9 ms·

So the author would rather see each state/country implement it’s own laws so that a small startup needs to ensure they comply with hundreds of regulatory jurisd

So the author would rather see each state/country implement it’s own laws so that a small startup needs to ensure they comply with hundreds of regulatory jurisdictions... awesome.

buildzr 7y ago
I'm just going to ignore them all until my actual operating jurisdiction implements one, I'm not beholden to the laws of another country, let alone a specific state in it.
- social_quotient 7y ago
  I’m not sure this is entirely true. Texas for example has some pretty big arms (long-arm statute) when conducting business in or with a resident or Texas business. Maybe helpful - http://euro.ecom.cmu.edu/program/law/08-732/Jurisdiction/LongArmSurvey.pdf http://euro.ecom.cmu.edu/program/law/08-732/Jurisdiction/Lon...
  - buildzr 7y ago
    I'm not even in their country, pretty sure I'm not going to get extradited for breaking the privacy laws of a jurisdiction in which I have no physical presence.
badrequest 7y ago
or, you could not start a business that requires you capture every single facet of a person's life as a data point.
- LanceH 7y ago
  But you'll start a business which captures some data, and you're on the hook for proving that everything captured is necessary and compliant in hundreds of jurisdictions.
  - SomeOldThrow 7y ago
    You could start a different business instead.
mitchdoogle 7y ago
The gist of these laws are all the same. Just respect ALL users' data from the start, and you shouldn't have any difficulty with compliance.
- clay_the_ripper 7y ago
  Totally disagree. Complicate is not the same thing as following the spirit of the rules. Compliance is proving you followed the rules. Totally different. Also, you have to define what you mean by “respecting privacy”. Something that I do on my website, like basic retargeting marketing for abandoned shopping carts doesn’t feel to me like an invasion of privacy. To you, it might. The rules have to be defined clearly.
  - mirimir 7y ago
    If you don't collect any information that's not essential to delivering content and services, there shouldn't be any problem. If you have a shopping cart, you must collect billing and shipping information. But you don't need to use it for any other purpose.
    - btilly 7y ago
      By your rule, companies should not engage in A/B testing to figure out how to make their sites easier to use. Because that involves tracking users for a purpose that is not actually essential to delivering content and services. Does this outcome make sense to you? (Disclaimer, I have worked in adtech a little bit, but I have worked a lot more with A/B testing.)
      - mirimir 7y ago
        I suspect that A/B testing is doable without collecting user information. Except for the OS, of course. But certainly nothing that's not in server logs.
    - yuliyp 7y ago
      Do you have an error log on your web server? Does that only collect data that is essential or do you do something like log a referer or IP address or user id in hopes that it might be useful un debugging. Is there an access log? What happens if a user asks to delete their data. Do you go back and scrub all such logs? What about if you have a backend service that logs errors about what data it had problems accessing. Or an SQL server that logs bad queries? It's not so straight forward as you make it seem.
katabatic 7y ago
How is that different than, well -- anything? In the United States all 50 states can make their own laws; it's a fundamental part of our legal system. As for every country making their own laws - well, yeah? That's what sovereignty is all about?
- javagram 7y ago
  In cases where the Feds have decided there should be a uniform standard, states can’t make their own law. https://en.m.wikipedia.org/wiki/Federal_preemption https://en.m.wikipedia.org/wiki/Federal_preemption
  - kelnos 7y ago
    I don't think that works quite like you think it does. The Federal government generally does not restrict states from making stronger laws than the equivalent Federal law. Take the Federal minimum wage, for instance: they set one level, but states are free to set a higher minimum wage. This case follows the same pattern: whatever meager privacy protections in place at the Federal level will continue to apply, but California law will take precedence in the case where it's stronger. There are certainly exceptions, like how currently Trump and the EPA are attempting to disallow CA's higher vehicle emissions standards, but, again: exceptions. (In this case, the relevant law has specific language that makes the EPA the final authority on this sort of thing, and requires states to get waivers for going their own way. That's not a general, common thing, though.) And I expect that bit to be tied up in court for a while.
    - trothamel 7y ago
      Actually, I think you're the one that's incorrect here. California can set a higher minimum wage because it's explicitly allowed to by 29 U.S. Code § 218. https://www.law.cornell.edu/uscode/text/29/218 https://www.law.cornell.edu/uscode/text/29/218 That's an exception that's written into the law, while federal preemption is the usual rule.
    - javagram 7y ago
bpodgursky 7y ago
Yeah... CCPA and GDPR have proved that large enterprises will do just fine, because Amazon can always afford enough lawyers to handle regulatory overhead and confusion across territories. The startups end up either (1) ignoring the laws or (2) giving up. Good job EU, if making the FAANGs the only companies with the clout to hold customer data or break into new markets was your primary goal.
- TazeTSchnitzel 7y ago
  GDPR is not a difficult law to comply with for an EU company, unless you're adtech.
  - bsder 7y ago
