said, I wonder how "precise location", and statistics/algorithms will combine?

for example, what if someone moves from zipcode 1 to zipcode 2? would that work out to a more precise position?

Re: Massachusetts bans sale of precise location data in new privacy rights bill

#55

Post by lightedman »

stronglikedan wrote: post #20
post_break wrote: post #10

Does this include vehicle data? That's a big one. Your new car selling you out constantly.

I've been driving connected cars for a decade and I haven't felt sold out yet. What am I missing?

You're missing the fact that if I wanted to find you and kill you companies are collecting that location data and I can buy it and use it to accomplish my goal.

Re: Massachusetts bans sale of precise location data in new privacy rights bill

#57

Post by MisterTea »

jboggan wrote: post #13

California very quietly passed AB-1542 last week which includes precise location data, health data, SSNs, etc. I expect many states to follow suit. Related, General Motors got hit with a $12.75M fine for reselling OnStar location data last month: https://ccpa.world/enforcement/gm-onstar-smart-driver

I wonder how much money GM made selling the data vs the fine.

Re: Massachusetts bans sale of precise location data in new privacy rights bill

#58

Post by cucumber3732842 »

tencentshill wrote: post #29
stronglikedan wrote: post #20

Earlier quoted context omitted.

I've been driving connected cars for a decade and I haven't felt sold out yet. What am I missing?

Are you in the US? Currently if you are in the US and not native-born, you're at very direct risk. That data is how ICE builds their enforcement leads. It's still often wrong, so they might break down your door and arrest you at gunpoint anyways.

> That data is how ICE builds their enforcement leads

Which is kind of ironic when you think about how much of their target demographic is driving 1999 Ford Rangers and 2003 Chevy Savannas.

Obviously they'll just augment it with ALPR, but still.

Re: Massachusetts bans sale of precise location data in new privacy rights bill

#59

Post by mindslight »

fultonn wrote: post #17
mindslight wrote: post #12

Earlier quoted context omitted.

I don't disagree with the thrust of your criticism of the dynamic (especially long term). But there is a legitimate concern that the first test cases to hit the courts need to be quite unsympathetic egregious violators rather than surveillance dynamics that have been thoroughly normalized for decades. If people start bringing private suits against neighbors that have deployed Amazon surveillance cameras, "credit bure…

Section 2 already limits applicability to persons collecting or processing data on not less than 60,000 consumers, so suits brought against neighbors would be (rightfully) dismissed. The concern about poor precedent stemming from poor cases has some rational sense, but we have the benefit of experience. Empirically it just hasn't tended to play out like that in the case of consumer protection statutes in MA. One reas…

I'll admit my examples were pretty weak.

What I see is this bill, while a fantastic development, is still just addressing the tip of an iceberg on an industry that has been festering for many decades now (I mean, the "Fair" Credit Reporting Act - aka regulatory capture by the early digital surveillance industry - was passed in 1970). So "pushback" doesn't necessarily mean this law being undone, but rather it ending up as the full amount of privacy we can expect rather than first step of a hopeful trend.

For example look at how many more rights the GDPR grants. If a GDPR-analog were on the table in the US, the entire surveillance industry would balk. And these days the surveillance industry is basically the bulk of our "economy" (ie stock market valuations). And given the way "our" government works, I wouldn't be terribly hopeful about the individual liberty side prevailing over entrenched interests. Which is why I'm making an argument for more of a gradual shift.

Now having said that, perhaps it makes more sense for each bit of legislation to bite off fewer rights (as I'd say this legislation does), while including a private right of action so that the rights it does grant are maximally enforced. Having glaring violations of the law-as-written just sit there unaddressed is certainly its own powerful momentum-killer.

Re: Massachusetts bans sale of precise location data in new privacy rights bill

#60

Post by mindslight »

kmeisthax wrote: post #21
mc32 wrote: post #2

This is good and all States should adopt some. Eventually I’d like to see one at the federal level that supersedes state level ones so that we don’t have to deal the the mess that is taxation across 50 states. A nice uniform privacy bill at the Fed level would be nice.

No, we specifically DO NOT want uniformity. We want a minimum that states can go beyond. In the current environment, tech companies have to bribe 50 states plus the federal legislature in order to block privacy bills. If you have federal preemption, then you just have to bribe Congress, because states can't pass ANY privacy laws whatsoever. And we already know the feds do not want a privacy law: the entire legality o…

> The ideal is that every sovereign entity passes their own privacy law that applies to their territory, with a private right of action, and adtech companies are forced to adopt a "50 states legal" posture. This is, deliberately, a ratchet: it's easy for any state to require a higher standard but hard to get every state to reduce it, so privacy laws cannot be walked back in secret.

You put this so well it kind of dislodged where I was coming from on my other comment you had responded to. I don't want to be disheartened and cynical. It's just hard to have seen this privacy issue openly festering for over two decades now, and think that things are ever going to change.

I think a private right of action with a two year delay would be great. And perhaps county DA's should be able to bring actions as well as the AG (legal policy adjacent actions aren't really in their wheelhouse, but it could help nudge the AG into action). I think the time period is a balance between giving the AG enough time to act (or be pressured into action), versus not making it too long so that illegal businesses can simply lobby to neuter the whole law before it actually goes into effect.

Post reply on HN