4 ms·

Lot's of (mis)information floating around regarding CCPA. I recommend taking the time to read the actual text[1]. The text is not particularly long or dense. Th

Lot's of (mis)information floating around regarding CCPA. I recommend taking the time to read the actual text[1]. The text is not particularly long or dense. There has been a lot of speculation about complex compliance procedures, but the main thrust of the bill is to provide users with information about how their data is collected, who it is shared with, and the rights to prevent certain types of selling or sharing of said data. The leginfo site also includes non-partisan analysis (under the "Bill Analysis" tab) of the bill and amendments as it moves through the legislature, which is useful for getting an understanding of how specific issues are being considered and addressed. Something to consider is that bills change substantially through the amendment process, so often critiques you read are based off old versions of the text that have already been addressed. [1] https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180AB375 https://leginfo.legislature.ca.gov/faces/billTextClient.xhtm...

SamReidHughes 7y ago
> (4) Exercise free speech, ensure the right of another consumer to exercise his or her right of free speech, or exercise another right provided for by law. Well, thanks for the link. For example, informing people that a user is located in a dormitory in The Netherlands sounds like free speech to me. So is location tracking information exempt from deletion?
- morganherlocker 7y ago
  Location data is explicitly called out as sensitive personal information in the text of the bill, so it's definitely not exempt as a category of data. > (e) Many businesses collect personal information from California consumers. They may know where a consumer lives and how many children a consumer has, how fast a consumer drives, a consumer’s personality, sleep habits, biometric and health information, financial information, precise geolocation information, and social networks, to name a few categories. As to how this will interact with free speech - in this case, speech of the company - is a bit of an open question. One of the assumptions of the bill though is that selling telemetry data about a consumer is not a form of protected speech, and that adding some restrictions to this practice is reasonable.
  - SamReidHughes 7y ago
    For a law to cover the set of data which is not necessary to exercise free speech would infringe on free speech, because the set and its complement are not disconnected sets. So either the company has stay on the safe side, and delete information necessary for it to exercise free speech, or miss the other way and be subject to penalties. The example I gave, by the way, is a real one: https://news.ycombinator.com/item?id=8418885 https://news.ycombinator.com/item?id=8418885
notfromhere 7y ago
The main problem is that the bill is rushed and the legal bits have a lot of ambiguity. source: CCPA and its potential compliance has been a big PITA
- morganherlocker 7y ago
  No argument there; just pointing out that many of the common complaints around ambiguity are explicitly addressed in the text of the bill already.
  - notfromhere 7y ago
    They're really not - the definition of using California household vs resident creates a huge unenforceable gray area for compliance
    - morganherlocker 7y ago
      Agree to disagree on this example I guess. "household" is referred to in the bill when defining re-identification, and this is an important improvement over the language in GDPR, especially when it comes to geolocation data, which is often sold at the household level (ie: Experian sells household level market segmentation profiles that tell you a lot about a person's behavior without directly linking to an individual). The only other place households are referred to is in the section defining which companies the rules apply to, which is also pretty straightforward in a plain reading. If a company's number of consumers, households, or devices exceeds 50k, they qualify. > (B) Alone or in combination, annually buys, receives for the business’ commercial purposes, sells, or shares for commercial purposes, alone or in combination, the personal information of 50,000 or more consumers, households, or devices.
- reaperducer 7y ago
  It's not rushed. It's agile!
buboard 7y ago
Yep. This law is nothing like the draconian extremes of GDPR. One can even say it's good because it weeds out the really shady businesses but allows the ad ecosystem to work.

SamReidHughes 7y ago

> (4) Exercise free speech, ensure the right of another consumer to exercise his or her right of free speech, or exercise another right provided for by law. Well, thanks for the link. For example, informing people that a user is located in a dormitory in The Netherlands sounds like free speech to me. So is location tracking information exempt from deletion?

morganherlocker 7y ago
Location data is explicitly called out as sensitive personal information in the text of the bill, so it's definitely not exempt as a category of data. > (e) Many businesses collect personal information from California consumers. They may know where a consumer lives and how many children a consumer has, how fast a consumer drives, a consumer’s personality, sleep habits, biometric and health information, financial information, precise geolocation information, and social networks, to name a few categories. As to how this will interact with free speech - in this case, speech of the company - is a bit of an open question. One of the assumptions of the bill though is that selling telemetry data about a consumer is not a form of protected speech, and that adding some restrictions to this practice is reasonable.
- SamReidHughes 7y ago
  For a law to cover the set of data which is not necessary to exercise free speech would infringe on free speech, because the set and its complement are not disconnected sets. So either the company has stay on the safe side, and delete information necessary for it to exercise free speech, or miss the other way and be subject to penalties. The example I gave, by the way, is a real one: https://news.ycombinator.com/item?id=8418885 https://news.ycombinator.com/item?id=8418885

notfromhere 7y ago

The main problem is that the bill is rushed and the legal bits have a lot of ambiguity. source: CCPA and its potential compliance has been a big PITA

morganherlocker 7y ago
No argument there; just pointing out that many of the common complaints around ambiguity are explicitly addressed in the text of the bill already.
- notfromhere 7y ago
  They're really not - the definition of using California household vs resident creates a huge unenforceable gray area for compliance
  - morganherlocker 7y ago
    Agree to disagree on this example I guess. "household" is referred to in the bill when defining re-identification, and this is an important improvement over the language in GDPR, especially when it comes to geolocation data, which is often sold at the household level (ie: Experian sells household level market segmentation profiles that tell you a lot about a person's behavior without directly linking to an individual). The only other place households are referred to is in the section defining which companies the rules apply to, which is also pretty straightforward in a plain reading. If a company's number of consumers, households, or devices exceeds 50k, they qualify. > (B) Alone or in combination, annually buys, receives for the business’ commercial purposes, sells, or shares for commercial purposes, alone or in combination, the personal information of 50,000 or more consumers, households, or devices.
reaperducer 7y ago
It's not rushed. It's agile!

buboard 7y ago

Yep. This law is nothing like the draconian extremes of GDPR. One can even say it's good because it weeds out the really shady businesses but allows the ad ecosystem to work.