    We've already had this discussion. We've already seen non-adtech companies simply shut down EU access if they don't have enough revenue. That's probably not a good thing. I support the GDPR, but complying with it is far from simple and the jurisprudence is not yet clear.
    - jjuhl 7y ago
      "We've already seen non-adtech companies simply shut down EU access if they don't have enough revenue. That's probably not a good thing." - Why not? I suspect we can live happily without them.
    - kelnos 7y ago
      > That's probably not a good thing. That's debatable. I imagine that many EU residents who are tired of having their data collected and sold by US companies consider this to be a very good thing. It also means that an EU-based company can come a long and fill the void left by the former incumbent that doesn't want to play ball, which is likely good for the EU's economy. Maybe it's not good for the US company, or for the US economy, but the EU (in theory) exists to further the interests of EU citizens. As a California resident, if the same happens with the CCPA, I will not shed a single tear.
bcheung 7y ago
Essentially, yes. And don't forget all the other ones from other countries as well.
PopeDotNinja 7y ago
And that's how privacy compliance as a service was born.
- Sweetness 7y ago
  i hate this, but you're right. pointless regulations that lead to pointless jobs to oversee and sell compliance is such a net waste for society.
- tchock23 7y ago
  Unfortunately, you’re correct. Post GDPR I’ve been pitched many times by EU companies trying to be my representative for GDPR, so if that is any indication we’ll see a booming industry for that in the US as well... Funny enough, the emails sent by these companies are not GDPR compliant and they’ve given me no indication as to how they gathered my info, nor do they give me an opt out.
TazeTSchnitzel 7y ago
No, a federal law that's as good as or better than CCPA would be great. But they know that's not what will happen.
rdiddly 7y ago
That's how it is with lots of things governed by laws though. Even murderers have to deal with a confusing patchwork of laws and penalties. "Do they have to prove premeditation in this state? Can the degree of the charge be changed at trial? Is there a death penalty?" It's getting so small-time murderers have to have a wall of law books just to do business!
ryandrake 7y ago
If your business is operating so close to the boundary of the law that you could be breaking it in some places but not others, then yea, you should be worried. If your business operates well above board and is not doing anything close to what might be the danger zone, then you should have nothing to worry about. It's always the folks walking right next to the cliff complaining about how complicated their path needs to be.
munk-a 7y ago
Each state can choose to be as restrictive as they like in their laws, and each startup can chose to invest in compliance on a wide scale or in the narrow scale as they'd like. It'd be nice if this was unified but it ain't because: 1. Tech companies lobby like hell at a national level 2. The national government is sort of broken right now so that's how the cookie crumbles. The fact that a number of companies have skirted local regulations and abused data usage so much is why this is happening, so don't blame the victims of this activity that want sane privacy laws - blame the bad actors that have forced this issue to need to be dealt with.
- Kalium 7y ago
  > Each state can choose to be as restrictive as they like in their laws, and each startup can chose to invest in compliance on a wide scale or in the narrow scale as they'd like. There's a special hell that exists where one state mandates records must be held for at least seven years and another mandates deletion at five. When the two states border one another and you may not have home addresses, how do you determine how to comply for a given user? You're absolutely right, in every way, that tech companies have brought this regulatory backlash on themselves. Yet, it might still be worth considering the potential costs.
  - DaveFr 7y ago
    Is this a hypo or a real example?
    - Kalium 7y ago
      As far as I know it's a hypothetical, but it is very much the kind of thing that could happen. Regulations don't always align across political borders, which means there's the possibility there being no way to comply with both.
      - behringer 7y ago
        This is what you call putting the cart before the horse.
jjuhl 7y ago
Just don't do stupid privacy violating shit and you'll be fine anywhere. Collect no information. Share no information. You are good - everywhere. And that really ought to be the default behaviour..
- GreenJelloShot 7y ago
  That is what they said about GDPR...
  - jjuhl 7y ago
    And what is your problem complying with that if you collect no information nor share any information?
    - vonmoltke 7y ago
      The main issue is proving compliance. Any website could, in theory, be recording information that counts as "personal data" under GDPR and CCPA without the user realizing it. What happens if a user doesn't believe you when you say you don't store or share anything? How do you prove to a regulator that you actually don't?
- fragmede 7y ago
  I'm not sure how ecommerce works without some information from the user, such as what they're trying to purchase, the quantity, a shipping address, and some form of payment, most likely a credit card.
  - morganherlocker 7y ago
    ... and if you plan to handle this type of highly sensitive data, you should be prepared to provide some basic levels of compliance, including appropriate auditing of sensitive data along with informed consent from users.
- opportune 7y ago
  How are you supposed to do any business over the internet without collecting information?
SomeOldThrow 7y ago
You could also not track or store PII.
nathanyz 7y ago
"With great scale, comes great responsibility"

