9 ms·

OPPA: Ohio could become the third US state to enact a new consumer privacy law

174 points by feross 5y ago

A4ET8a8uTh0 5y ago
Interesting. It would appear maybe I was wrong about general sentiment towards privacy in US. CA law did not surprise that much and most dismissed it as 'what will they do next', but Ohio is not exactly blue, which would suggest some people are finally getting a little fed up with status quo. All this against backdrop of nationwide corps having tried to stop this exact scenario ( patchwork of state privacy laws ).
- TrispusAttucks 5y ago
  Privacy ain't a red or blue issue. It's a human issue.
  - A4ET8a8uTh0 5y ago
    In my heart of hearts, I agree with you. My cynical surface would just want to take this moment to kinda spread my hands as if to show that our current existence has been ridiculously politicized. You may not think it is a blue issue, but -- and I am not trying to derail this thread -- I just want to make an argument, isn't abortion a human issue?
    - rndmind 5y ago
      Yeah, bringing up abortion here? original conservatives were actually in favor of abortion because it the government did not have the right to tell you what you could do with you body. It wasn't until early '70's when G.O.P. figured out they could win the ultra religious voters by catering to this specific issue. Noam Chomsky has an excellent dialogue about this
  - mywittyname 5y ago
    Ohio isn't exactly pro-consumer at all. The Affirmative Defense section of the bill kind of highlights that, IMHO. > Businesses that satisfy requirements for the affirmative defense are afforded protection from any cause of action brought under Ohio laws, or in Ohio courts, alleging a violation of the OPPA or similar claims based on alleged violations of the Ohio Consumer Sales Practices Act’s privacy-related provisions. It also prohibits citizens from suing violators of the law. Sounds to me like this is more about protecting businesses from litigation than it is about protecting consumers. I'm curious if the CCPA or Colorado's law have similar language; my suspicion is that they don't. Though, I'd love it if my beliefs were proven wrong here.
    - thegasman 5y ago
      I agree. The law authorizes only the attorney general to crack the whip, and limits that prosecutorial discretion with an blanket affirmative defense. Who wins here?
      - dodobirdlord 5y ago
        The state government gains the ability to selectively harass west coast tech companies. Since west coast tech companies are perceived as left-wing institutions, state legislators probably anticipate that media coverage of the attorney general harassing them in court will poll well with voters in Ohio.
- finiteseries 5y ago
  I don’t know, that might be optimistic. There is infinitely more talk about how big tech is bad than how privacy is good in “red” areas. A cudgel’s a cudgel though, and this one came with blueprints.
Jon_Lowtek 5y ago
Full text: https://legiscan.com/OH/text/HB376/2021 https://legiscan.com/OH/text/HB376/2021
- Jon_Lowtek 5y ago
  giant hole number one: stupid definition of personal data as an effect of consumer rights instead of human right means no protection for employees. This is big because of cloud native back office or collaboration services. Microsoft Teams is not a consumer app. >> Sec. 1355.01.(J) "Personal data" means any information that relates to an identified or identifiable consumer processed by a business for a commercial purpose. "Personal data" does not include [...] >> (G) "Consumer" means a natural person who is a resident of this state acting only in an individual or household context. "Consumer" does not include a natural person acting in a business capacity or employment context, including contractors, job applicants, officers, directors, or owners.
  - Jon_Lowtek 5y ago
    obviously the difference between human right and consumer right makes this unnecessary, but just to be sure: >> 1355.02.(B) This chapter does not apply to any of the following: (1) Any body, authority, board, bureau, commission, district, or agency of this state or of any political subdivision of this state;
- Jon_Lowtek 5y ago
  This one is interesting because many applications argue they have user behavior tracking (by a third party as a service) for this purpose >> 1355.02.(F) The obligations imposed on businesses or processors under this chapter shall not be construed as restricting a business's or processor's ability to collect, use, or retain data as necessary to do any of the following: (1) Conduct internal research solely to improve or repair products, services, or technology; [...]
- Jon_Lowtek 5y ago
  This looks easily exploitable >> Sec. 1355.01.(J) [...] "Personal data" does not include [...] (2) Pseudonymized, deidentified, or aggregate data. [...] Because ad-tech at large doesn't care about actually identifying an individual as long as they can engage with it. Example: Facebook provides access to large amounts of "pseudonymized" data to the SCL group, who runs their own analysis resulting in a map of pseudonym->propaganda. They then pay FB to engage the users based on that. I am not a lawyer, but this case seems to not fall under OPPA, because everyone can argue that they did not share personal data. So the user has no right to be informed about their "pseudonymized data" being processed by the SCL group for the purpose of feeding them propaganda. Similar case is google analytics. A webapp sets 'anonymize_ip: true' and avoids pushing the consumers name and postal address in the data layer and can then argue the collection of tracking data by the third party affiliate google is pseudonymized. Nevermind that google doesn't actually care about the consumers address as long as they can create a profile for the pseudonym. The european unions GDPR has a chapter on profiling, which OPPA has not.
