8 ms·
California Unanimously Passes Historic Privacy Bill
- PlanarFreak 8y agoGood to hear! Glad to see that some state is going to stand up for consumer protections. > Facebook initially supported the opposition initiative, but pulled out publicly in April, a month after news broke that a political consulting firm called Cambridge Analytica amassed data on tens of millions of American Facebook users for political purposes without their knowledge. Hilarious. > [] lobbyists affiliated with the group TechNet were working behind the scenes to change crucial parts of the bill, as well, including the stipulation that businesses include a clear button on their websites giving people the ability to opt out of data collection. > The law goes into effect on January 1, 2020. The Internet Association has already hinted at efforts to modify the legislation before implementation. A year and a half before it goes live; the fight's not over yet. Gotta make sure they don't completely gut it before then, like the net neutrality bill.
- yuhong 8y agoI was writing my essay on Google at around the same time: http://yuhongbao.blogspot.com/2018/04/google-doubleclick-mozilla-essay-final.html http://yuhongbao.blogspot.com/2018/04/google-doubleclick-moz...
- sqdbps 8y agoIdiocy. The motive is to hamstring some of our most innovative companies which by itself is baffling and of course the collateral damage is the extra overhead and lawyers inflicted on all businesses big and small. The desire to imitate the euros in their efforts in making it as hard as possible for our companies to operate there is beyond stupid. California ballot initiatives like all referendums must be eradicated and the fact that a california real estate developer (the source of all that is wrong in the state) straight after killing recent zoning reform is using a ballot initiative to blackmail the assembly into passing this law makes it worse.
- x0x0 8y agoYou clearly haven't read the bill. Guess how I can tell? tip: company has to either (1) make more than $25m/year, or (2) buy or sell personal information of 50k+ consumers/devices; (3) make 50% of rev from selling personal data to be subject. ps -- passing laws popular with constituents is not exactly a reasonable definition of "blackmail."
- sqdbps 8y agoHow do they define what "selling personal data" means? Does that mean the the law affects equifax and not facebook for example? and what if a company which collects data is sold to another company or its assets were sold during bankruptcy does that count as selling personal data?
- x0x0 8y agohttps://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180AB375 https://leginfo.legislature.ca.gov/faces/billTextClient.xhtm...
- pteredactyl 8y agoThis sounds reasonable. Will you post a link to the legislation?
- x0x0 8y agosee 1798.140 https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180AB375 https://leginfo.legislature.ca.gov/faces/billTextClient.xhtm...
- pteredactyl 8y agoThanks!
- Rjevski 8y ago> most innovative companies If that innovation is about stalking people online & offline to serve them ads then no thanks.
- deleted 8y ago[deleted]
- jackfoxy 8y agoMost important part of the tldr; is this law does not take effect until 2020. Lots of time to be amended before then.
- 394549 8y ago> Most important part of the tldr; is this law does not take effect until 2020. Lots of time to be amended before then. Yeah, and it looks like the process has already started: > And yet, a report by The Intercept revealed that lobbyists affiliated with the group TechNet were working behind the scenes to change crucial parts of the bill, as well, including a stipulation that businesses must include a clear button on their websites giving people the ability to opt out of data collection.
- btown 8y agoText of the bill: https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180AB375 https://leginfo.legislature.ca.gov/faces/billTextClient.xhtm... Only seems to apply to companies with 50k+ California-resident users, or $25mm+ in revenue. So there's likely much less of a chilling effect on small businesses than GDPR. (IANAL, though, and with the speed this was pushed through, lawyers should take a much closer look in the coming days before anyone jumps to conclusions.)
- raven11 8y agoWatered down useless bill as a ballot initative would have given stronger protection vs the $750 fine limit with this bill. As usual big tech purchased the politicians, the last minute negotiations were about their price.
- burntrelish1273 8y agoIt's better than nothing. Until personal information is the property of the individual, and not resold/shared without permission, the "genie" is out of the "bottle;" lists and databases of personal information will continue to be trafficked by corporations of all sorts.
- alfredallan1 8y agoThat’s one of the most valid ideas I’ve heard - define private data as personal property. When one looks deeper into laws like GDPR and this one, at the heart of it lies the fact that a company cannot do as it pleases with an individual’s data without said individuals consent. But given the nature of the legislation, it is not too hard for a company to simply bypass it in ways that adhere to the letter of the law but not the spirit. If instead there were laws that defined private data as the personal property of the respective individual, the need for all this convoluted legislation would be rendered moot, since such a law would open the grounds for a variety of class action lawsuits against companies perceived to be egregiously abusive. The case law itself would set numerous precedents and eliminate the need for varied “interpretations” of one piece of legislation. IMO, this is what we should be pushing for, not more GDPR-clones which can be watered down by lobbyists.