So the author would rather see each state/country implement it’s own laws so that a small startup needs to ensure they comply with hundreds of regulatory jurisdictions... awesome.

buildzr 7y ago

I'm just going to ignore them all until my actual operating jurisdiction implements one, I'm not beholden to the laws of another country, let alone a specific state in it.

social_quotient 7y ago
I’m not sure this is entirely true. Texas for example has some pretty big arms (long-arm statute) when conducting business in or with a resident or Texas business. Maybe helpful - http://euro.ecom.cmu.edu/program/law/08-732/Jurisdiction/LongArmSurvey.pdf http://euro.ecom.cmu.edu/program/law/08-732/Jurisdiction/Lon...
- buildzr 7y ago
  I'm not even in their country, pretty sure I'm not going to get extradited for breaking the privacy laws of a jurisdiction in which I have no physical presence.

badrequest 7y ago

or, you could not start a business that requires you capture every single facet of a person's life as a data point.

LanceH 7y ago
But you'll start a business which captures some data, and you're on the hook for proving that everything captured is necessary and compliant in hundreds of jurisdictions.
- SomeOldThrow 7y ago
  You could start a different business instead.

mitchdoogle 7y ago

The gist of these laws are all the same. Just respect ALL users' data from the start, and you shouldn't have any difficulty with compliance.

clay_the_ripper 7y ago
Totally disagree. Complicate is not the same thing as following the spirit of the rules. Compliance is proving you followed the rules. Totally different. Also, you have to define what you mean by “respecting privacy”. Something that I do on my website, like basic retargeting marketing for abandoned shopping carts doesn’t feel to me like an invasion of privacy. To you, it might. The rules have to be defined clearly.
- mirimir 7y ago
  If you don't collect any information that's not essential to delivering content and services, there shouldn't be any problem. If you have a shopping cart, you must collect billing and shipping information. But you don't need to use it for any other purpose.
  - btilly 7y ago
    By your rule, companies should not engage in A/B testing to figure out how to make their sites easier to use. Because that involves tracking users for a purpose that is not actually essential to delivering content and services. Does this outcome make sense to you? (Disclaimer, I have worked in adtech a little bit, but I have worked a lot more with A/B testing.)
    - mirimir 7y ago
      I suspect that A/B testing is doable without collecting user information. Except for the OS, of course. But certainly nothing that's not in server logs.
  - yuliyp 7y ago
    Do you have an error log on your web server? Does that only collect data that is essential or do you do something like log a referer or IP address or user id in hopes that it might be useful un debugging. Is there an access log? What happens if a user asks to delete their data. Do you go back and scrub all such logs? What about if you have a backend service that logs errors about what data it had problems accessing. Or an SQL server that logs bad queries? It's not so straight forward as you make it seem.

katabatic 7y ago

How is that different than, well -- anything? In the United States all 50 states can make their own laws; it's a fundamental part of our legal system. As for every country making their own laws - well, yeah? That's what sovereignty is all about?

javagram 7y ago
In cases where the Feds have decided there should be a uniform standard, states can’t make their own law. https://en.m.wikipedia.org/wiki/Federal_preemption https://en.m.wikipedia.org/wiki/Federal_preemption
- kelnos 7y ago
  I don't think that works quite like you think it does. The Federal government generally does not restrict states from making stronger laws than the equivalent Federal law. Take the Federal minimum wage, for instance: they set one level, but states are free to set a higher minimum wage. This case follows the same pattern: whatever meager privacy protections in place at the Federal level will continue to apply, but California law will take precedence in the case where it's stronger. There are certainly exceptions, like how currently Trump and the EPA are attempting to disallow CA's higher vehicle emissions standards, but, again: exceptions. (In this case, the relevant law has specific language that makes the EPA the final authority on this sort of thing, and requires states to get waivers for going their own way. That's not a general, common thing, though.) And I expect that bit to be tied up in court for a while.
  - trothamel 7y ago
    Actually, I think you're the one that's incorrect here. California can set a higher minimum wage because it's explicitly allowed to by 29 U.S. Code § 218. https://www.law.cornell.edu/uscode/text/29/218 https://www.law.cornell.edu/uscode/text/29/218 That's an exception that's written into the law, while federal preemption is the usual rule.
  - javagram 7y ago

bpodgursky 7y ago

Yeah... CCPA and GDPR have proved that large enterprises will do just fine, because Amazon can always afford enough lawyers to handle regulatory overhead and confusion across territories. The startups end up either (1) ignoring the laws or (2) giving up. Good job EU, if making the FAANGs the only companies with the clout to hold customer data or break into new markets was your primary goal.

