4 ms·

Yep, we got the same. Seriously unethical behavior.

by apignotti 5y ago

dang 5y ago
We've gotten them too, including one as far back as last April.
- killion 5y ago
  We've gotten them not just for CCPA but also GDPR.
- 0xFF0123 5y ago
  Interesting, did HN respond, or was it considered spam?
  - dang 5y ago
    We always respond, and we get a plethora of them. Far beyond this particular study. There's a whole other blog post waiting to be written about the intersection between GDPR/CCPA threats and spam.
- dangrossman 5y ago
  I got the GDPR one in April as well, and four more this month.
the_optimist 5y ago
Please explain why this is unethical. The worst case is that you’re simply subject to the law. Presumably you’re abiding by the law. edit: I'm playing devil's advocate. I think the law sucks, the study is weird, and I empathize directly with the blog author. That said, downvoting to 'disagree' without explaining your reasoning is below the grade of this fine institution.
- 0xFF0123 5y ago
  From the perspective of someone not living in the US, how on earth would one be expected to know what "the law" in California is?
  - the_optimist 5y ago
    Part of the premise of the nation state is that you don't need to abide by other countries' laws. If you're doing business within that nation state, you're required to operate by their laws.
    - krisoft 5y ago
      Quick, someone tell that to Julian Assange. :) Or all the webpages which choose to implement GDPR by blocking european visitors.
      - the_optimist 5y ago
        I agree with you. The networks allow incursion, the law seems to allow for excursion.
  - hnfong 5y ago
    when they invented the legal principle of "ignorance of the law is no defence", most common people were illiterate. That didn't stop them from making people guilty for committing crimes they didn't know were crimes.
- deleted 5y ago
  [deleted]
- ncallaway 5y ago
  Sure. In my view there are two things that are unethical about this email. The first is that they lied about who they were (and lied by omission about the purpose of the email). The ethics of deceiving someone for research are complicated, but should go through an IRB evaluation. Since they avoided the IRB by claiming it was a study about process, they should have avoided the ethics issues from lying in the survey. They should have been up-front and honest about who they were, and why they were asking the question. If their research truly requires deceiving the participant (and, I’m not at all convinced that it does), then it needed to be rigorously evaluated by the IRB, which almost certainly should and should have rejected it. Second, their research makes a demand for a response “without undue delay”, rather than a request. That is also unethical, as it’s misrepresenting the law and implying a response within 45 days is required by law. It is not. Many of the involuntary subject participants are not subject to the cited provision of the law. As such, demanding a response within the time frame and citing that provision of the law is misleading. Also, the law makes no requirement for a business to respond to such a query within 45 days. The legislative text is here (https://casetext.com/statute/california-codes/california-civil-code/division-3-obligations/part-4-obligations-arising-from-particular-transactions/title-1815-california-consumer-privacy-act-of-2018/section-1798130-operative-until112023facilitating-consumer-requests https://casetext.com/statute/california-codes/california-civ...) and the only 45 day window that exists is for responding to an actual CCPA request, which this query explicitly disclaimed from being. So even if this was a business required to comply with CCPA, they are not required to respond to this query. So, they lied (by implication) to claim that provision of the law approach lied to the business, and lied (explicitly) by claiming the law created a duty to respond to the email within a 45 day period, which it does not.
- wildrhythms 5y ago
  This 'study' is effectively a survey. Can you explain what ethical survey 1) does not inform its participants that it's a survey, 2) poses as a fake individual persona to conceal the identity of the surveyor, 3) cites either knowingly or unknowingly scary legal jargon to coerce participation, 4) does not make any attempt to disclose confidentiality?

Yep, we got the same. Seriously unethical behavior.

dang 5y ago

We've gotten them too, including one as far back as last April.

killion 5y ago
We've gotten them not just for CCPA but also GDPR.
0xFF0123 5y ago
Interesting, did HN respond, or was it considered spam?
- dang 5y ago
  We always respond, and we get a plethora of them. Far beyond this particular study. There's a whole other blog post waiting to be written about the intersection between GDPR/CCPA threats and spam.
dangrossman 5y ago
I got the GDPR one in April as well, and four more this month.

the_optimist 5y ago

Please explain why this is unethical. The worst case is that you’re simply subject to the law. Presumably you’re abiding by the law. edit: I'm playing devil's advocate. I think the law sucks, the study is weird, and I empathize directly with the blog author. That said, downvoting to 'disagree' without explaining your reasoning is below the grade of this fine institution.

0xFF0123 5y ago
From the perspective of someone not living in the US, how on earth would one be expected to know what "the law" in California is?
- the_optimist 5y ago
  Part of the premise of the nation state is that you don't need to abide by other countries' laws. If you're doing business within that nation state, you're required to operate by their laws.
  - krisoft 5y ago
    Quick, someone tell that to Julian Assange. :) Or all the webpages which choose to implement GDPR by blocking european visitors.
    - the_optimist 5y ago
      I agree with you. The networks allow incursion, the law seems to allow for excursion.
- hnfong 5y ago
  when they invented the legal principle of "ignorance of the law is no defence", most common people were illiterate. That didn't stop them from making people guilty for committing crimes they didn't know were crimes.
deleted 5y ago
[deleted]
ncallaway 5y ago
Sure. In my view there are two things that are unethical about this email. The first is that they lied about who they were (and lied by omission about the purpose of the email). The ethics of deceiving someone for research are complicated, but should go through an IRB evaluation. Since they avoided the IRB by claiming it was a study about process, they should have avoided the ethics issues from lying in the survey. They should have been up-front and honest about who they were, and why they were asking the question. If their research truly requires deceiving the participant (and, I’m not at all convinced that it does), then it needed to be rigorously evaluated by the IRB, which almost certainly should and should have rejected it. Second, their research makes a demand for a response “without undue delay”, rather than a request. That is also unethical, as it’s misrepresenting the law and implying a response within 45 days is required by law. It is not. Many of the involuntary subject participants are not subject to the cited provision of the law. As such, demanding a response within the time frame and citing that provision of the law is misleading. Also, the law makes no requirement for a business to respond to such a query within 45 days. The legislative text is here (https://casetext.com/statute/california-codes/california-civil-code/division-3-obligations/part-4-obligations-arising-from-particular-transactions/title-1815-california-consumer-privacy-act-of-2018/section-1798130-operative-until112023facilitating-consumer-requests https://casetext.com/statute/california-codes/california-civ...) and the only 45 day window that exists is for responding to an actual CCPA request, which this query explicitly disclaimed from being. So even if this was a business required to comply with CCPA, they are not required to respond to this query. So, they lied (by implication) to claim that provision of the law approach lied to the business, and lied (explicitly) by claiming the law created a duty to respond to the email within a 45 day period, which it does not.
wildrhythms 5y ago
This 'study' is effectively a survey. Can you explain what ethical survey 1) does not inform its participants that it's a survey, 2) poses as a fake individual persona to conceal the identity of the surveyor, 3) cites either knowingly or unknowingly scary legal jargon to coerce participation, 4) does not make any attempt to disclose confidentiality?