4 ms·

I had similar thoughts when I read this story: how messed up is the legal climate in the US if a person who knows for sure they did absolutely nothing wrong sho

by smsm42 5y ago

I had similar thoughts when I read this story: how messed up is the legal climate in the US if a person who knows for sure they did absolutely nothing wrong should be scared by obvious nonsense email instead of laughing it off and deleting it? I don't diminish the ethical breach the researchers committed - they clearly shouldn't be inflicting any amount of mental anguish on people that did not agree to be part of any study. But it's not the only - and not the largest - problem here. The climate where this thing is seriously scary to so many people is really messed up.

jcims 5y ago
It’s not obvious they did nothing wrong. The referenced statute creates an obligation to respond to inquiries and not everyone is comfortable making their own decision whether or not it applies to them.
- smsm42 5y ago
  It creates an obligation to businesses selling user data, or ones with revenues over 25 millions. It's not hard to find either: https://oag.ca.gov/privacy/ccpa https://oag.ca.gov/privacy/ccpa The CCPA applies to for-profit businesses that do business in California and meet any of the following: Have a gross annual revenue of over $25 million; Buy, receive, or sell the personal information of 50,000 or more California residents, households, or devices; or Derive 50% or more of their annual revenue from selling California residents’ personal information. It's not a very hard decision to make, the text is pretty clear. Especially if literally the fifth word of it - "for profit" - makes the further reading unnecessary.
  - andybak 5y ago
    I'm reading that and I can already see things that require me to think hard about whether it might apply. > any of the following OK > Buy, receive, or sell the personal information of 50,000 or more California residents, "receive" and "50,000" seem like a low bar if the definition of "personal" includes anything caught in typical web logging. You see? It's not clear cut from reading the thing you just said was very clear and it's hard to be 100% sure it doesn't apply. "For profit" and "business" and similarly wide nets. Business can include individual sole traders and "profit" could be "accepting donations" or "running AdWords"
    - xena 5y ago
      As the author of that article, I bet I meet that bar as soon as one of my posts gets on the front page of Hacker News, very easily if I post multiple articles which ended up getting popular like I have this month.
      - master-lincoln 5y ago
        Why are you collecting personal information (IPs) of your readers though?
        xena 5y ago
        Really I have the nginx logs going to the disk so that I can have prometheus-nginx scrape them for referer patterns (it getting above a certain threshold for a given referer is how I know when my article got posted somewhere), status code rates and overall to make sure that the core functions of the site (such as the RSS feed) are working like I expect. I could probably change it to write the logs to a unix fifo instead of a unix file, but I actually do end up going back to look at the logs for things like people attempting to exploit my code so I can harden my site appropriately.
        Beldin 5y ago
        Thanks! That's an informative reply. I was wondering whether not logging could be an option. That's now quite clear.
        xena 5y ago
        I just checked the logs and did some reverse IP lookups at random and it turns out nearly all the IP addresses I have are cloudflare IPs. So I don't even have IP addresses logged the way I thought I did! Yay me!
        jcims 5y ago
        Not OP, but IPs are not always considered personal information. If you never establish the identity of the consumer directly, its not clear that the effort required to convert that address to an identity meets the bar of 'reasonably capable'. The point of my original comment was that there is gray area here and people dismissing it outright as obviously bogus are not thinking very critically about it. I think this is a good example of that.
luckylion 5y ago
I guarantee you that you can send a similarly worded email in Germany to bloggers / small site operators about GDPR/DSGVO and you'll instill similar angst in the recipients. "Before the courts and on the high seas, we are in God's hands" isn't a proverb for no reason, and it's valid pretty much anywhere.

by smsm42 5y ago

jcims 5y ago

It’s not obvious they did nothing wrong. The referenced statute creates an obligation to respond to inquiries and not everyone is comfortable making their own decision whether or not it applies to them.

smsm42 5y ago
It creates an obligation to businesses selling user data, or ones with revenues over 25 millions. It's not hard to find either: https://oag.ca.gov/privacy/ccpa https://oag.ca.gov/privacy/ccpa The CCPA applies to for-profit businesses that do business in California and meet any of the following: Have a gross annual revenue of over $25 million; Buy, receive, or sell the personal information of 50,000 or more California residents, households, or devices; or Derive 50% or more of their annual revenue from selling California residents’ personal information. It's not a very hard decision to make, the text is pretty clear. Especially if literally the fifth word of it - "for profit" - makes the further reading unnecessary.
- andybak 5y ago
  I'm reading that and I can already see things that require me to think hard about whether it might apply. > any of the following OK > Buy, receive, or sell the personal information of 50,000 or more California residents, "receive" and "50,000" seem like a low bar if the definition of "personal" includes anything caught in typical web logging. You see? It's not clear cut from reading the thing you just said was very clear and it's hard to be 100% sure it doesn't apply. "For profit" and "business" and similarly wide nets. Business can include individual sole traders and "profit" could be "accepting donations" or "running AdWords"
  - xena 5y ago
    As the author of that article, I bet I meet that bar as soon as one of my posts gets on the front page of Hacker News, very easily if I post multiple articles which ended up getting popular like I have this month.
    - master-lincoln 5y ago
      Why are you collecting personal information (IPs) of your readers though?
      - xena 5y ago
        Really I have the nginx logs going to the disk so that I can have prometheus-nginx scrape them for referer patterns (it getting above a certain threshold for a given referer is how I know when my article got posted somewhere), status code rates and overall to make sure that the core functions of the site (such as the RSS feed) are working like I expect. I could probably change it to write the logs to a unix fifo instead of a unix file, but I actually do end up going back to look at the logs for things like people attempting to exploit my code so I can harden my site appropriately.
        Beldin 5y ago
        Thanks! That's an informative reply. I was wondering whether not logging could be an option. That's now quite clear.
        xena 5y ago
        I just checked the logs and did some reverse IP lookups at random and it turns out nearly all the IP addresses I have are cloudflare IPs. So I don't even have IP addresses logged the way I thought I did! Yay me!
      - jcims 5y ago
        Not OP, but IPs are not always considered personal information. If you never establish the identity of the consumer directly, its not clear that the effort required to convert that address to an identity meets the bar of 'reasonably capable'. The point of my original comment was that there is gray area here and people dismissing it outright as obviously bogus are not thinking very critically about it. I think this is a good example of that.

luckylion 5y ago

I guarantee you that you can send a similarly worded email in Germany to bloggers / small site operators about GDPR/DSGVO and you'll instill similar angst in the recipients. "Before the courts and on the high seas, we are in God's hands" isn't a proverb for no reason, and it's valid pretty much anywhere.