9 ms·

I read this and immediately thought "oh shit, yet another regulation for a small bootstrapped software business where we try to be honest while the big guys wil

I read this and immediately thought "oh shit, yet another regulation for a small bootstrapped software business where we try to be honest while the big guys will still find a way to circumvent it". Thankfully, I looked into the fine print and was wrong. This bill is only for Corporations that do over $50,000,000 in revenues or higher OR (EDITED from AND) have info on at least 1,000,000 or more customers. Of course, I don't mean to imply that smaller tech. companies are all saints but this bill clearly seems to be drafted for the bigger fishes who are powerful enough to blatantly ignore privacy laws. EDIT: I clarified one thing user downandout pointed that it could apply to App developers who may have a million users as well but overall, it should not affect bootstrappers or smaller tech. businesses that don't have that high amount of consumer data so my overall point still remains. Below is the link to the details on this bill: https://www.wyden.senate.gov/news/press-releases/wyden-releases-discussion-draft-of-legislation-to-provide-real-protections-for-americans-privacy https://www.wyden.senate.gov/news/press-releases/wyden-relea...

gigatexal 8y ago
So then big corps do all their customer information risking behavior in spun out small wholly owned subsidiaries or even arms length non owned ones and if successful acquire them for some fixed amount but if they screw up with this law the company just folds and the parent is free from financial damage.
- codegeek 8y ago
  I am not an expert bill reader but seems like this loophole is covered as there is another point that says : "(ii) is not substantially owned, oper ated, or controlled by a person, partner ship, or corporation that does not meet the 6 requirements under clause"
  - r00fus 8y ago
    Contracting it out still seems to bypass the regulation
    - setr 8y ago
      Tbh thats still a better outcome than the status quo isn’t it: a single hack is now limited in damage, and multiple are required to do the equivalent of todays scenarios
      - CamelCaseName 8y ago
        What if everyone contracts out the data collection to a single party? Only giving the data a larger exposure. I'm really glad this is coming to light and I hope it passes. It will be very interesting to see how companies try to avoid it, but at first glance, it seems well thought out.
        kissickas 8y ago
        If that company has 1,000,000 or more customers' data, then they're no longer exempt. Maybe you came in after the OOP did their edit.
    - hessenwolf 8y ago
      “Controlled”
- vkou 8y ago
  Generally speaking, judges and juries aren't idiots, and you can't hack around laws by claiming that your dog did it.
  - jacques_chester 8y ago
    Software engineers tend to assume that (a) they are the smartest in the room, (b) legislation is exactly like code, (c) caselaw doesn't exist and (d) nobody has ever had to write complex rules before software was invented. All of which, we feel, qualifies us to poke holes in any legislation we happen to stumble across. But, of course, it doesn't. Not even close. By way of analogy, if someone looked at a link to a github repo and said "yeah well I can't see any GOTO 10 lines, I bet this will crash when the IP trace becomes Apache'd" I hope someone would be patient and polite in explaining the several levels of wrongness involved.
    - zaarn 8y ago
      There are jurisdictions were caselaw doesn't exist (which a lot of software engineers also conveniently forget a lot of the time) or law is written differently from the anglo-american legislations (which software engineers also conveniently forget a lot)
      - jacques_chester 8y ago
        That the doctrinal basis is different does not change that law requires interpretation by experts using something more sophisticated than "it's just code". Civil jurisdictions don't have caselaw as an independent source of legal rules, but they still have cases and they still have interpretation. It is not uncommon for an ancient Roman jurist's opinion to be cited in argument in Scots law, just as it is not uncommon to cite very old English cases in Australian law. And it is also common to have civil codes in common law jurisdictions -- the criminal law I was taught was based on a statutory instrument which asserted itself to be the whole of the criminal law and which was frequently amended whenever courts began to accrete rulings around it.
  - fjsolwmv 8y ago
downandout 8y ago
You read that wrong. In order to NOT be a "covered entity," you must meet ALL of the following criteria: 1) Revenue of less than $50 million; AND 2) Must not have info on 1 million or more people; AND 3) cannot be a data broker That means an independent app developer who gets more than 1 million installs, or a website with more than 1 million users, IS a covered entity, regardless of revenue. Also, ANY "data broker," regardless of size, is covered. This info is on page 4 and 5. Edit: How is a factual comment getting downvotes? OP read it wrong, and I told him so. There's nothing in this comment to disagree with. There are only facts.
- codegeek 8y ago
  I corrected my And to an OR so yes, good point but overall, it still doesn't impact "entire startup community". There are plenty of tech. businesses that don't hit 50 Million in revenue AND don't have a million users. I am talking about those.
  - downandout 8y ago
    True, but the issue is that getting 1M+ installs isn't under the control of the developer. Sometimes things go viral - look at Flappy Bird. Under this law, that guy (if he were in the US) could be looking at decades in prison unless he took enough investment money to comply. This law also uses a very broad definition of "personal information" that could possibly include IP addresses. So it does have an effect on the entire community, in the sense that every startup hopes to surpass 1M users, and this law will punish them for it. I don't think it will pass as is, but if it does, this is truly a "sky is falling" moment for US startups. Because it effectively limits non-VC backed startups to less than 1M users, it also makes sure that there will never be a competitor to Facebook or Google. Like GDPR, it locks in entrenched competitors.
    - chickenfries 8y ago
      You think someone can compete with Google or Facebook without massive amounts of capital?
    - 8y ago
tptacek 8y ago
IIRC from my brief skim this morning, it's $50MM over three years, so it might make more sense to think about it in terms of $16MM/yr. edit: I misread this
- codegeek 8y ago
  This is where it gets tricky as it says annually over past 3 years. So i thought it means 50 mil every year for past 3 years ?
  - tptacek 8y ago
    Oh, I think you're right. Thanks!
adventured 8y ago
That ultimately doesn't matter. The bill has zero shot at passing and becoming law. Wyden doesn't have anywhere near the votes he would need, so it's essentially his fantasy idea of a bill. There's no privacy law that is going to get passed by the US Government, focused on large corporations, that involves sending violators to prison for up to 20 years.
- fjsolwmv 8y ago
  Right, this is just an election gimmick.
candybar 8y ago
The way GDPR hurt smaller companies wasn't so much that the regulation directly applied to smaller companies but that larger companies, due to the liability the regulation presented, no longer felt comfortable working with smaller vendors who they felt couldn't provide the assurance of GDPR compliance. External vendors became riskier that everyone reduced the number of vendors and partners they wanted to work with (either directly or indirectly), which had the cascading impact of smaller companies being cut out of the ad ecosystem and Google becoming much more dominant. Now I'm not yet familiar with this draft nor with how it's likely to evolve from this point on but you have to do one or the other. You make the regulation overarching enough that partners' lack of compliance affects your own compliance efforts, in which case smaller players are going to have a hard time competing and will be cut out of the ecosystem by legit big companies who have more to lose than you do. If you don't do that and it becomes relatively easy to outsource data-related liability to your partners, there will be a loophole where shady data collection and processing activities will tend to aggregate and move towards entities that are either exempt from regulations or at least willing to take on liability for their customers for short-term gains. The latter is distinctly worse than the status quo because you're making the problem worse. The former is arguably bad for the startup ecosystem. My understanding is that smaller players are, in the aggregate, much worse about pretty much everything and the effectiveness of GDPR-style regulations depends on the impact they have on smaller players who are much further away from compliance than the big tech companies who were for the most part never too far away from compliance and whose bottom line never depended on any of the alleged shady practices. Most people aren't aware of smaller ad-tech players or data vendors so often their (and their customers' or partners') wrong-doings are blamed on the big tech companies that are much more visible. To a large extent, what happened in the ad ecosystem is that smaller shadier ad tech companies forced everyone else to become shadier - if they are out there promising marketers more data, better tracking and more accurate measurements and they are accomplishing that through questionable practices, that still raises the bar for what marketers expect and they are able to force their way into integration with other platforms or at least force everyone to do similar things. Ultimately, there's a trade-off between transparency and measurements for marketers and privacy and a world dominated by lots of small players who don't trust one another is one where marketers are forced to require proof that their money is being well-spent, which means more privacy-defeating tracking and measurements.