akersten 5y ago
As more and more states create their own legislation in this space, I've got a great startup pitch: Taxjar, but for each municipality's data laws - caters your Privacy Policy based on visitor IP (with requisite geolocation disclaimer before one is allowed to view the Privacy Policy, of course). There's no innovation quite like compliance-driven innovation! C'mon gang, let's get coding.
- hosh 5y ago
  I think that is one of the value proposition of fly.io -- by bringing compute to the edge, you can comply with local data privacy policies, along with some interesting ways of building web apps, and get great data locality and low latency.
- theandrewbailey 5y ago
  Instead, let's disrupt the industry with storageless personal data. It's like serverless, but for PII.
  - keneda7 5y ago
    So are you purposing each person's data is not stored anywhere and must be manually typed? Or something where each person controls where their data is stored and has to explicitly give access to sites in order to read the data? I feel like the second option would be feasible if you could somehow get the major sites to agree they would pull the data each request rather than storing it in their databases.
  - teeray 5y ago
    “User data is stored securely using our innovative write-only memory”
    - tomschlick 5y ago
      "By storing our blockchain on /dev/null, we have limitless scalability to handle your customer's data, without the need to worry about it being stolen by hackers"
ramesh31 5y ago
>Derives more than 50% of its gross revenue from the sale of personal data and processes/controls the personal data of 25,000 or more consumers during a calendar year. This seems really arbitrary and pointless. Especially since it's gross revenue and not profit. Sounds like a perfect excuse for some creative accounting.
- lmkg 5y ago
  This looks like a modification of the California version, and I like the original more than the remix. The California version (CCPA) imposes restrictions on large businesses, and on data brokers. "Large business" is defined by revenue and number of data subjects. "Data brokers" are defined purely by deriving majority of revenue from sale of personal data. Notably, CCPA does not have a lower bound on the size of data brokers. If your business is to sell personal data, then you are a data broker and CCPA applies, even if you're just one guy hawking a spreadsheet of a dozen data subjects. The Ohio version seems to have modified this so that data brokers have a lower size bound. I.e. it applies to any Business over X size, and data brokers over X/4. That's... I don't see the point. If you're gonna protect personal data, then the long tail of small-size data brokers is something that I would consider kind of a big concern. Like, datasets about medical conditions could conceivably be very small and I want that shit regulated into the ground.
- jonas21 5y ago
  You omitted the other criteria. Only one of the following needs to be satisfied for the law to apply: * Annual gross revenue generated in Ohio above $25 million. * Controls or processes the personal data of 100,000 or more consumers during the calendar year. * Derives more than 50% of its gross revenue from the sale of personal data and processes/controls the personal data of 25,000 or more consumers during a calendar year. If you control or process the personal data of more than 100K consumers, or have more than $25M in Ohio revenue, then it doesn't matter where your revenue comes from. Also, gross revenue from sale of personal data is straightforward to measure and verify: How much did you get paid for the data? Profit is not since this depends on how you allocate expenses to various parts of the business.
  - 5y ago
priansh 5y ago
I’d like to speak to whoever came up with this acronym for obvious reasons
- triceratops 5y ago
  Sorry, what are these reasons? It was not obvious to me.
  - cmelbye 5y ago
    It means big brother in Korean.
    - More-nitors 5y ago
      maybe we should wait for NUNA or ONNI ?
fmajid 5y ago
No, because California, Colorado and Virginia already have privacy laws, so at best it will be fourth.
- rrix2 5y ago
  California did not enact their privacy law in 2021, but in 2020...
  - fmajid 5y ago
    The Hacker News headline omitted the “in 2021” bit.
asdff 5y ago
It doesn't hit the governors desk for a signature until december 2022. That's plenty of time for the Ohio legislature to do as the Ohio legislature does and make this bill much less exciting.
thegasman 5y ago
This is toothless. Without a private cause of action available to the consumer, prosecutorial discretion means offenses will go unpunished based on political winds.
ksec 5y ago
I guess Koreans in US are going to laugh hard when they read this on news paper. For those who are not into K-Pop culture, >The Korean word Oppa (오빠) is used when you are a woman and talking with an older male (related to you or not). For example, Oppa (오빠) is used to address an older male friend, even if he is not your older brother by blood.
- tokai 5y ago
  Doubt that anyone will laugh hard over that. Also its a surprisingly common acronym in Ohio[0], so I would guess that Ohio based Koreans have gotten over it by now. [0] Ohio Public Policy Archives, Ohio Psychiatric Physicians Association, etc.

