4 ms·

We’re going to end up with some HIPAA like regulations on collecting data and it’s going to be a massive pain in the ass. The scary part is the big companies w

We’re going to end up with some HIPAA like regulations on collecting data and it’s going to be a massive pain in the ass. The scary part is the big companies will have the money to lobby for regulations to be written in a way that is easy for them to comply with while shutting out smaller companies and startups.

downandout 8y ago
This law applies only to data brokers in Vermont. From the article: Data brokers in Vermont will now have to register as such with the state; they must take standard security measures and notify authorities of security breaches (no, they weren’t before); and using their data for criminal purposes like fraud is now its own actionable offense. It defines data brokers as businesses in Vermont that buy and sell data on people with whom they have no direct relationship. Seems like a reasonable law - unlike GDPR, they aren’t trying to reach outside of their jurisdiction, they aren’t trying to wipe out entire business models, there are no absurd fines, it’s easy to know if you’re violating it (because you would know that you have setup a data brokerage in Vermont), etc. My guess is there are only a handful of “data brokers” as they define that term within Vermont, so this affects very few people.
- matte_black 8y ago
  I didn't stand up for the data brokers because I wasn't a data broker, etc.. etc.. when they came for me, there was no one left to stand up... etc
  - quantum_magpie 8y ago
    This quote only works when you're using other neutral, but unrelated-to-you parties. Data brokers are scum. They do not produce any value, they do not improve the society, they have no positive effect on anyone. No reasonable person should stand up to protect them from liability.
    - lovich 8y ago
      Agreed. The "didnt stand up for [x]" quote only works when we are passively letting groups be hurt. I would actively help to destroy this business model if possible
- niftich 8y ago
  Your reading that they define 'data broker' as a business in Vermont is not substantiated by the text of the bill [1]. Some excerpts that define some key terms: "(2) "Business" means a commercial entity, including a sole proprietorship, partnership, corporation, association, limited liability company, or other group, however organized and whether or not organized to operate at a profit, including a financial institution organized, charterd, or holding a license or authorization certificate under the laws of this State, any other state, the United States, or any other country, or the parent, affiliate, or subsidiary of a financial institution, but does not include the State, a State agency, any political subdivision of the State, or a vendor acting solely on behalf of, and at the direction of, the State. (3) "Consumer" means an individual residing in this State. (4)(A) "Data broker" means a business, or unit or units of a business, separately or together, that knowingly collects and sells or licenses to third parties the brokered personal information of a consumer with whom the business does not have a direct relationship." [1] https://legislature.vermont.gov/bill/status/2018/H.764 https://legislature.vermont.gov/bill/status/2018/H.764
  - downandout 8y ago
    What you’re not understanding is that this is a state law. They can only regulate the activities of businesses that operate within their own state. They use the broad definition of a “business” because in the US you can be incorporated in Delaware and actually operate in Vermont. This is actually a common thing - most US corporations are incorporated under the laws of either Delaware or Nevada but operate within their home state. But the state only has the ability to regulate the actual operations of businesses operating within Vermont.
    - geocar 8y ago
      There's lots of ways a Vermont court could apply their laws to a Delaware corporation operating out of Delaware: Renvoi, significant contacts test, "better rule" test, and so on.
avn2109 8y ago
>> "...big companies will have the money to lobby for regulations to be written in a way that is easy for them to comply with while shutting out smaller companies and startups." GDPR is already this. If your company does less than 20 million a year, the fine for your first violation is 20 million, aka 100% of revenue.
- dmitriid 8y ago
  You mean "the maximum applicable fine" in case you "willfully abuse data".
  - Mirioron 8y ago
    Which could easily happen if the person levying the fine doesn't like you. In some countries the data protection agency has a whopping dozen to two dozen people working at it total. In other words, if it so happens that you don't get along with them then there's nothing stopping them to be harsher on their enforcement. You can't ask them for advice either. They'll tell you that they're there for enforcement.
    - guitarbill 8y ago
      It's not only wrong, but also very insulting to suggest there's no due process in the EU.
      - Mirioron 8y ago
        I'm not saying there is no due process, but it definitely is massaged in some parts of it. In the country I mentioned according to the statements of the Ministry of Justice the conviction rate is 99%. Out of 100 cases that go to trial only 1 gets a 'not guilty' verdict.
        dmitriid 8y ago
        That country is Russia perchance? Because that's statistics for Russia.
Analemma_ 8y ago
> We’re going to end up with some HIPAA like regulations on collecting data and it’s going to be a massive pain in the ass. Yes, that's the point: at the moment, vacuuming up every bit of data is essentially free, so companies take a maximalist approach to it, and aren't paying nearly their fair share of the resulting externality costs. Personal data storage needs to become costly enough that companies are forced to decide if it's actually worth it. I would also add that, just like every other time an industry failed completely at self-regulation and just ran wild until public outrage forced the government to step in, this wouldn't be happening if companies had been responsible. But CA and Experia and Unroll.me proved that was never a possibility.
- Mirioron 8y ago
  Didn't a lot of this privacy stuff start in the EU because some of the politicians didn't like the fact that it's big American companies that are getting all the business, while Europe had basically none of them? You can still see this attitude during Zuckerberg's appearance before the European Parliament when he was asked to name a European competitor to Facebook to show that Facebook is not a monopoly.
  - ahartmetz 8y ago
    How do you think that GDPR is the optimal way to achieve... Well, what exactly are you saying is the goal? You are only alluding, thus letting everyone complete your argument with whatever they may find most credible. IMO, it's that a) people in EU care more about privacy and b) the political influence of the data processors in question isn't as strong as in the USA. b) (with swapped roles) is the reason why the diesel emissions cheating and the FIFA bribery cases were investigated in the USA. They were open secrets, but nobody did anything about them in their countries of origin because of regulatory capture.
    - Mirioron 8y ago
      You can't really say that people in the EU care more about privacy, because it's the EU that brings this action. In the EU we have very poor participation in EU parliamentary elections and the commission is picked in ways that most people don't seem to understand. The 2014 EU parliamentary election had a voter turnout of 42.54%. The other thing is that the EU parliament has some internal political shuffling that most people aren't even aware of. I don't know anybody in real life that can name even one of the parties (or groups) in the EU parliament. It's very difficult to say that they're definitely doing what the people want. >How do you think that GDPR is the optimal way to achieve... Well, what exactly are you saying is the goal? You are only alluding, thus letting everyone complete your argument with whatever they may find most credible. Simply make it more difficult for established/outside companies to target the EU market. It's not a conspiracy, so there isn't like a step by step plan that could be taken by the EU to actually do this. Only some people and groups in the EU seem to be really interested in something like this.

