3 ms·

Full text: https://legiscan.com/OH/text/HB376/2021 https://legiscan.com/OH/text/HB376/2021

Jon_Lowtek 5y ago
giant hole number one: stupid definition of personal data as an effect of consumer rights instead of human right means no protection for employees. This is big because of cloud native back office or collaboration services. Microsoft Teams is not a consumer app. >> Sec. 1355.01.(J) "Personal data" means any information that relates to an identified or identifiable consumer processed by a business for a commercial purpose. "Personal data" does not include [...] >> (G) "Consumer" means a natural person who is a resident of this state acting only in an individual or household context. "Consumer" does not include a natural person acting in a business capacity or employment context, including contractors, job applicants, officers, directors, or owners.
- Jon_Lowtek 5y ago
  obviously the difference between human right and consumer right makes this unnecessary, but just to be sure: >> 1355.02.(B) This chapter does not apply to any of the following: (1) Any body, authority, board, bureau, commission, district, or agency of this state or of any political subdivision of this state;
Jon_Lowtek 5y ago
This one is interesting because many applications argue they have user behavior tracking (by a third party as a service) for this purpose >> 1355.02.(F) The obligations imposed on businesses or processors under this chapter shall not be construed as restricting a business's or processor's ability to collect, use, or retain data as necessary to do any of the following: (1) Conduct internal research solely to improve or repair products, services, or technology; [...]
Jon_Lowtek 5y ago
This looks easily exploitable >> Sec. 1355.01.(J) [...] "Personal data" does not include [...] (2) Pseudonymized, deidentified, or aggregate data. [...] Because ad-tech at large doesn't care about actually identifying an individual as long as they can engage with it. Example: Facebook provides access to large amounts of "pseudonymized" data to the SCL group, who runs their own analysis resulting in a map of pseudonym->propaganda. They then pay FB to engage the users based on that. I am not a lawyer, but this case seems to not fall under OPPA, because everyone can argue that they did not share personal data. So the user has no right to be informed about their "pseudonymized data" being processed by the SCL group for the purpose of feeding them propaganda. Similar case is google analytics. A webapp sets 'anonymize_ip: true' and avoids pushing the consumers name and postal address in the data layer and can then argue the collection of tracking data by the third party affiliate google is pseudonymized. Nevermind that google doesn't actually care about the consumers address as long as they can create a profile for the pseudonym. The european unions GDPR has a chapter on profiling, which OPPA has not.
Jon_Lowtek 5y ago
The fuck is this >> Sec. 1355.07.(B) A business may charge different prices or rates for goods or services for individuals who exercise their rights under this chapter for legitimate business reasons or as otherwise permitted or required by applicable law.

giant hole number one: stupid definition of personal data as an effect of consumer rights instead of human right means no protection for employees. This is big because of cloud native back office or collaboration services. Microsoft Teams is not a consumer app. >> Sec. 1355.01.(J) "Personal data" means any information that relates to an identified or identifiable consumer processed by a business for a commercial purpose. "Personal data" does not include [...] >> (G) "Consumer" means a natural person who is a resident of this state acting only in an individual or household context. "Consumer" does not include a natural person acting in a business capacity or employment context, including contractors, job applicants, officers, directors, or owners.

Jon_Lowtek 5y ago
obviously the difference between human right and consumer right makes this unnecessary, but just to be sure: >> 1355.02.(B) This chapter does not apply to any of the following: (1) Any body, authority, board, bureau, commission, district, or agency of this state or of any political subdivision of this state;

Jon_Lowtek 5y ago

This one is interesting because many applications argue they have user behavior tracking (by a third party as a service) for this purpose >> 1355.02.(F) The obligations imposed on businesses or processors under this chapter shall not be construed as restricting a business's or processor's ability to collect, use, or retain data as necessary to do any of the following: (1) Conduct internal research solely to improve or repair products, services, or technology; [...]

Jon_Lowtek 5y ago

This looks easily exploitable >> Sec. 1355.01.(J) [...] "Personal data" does not include [...] (2) Pseudonymized, deidentified, or aggregate data. [...] Because ad-tech at large doesn't care about actually identifying an individual as long as they can engage with it. Example: Facebook provides access to large amounts of "pseudonymized" data to the SCL group, who runs their own analysis resulting in a map of pseudonym->propaganda. They then pay FB to engage the users based on that. I am not a lawyer, but this case seems to not fall under OPPA, because everyone can argue that they did not share personal data. So the user has no right to be informed about their "pseudonymized data" being processed by the SCL group for the purpose of feeding them propaganda. Similar case is google analytics. A webapp sets 'anonymize_ip: true' and avoids pushing the consumers name and postal address in the data layer and can then argue the collection of tracking data by the third party affiliate google is pseudonymized. Nevermind that google doesn't actually care about the consumers address as long as they can create a profile for the pseudonym. The european unions GDPR has a chapter on profiling, which OPPA has not.

Jon_Lowtek 5y ago

The fuck is this >> Sec. 1355.07.(B) A business may charge different prices or rates for goods or services for individuals who exercise their rights under this chapter for legitimate business reasons or as otherwise permitted or required by applicable law.