Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Californians' data deletion requests, DROP, become enforceable Aug. 1

nbcsandiego.com

Post reply on HN
Print view View original

61–70 of 106 posts

Re: Californians' data deletion requests, DROP, become enforceable Aug. 1

#61

Post by dredmorbius »

tjwebbnorfolk wrote: post #31

> Companies that fail to comply can face fines of $200 per day for each affected Californian. Does this cover things like credit reports/scores? If someone submits a request to this DROP thing, is it possible data gets deleted that they don't intend?

Probably not. Under TITLE 1.81.48:

“Data broker” does not include any of the following:

(1) An entity to the extent that it is covered by the federal Fair Credit Reporting Act (15 U.S.C. Sec. 1681 et seq.).

(2) An entity to the extent that it is covered by the Gramm-Leach-Bliley Act (Public Law 106-102) and implementing regulations.

(3) An entity to the extent that it is covered by the Insurance Information and Privacy Protection Act (Article 6.6 (commencing with Section 791) of Chapter 1 of Part 2 of Division 1 of the Insurance Code).

(4) An entity, or a business associate of a covered entity, to the extent their processing of personal information is exempt under Section 1798.146. For purposes of this paragraph, “business associate” and “covered entity” have the same meanings as defined in Section 1798.146.

https://leginfo.legislature.ca.gov/faces/codes_displayText.x...>

Credit bureaus are, I think, covered as item (1).

Re: Californians' data deletion requests, DROP, become enforceable Aug. 1

#62

Post by kooi »

ryandrake wrote: post #53

As good intentioned as it is, I don't like the wording used around this law. "Request" and "Ask" and "please delete my information." Notice that regular users have to "ask nicely" but when it's something like the DMCA, which benefits corporations, they use "takedown notices" and "demand letters." I don't want to ask data brokers, pretty please with sugar on top. I want to be able to demand they do it, and require the…

here-here

Re: Californians' data deletion requests, DROP, become enforceable Aug. 1

#63

Post by brookst »

ryandrake wrote: post #53

As good intentioned as it is, I don't like the wording used around this law. "Request" and "Ask" and "please delete my information." Notice that regular users have to "ask nicely" but when it's something like the DMCA, which benefits corporations, they use "takedown notices" and "demand letters." I don't want to ask data brokers, pretty please with sugar on top. I want to be able to demand they do it, and require the…

You’re free to label it as a demand, but unless you run a courtroom and swear them in, any failure to do so will not be perjury.

Re: Californians' data deletion requests, DROP, become enforceable Aug. 1

#64

Post by testing22321 »

tomhow wrote: post #52
testing22321 wrote: post #17

Earlier quoted context omitted.

And it’s utterly useless, because your username and all comments get THE SAME random user ID. So once someone identifies that ID as you, it does nothing. When I asked dang to do better after me and my family got death threats online, dang told me “tough luck” To this day thousands of my comments from my old username are on this site and trivially east to link to my real name. (Links to my website, etc)

> dang told me “tough luck” He (nor I) would never write that or anything like it. What we always say is that we aim to find a compromise between a user's wish for their entire history to be erased and the rest of the community's expectation that when they participate in discussion threads, those threads will persist unadulterated into the future. We are always willing to redact PII and do other things to prevent peo…

Dang said exactly that. What’s your email, I’ll forward it.

Changing my username to something random doesn’t help, because it’s trivial to find a comment or two that make it clear that random user ID is me, and then you can see all my comments.

There are two much better approaches.

1. Make every single comment of mine a new random user if so they’re all separate.

2. Make the user id of everyone who has ever asked for deletion ”deleted-user” so my comments are lost in the sea.

Either of those approaches would make it impossible to find all my old comments and know they all belong to the real me in the real world.

Please help. Death threats are not fun, especially when you have a 2 year old daughter. There is a 100+ page forum thread of people betting on when I (real name, real person) am going to die. Just saying that somewhat Doxxes me.

Re: Californians' data deletion requests, DROP, become enforceable Aug. 1

#65

Post by testing22321 »

vlovich123 wrote: post #33
testing22321 wrote: post #27

Earlier quoted context omitted.

100% In 2012 when I started commenting here I had no idea it would lead to death threats and I’d have a two year old daughter.

What kind of topics/comments did you make that got you death threats? Really want to make sure I stay away from such topics.

I don’t want to doxx myself.

There is a 100+ page forum thread of people betting on when I’m going to die. Redditors have commented in public “I wish he did die”, etc etc

Re: Californians' data deletion requests, DROP, become enforceable Aug. 1

#67

Post by testing22321 »

tomhow wrote: post #49
downrightmike wrote: post #29

Earlier quoted context omitted.

really just whatever dang feels like that day

We take users' privacy seriously and have had a consistent policy for years. If anyone is worried about personally identifying information, we're always happy to redact the PII and reassign comments/posts to an anonymous account. The only thing we don't do is wholesale wipe someone's entire history from HN, because it guts the threads and ruins them for everyone else who participated and who might find them interesti…

> If anyone is worried about personally identifying information, we're always happy to redact the PII and reassign comments/posts to an anonymous account

This is the identical line dang fed me, and what he did is useless. It changes nothing.

Stop saying you’ll go out of your way to help users when you clearly won’t. Changing my username on all my old comments to some other username is not enough. It’s trivial to figure out who I am, and then have all my comments attributed to me.

You should aim to actually do better, not just say that what you do now is good enough when it clearly isn’t.

Re: Californians' data deletion requests, DROP, become enforceable Aug. 1

#68

Post by tomhow »

amazingamazing wrote: post #34
EA-3167 wrote: post #30

Earlier quoted context omitted.

If you knew those were the conditions when you joined? Yes.

Ok. Luckily people who make the rules don’t have such ideas.

GDPR doesn't require that a participant on a discussion forum be able to erase their entire history. Article 17(3) covers this. It is reasonable for a user to ask that their posts be anonymized.

Re: Californians' data deletion requests, DROP, become enforceable Aug. 1

#69

Post by ransom1538 »

hedora wrote: post #60

Does this apply to Google, car companies, etc, or did they bribe in exceptions for themselves (like California grocery stores did for the Do Not Sell My Personal Information law)? Also, who gets the $200/day? If I issue a drop request, wait 145 days, then buy my data from brokers, do they have to pay me $20,000 per record they return?

Fast workers make $20 an hour in Cali, except for panera bread workers OBVIOUSLY.

Re: Californians' data deletion requests, DROP, become enforceable Aug. 1

#70

Post by ransom1538 »

MrZander wrote: post #7

Out of curiosity, does anyone know how this is enforceable for a company not based in California? Can CA fine a data broker that is based in another state but that is selling CA residents' information?

Yes. We talk to our lawyers here in FL. We take the legal document from CA and throw them in the garbage while laughing is the current policy.
Post reply on HN