gigatexal 8y ago

So then big corps do all their customer information risking behavior in spun out small wholly owned subsidiaries or even arms length non owned ones and if successful acquire them for some fixed amount but if they screw up with this law the company just folds and the parent is free from financial damage.

codegeek 8y ago
I am not an expert bill reader but seems like this loophole is covered as there is another point that says : "(ii) is not substantially owned, oper ated, or controlled by a person, partner ship, or corporation that does not meet the 6 requirements under clause"
- r00fus 8y ago
  Contracting it out still seems to bypass the regulation
  - setr 8y ago
    Tbh thats still a better outcome than the status quo isn’t it: a single hack is now limited in damage, and multiple are required to do the equivalent of todays scenarios
    - CamelCaseName 8y ago
      What if everyone contracts out the data collection to a single party? Only giving the data a larger exposure. I'm really glad this is coming to light and I hope it passes. It will be very interesting to see how companies try to avoid it, but at first glance, it seems well thought out.
      - kissickas 8y ago
        If that company has 1,000,000 or more customers' data, then they're no longer exempt. Maybe you came in after the OOP did their edit.
  - hessenwolf 8y ago
    “Controlled”
vkou 8y ago
Generally speaking, judges and juries aren't idiots, and you can't hack around laws by claiming that your dog did it.
- jacques_chester 8y ago
  Software engineers tend to assume that (a) they are the smartest in the room, (b) legislation is exactly like code, (c) caselaw doesn't exist and (d) nobody has ever had to write complex rules before software was invented. All of which, we feel, qualifies us to poke holes in any legislation we happen to stumble across. But, of course, it doesn't. Not even close. By way of analogy, if someone looked at a link to a github repo and said "yeah well I can't see any GOTO 10 lines, I bet this will crash when the IP trace becomes Apache'd" I hope someone would be patient and polite in explaining the several levels of wrongness involved.
  - zaarn 8y ago
    There are jurisdictions were caselaw doesn't exist (which a lot of software engineers also conveniently forget a lot of the time) or law is written differently from the anglo-american legislations (which software engineers also conveniently forget a lot)
    - jacques_chester 8y ago
      That the doctrinal basis is different does not change that law requires interpretation by experts using something more sophisticated than "it's just code". Civil jurisdictions don't have caselaw as an independent source of legal rules, but they still have cases and they still have interpretation. It is not uncommon for an ancient Roman jurist's opinion to be cited in argument in Scots law, just as it is not uncommon to cite very old English cases in Australian law. And it is also common to have civil codes in common law jurisdictions -- the criminal law I was taught was based on a statutory instrument which asserted itself to be the whole of the criminal law and which was frequently amended whenever courts began to accrete rulings around it.
- fjsolwmv 8y ago

