13 ms·

Salesforce CEO Benioff calls for national privacy law

318 points by jeffthechimp 8y ago

throwaway_2277 8y ago
Although, it might a wildly unpopular opinion here, if US does not innovate in AI, someone else (and you know who) will and US will have to follow the suit. Regulations are healthy as long as they are well understood and not over-reaching. Sounds like he wants to have regulation for all the aspects where their company innovate
ocdtrekkie 8y ago
Both the UN and the EU consider privacy a fundamental human right. We shouldn't be looking for a law, we should be looking for a Constitutional Amendment.
- strictnein 8y ago
  It would be improper to limit individuals in their interactions with other individuals or corporations via an amendment. A law is the proper place for that type of restriction.
  - gowld 8y ago
    You are getting reflexively downvoted, but it's not so clear cut. On the one hand, slavery was banned by 13th amendment. On the middle handle, alcohol was banned (18th) and then unbanned (21st) by amendment. On the other hand, nearly everything else in the Constitution is about the function of government and the rights of individuals with respect to government, not the rights of individuals with respect to other individuals.
  - glup 8y ago
    To clarify: your argument is that by precedent with existing amendments, the US Constitution should be limited to interactions with the state?
  - ocdtrekkie 8y ago
    We should arguably guarantee a right to privacy in the Constitution first, as we should have the same protections from government as well. (As our other human rights are generally protected via the Constitution.) Then, if it is viewed as improper to do so via Amendment, additional laws can be passed to apply it to private entities as well, much as the Civil Rights Act of 1964 builds on the 14th Amendment.
- JumpCrisscross 8y ago
  > Both the UN and the EU consider privacy a fundamental human right Privacy and free speech exist in natural conflict. Between the two, I prefer our society which enshrines the latter over the former to the European model which does the reverse.
  - s73v3r_ 8y ago
    Absolutely wrong. The two do not exist in any sort of conflict whatsoever.
    - JumpCrisscross 8y ago
      > The two do not exist in any sort of conflict whatsoever The "right to be forgotten” debate [1] neatly encapsulates this conflict. Journalists' rights to pry versus citizens' rights to avoid being pried on is another example [2]. This is a balancing act. Excessive privacy restricts what third parties can talk about. Unrestricted speech means anyone can say everything they know (or know to be false) about others' private lives. There are multiple equilibria. But acknowledging the trade-off is a pre-requisite to writing good law. [1] https://en.wikipedia.org/wiki/Right_to_be_forgotten https://en.wikipedia.org/wiki/Right_to_be_forgotten [2] https://www.economist.com/node/18621060 https://www.economist.com/node/18621060
      - mLuby 8y ago
        Free speech is not the same as violating someone's privacy (whether as a journalist or a doxxer).
        Matticus_Rex 8y ago
        You're begging the question in both your definition of free speech and assuming a certain bundle of privacy rights. There's plenty to debate on what speech freedoms people should have and what privacy rights people should have, but it's silly to claim that there's no conflict between them conceptually; if you're stating that there's no conflict, you're assuming a certain set of each, which is just you defining the problem a certain way so that you can say it is solved. If other people don't agree with your definition of the problem, then your solution doesn't hold for them.
slap_shot 8y ago
This is absolutely hilarious. This dude owns company that builds an array of products around identifying your users, storing as much information about them as possible, and then making that information as actionable as it can. >A national privacy law would require that companies disclose how they collect your information, use your information, and offer a right-to-be-forgotten, Benioff explained. “If you want to delete your information, you could hit that button and be sure your data is gone forever.” Okay, want to start by adding that button the Salesforce DMP Page? Right now, it looks like the best I can do is get an opt-out cookie that expires in 6 months [0]. I'll wait. [0] https://www.salesforce.com/products/marketing-cloud/sfmc/salesforce-dmp-privacy/ https://www.salesforce.com/products/marketing-cloud/sfmc/sal... Edit: I was being facetious. I know exactly why he said this and I don't expect Salesforce to do this until they legally have to. I just hope the irony wasn't lost on anyone.
- tome 8y ago
  Why would they do that unless their competitors are mandated to also?
- staplers 8y ago
  Well.. a privacy law banning everyone except those who are grandfathered in to collect data..
  - rckclmbr 8y ago