- AdamM12 8y agoUntil government taxes it :)
- nostrademons 8y agoI'd love to see private data as personal property, but in practice that's likely to run into a lot of contradictions. The biggest problem is that most of the interesting private data is actually about relationships between multiple private individuals. If you're having a conversation with a friend on Whatsapp, is that conversation property of you, your friend, or do you each own your own messages? If it's a group conversation, is the whole conversation owned by all of the participants, or only parts of it? What if some people in the group chat aren't actually participating, but are just lurking? If you mention a company's product, does that mention belong to the company or the person mentioning it? What if instead of a product, you mention another person? What if you're quoting gossip they told you in person? This is why Hacker News doesn't let you delete or edit posts after 2 hours, BTW. Once people have read them and replied and referenced them elsewhere, it's not really fair to other participants in the conversation to remove the words they were replying to. Other social networks have run into real problems where people have edited their posts after many replies have been added to take the replies out of context and make them mean something totally the opposite of what their authors intended. If you own your own words, this is your right, but it's also a dickish and disruptive thing to do. The same applies to many other types of personal data. A credit report is a list of transactions between you and various creditors. The credit bureau didn't just snoop on everything you do, that information was reported to them by the other party of the transaction. If they own the data about them, this is within their rights, but it certainly doesn't feel about it when it's used to deny the borrower further credit. I think the current situation, where data is owned by the company or individual that collects it, is the most absurd alternative possible. But that's because our legal system is poorly structured to handle property rights where the "property" is owned by multiple firms, can be transferred easily (and surreptitiously) without the original owner losing rights, and may eventually come to harm one of the original owners.
- Gaelan 8y agoAFAICT, the opt-out stuff only applies to selling data, and not using it internally for ads or whatever. Seems like this won’t hit Google or FB very hard.
- adventured 8y agoThe disaster is going to be when/as every state adopts unique privacy legislation. It's going to be necessary for the US Congress to override these state-based rules using the Commerce Clause, FCC, and FTC, to takeover responsibility for legislating all digital privacy matters on the basis of its impact on interstate commerce and the FCC's overarching control of nearly anything involving electronic communication. It won't be practical or reasonable to track users across every state and their movements at all times. People that happen to cross a state line and the need to somehow magically identify their location of origin, and all the blah blah shit that goes with that nightmare. California (or any given state) will probably claim their law applies to California residents at all times, and states will claim their laws apply if you're in their state at any point, enter the conflicting nightmare. Here's also where GDPR's global enforcement proponents should get pretty excited: being consistent with that premise, now all of the EU has to comply with all privacy laws of all 50 US states, to the extent that they have users from the states. So EU companies will have to implement and maintain dozens of privacy schemes to fit all of the US states (as they each roll out unique privacy legislation). That glorious global enforcement. The world must now adopt all US policies. That's how it works according to GDPR proponents, right? Instead of the Web of insanity that that 50 state disaster will spin, the Feds will ideally smother all state attempts at establishing their own privacy frameworks, establish Federal regulations on the matter and overrule the states aggressively.
- casefields 8y agoThat's how car emissions are and the world isn't collapsing. Auto manufacturers know if they want access to California they're going to have to deal with the toughest pollution regulations.
- Sylos 8y ago> It’s similar to the General Data Protection Regulation that went into effect in the European Union last month, but adds to it in crucial ways. Under the GDPR, businesses are required to get users' permission before collecting and storing their data. But the way most companies have designed those opt-in pop-ups, "you really don't have a choice," says Ashkan Soltani Those opt-in dialogs that don't actually leave you a choice are not legal under the GDPR. So, you cannot add to the GDPR in crucial ways and somehow make these more illegal. In fact, the GDPR even requires that revoking once given consent is just as easy as giving it. So, companies that have no problem interpreting a single click as consent for something that you need a team of lawyers and tech experts to actually understand the implications of, will have to also somehow present users with a one-click process for revoking this consent. Companies like Google and Facebook just don't adhere to the GDPR and there's no reason to assume that they will adhere to this new law either. They've placed these clearly illegal dialogs and are now waiting for lawsuits to follow through, requiring them to actually adhere to the law then. They're gambling for the punishment to not be as high as the profit that they'll turn in the time that the lawsuit is not yet settled.