downandout 8y ago

You read that wrong. In order to NOT be a "covered entity," you must meet ALL of the following criteria: 1) Revenue of less than $50 million; AND 2) Must not have info on 1 million or more people; AND 3) cannot be a data broker That means an independent app developer who gets more than 1 million installs, or a website with more than 1 million users, IS a covered entity, regardless of revenue. Also, ANY "data broker," regardless of size, is covered. This info is on page 4 and 5. Edit: How is a factual comment getting downvotes? OP read it wrong, and I told him so. There's nothing in this comment to disagree with. There are only facts.

codegeek 8y ago
I corrected my And to an OR so yes, good point but overall, it still doesn't impact "entire startup community". There are plenty of tech. businesses that don't hit 50 Million in revenue AND don't have a million users. I am talking about those.
- downandout 8y ago
  True, but the issue is that getting 1M+ installs isn't under the control of the developer. Sometimes things go viral - look at Flappy Bird. Under this law, that guy (if he were in the US) could be looking at decades in prison unless he took enough investment money to comply. This law also uses a very broad definition of "personal information" that could possibly include IP addresses. So it does have an effect on the entire community, in the sense that every startup hopes to surpass 1M users, and this law will punish them for it. I don't think it will pass as is, but if it does, this is truly a "sky is falling" moment for US startups. Because it effectively limits non-VC backed startups to less than 1M users, it also makes sure that there will never be a competitor to Facebook or Google. Like GDPR, it locks in entrenched competitors.
  - chickenfries 8y ago
    You think someone can compete with Google or Facebook without massive amounts of capital?
  - 8y ago

tptacek 8y ago

IIRC from my brief skim this morning, it's $50MM over three years, so it might make more sense to think about it in terms of $16MM/yr. edit: I misread this

codegeek 8y ago
This is where it gets tricky as it says annually over past 3 years. So i thought it means 50 mil every year for past 3 years ?
- tptacek 8y ago
  Oh, I think you're right. Thanks!

adventured 8y ago

That ultimately doesn't matter. The bill has zero shot at passing and becoming law. Wyden doesn't have anywhere near the votes he would need, so it's essentially his fantasy idea of a bill. There's no privacy law that is going to get passed by the US Government, focused on large corporations, that involves sending violators to prison for up to 20 years.

fjsolwmv 8y ago
Right, this is just an election gimmick.

candybar 8y ago

The way GDPR hurt smaller companies wasn't so much that the regulation directly applied to smaller companies but that larger companies, due to the liability the regulation presented, no longer felt comfortable working with smaller vendors who they felt couldn't provide the assurance of GDPR compliance. External vendors became riskier that everyone reduced the number of vendors and partners they wanted to work with (either directly or indirectly), which had the cascading impact of smaller companies being cut out of the ad ecosystem and Google becoming much more dominant. Now I'm not yet familiar with this draft nor with how it's likely to evolve from this point on but you have to do one or the other. You make the regulation overarching enough that partners' lack of compliance affects your own compliance efforts, in which case smaller players are going to have a hard time competing and will be cut out of the ecosystem by legit big companies who have more to lose than you do. If you don't do that and it becomes relatively easy to outsource data-related liability to your partners, there will be a loophole where shady data collection and processing activities will tend to aggregate and move towards entities that are either exempt from regulations or at least willing to take on liability for their customers for short-term gains. The latter is distinctly worse than the status quo because you're making the problem worse. The former is arguably bad for the startup ecosystem. My understanding is that smaller players are, in the aggregate, much worse about pretty much everything and the effectiveness of GDPR-style regulations depends on the impact they have on smaller players who are much further away from compliance than the big tech companies who were for the most part never too far away from compliance and whose bottom line never depended on any of the alleged shady practices. Most people aren't aware of smaller ad-tech players or data vendors so often their (and their customers' or partners') wrong-doings are blamed on the big tech companies that are much more visible. To a large extent, what happened in the ad ecosystem is that smaller shadier ad tech companies forced everyone else to become shadier - if they are out there promising marketers more data, better tracking and more accurate measurements and they are accomplishing that through questionable practices, that still raises the bar for what marketers expect and they are able to force their way into integration with other platforms or at least force everyone to do similar things. Ultimately, there's a trade-off between transparency and measurements for marketers and privacy and a world dominated by lots of small players who don't trust one another is one where marketers are forced to require proof that their money is being well-spent, which means more privacy-defeating tracking and measurements.