downandout 8y ago

This law applies only to data brokers in Vermont. From the article: Data brokers in Vermont will now have to register as such with the state; they must take standard security measures and notify authorities of security breaches (no, they weren’t before); and using their data for criminal purposes like fraud is now its own actionable offense. It defines data brokers as businesses in Vermont that buy and sell data on people with whom they have no direct relationship. Seems like a reasonable law - unlike GDPR, they aren’t trying to reach outside of their jurisdiction, they aren’t trying to wipe out entire business models, there are no absurd fines, it’s easy to know if you’re violating it (because you would know that you have setup a data brokerage in Vermont), etc. My guess is there are only a handful of “data brokers” as they define that term within Vermont, so this affects very few people.

matte_black 8y ago
I didn't stand up for the data brokers because I wasn't a data broker, etc.. etc.. when they came for me, there was no one left to stand up... etc
- quantum_magpie 8y ago
  This quote only works when you're using other neutral, but unrelated-to-you parties. Data brokers are scum. They do not produce any value, they do not improve the society, they have no positive effect on anyone. No reasonable person should stand up to protect them from liability.
  - lovich 8y ago
    Agreed. The "didnt stand up for [x]" quote only works when we are passively letting groups be hurt. I would actively help to destroy this business model if possible
niftich 8y ago
Your reading that they define 'data broker' as a business in Vermont is not substantiated by the text of the bill [1]. Some excerpts that define some key terms: "(2) "Business" means a commercial entity, including a sole proprietorship, partnership, corporation, association, limited liability company, or other group, however organized and whether or not organized to operate at a profit, including a financial institution organized, charterd, or holding a license or authorization certificate under the laws of this State, any other state, the United States, or any other country, or the parent, affiliate, or subsidiary of a financial institution, but does not include the State, a State agency, any political subdivision of the State, or a vendor acting solely on behalf of, and at the direction of, the State. (3) "Consumer" means an individual residing in this State. (4)(A) "Data broker" means a business, or unit or units of a business, separately or together, that knowingly collects and sells or licenses to third parties the brokered personal information of a consumer with whom the business does not have a direct relationship." [1] https://legislature.vermont.gov/bill/status/2018/H.764 https://legislature.vermont.gov/bill/status/2018/H.764
- downandout 8y ago
  What you’re not understanding is that this is a state law. They can only regulate the activities of businesses that operate within their own state. They use the broad definition of a “business” because in the US you can be incorporated in Delaware and actually operate in Vermont. This is actually a common thing - most US corporations are incorporated under the laws of either Delaware or Nevada but operate within their home state. But the state only has the ability to regulate the actual operations of businesses operating within Vermont.
  - geocar 8y ago
    There's lots of ways a Vermont court could apply their laws to a Delaware corporation operating out of Delaware: Renvoi, significant contacts test, "better rule" test, and so on.