    They will help create the legislation so that it benefits their company and makes it harder for differentiated competitors. It also forces you to have more capital in order to implement those practices (which salesforce has), which means only big companies can compete. This is unfortunate. As more and more big tech companies do this, the tech industry is turning more and more into the bad guy, and something I didn't want to be involved in. I don't know, maybe he's being authentic and is seeing a problem, but the way the industry has been headed just makes me not trust it.
    - cptskippy 8y ago
collyw 8y ago
This seems slightly ironic from Salesforce. I am pretty sure companies that use Salesforce will also be doing as much tracking of their users as they know how to and feeding that data into Salesforce.
mychael 8y ago
Of course he does. Big businesses like SalesForce will benefit the most from the regulation and he gets the glory of virtue signaling about it.
- baxtr 8y ago
  Absolutely. It helps manifesting monopolies because smaller companies can’t afford to compete anymore.
- bllguo 8y ago
  I get these cynical responses, but ultimately don't many HN readers - me included - want this kind of law too? Why are people so hung up about the guy's motivations? seems like a case of letting perfect be the enemy of good
  - woolvalley 8y ago
    Seeing what is happening with GDPR currently is cause to be cynical. Lawmakers tend to copy & reference laws from other places as case studies. So if one law shows up somewhere, that law tends to start spreading around like it's a meme.
  - dredmorbius 8y ago
    Beware label vs. content. Good intentions, or their colour, pave many routes to Hell.
Shivetya 8y ago
Can we have opt out for government agencies as well? I posted the other day that many county and state governments let you search their data bases for a wealth of information and you can damn well bet they sell or provide bulk access. While I know it cannot be reasonably expected that "government" forget us in this manner it certainly could be forced to limit access to data that is identifiable back to an individual without their permission Example of the details offered, by address or name of owner http://www.cobbassessor.org/cobbga/search/commonsearch.aspx?mode=address http://www.cobbassessor.org/cobbga/search/commonsearch.aspx?...
- peatmoss 8y ago
  Many governments are providing access to the sort of data you link out of a desire / mandate for transparency. As an undergrad journalism major, one of our assignments was to dig up as much information as we could from public records about the school’s dean (he was a willing participant). The purpose of the exercise was to impress upon us how much information was available through public records. The difference now is that those records are digital and don’t require (in most cases) flipping through actual paper documents. The question of privacy vs. transparency is an active area of conversation now, particularly because people like yourself are discovering that you never had privacy around some transactions in the first place. Also, machine readability has changed the threat model somewhat. In general, however, I’d guess that transparency and open access to many kinds of data will continue to be the way the law leans.
ProAm 8y ago
I think it's fair we should implement some sort of Consumer DRM law, where explicit permission be granted to reproduce our private data.
- gowld 8y ago
  Copyright, not DRM. You should own your personal information, until 70 years after your death.
  - dredmorbius 8y ago
    Copyright doesn't apply to facts, only expression. A restated diary of your life with sub-second and sub-metre accuracy would not violate copyright law. (The initial collection ... might, though if not "an original work of authorship", that case is difficult to make..) What GP and you are looking for is privacy-specific legislation (or court interpretations).
eganist 8y ago
People might be missing the point. You always start ahead in a contract negotiation when you're the one writing the first draft. It's no different here having an adtech/martech company kick off a privacy discussion; Salesforce wants the upper hand because it's easier to know the ways around the legalese when you're the one writing it. The key is to say "you're right" to Benioff and then draft the law entirely without his influence.
- cityzen 8y ago
  "You always start ahead in a contract negotiation when you're the one writing the first draft." Never heard that but I like it. I am aware of it, just never heard it put into words like that. Thanks!
lixtra 8y ago
Can they please also come up with a reasonable standard to communicate the privacy policies, i.e. https://news.ycombinator.com/item?id=17067787 https://news.ycombinator.com/item?id=17067787
matchagaucho 8y ago
Regulatory capture would be the result of any regulation on FB. I'm not convinced that Benioff is devious enough to have this ulterior motive. But clearly, social networks have become the new CRM for many small-mid size businesses... and on that front FB represents a threat.
- thrav 8y ago
  Facebook is definitely not a threat to Salesforce small business. Hubspot, Insightly, and other small focused offerings plus Pad of Paper and Excel are the real competition for small CRM / Marketing buyers.
hadrien01 8y ago
