6 ms·

I do not consider acceptable to be threatened about California law that does not apply to me. I do not appreciate learning about any law by being threatened wi

I do not consider acceptable to be threatened about California law that does not apply to me. I do not appreciate learning about any law by being threatened with it in fake spam email. And sending threatening email to humans and having chutzpah to comment "our study does not constitute human subjects research" is just insulting. I received numerous spam from universities about "research" but never one that was blatantly lying, threatening me with inapplicable law and with legal documentation claiming that I am not a human. I send a complaint to them, and will consider further complaining. Does anybody have any idea why it "does not constitute human subjects research"? Is threatening people online not counted because it is online? Or have they lied to review board?

jonas21 5y ago
Even if the California law doesn't apply, if you operate a website with EU citizens as users, you're subject to the GDPR (and unless your website is extremely small or you explicitly block them, you've probably got some users from the EU). The GDPR has similar provisions to the CCPA, and some people do exercise their GDPR rights by sending emails like the ones the researchers sent. Which isn't to say that what the researchers did was acceptable -- just that it can still be a valuable educational experience for anyone unprepared to handle such a request.
- matkoniecz 5y ago
  > some people do exercise their GDPR rights by sending emails like the ones the researchers sent. Legitimate mails are OK. Mass send spam with illegitimate threats is still not. I am in large part irritated because it gives arguments to people who would want to get rid of such laws, makes harder to handle legitimate requests and spreads false info about such laws. > it can still be a valuable educational experience for anyone unprepared to handle such a request. And being robbed or having your country invaded also can be valuable lesson, which is not making it in any way acceptable or welcome.
- joecool1029 5y ago
  If they aren't an EU website, GDPR effectively doesn't apply. EU can word the law however they want but at least in the US without a treaty to enforce such a law, it lacks the force of law here. Europeans have an extremely hard time understanding this and I'm not quite sure why. I see this assertion again and again across the web.
  - kstrauser 5y ago
    I've seen that too. I'm in the US, and not subject to the GDPR. I like the GDPR and totally approve of its goals. As a Californian, I'm glad we have the CCPA which is similar to it. I say this, then, as someone who supports the GDPR and appreciates it: I'm still not subject to it because I'm not inside its jurisdiction. Similarly, I'm certain I've broken laws in other jurisdictions, such as by criticizing fragile-egoed governments who make that illegal. Doesn't matter, they don't apply to me either.
    - Beldin 5y ago
      Slightly more nuanced: you do not foresee (and have no intention of) being anywhere where the laws you broke hold sway. There are laws that apply to anyone anywhere*; if you never have to worry about the consequences of breaking a law, you could choose to ignore it. * Belgium has one on warcrimes if memory serves; the GDPR might also apply to anyone handling an EU citizen's data (but IANAL).
    - tremon 5y ago
      This is a bit pedantic, but I'll make my point anyway: whether a law can apply to you is orthogonal to whether it can be enforced on you. The GDPR is very clear about its application, and it is explicitly extraterritorial [1]. Of course, it does have secondary provisions about company size and non-commercial activity (mainly recitals [13] and [18]) which limits its applicability, but from a legal definition point of view, "I don't live in the EU so the GDPR does not apply to me" is too simplistic. [1] https://gdpr-info.eu/art-3-gdpr/ https://gdpr-info.eu/art-3-gdpr/ [13] https://gdpr-info.eu/recitals/no-13/ https://gdpr-info.eu/recitals/no-13/ [18] https://gdpr-info.eu/recitals/no-18/ https://gdpr-info.eu/recitals/no-18/
- michaelmrose 5y ago
  Nobody in America is going to know about or expect to be bound to the laws of 100 different jurisdictions because in theory someone could visit from that country. Kind of like visitors from Spain don't bring with them Spanish laws when they visit Nevada.
kbenson 5y ago
> I do not consider acceptable to be threatened about California law that does not apply to me. I think that's a bit much. Someone asking how they would submit a request if they needed to, and specifically saying in the message "I am not submitting a request, just wondering how" isn't exactly threatening you. It's sort of like someone going door to door ina neighborhood asking people what they think of the new water conservation law that requires sprinklers to be run after a certain time of day (which my city has, and recently went into effect). If I'm not in compliance, or don't even know if I'm in compliance, could that person have possibly seen my out of compliance and that's why they're asking? Maybe. If I knew about the law and was actually in compliance, I would know it's not a problem. One thing is not in question though, which is that if I'm subject to the law it's my responsibility to know about it and be in compliance, legally. Someone asking me about it is only a problem if I'm failing to do that in some way. If they ask me about a law for some other county or state? I could look that up and determine I'm not subject to it. There's plenty of information on it. > Is threatening people online not counted because it is online? Your entire comment and all points therein relies on the assertion that the email is threatening. You haven't shown this. Some people might read that email as threatening, but I'll note, the only people that would do so are those that don't actually know whether they are subject to those laws and have ignored what's been going on and were blindsided by the question. This whole thing is blown up because people are upset at being called out on their disregard to the current state of the internet and the laws being passed to regulate it. That's not to say the study was carried out without problem (it wasn't), but there actual harm to people of the type described in this thread was of their own negligence. Whether you think these laws are good or not, it is your responsibility to know whether you are affected, or have some assurance from others whether you are or not (even if it's just a hosting platform telling you what it thinks your responsibilities are). You can ignore this responsibility if you like. People do that all the time about laws that affect them. I'm sure everyone does it to some extent. Just don't act like you're a blameless victim when asked about them.
- smoe 5y ago
  I don't think anyone is claiming that the "I am not submitting a request, just wondering how" is threatening What they refer to is the final paragraph of the mail "I look forward to your reply without undue delay and at most within 45 days of this email, as required by Section 1798.130 of the California Civil Code."

