5 ms·

Attorney General Bonta Announces Settlement with Sephora on CCPA/GPC Enforcement

38 points by sebastian_z 4y ago

keneda7 4y ago
The fact that the CCPA does not apply to government agencies is completely outrageous in my opinion. The CA DOJ leaked thousands of citizens private information recently and nothing is happening to them. They even went through the trouble of building a UI to search the data released, so its pretty hard to claim it wasn't intentional. If we are going to hold companies to the CCPA should the agency in charge of enforcement not be held to the same standard?
- mistrial9 4y ago
  on the other side, arguments like this can be used to stall and diffuse the actual implementation upon the most egregious violators. In an extreme scenario (like say tribe gaming laws) said violators could actually hire and "astroturf" this kind of "look, over there" sort of outrage. Perhaps you are genuine, but .. congratulations California and AG Bonta on at least this action, right?
  - keneda7 4y ago
    So my argument that MORE people should have to follow the CCPA is somehow an argument to prevent implementations of the CCPA. Could you please explain your logic there?
    - mistrial9 4y ago
      yes of course - the phrase is "the perfect is the enemy of the good" which means.. implementation of the law could be stalled or delayed, or the law could be challenged in court and reversed in the extreme case.. based on an argument that it is fundamentally flawed. A reason to be flawed is "not all covered parties are treated fairly" or something .. IANAL secondly, from a public relations "swindle" side, an ad campaign could be purchased that makes the argument that "this kind of law is obviously not OK" look at this ridiculous example, the State is not following the same requirements as business is.. or similar..
      - keneda7 4y ago
        So I could see your argument if in my original post I said something about the law being wrong and needs to be removed. But I was careful not do that as I agree with most of the CCPA. I simply stated it is ridiculous that this law does not apply to more people. Especially when those people just leaked 200k+ sets of PII. Again I simply said more people should have to follow the CCPA, nothing about stopping or slowing it down. Yet you choose to try and invalidate my point by connecting it to something I very clearly did not say. From my point of view it appears that you just wanted to shut down criticism of the CA government because... well I have no idea.
- __derek__ 4y ago
  While I think that data leak was horrible (and potentially disastrous), it's not clear how CCPA would apply in that case.
  - keneda7 4y ago
    Check under Section A number 8. https://oag.ca.gov/privacy/ccpa https://oag.ca.gov/privacy/ccpa
    - __derek__ 4y ago
      Thanks. Somehow I didn't realize that driver's license number counted, but there it is.[1] [1]: https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&title=1.81.&part=4.&chapter=&article= https://leginfo.legislature.ca.gov/faces/codes_displayText.x...
- KennyBlanken 4y ago
  The incident you're referring to was a concealed carry permit site that exposed data and it happened about a month or two ago, so it's premature to say "nothing happened to them." The data was accessible for about 24 hours. https://www.latimes.com/california/story/2022-06-29/california-concealed-carry-weapons-permit-data-exposed-in-leak https://www.latimes.com/california/story/2022-06-29/californ... You made up "thousands" as no numbers have been given . The incident has been widely condemned including by the state AG, and they're contacting anyone affected / providing credit monitoring.
  - staringback 4y ago
    I'm sure credit monitoring will help when criminals go and break into their homes to steal their firearms
  - keneda7 4y ago
    The leak did not just expose ccw holders. It exposed ccw applications that were denied as well. DROS info was also available for a short time. I know exactly what was exposed because I looked myself up and I also received a the letter offering the IDX monitoring. I did not make up thousands, in fact the actual number is way higher... 200k ccw holders in ca. Simple google search: https://www.google.com/search?q=how+many+ccw+holders+are+in+CA&rlz=1C1CHBF_enUS940US940&oq=how+many+ccw+holders+are+in+CA&aqs=chrome..69i57j0i22i30l3j0i390l4.3376j0j7&sourceid=chrome&ie=UTF-8 https://www.google.com/search?q=how+many+ccw+holders+are+in+... The state AG is literally the person responsible so to say they condemned it is laughable. For example lets say I, keneda, somehow had all of your, KennyBlaken's, bank account numbers. I then pay someone to make a website with a UI to search for any of your account numbers. Then after all your account numbers publicly available and stolen I take it down and say oh I'm sorry I shouldn't have done that it was wrong. Sure I condemned the action but guess what I am still 100% responsible for making a publicly searchable user interface to expose data that is supposed to be private. The CA DOJ choose to have this searchable site made, it did not just magically appear on the internet.