Could we link to the canonical url [1] instead of the tracking shortened url please? [1] https://www.salesforce.com/company/news-press/stories/2018/5/051618/ https://www.salesforce.com/company/news-press/stories/2018/5...
- sctb 8y ago
  Sure thing, we've updated the link from https://sforce.co/2wKldaR https://sforce.co/2wKldaR.
jaredhansen 8y ago
The CEO of a massive public company that lives on data is calling for new regulations that his company will be better equipped to deal with than competitors will? Color me shocked.
- dmode 8y ago
  Just to clarify, Salesforce doesn't live on data. Salesforce primary business is CRM tools, where the data belongs to Salesforce customers. Salesforce is not tricking its customers' customers in giving them data for one purpose and then using it for another purpose and selling it to advertisers. Salesforce simply makes money from the CRM license. Not through data trading.
- throwaway48582 8y ago
  Salesforce is a database company. They have a lot of data about their customers, but they don't actually have much data that they can legally use. They're also pretty bad at using data.
gwbas1c 8y ago
> In some ways, you could say that Facebook has become the new cigarettes in our industry. That is, it's a technology that is addictive, it may not be that great for you and it might be something you don't want to go back to. I watched Bernioff repeat, over and over, about how much he loved Facebook, for about 30 minutes. This was in 2010 at the Moscone center in San Francisco, right before he introduced Chatter.
- inscionent 8y ago
  Is 8 years not long enough for someone to change their opinion or at least have their economic incentives change?
bedhead 8y ago
Benioff has become one of the most insufferable preachy loud-mouths in the US.
- organicmultiloc 8y ago
  Do you have other examples? I haven't heard much about him.
- rosser 8y ago
  Well, that's a substantive criticism.
deleted 8y ago
[deleted]
skrebbel 8y ago
I disagree with the people here who call out Benioff's hypocrisy in making this statement. It's not uncommon or hypocritical for companies to be in favour of regulation that would prohibit things that they currently do. The whole point is that if Salesforce would currently start respecting privacy more than they'd be legally required to, for plain ethical reasons, but other companies don't do the same, then they have a competitive disadvantage. If the law requires them to do so, they can be more ethical while the playing field is level. Of course there's still a strong and fair open discussion on how far a company should go in the "totally unethical but technically legal" arena of evil shit. But I don't see much of that discussion in this thread. Companies often welcome regulation. I once read somewhere that when cigarette companies were forbidden to advertise in the EU, their profits went up. All of them were only advertising to compete with the others, it was an arms race without end. When the entire arms race got outlawed, cost shrunk but income did not change. Smokers didn't suddenly switch brand because they didn't see bad jokes about camels every commercial block. I also disagree with the argument that this is a call for regulation to keep newcomers out. It's true that bigco's rooting for regulation often do this for anticompetitive reasons and it's abysmal, but I really don't see how increased privacy controls such as the GDPR (but in more places) prevents incumbents from outperforming and outmarketing the big shots. You need to come with a stronger argument about how such regulation affects Salesforce less than a tiny startup. Assuming it's decent regulation, of course - I fully agree if this ends up being a legal minefield. But eg the GDPR is decent regulation that is really not that hard to abide to unless you're genuinely evil (I say this as the owner of a small EU-based startup). The world could use more of that stuff.
njarboe 8y ago
I think the big problem is not privacy violations, per se, but that, with computers and the internet, one never knows what information about you is being stored and sold to others. The majority of states make it illegal to tape a conversation without consent of the other person. I support those laws. Also ones where businesses have to post they are using video surveillance. It would be great if the government or some other group would develop well defined levels of privacy with good names and icons so companies can easily describe their policies to the public. Like movie ratings. Not the best. Wish we did not need them. But works OK. I'll avoid companies that sell my location information to anyone who will pay. Passing laws where people somehow own what other people and companies know about you is not a good idea. I saw your dog poop on my lawn and you did not pick it up. Can I tell my neighbors about that? What about posting on Nextdoor? Local newspaper? A tweet? If I libel or slander someone, we have laws against that. It seems to me that telling a truth you know about someone should not be at the discretion of the someone. People just need to know when they are being observed, what is being observed, and by who (or what), so they can act accordingly. Not sure how to get to that space in this smartphone world.

