Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Californians' data deletion requests, DROP, become enforceable Aug. 1

nbcsandiego.com

Post reply on HN
Print view View original

81–90 of 106 posts

Re: Californians' data deletion requests, DROP, become enforceable Aug. 1

#81

Post by wilg »

ryandrake wrote: post #53

As good intentioned as it is, I don't like the wording used around this law. "Request" and "Ask" and "please delete my information." Notice that regular users have to "ask nicely" but when it's something like the DMCA, which benefits corporations, they use "takedown notices" and "demand letters." I don't want to ask data brokers, pretty please with sugar on top. I want to be able to demand they do it, and require the…

Well, I don't think any of these things are legally required, so call it whatever you want.

Re: Californians' data deletion requests, DROP, become enforceable Aug. 1

#82

Post by jboggan »

I've been building the infra for data brokers to connect to DROP (easy), actually effect deletions (hard), and make sure the data stays deleted (harder): forgetmenaut.com

DROP is pretty significant considering that it's the first compliance system meant to have an immediate effect (delete the data), backward-looking effect (forward a legally-binding deletion request to everyone that data was sold to or shared with), and a forward-looking effect (never let that record re-enter your system, in perpetuity). This is significantly more tracking and auditing infrastructure than anyone in the industry has ever normally run, not to mention that the request volume is 100-10000x what most of these brokers would process in previous years.

We'll see how well companies actually managed to comply when audits are performed for every registered broker in 24 months. I also think the impending prosecutions (and likely bankruptcies) of several unregistered data brokers will encourage the others to take it more seriously.

Re: Californians' data deletion requests, DROP, become enforceable Aug. 1

#83

Post by vvbull »

what wrote: post #45
braiamp wrote: post #38

Earlier quoted context omitted.

Doing business is doing business, money isn't necessary to "do business". If you hold any interest and that person has any relationship with you in a way that can be inferred that a contract is implied, then that's business. That's why travel to get an "agreement" is considered a business expense, even if the agreement never materialize.

> doing business is doing business That’s not much of a definition.

You'd hate practicing law.

Re: Californians' data deletion requests, DROP, become enforceable Aug. 1

#84

Post by vvbull »

ransom1538 wrote: post #70
MrZander wrote: post #7

Out of curiosity, does anyone know how this is enforceable for a company not based in California? Can CA fine a data broker that is based in another state but that is selling CA residents' information?

Yes. We talk to our lawyers here in FL. We take the legal document from CA and throw them in the garbage while laughing is the current policy.

This feels like bloviating. You are unlikely to be subject to this law, and even if you were your lawyers probably wouldn't advise you to ignore laws in states where you operate. (If you don't operate in California or on California residents, then you are obviously not subject to this law.) And you're lawyers would definitely not recommend posting publicly that you plan to willfully break this law. Which suggests to me that you are just blowing hot air online.

Re: Californians' data deletion requests, DROP, become enforceable Aug. 1

#85

Post by vvbull »

mindslight wrote: post #75
tomhow wrote: post #71

Earlier quoted context omitted.

My email is the same as Dan's. hn@ycombinator.com. Yes you can forward it and I'll read it straight away. We can't necessarily do the exact things you've asked, because it makes all the discussion threads you participated in incoherent. We can take reasonable steps to disassociate personally-identifying comments from others. > Please help. Death threats are not fun, especially when you have a 2 year old daughter. The…

It seems like you should be able to do a middle ground that preserves the commenter identity in each individual thread, while destroying the links across different threads. For example, reserve the usernames 'deleted-xxxx' where x is a number. Then when someone wants their history obliterated, loop over every thread they have commented in. For each thread, choose a random number deleted-xxxx and assign that username…

It should just be randomly generated when the page loads. "Oh, this user has the 'dormant' flag set? Generate a uid on page load" so all their comments have consistency for that one viewer for that single page load. Then if you click that user to see all the posts by them, you get an empty set. (Have the search queries return nothing for dormant users.)

Re: Californians' data deletion requests, DROP, become enforceable Aug. 1

#86

Post by tomhow »

testing22321 wrote: post #80
tomhow wrote: post #74

Earlier quoted context omitted.

We go to great effort to find the right balance between a user's need for privacy and the community/public benefit in keeping threads intact and coherent (moving every one of a user's comments to a different username makes the threads incoherent). On a case-by-case basis we can move a selection of comments to a separate username. We of course don't want anyone to be in danger.

It seems like you’re more concerned about keeping threads from years ago coherent than you are about my wishes and safety. Middle ground: on any given topic change all my comments to some random user I’d, then a different one for every topic. threads will stay coherent, but people won’t be able to follow my old user name around topics for 14 years. I’ll send an email in the morning. I have to sleep.

> It seems like you’re more concerned about keeping threads from years ago coherent than you are about my wishes and safety.

This is obviously not true. We care about thread persistence and coherence as a default, because some of HN's most historically significant threads are from the earliest years. We will take reasonable steps to protect people's identity and safety once we know the specifics of the situation. We routinely redact URLs, company names, project names and other identifying details from historical comments to prevent people's identity from being inferred.

Re: Californians' data deletion requests, DROP, become enforceable Aug. 1

#87

Post by dragonwriter »

ryandrake wrote: post #53

As good intentioned as it is, I don't like the wording used around this law. "Request" and "Ask" and "please delete my information." Notice that regular users have to "ask nicely" but when it's something like the DMCA, which benefits corporations, they use "takedown notices" and "demand letters." I don't want to ask data brokers, pretty please with sugar on top. I want to be able to demand they do it, and require the…

The penalty for not honoring a DROP “request” is more severe than perjury (and, conversely, there is no penalty at all for not honoring a DMCA notice, the only effect is that you do not benefit from the DMCA safe harbor if you would have been liable for copyright violation without it.)

You are being distracted from the substance by non-substantial surface features.

Re: Californians' data deletion requests, DROP, become enforceable Aug. 1

#88

Post by aw1621107 »

Razengan wrote: post #66

How does this apply to shit like not being able to delete your past messages from a Discord server if you get banned from it?

I don't think Discord counts as a data broker under the act as it does not apply to entities with whom you have a "direct relationship"

Re: Californians' data deletion requests, DROP, become enforceable Aug. 1

#89

Post by hackernud3s »

jboggan wrote: post #79
hackernud3s wrote: post #3

What about unregistered data-brokers? I would he happy to sign up to webhooks for when someone wants to delete data. Problem is though, you'd be revealing more data about them than I probably have by sending it.

Do you think you could be an unregistered data broker? You should probably reach out to me directly so I can give you more targeted advice. All of the requests are SHA-256 hashvalues, they aren't transmitting any usable information in the process of sending the deletion requests.

[dead]

Re: Californians' data deletion requests, DROP, become enforceable Aug. 1

#90

Post by Bender »

echelon wrote: post #4

Does this mean people can delete comments from HN?

Does this mean people can delete comments from HN?

This is already a thing. One can reach out to dang to request their account or their comments be removed. They do not like to remove comments as it breaks some of the interaction and context people had on the site but they will not refuse to do it. hn@ycombinator.com

Post reply on HN