jonas21 5y ago

Even if the California law doesn't apply, if you operate a website with EU citizens as users, you're subject to the GDPR (and unless your website is extremely small or you explicitly block them, you've probably got some users from the EU). The GDPR has similar provisions to the CCPA, and some people do exercise their GDPR rights by sending emails like the ones the researchers sent. Which isn't to say that what the researchers did was acceptable -- just that it can still be a valuable educational experience for anyone unprepared to handle such a request.

matkoniecz 5y ago
> some people do exercise their GDPR rights by sending emails like the ones the researchers sent. Legitimate mails are OK. Mass send spam with illegitimate threats is still not. I am in large part irritated because it gives arguments to people who would want to get rid of such laws, makes harder to handle legitimate requests and spreads false info about such laws. > it can still be a valuable educational experience for anyone unprepared to handle such a request. And being robbed or having your country invaded also can be valuable lesson, which is not making it in any way acceptable or welcome.
joecool1029 5y ago
If they aren't an EU website, GDPR effectively doesn't apply. EU can word the law however they want but at least in the US without a treaty to enforce such a law, it lacks the force of law here. Europeans have an extremely hard time understanding this and I'm not quite sure why. I see this assertion again and again across the web.
- kstrauser 5y ago
  I've seen that too. I'm in the US, and not subject to the GDPR. I like the GDPR and totally approve of its goals. As a Californian, I'm glad we have the CCPA which is similar to it. I say this, then, as someone who supports the GDPR and appreciates it: I'm still not subject to it because I'm not inside its jurisdiction. Similarly, I'm certain I've broken laws in other jurisdictions, such as by criticizing fragile-egoed governments who make that illegal. Doesn't matter, they don't apply to me either.
  - Beldin 5y ago
    Slightly more nuanced: you do not foresee (and have no intention of) being anywhere where the laws you broke hold sway. There are laws that apply to anyone anywhere*; if you never have to worry about the consequences of breaking a law, you could choose to ignore it. * Belgium has one on warcrimes if memory serves; the GDPR might also apply to anyone handling an EU citizen's data (but IANAL).
  - tremon 5y ago
    This is a bit pedantic, but I'll make my point anyway: whether a law can apply to you is orthogonal to whether it can be enforced on you. The GDPR is very clear about its application, and it is explicitly extraterritorial [1]. Of course, it does have secondary provisions about company size and non-commercial activity (mainly recitals [13] and [18]) which limits its applicability, but from a legal definition point of view, "I don't live in the EU so the GDPR does not apply to me" is too simplistic. [1] https://gdpr-info.eu/art-3-gdpr/ https://gdpr-info.eu/art-3-gdpr/ [13] https://gdpr-info.eu/recitals/no-13/ https://gdpr-info.eu/recitals/no-13/ [18] https://gdpr-info.eu/recitals/no-18/ https://gdpr-info.eu/recitals/no-18/
michaelmrose 5y ago
Nobody in America is going to know about or expect to be bound to the laws of 100 different jurisdictions because in theory someone could visit from that country. Kind of like visitors from Spain don't bring with them Spanish laws when they visit Nevada.

kbenson 5y ago

> I do not consider acceptable to be threatened about California law that does not apply to me. I think that's a bit much. Someone asking how they would submit a request if they needed to, and specifically saying in the message "I am not submitting a request, just wondering how" isn't exactly threatening you. It's sort of like someone going door to door ina neighborhood asking people what they think of the new water conservation law that requires sprinklers to be run after a certain time of day (which my city has, and recently went into effect). If I'm not in compliance, or don't even know if I'm in compliance, could that person have possibly seen my out of compliance and that's why they're asking? Maybe. If I knew about the law and was actually in compliance, I would know it's not a problem. One thing is not in question though, which is that if I'm subject to the law it's my responsibility to know about it and be in compliance, legally. Someone asking me about it is only a problem if I'm failing to do that in some way. If they ask me about a law for some other county or state? I could look that up and determine I'm not subject to it. There's plenty of information on it. > Is threatening people online not counted because it is online? Your entire comment and all points therein relies on the assertion that the email is threatening. You haven't shown this. Some people might read that email as threatening, but I'll note, the only people that would do so are those that don't actually know whether they are subject to those laws and have ignored what's been going on and were blindsided by the question. This whole thing is blown up because people are upset at being called out on their disregard to the current state of the internet and the laws being passed to regulate it. That's not to say the study was carried out without problem (it wasn't), but there actual harm to people of the type described in this thread was of their own negligence. Whether you think these laws are good or not, it is your responsibility to know whether you are affected, or have some assurance from others whether you are or not (even if it's just a hosting platform telling you what it thinks your responsibilities are). You can ignore this responsibility if you like. People do that all the time about laws that affect them. I'm sure everyone does it to some extent. Just don't act like you're a blameless victim when asked about them.

smoe 5y ago
I don't think anyone is claiming that the "I am not submitting a request, just wondering how" is threatening What they refer to is the final paragraph of the mail "I look forward to your reply without undue delay and at most within 45 days of this email, as required by Section 1798.130 of the California Civil Code."