318 points by jeffthechimp 8y ago

Although, it might a wildly unpopular opinion here, if US does not innovate in AI, someone else (and you know who) will and US will have to follow the suit. Regulations are healthy as long as they are well understood and not over-reaching. Sounds like he wants to have regulation for all the aspects where their company innovate

ocdtrekkie 8y ago

Both the UN and the EU consider privacy a fundamental human right. We shouldn't be looking for a law, we should be looking for a Constitutional Amendment.

strictnein 8y ago
It would be improper to limit individuals in their interactions with other individuals or corporations via an amendment. A law is the proper place for that type of restriction.
- gowld 8y ago
  You are getting reflexively downvoted, but it's not so clear cut. On the one hand, slavery was banned by 13th amendment. On the middle handle, alcohol was banned (18th) and then unbanned (21st) by amendment. On the other hand, nearly everything else in the Constitution is about the function of government and the rights of individuals with respect to government, not the rights of individuals with respect to other individuals.
- glup 8y ago
  To clarify: your argument is that by precedent with existing amendments, the US Constitution should be limited to interactions with the state?
- ocdtrekkie 8y ago
  We should arguably guarantee a right to privacy in the Constitution first, as we should have the same protections from government as well. (As our other human rights are generally protected via the Constitution.) Then, if it is viewed as improper to do so via Amendment, additional laws can be passed to apply it to private entities as well, much as the Civil Rights Act of 1964 builds on the 14th Amendment.
JumpCrisscross 8y ago
> Both the UN and the EU consider privacy a fundamental human right Privacy and free speech exist in natural conflict. Between the two, I prefer our society which enshrines the latter over the former to the European model which does the reverse.
- s73v3r_ 8y ago
  Absolutely wrong. The two do not exist in any sort of conflict whatsoever.
  - JumpCrisscross 8y ago
    > The two do not exist in any sort of conflict whatsoever The "right to be forgotten” debate [1] neatly encapsulates this conflict. Journalists' rights to pry versus citizens' rights to avoid being pried on is another example [2]. This is a balancing act. Excessive privacy restricts what third parties can talk about. Unrestricted speech means anyone can say everything they know (or know to be false) about others' private lives. There are multiple equilibria. But acknowledging the trade-off is a pre-requisite to writing good law. [1] https://en.wikipedia.org/wiki/Right_to_be_forgotten https://en.wikipedia.org/wiki/Right_to_be_forgotten [2] https://www.economist.com/node/18621060 https://www.economist.com/node/18621060
    - mLuby 8y ago
      Free speech is not the same as violating someone's privacy (whether as a journalist or a doxxer).
      - Matticus_Rex 8y ago
        You're begging the question in both your definition of free speech and assuming a certain bundle of privacy rights. There's plenty to debate on what speech freedoms people should have and what privacy rights people should have, but it's silly to claim that there's no conflict between them conceptually; if you're stating that there's no conflict, you're assuming a certain set of each, which is just you defining the problem a certain way so that you can say it is solved. If other people don't agree with your definition of the problem, then your solution doesn't hold for them.

slap_shot 8y ago

This is absolutely hilarious. This dude owns company that builds an array of products around identifying your users, storing as much information about them as possible, and then making that information as actionable as it can. >A national privacy law would require that companies disclose how they collect your information, use your information, and offer a right-to-be-forgotten, Benioff explained. “If you want to delete your information, you could hit that button and be sure your data is gone forever.” Okay, want to start by adding that button the Salesforce DMP Page? Right now, it looks like the best I can do is get an opt-out cookie that expires in 6 months [0]. I'll wait. [0] https://www.salesforce.com/products/marketing-cloud/sfmc/salesforce-dmp-privacy/ https://www.salesforce.com/products/marketing-cloud/sfmc/sal... Edit: I was being facetious. I know exactly why he said this and I don't expect Salesforce to do this until they legally have to. I just hope the irony wasn't lost on anyone.