- deleted 4y ago
  [deleted]
- systemvoltage 4y ago
  CA DOJ is completely and utterly shameless/corrupt. It is one of the most eggregeious institutions of America. They continue to violate basic fundamental rights guaranteed by the US constitution and then citizens of CA have to wait for 2 years of lawsuits to get their rights restored. They are also morally corrupt and will do anything in their power to tighten control over citizens of California.
  - chmod600 4y ago
    Examples?
    - systemvoltage 4y ago
      https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202120220SB918 https://leginfo.legislature.ca.gov/faces/billTextClient.xhtm... Bonta's is busy infringing fundamental rights. CCW would essentially be banned in California despite of Bruen. FYI https://en.wikipedia.org/wiki/Mia_Bonta https://en.wikipedia.org/wiki/Mia_Bonta Mia + Robert Bonta are a husband-wife duo that exemplifies corruption at the highest level. Mia is a state representative and Robert is the Attorney general of California. One is helping write unconstitutional legislation, the other is helping with litigation with the 9th circuit to make sure Americans are deprived of their rights. CA DOJ + 9th Circuit is one of the most corrupt judicial branches. Just recently Miller vs. Bonta was shoved back down to CA District court by 9th in light of Bruen even though they knew it would get appealed back to them. It deprived the rest of the west coast of liberties along with states such as Arizona, Montana and Idaho. It is absolutely hilarious when Newsom, et. al. calls California a free state. Freedom is being eroded here at an alarming but consistent pace for last 3 decades. Thanks to CA DOJ. The shining example of liberal states which still respect freedom, individualism and liberty is New Hampshire. Starkly different than California which wants to give free pass to criminals and punishes law abiding citizens. As a Californian, I want my damn pre-90's California back.
      - mint2 4y ago
        Okay so apparently you have beef about concealed carry permits and want more gun freedom. Any other examples that don’t involve gun ownership as that issue is way too debatable?
sillystuff 4y ago
I'm curious what HN folks' experiences with CCPA have been (from the consumer side)? For instance, I filled out a form for CCPA data deletion, at a very large data broker, to receive a report on data they had collected and to request my data not be sold, and then had evidence that my data was both retained and continued to be sold several months later. I wish surveillance was opt-in (yes, no one would and that is the point). It is quite a burden to try to "opt out" from data collection and sales with so many companies collecting, aggregating and selling this personal information.
- AlotOfReading 4y ago
  Most of the companies I've tried to opt-out from either don't recognize their obligations (you're not a 'customer' even though we're collecting your data), don't have a way to opt out short of contacting a legal department that has no public contact info, or failed to actually resolve the issue. I can only recall one case where I succeeded, in a couple dozen attempts.
  - ThrustVectoring 4y ago
    > short of contacting a legal department that has no public contact info All corporations are required to have an "agent for service of process" in the state they are registered in, and the secretary of state should maintain a lookup tool for this (haven't checked all 50 but it's common). Opt-out should take you approximately ten minutes - look up their agent for service of process, and send a certified letter explaining the action you want them to take to avoid the lawsuit you are considering.
- __derek__ 4y ago
  > I wish surveillance was opt-in (yes, no one would and that is the point). The European Data Protection Board is moving in that direction for "virtual voice assistants": requiring active consent to store data beyond what's necessary to execute the immediate request.[1] [1]: https://edpb.europa.eu/news/news/2021/july-7-12-plenaries-adopted-documents_en https://edpb.europa.eu/news/news/2021/july-7-12-plenaries-ad...
- 4y ago
henryfjordan 4y ago
The settlement was for $1.2M and some promises. Sephora has more than 100 locations in California. I bet some of their more prominent locations charge close to that $1.2M in rent. What a pittance of a settlement...