174 points by feross 5y ago

Interesting. It would appear maybe I was wrong about general sentiment towards privacy in US. CA law did not surprise that much and most dismissed it as 'what will they do next', but Ohio is not exactly blue, which would suggest some people are finally getting a little fed up with status quo. All this against backdrop of nationwide corps having tried to stop this exact scenario ( patchwork of state privacy laws ).

TrispusAttucks 5y ago
Privacy ain't a red or blue issue. It's a human issue.
- A4ET8a8uTh0 5y ago
  In my heart of hearts, I agree with you. My cynical surface would just want to take this moment to kinda spread my hands as if to show that our current existence has been ridiculously politicized. You may not think it is a blue issue, but -- and I am not trying to derail this thread -- I just want to make an argument, isn't abortion a human issue?
  - rndmind 5y ago
    Yeah, bringing up abortion here? original conservatives were actually in favor of abortion because it the government did not have the right to tell you what you could do with you body. It wasn't until early '70's when G.O.P. figured out they could win the ultra religious voters by catering to this specific issue. Noam Chomsky has an excellent dialogue about this
- mywittyname 5y ago
  Ohio isn't exactly pro-consumer at all. The Affirmative Defense section of the bill kind of highlights that, IMHO. > Businesses that satisfy requirements for the affirmative defense are afforded protection from any cause of action brought under Ohio laws, or in Ohio courts, alleging a violation of the OPPA or similar claims based on alleged violations of the Ohio Consumer Sales Practices Act’s privacy-related provisions. It also prohibits citizens from suing violators of the law. Sounds to me like this is more about protecting businesses from litigation than it is about protecting consumers. I'm curious if the CCPA or Colorado's law have similar language; my suspicion is that they don't. Though, I'd love it if my beliefs were proven wrong here.
  - thegasman 5y ago
    I agree. The law authorizes only the attorney general to crack the whip, and limits that prosecutorial discretion with an blanket affirmative defense. Who wins here?
    - dodobirdlord 5y ago
      The state government gains the ability to selectively harass west coast tech companies. Since west coast tech companies are perceived as left-wing institutions, state legislators probably anticipate that media coverage of the attorney general harassing them in court will poll well with voters in Ohio.
finiteseries 5y ago
I don’t know, that might be optimistic. There is infinitely more talk about how big tech is bad than how privacy is good in “red” areas. A cudgel’s a cudgel though, and this one came with blueprints.

Jon_Lowtek 5y ago

Full text: https://legiscan.com/OH/text/HB376/2021 https://legiscan.com/OH/text/HB376/2021

Jon_Lowtek 5y ago
giant hole number one: stupid definition of personal data as an effect of consumer rights instead of human right means no protection for employees. This is big because of cloud native back office or collaboration services. Microsoft Teams is not a consumer app. >> Sec. 1355.01.(J) "Personal data" means any information that relates to an identified or identifiable consumer processed by a business for a commercial purpose. "Personal data" does not include [...] >> (G) "Consumer" means a natural person who is a resident of this state acting only in an individual or household context. "Consumer" does not include a natural person acting in a business capacity or employment context, including contractors, job applicants, officers, directors, or owners.
- Jon_Lowtek 5y ago
  obviously the difference between human right and consumer right makes this unnecessary, but just to be sure: >> 1355.02.(B) This chapter does not apply to any of the following: (1) Any body, authority, board, bureau, commission, district, or agency of this state or of any political subdivision of this state;
Jon_Lowtek 5y ago
This one is interesting because many applications argue they have user behavior tracking (by a third party as a service) for this purpose >> 1355.02.(F) The obligations imposed on businesses or processors under this chapter shall not be construed as restricting a business's or processor's ability to collect, use, or retain data as necessary to do any of the following: (1) Conduct internal research solely to improve or repair products, services, or technology; [...]
Jon_Lowtek 5y ago
This looks easily exploitable >> Sec. 1355.01.(J) [...] "Personal data" does not include [...] (2) Pseudonymized, deidentified, or aggregate data. [...] Because ad-tech at large doesn't care about actually identifying an individual as long as they can engage with it. Example: Facebook provides access to large amounts of "pseudonymized" data to the SCL group, who runs their own analysis resulting in a map of pseudonym->propaganda. They then pay FB to engage the users based on that. I am not a lawyer, but this case seems to not fall under OPPA, because everyone can argue that they did not share personal data. So the user has no right to be informed about their "pseudonymized data" being processed by the SCL group for the purpose of feeding them propaganda. Similar case is google analytics. A webapp sets 'anonymize_ip: true' and avoids pushing the consumers name and postal address in the data layer and can then argue the collection of tracking data by the third party affiliate google is pseudonymized. Nevermind that google doesn't actually care about the consumers address as long as they can create a profile for the pseudonym. The european unions GDPR has a chapter on profiling, which OPPA has not.