tome 8y ago
Why would they do that unless their competitors are mandated to also?
staplers 8y ago
Well.. a privacy law banning everyone except those who are grandfathered in to collect data..
- rckclmbr 8y ago
  They will help create the legislation so that it benefits their company and makes it harder for differentiated competitors. It also forces you to have more capital in order to implement those practices (which salesforce has), which means only big companies can compete. This is unfortunate. As more and more big tech companies do this, the tech industry is turning more and more into the bad guy, and something I didn't want to be involved in. I don't know, maybe he's being authentic and is seeing a problem, but the way the industry has been headed just makes me not trust it.
  - cptskippy 8y ago

collyw 8y ago

This seems slightly ironic from Salesforce. I am pretty sure companies that use Salesforce will also be doing as much tracking of their users as they know how to and feeding that data into Salesforce.

mychael 8y ago

Of course he does. Big businesses like SalesForce will benefit the most from the regulation and he gets the glory of virtue signaling about it.

baxtr 8y ago
Absolutely. It helps manifesting monopolies because smaller companies can’t afford to compete anymore.
bllguo 8y ago
I get these cynical responses, but ultimately don't many HN readers - me included - want this kind of law too? Why are people so hung up about the guy's motivations? seems like a case of letting perfect be the enemy of good
- woolvalley 8y ago
  Seeing what is happening with GDPR currently is cause to be cynical. Lawmakers tend to copy & reference laws from other places as case studies. So if one law shows up somewhere, that law tends to start spreading around like it's a meme.
- dredmorbius 8y ago
  Beware label vs. content. Good intentions, or their colour, pave many routes to Hell.

Shivetya 8y ago

Can we have opt out for government agencies as well? I posted the other day that many county and state governments let you search their data bases for a wealth of information and you can damn well bet they sell or provide bulk access. While I know it cannot be reasonably expected that "government" forget us in this manner it certainly could be forced to limit access to data that is identifiable back to an individual without their permission Example of the details offered, by address or name of owner http://www.cobbassessor.org/cobbga/search/commonsearch.aspx?mode=address http://www.cobbassessor.org/cobbga/search/commonsearch.aspx?...

peatmoss 8y ago
Many governments are providing access to the sort of data you link out of a desire / mandate for transparency. As an undergrad journalism major, one of our assignments was to dig up as much information as we could from public records about the school’s dean (he was a willing participant). The purpose of the exercise was to impress upon us how much information was available through public records. The difference now is that those records are digital and don’t require (in most cases) flipping through actual paper documents. The question of privacy vs. transparency is an active area of conversation now, particularly because people like yourself are discovering that you never had privacy around some transactions in the first place. Also, machine readability has changed the threat model somewhat. In general, however, I’d guess that transparency and open access to many kinds of data will continue to be the way the law leans.

ProAm 8y ago

I think it's fair we should implement some sort of Consumer DRM law, where explicit permission be granted to reproduce our private data.

gowld 8y ago
Copyright, not DRM. You should own your personal information, until 70 years after your death.
- dredmorbius 8y ago
  Copyright doesn't apply to facts, only expression. A restated diary of your life with sub-second and sub-metre accuracy would not violate copyright law. (The initial collection ... might, though if not "an original work of authorship", that case is difficult to make..) What GP and you are looking for is privacy-specific legislation (or court interpretations).

eganist 8y ago

People might be missing the point. You always start ahead in a contract negotiation when you're the one writing the first draft. It's no different here having an adtech/martech company kick off a privacy discussion; Salesforce wants the upper hand because it's easier to know the ways around the legalese when you're the one writing it. The key is to say "you're right" to Benioff and then draft the law entirely without his influence.

cityzen 8y ago
"You always start ahead in a contract negotiation when you're the one writing the first draft." Never heard that but I like it. I am aware of it, just never heard it put into words like that. Thanks!

lixtra 8y ago

Can they please also come up with a reasonable standard to communicate the privacy policies, i.e. https://news.ycombinator.com/item?id=17067787 https://news.ycombinator.com/item?id=17067787

matchagaucho 8y ago

Regulatory capture would be the result of any regulation on FB. I'm not convinced that Benioff is devious enough to have this ulterior motive. But clearly, social networks have become the new CRM for many small-mid size businesses... and on that front FB represents a threat.

thrav 8y ago
Facebook is definitely not a threat to Salesforce small business. Hubspot, Insightly, and other small focused offerings plus Pad of Paper and Excel are the real competition for small CRM / Marketing buyers.