avn2109 8y ago

>> "...big companies will have the money to lobby for regulations to be written in a way that is easy for them to comply with while shutting out smaller companies and startups." GDPR is already this. If your company does less than 20 million a year, the fine for your first violation is 20 million, aka 100% of revenue.

dmitriid 8y ago
You mean "the maximum applicable fine" in case you "willfully abuse data".
- Mirioron 8y ago
  Which could easily happen if the person levying the fine doesn't like you. In some countries the data protection agency has a whopping dozen to two dozen people working at it total. In other words, if it so happens that you don't get along with them then there's nothing stopping them to be harsher on their enforcement. You can't ask them for advice either. They'll tell you that they're there for enforcement.
  - guitarbill 8y ago
    It's not only wrong, but also very insulting to suggest there's no due process in the EU.
    - Mirioron 8y ago
      I'm not saying there is no due process, but it definitely is massaged in some parts of it. In the country I mentioned according to the statements of the Ministry of Justice the conviction rate is 99%. Out of 100 cases that go to trial only 1 gets a 'not guilty' verdict.
      - dmitriid 8y ago
        That country is Russia perchance? Because that's statistics for Russia.

Analemma_ 8y ago

> We’re going to end up with some HIPAA like regulations on collecting data and it’s going to be a massive pain in the ass. Yes, that's the point: at the moment, vacuuming up every bit of data is essentially free, so companies take a maximalist approach to it, and aren't paying nearly their fair share of the resulting externality costs. Personal data storage needs to become costly enough that companies are forced to decide if it's actually worth it. I would also add that, just like every other time an industry failed completely at self-regulation and just ran wild until public outrage forced the government to step in, this wouldn't be happening if companies had been responsible. But CA and Experia and Unroll.me proved that was never a possibility.

Mirioron 8y ago
Didn't a lot of this privacy stuff start in the EU because some of the politicians didn't like the fact that it's big American companies that are getting all the business, while Europe had basically none of them? You can still see this attitude during Zuckerberg's appearance before the European Parliament when he was asked to name a European competitor to Facebook to show that Facebook is not a monopoly.
- ahartmetz 8y ago
  How do you think that GDPR is the optimal way to achieve... Well, what exactly are you saying is the goal? You are only alluding, thus letting everyone complete your argument with whatever they may find most credible. IMO, it's that a) people in EU care more about privacy and b) the political influence of the data processors in question isn't as strong as in the USA. b) (with swapped roles) is the reason why the diesel emissions cheating and the FIFA bribery cases were investigated in the USA. They were open secrets, but nobody did anything about them in their countries of origin because of regulatory capture.
  - Mirioron 8y ago
    You can't really say that people in the EU care more about privacy, because it's the EU that brings this action. In the EU we have very poor participation in EU parliamentary elections and the commission is picked in ways that most people don't seem to understand. The 2014 EU parliamentary election had a voter turnout of 42.54%. The other thing is that the EU parliament has some internal political shuffling that most people aren't even aware of. I don't know anybody in real life that can name even one of the parties (or groups) in the EU parliament. It's very difficult to say that they're definitely doing what the people want. >How do you think that GDPR is the optimal way to achieve... Well, what exactly are you saying is the goal? You are only alluding, thus letting everyone complete your argument with whatever they may find most credible. Simply make it more difficult for established/outside companies to target the EU market. It's not a conspiracy, so there isn't like a step by step plan that could be taken by the EU to actually do this. Only some people and groups in the EU seem to be really interested in something like this.