akersten 5y ago

As more and more states create their own legislation in this space, I've got a great startup pitch: Taxjar, but for each municipality's data laws - caters your Privacy Policy based on visitor IP (with requisite geolocation disclaimer before one is allowed to view the Privacy Policy, of course). There's no innovation quite like compliance-driven innovation! C'mon gang, let's get coding.

hosh 5y ago
I think that is one of the value proposition of fly.io -- by bringing compute to the edge, you can comply with local data privacy policies, along with some interesting ways of building web apps, and get great data locality and low latency.
theandrewbailey 5y ago
Instead, let's disrupt the industry with storageless personal data. It's like serverless, but for PII.
- keneda7 5y ago
  So are you purposing each person's data is not stored anywhere and must be manually typed? Or something where each person controls where their data is stored and has to explicitly give access to sites in order to read the data? I feel like the second option would be feasible if you could somehow get the major sites to agree they would pull the data each request rather than storing it in their databases.
- teeray 5y ago
  “User data is stored securely using our innovative write-only memory”
  - tomschlick 5y ago
    "By storing our blockchain on /dev/null, we have limitless scalability to handle your customer's data, without the need to worry about it being stolen by hackers"

ramesh31 5y ago

>Derives more than 50% of its gross revenue from the sale of personal data and processes/controls the personal data of 25,000 or more consumers during a calendar year. This seems really arbitrary and pointless. Especially since it's gross revenue and not profit. Sounds like a perfect excuse for some creative accounting.

lmkg 5y ago
This looks like a modification of the California version, and I like the original more than the remix. The California version (CCPA) imposes restrictions on large businesses, and on data brokers. "Large business" is defined by revenue and number of data subjects. "Data brokers" are defined purely by deriving majority of revenue from sale of personal data. Notably, CCPA does not have a lower bound on the size of data brokers. If your business is to sell personal data, then you are a data broker and CCPA applies, even if you're just one guy hawking a spreadsheet of a dozen data subjects. The Ohio version seems to have modified this so that data brokers have a lower size bound. I.e. it applies to any Business over X size, and data brokers over X/4. That's... I don't see the point. If you're gonna protect personal data, then the long tail of small-size data brokers is something that I would consider kind of a big concern. Like, datasets about medical conditions could conceivably be very small and I want that shit regulated into the ground.
jonas21 5y ago
You omitted the other criteria. Only one of the following needs to be satisfied for the law to apply: * Annual gross revenue generated in Ohio above $25 million. * Controls or processes the personal data of 100,000 or more consumers during the calendar year. * Derives more than 50% of its gross revenue from the sale of personal data and processes/controls the personal data of 25,000 or more consumers during a calendar year. If you control or process the personal data of more than 100K consumers, or have more than $25M in Ohio revenue, then it doesn't matter where your revenue comes from. Also, gross revenue from sale of personal data is straightforward to measure and verify: How much did you get paid for the data? Profit is not since this depends on how you allocate expenses to various parts of the business.
- 5y ago

priansh 5y ago

I’d like to speak to whoever came up with this acronym for obvious reasons

triceratops 5y ago
Sorry, what are these reasons? It was not obvious to me.
- cmelbye 5y ago
  It means big brother in Korean.
  - More-nitors 5y ago
    maybe we should wait for NUNA or ONNI ?

fmajid 5y ago

No, because California, Colorado and Virginia already have privacy laws, so at best it will be fourth.

rrix2 5y ago
California did not enact their privacy law in 2021, but in 2020...
- fmajid 5y ago
  The Hacker News headline omitted the “in 2021” bit.

asdff 5y ago

It doesn't hit the governors desk for a signature until december 2022. That's plenty of time for the Ohio legislature to do as the Ohio legislature does and make this bill much less exciting.

thegasman 5y ago

This is toothless. Without a private cause of action available to the consumer, prosecutorial discretion means offenses will go unpunished based on political winds.

ksec 5y ago

I guess Koreans in US are going to laugh hard when they read this on news paper. For those who are not into K-Pop culture, >The Korean word Oppa (오빠) is used when you are a woman and talking with an older male (related to you or not). For example, Oppa (오빠) is used to address an older male friend, even if he is not your older brother by blood.

tokai 5y ago
Doubt that anyone will laugh hard over that. Also its a surprisingly common acronym in Ohio[0], so I would guess that Ohio based Koreans have gotten over it by now. [0] Ohio Public Policy Archives, Ohio Psychiatric Physicians Association, etc.