hadrien01 8y ago

Could we link to the canonical url [1] instead of the tracking shortened url please? [1] https://www.salesforce.com/company/news-press/stories/2018/5/051618/ https://www.salesforce.com/company/news-press/stories/2018/5...

sctb 8y ago
Sure thing, we've updated the link from https://sforce.co/2wKldaR https://sforce.co/2wKldaR.

jaredhansen 8y ago

The CEO of a massive public company that lives on data is calling for new regulations that his company will be better equipped to deal with than competitors will? Color me shocked.

dmode 8y ago
Just to clarify, Salesforce doesn't live on data. Salesforce primary business is CRM tools, where the data belongs to Salesforce customers. Salesforce is not tricking its customers' customers in giving them data for one purpose and then using it for another purpose and selling it to advertisers. Salesforce simply makes money from the CRM license. Not through data trading.
throwaway48582 8y ago
Salesforce is a database company. They have a lot of data about their customers, but they don't actually have much data that they can legally use. They're also pretty bad at using data.

gwbas1c 8y ago

> In some ways, you could say that Facebook has become the new cigarettes in our industry. That is, it's a technology that is addictive, it may not be that great for you and it might be something you don't want to go back to. I watched Bernioff repeat, over and over, about how much he loved Facebook, for about 30 minutes. This was in 2010 at the Moscone center in San Francisco, right before he introduced Chatter.

inscionent 8y ago
Is 8 years not long enough for someone to change their opinion or at least have their economic incentives change?

bedhead 8y ago

Benioff has become one of the most insufferable preachy loud-mouths in the US.

organicmultiloc 8y ago
Do you have other examples? I haven't heard much about him.
rosser 8y ago
Well, that's a substantive criticism.

deleted 8y ago

[deleted]

skrebbel 8y ago

I disagree with the people here who call out Benioff's hypocrisy in making this statement. It's not uncommon or hypocritical for companies to be in favour of regulation that would prohibit things that they currently do. The whole point is that if Salesforce would currently start respecting privacy more than they'd be legally required to, for plain ethical reasons, but other companies don't do the same, then they have a competitive disadvantage. If the law requires them to do so, they can be more ethical while the playing field is level. Of course there's still a strong and fair open discussion on how far a company should go in the "totally unethical but technically legal" arena of evil shit. But I don't see much of that discussion in this thread. Companies often welcome regulation. I once read somewhere that when cigarette companies were forbidden to advertise in the EU, their profits went up. All of them were only advertising to compete with the others, it was an arms race without end. When the entire arms race got outlawed, cost shrunk but income did not change. Smokers didn't suddenly switch brand because they didn't see bad jokes about camels every commercial block. I also disagree with the argument that this is a call for regulation to keep newcomers out. It's true that bigco's rooting for regulation often do this for anticompetitive reasons and it's abysmal, but I really don't see how increased privacy controls such as the GDPR (but in more places) prevents incumbents from outperforming and outmarketing the big shots. You need to come with a stronger argument about how such regulation affects Salesforce less than a tiny startup. Assuming it's decent regulation, of course - I fully agree if this ends up being a legal minefield. But eg the GDPR is decent regulation that is really not that hard to abide to unless you're genuinely evil (I say this as the owner of a small EU-based startup). The world could use more of that stuff.

njarboe 8y ago

I think the big problem is not privacy violations, per se, but that, with computers and the internet, one never knows what information about you is being stored and sold to others. The majority of states make it illegal to tape a conversation without consent of the other person. I support those laws. Also ones where businesses have to post they are using video surveillance. It would be great if the government or some other group would develop well defined levels of privacy with good names and icons so companies can easily describe their policies to the public. Like movie ratings. Not the best. Wish we did not need them. But works OK. I'll avoid companies that sell my location information to anyone who will pay. Passing laws where people somehow own what other people and companies know about you is not a good idea. I saw your dog poop on my lawn and you did not pick it up. Can I tell my neighbors about that? What about posting on Nextdoor? Local newspaper? A tweet? If I libel or slander someone, we have laws against that. It seems to me that telling a truth you know about someone should not be at the discretion of the someone. People just need to know when they are being observed, what is being observed, and by who (or what), so they can act accordingly. Not sure how to get to that space in this smartphone world.