TazeTSchnitzel 7y ago
GDPR is not a difficult law to comply with for an EU company, unless you're adtech.
- bsder 7y ago
  We've already had this discussion. We've already seen non-adtech companies simply shut down EU access if they don't have enough revenue. That's probably not a good thing. I support the GDPR, but complying with it is far from simple and the jurisprudence is not yet clear.
  - jjuhl 7y ago
    "We've already seen non-adtech companies simply shut down EU access if they don't have enough revenue. That's probably not a good thing." - Why not? I suspect we can live happily without them.
  - kelnos 7y ago
    > That's probably not a good thing. That's debatable. I imagine that many EU residents who are tired of having their data collected and sold by US companies consider this to be a very good thing. It also means that an EU-based company can come a long and fill the void left by the former incumbent that doesn't want to play ball, which is likely good for the EU's economy. Maybe it's not good for the US company, or for the US economy, but the EU (in theory) exists to further the interests of EU citizens. As a California resident, if the same happens with the CCPA, I will not shed a single tear.

bcheung 7y ago

Essentially, yes. And don't forget all the other ones from other countries as well.

PopeDotNinja 7y ago

And that's how privacy compliance as a service was born.

Sweetness 7y ago
i hate this, but you're right. pointless regulations that lead to pointless jobs to oversee and sell compliance is such a net waste for society.
tchock23 7y ago
Unfortunately, you’re correct. Post GDPR I’ve been pitched many times by EU companies trying to be my representative for GDPR, so if that is any indication we’ll see a booming industry for that in the US as well... Funny enough, the emails sent by these companies are not GDPR compliant and they’ve given me no indication as to how they gathered my info, nor do they give me an opt out.

TazeTSchnitzel 7y ago

No, a federal law that's as good as or better than CCPA would be great. But they know that's not what will happen.

rdiddly 7y ago

That's how it is with lots of things governed by laws though. Even murderers have to deal with a confusing patchwork of laws and penalties. "Do they have to prove premeditation in this state? Can the degree of the charge be changed at trial? Is there a death penalty?" It's getting so small-time murderers have to have a wall of law books just to do business!

ryandrake 7y ago

If your business is operating so close to the boundary of the law that you could be breaking it in some places but not others, then yea, you should be worried. If your business operates well above board and is not doing anything close to what might be the danger zone, then you should have nothing to worry about. It's always the folks walking right next to the cliff complaining about how complicated their path needs to be.

munk-a 7y ago

Each state can choose to be as restrictive as they like in their laws, and each startup can chose to invest in compliance on a wide scale or in the narrow scale as they'd like. It'd be nice if this was unified but it ain't because: 1. Tech companies lobby like hell at a national level 2. The national government is sort of broken right now so that's how the cookie crumbles. The fact that a number of companies have skirted local regulations and abused data usage so much is why this is happening, so don't blame the victims of this activity that want sane privacy laws - blame the bad actors that have forced this issue to need to be dealt with.

Kalium 7y ago
> Each state can choose to be as restrictive as they like in their laws, and each startup can chose to invest in compliance on a wide scale or in the narrow scale as they'd like. There's a special hell that exists where one state mandates records must be held for at least seven years and another mandates deletion at five. When the two states border one another and you may not have home addresses, how do you determine how to comply for a given user? You're absolutely right, in every way, that tech companies have brought this regulatory backlash on themselves. Yet, it might still be worth considering the potential costs.
- DaveFr 7y ago
  Is this a hypo or a real example?
  - Kalium 7y ago
    As far as I know it's a hypothetical, but it is very much the kind of thing that could happen. Regulations don't always align across political borders, which means there's the possibility there being no way to comply with both.
    - behringer 7y ago
      This is what you call putting the cart before the horse.

jjuhl 7y ago

Just don't do stupid privacy violating shit and you'll be fine anywhere. Collect no information. Share no information. You are good - everywhere. And that really ought to be the default behaviour..

GreenJelloShot 7y ago
That is what they said about GDPR...
- jjuhl 7y ago
  And what is your problem complying with that if you collect no information nor share any information?
  - vonmoltke 7y ago
    The main issue is proving compliance. Any website could, in theory, be recording information that counts as "personal data" under GDPR and CCPA without the user realizing it. What happens if a user doesn't believe you when you say you don't store or share anything? How do you prove to a regulator that you actually don't?
fragmede 7y ago
I'm not sure how ecommerce works without some information from the user, such as what they're trying to purchase, the quantity, a shipping address, and some form of payment, most likely a credit card.
- morganherlocker 7y ago
  ... and if you plan to handle this type of highly sensitive data, you should be prepared to provide some basic levels of compliance, including appropriate auditing of sensitive data along with informed consent from users.
opportune 7y ago
How are you supposed to do any business over the internet without collecting information?

SomeOldThrow 7y ago

You could also not track or store PII.

nathanyz 7y ago

"With great scale, comes great responsibility"