4 ms·

>Derives more than 50% of its gross revenue from the sale of personal data and processes/controls the personal data of 25,000 or more consumers during a calenda

>Derives more than 50% of its gross revenue from the sale of personal data and processes/controls the personal data of 25,000 or more consumers during a calendar year. This seems really arbitrary and pointless. Especially since it's gross revenue and not profit. Sounds like a perfect excuse for some creative accounting.

lmkg 5y ago
This looks like a modification of the California version, and I like the original more than the remix. The California version (CCPA) imposes restrictions on large businesses, and on data brokers. "Large business" is defined by revenue and number of data subjects. "Data brokers" are defined purely by deriving majority of revenue from sale of personal data. Notably, CCPA does not have a lower bound on the size of data brokers. If your business is to sell personal data, then you are a data broker and CCPA applies, even if you're just one guy hawking a spreadsheet of a dozen data subjects. The Ohio version seems to have modified this so that data brokers have a lower size bound. I.e. it applies to any Business over X size, and data brokers over X/4. That's... I don't see the point. If you're gonna protect personal data, then the long tail of small-size data brokers is something that I would consider kind of a big concern. Like, datasets about medical conditions could conceivably be very small and I want that shit regulated into the ground.
jonas21 5y ago
You omitted the other criteria. Only one of the following needs to be satisfied for the law to apply: * Annual gross revenue generated in Ohio above $25 million. * Controls or processes the personal data of 100,000 or more consumers during the calendar year. * Derives more than 50% of its gross revenue from the sale of personal data and processes/controls the personal data of 25,000 or more consumers during a calendar year. If you control or process the personal data of more than 100K consumers, or have more than $25M in Ohio revenue, then it doesn't matter where your revenue comes from. Also, gross revenue from sale of personal data is straightforward to measure and verify: How much did you get paid for the data? Profit is not since this depends on how you allocate expenses to various parts of the business.
- akersten 5y ago
  > Also, gross revenue from sale of personal data is straightforward to measure and verify: How much did you get paid for the data? I really wouldn't say that it's straightforward at all. How much money would you guess Google (or any AdTech firm) "makes" under that definition in Ohio? I would bet you the farm that it's actually $0, because they're not selling data, they're selling ad space ("retargeting").
  - maxerickson 5y ago
    But it's 'or', so who cares. Is there some clever argument they can use to avoid admitting that they process data that they process?
  - deleted 5y ago
    [deleted]
  - jonas21 5y ago
    Exactly. Google does not sell personal data, so its revenue from selling personal data is $0. Of course Google is still subject to the law because it qualifies on the other two criteria.

lmkg 5y ago

This looks like a modification of the California version, and I like the original more than the remix. The California version (CCPA) imposes restrictions on large businesses, and on data brokers. "Large business" is defined by revenue and number of data subjects. "Data brokers" are defined purely by deriving majority of revenue from sale of personal data. Notably, CCPA does not have a lower bound on the size of data brokers. If your business is to sell personal data, then you are a data broker and CCPA applies, even if you're just one guy hawking a spreadsheet of a dozen data subjects. The Ohio version seems to have modified this so that data brokers have a lower size bound. I.e. it applies to any Business over X size, and data brokers over X/4. That's... I don't see the point. If you're gonna protect personal data, then the long tail of small-size data brokers is something that I would consider kind of a big concern. Like, datasets about medical conditions could conceivably be very small and I want that shit regulated into the ground.

jonas21 5y ago

You omitted the other criteria. Only one of the following needs to be satisfied for the law to apply: * Annual gross revenue generated in Ohio above $25 million. * Controls or processes the personal data of 100,000 or more consumers during the calendar year. * Derives more than 50% of its gross revenue from the sale of personal data and processes/controls the personal data of 25,000 or more consumers during a calendar year. If you control or process the personal data of more than 100K consumers, or have more than $25M in Ohio revenue, then it doesn't matter where your revenue comes from. Also, gross revenue from sale of personal data is straightforward to measure and verify: How much did you get paid for the data? Profit is not since this depends on how you allocate expenses to various parts of the business.

akersten 5y ago
> Also, gross revenue from sale of personal data is straightforward to measure and verify: How much did you get paid for the data? I really wouldn't say that it's straightforward at all. How much money would you guess Google (or any AdTech firm) "makes" under that definition in Ohio? I would bet you the farm that it's actually $0, because they're not selling data, they're selling ad space ("retargeting").
- maxerickson 5y ago
  But it's 'or', so who cares. Is there some clever argument they can use to avoid admitting that they process data that they process?
- deleted 5y ago
  [deleted]
- jonas21 5y ago
  Exactly. Google does not sell personal data, so its revenue from selling personal data is $0. Of course Google is still subject to the law because it qualifies on the other two criteria.