Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CCPA Will Hit Dev Teams Harder Than GDPR

tonic.ai

Post reply on HN
Print view View original

61–70 of 179 posts

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#61

Post by saalweachter »

ghayes wrote: post #58
jarvuschris wrote: post #37

Counting an IP address as PII is kind of crappy, you need a court order to turn an IP alone into PII. Operators should be free to log traffic at the network level, PII should only come into play once you're asking someone to provide personal information.

Could you salt and perform a one-way hash on the IP address and store that? It would alleviate a large amount of leakage issues while still giving you uniqueness counts.

IPv4 addresses are only 32 bits, which makes building rainbow tables almost trivial.

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#62

Post by Karrot_Kream »

nickpeterson wrote: post #60
jordigh wrote: post #54

Earlier quoted context omitted.

One of the most famous "legal hacks", Richard Stallman's copyleft, had to be rewritten by a lawyer. rms wrote GPLv1 by himself and you should never use it. GPLv2 is the version that was actually vetted by a lawyer. A similar thing happened with Perl's Artistic License. Its version 2 is basically also a lawyer-approved rewrite. In other words, hackers, don't try this at home. There are professionals who can do this fo…

I find it somewhat sad that law is basically a guild where arcane language is used to gatekeep what should be a much more straightforward exercise.

It's not. It's the equivalent of saying "I can do this better" and producing unreliably, buggy code. Sure you can, but a more experienced professional can point out all the corner cases you missed.

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#63

Post by masonicb00m »

ghayes wrote: post #58
jarvuschris wrote: post #37

Counting an IP address as PII is kind of crappy, you need a court order to turn an IP alone into PII. Operators should be free to log traffic at the network level, PII should only come into play once you're asking someone to provide personal information.

Could you salt and perform a one-way hash on the IP address and store that? It would alleviate a large amount of leakage issues while still giving you uniqueness counts.

I built an Nginx plugin to do something like this https://github.com/masonicboom/ipscrub

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#64

Post by M2Ys4U »

kodablah wrote: post #45

Going into effect in a year? Seems like a business opportunity. Someone let me pay them $X and review my systems every so often and give me a seal saying I'm compliant with all these laws, and include some insurance up to $Y. Especially given the selective enforcement, there's money to be made from the chill alone. Compliance audit companies can probably just roll this into their package. Also, I'm a bit annoyed at l…

>Going into effect in a year? Seems like a business opportunity.

GDPR was law two years before it came in to effect and everyone left it until the last ~month.

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#66

Post by carbocation »

jordigh wrote: post #48
carbocation wrote: post #40

Earlier quoted context omitted.

I dislike how the minute someone mentions a legal hack, the responses are "oh, are you a lawyer?" Why not consider this reply on its merits?

Because it is super-risky to consider these things on their own merits if you are not the kind of person who regularly interacts with judges and juries. Laws are something that are applied within a particular kind of, ah, culture. You have to be familiar with the body of work of that culture and how they will likely interpret the law. Trying to interpret laws in ignorance of that culture is likely to lead to interpre…

Does everyone downvote all medical speculation in the numerous health threads on this site?

No.

It's fine for people to speculate about medical ideas, legal ideas, etc. Especially on a forum like this where there is no pretense that people are offering genuine legal advice.

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#67

Post by wahern »

kevin_b_er wrote: post #25
lxe wrote: post #2

> if a data breach occurs, the law permits consumers to recover up to $750 per incident This is great!

Simple, you just add this to clickwrap agreement: The Parties mutually agree that any and all disputes arising from or relating to this Agreement, including the interpretation or application of this Agreement will be submitted exclusively to final and binding arbitration pursuant to the Federal Arbitration Act. The arbitration will be conducted the state of Delaware or such other location as the Parties may agree, by…

Setting aside potential flaws in your thesis, theoretically the Federal Arbitration Act (FAA) can be circumvented by making the state the real party in interest but permitting a victim to sue and recover on behalf of the state. Because the state wouldn't be a party to any contract (and also because it's a state), the FAA wouldn't apply.

California does this for labor violations through it's Private Attorneys General Act (PAGA): https://www.dir.ca.gov/Private-Attorneys-General-Act/Private...

Glancing at the Wikipedia page for CCPA, it's possible that the CCPA is structured similarly--"Companies ... can be ordered in civil class action lawsuits ... subject to an option of the California Attorney General's Office to prosecute the company instead of allowing civil suits to be brought against it."

That said, I don't think California's PAGA has ever been tested vis-a-vis the FAA in the Supreme Court because it was only recently that they decided to strictly apply the FAA to employment contracts.

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#68

Post by heavenlyblue »

nickpeterson wrote: post #60
jordigh wrote: post #54

Earlier quoted context omitted.

One of the most famous "legal hacks", Richard Stallman's copyleft, had to be rewritten by a lawyer. rms wrote GPLv1 by himself and you should never use it. GPLv2 is the version that was actually vetted by a lawyer. A similar thing happened with Perl's Artistic License. Its version 2 is basically also a lawyer-approved rewrite. In other words, hackers, don't try this at home. There are professionals who can do this fo…

I find it somewhat sad that law is basically a guild where arcane language is used to gatekeep what should be a much more straightforward exercise.

I mean, if you pay attention to the names of the kernel API functions, you'd probably end up with the same conclusion.

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#69

Post by munk-a »

coldacid wrote: post #55
jboy55 wrote: post #27

Earlier quoted context omitted.

The $25 million revenue limit would be a pretty good guide from 'small'. Typically there are a lot of changes around that mark, one of which should be to stop using Customer data insecurely.

Except that revenue limit is just one term of an OR clause. If you hit any of those three listed points, CCPA comes down on you. No revenue at all but 50k unique visitors, and it applies.

Yea but the $25mil portion of the clause is the only one I see an excuse for, if you're saying that -all- businesses generating X revenue or higher need to comply with a regulation then it's good to make sure X is high enough that businesses in unrelated fields will be able to afford the cost of compliance without going bankrupt.

The other two categories specifically target companies that really should comply with this law - I assume the $25mil clause is there to make sure large companies can't loop hole themselves out of this somehow (offload PII responsibility onto a subsidiary or a "third party" that is incorporated in Bermuda by the owner of the company)

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#70

Post by pkaye »

AnthonyMouse wrote: post #32
fooey wrote: post #29

Earlier quoted context omitted.

The criteria is a "one or more of the following" not a combination of them all So if you make more than $25 million, OR your have more than 50k users or devices, OR you make more than 50% of your money selling data

Seems like the second one is the real problem. "50K users or devices" is less than 0.02% market share, even if you have only US customers, and for businesses with margins in the $1/user/year range it doesn't even cover one full time employee. You can end up with that many users on a side project all of a sudden if it gets posted to the front page of a site like this one.

50K California customers.
Post reply on HN