38 points by sebastian_z 4y ago

The fact that the CCPA does not apply to government agencies is completely outrageous in my opinion. The CA DOJ leaked thousands of citizens private information recently and nothing is happening to them. They even went through the trouble of building a UI to search the data released, so its pretty hard to claim it wasn't intentional. If we are going to hold companies to the CCPA should the agency in charge of enforcement not be held to the same standard?

mistrial9 4y ago
on the other side, arguments like this can be used to stall and diffuse the actual implementation upon the most egregious violators. In an extreme scenario (like say tribe gaming laws) said violators could actually hire and "astroturf" this kind of "look, over there" sort of outrage. Perhaps you are genuine, but .. congratulations California and AG Bonta on at least this action, right?
- keneda7 4y ago
  So my argument that MORE people should have to follow the CCPA is somehow an argument to prevent implementations of the CCPA. Could you please explain your logic there?
  - mistrial9 4y ago
    yes of course - the phrase is "the perfect is the enemy of the good" which means.. implementation of the law could be stalled or delayed, or the law could be challenged in court and reversed in the extreme case.. based on an argument that it is fundamentally flawed. A reason to be flawed is "not all covered parties are treated fairly" or something .. IANAL secondly, from a public relations "swindle" side, an ad campaign could be purchased that makes the argument that "this kind of law is obviously not OK" look at this ridiculous example, the State is not following the same requirements as business is.. or similar..
    - keneda7 4y ago
      So I could see your argument if in my original post I said something about the law being wrong and needs to be removed. But I was careful not do that as I agree with most of the CCPA. I simply stated it is ridiculous that this law does not apply to more people. Especially when those people just leaked 200k+ sets of PII. Again I simply said more people should have to follow the CCPA, nothing about stopping or slowing it down. Yet you choose to try and invalidate my point by connecting it to something I very clearly did not say. From my point of view it appears that you just wanted to shut down criticism of the CA government because... well I have no idea.
__derek__ 4y ago
While I think that data leak was horrible (and potentially disastrous), it's not clear how CCPA would apply in that case.
- keneda7 4y ago
  Check under Section A number 8. https://oag.ca.gov/privacy/ccpa https://oag.ca.gov/privacy/ccpa
  - __derek__ 4y ago
    Thanks. Somehow I didn't realize that driver's license number counted, but there it is.[1] [1]: https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&title=1.81.&part=4.&chapter=&article= https://leginfo.legislature.ca.gov/faces/codes_displayText.x...
KennyBlanken 4y ago
The incident you're referring to was a concealed carry permit site that exposed data and it happened about a month or two ago, so it's premature to say "nothing happened to them." The data was accessible for about 24 hours. https://www.latimes.com/california/story/2022-06-29/california-concealed-carry-weapons-permit-data-exposed-in-leak https://www.latimes.com/california/story/2022-06-29/californ... You made up "thousands" as no numbers have been given . The incident has been widely condemned including by the state AG, and they're contacting anyone affected / providing credit monitoring.
- staringback 4y ago
  I'm sure credit monitoring will help when criminals go and break into their homes to steal their firearms
- keneda7 4y ago
  The leak did not just expose ccw holders. It exposed ccw applications that were denied as well. DROS info was also available for a short time. I know exactly what was exposed because I looked myself up and I also received a the letter offering the IDX monitoring. I did not make up thousands, in fact the actual number is way higher... 200k ccw holders in ca. Simple google search: https://www.google.com/search?q=how+many+ccw+holders+are+in+CA&rlz=1C1CHBF_enUS940US940&oq=how+many+ccw+holders+are+in+CA&aqs=chrome..69i57j0i22i30l3j0i390l4.3376j0j7&sourceid=chrome&ie=UTF-8 https://www.google.com/search?q=how+many+ccw+holders+are+in+... The state AG is literally the person responsible so to say they condemned it is laughable. For example lets say I, keneda, somehow had all of your, KennyBlaken's, bank account numbers. I then pay someone to make a website with a UI to search for any of your account numbers. Then after all your account numbers publicly available and stolen I take it down and say oh I'm sorry I shouldn't have done that it was wrong. Sure I condemned the action but guess what I am still 100% responsible for making a publicly searchable user interface to expose data that is supposed to be private. The CA DOJ choose to have this searchable site made, it did not just magically appear on the internet.
deleted 4y ago
[deleted]
systemvoltage 4y ago
CA DOJ is completely and utterly shameless/corrupt. It is one of the most eggregeious institutions of America. They continue to violate basic fundamental rights guaranteed by the US constitution and then citizens of CA have to wait for 2 years of lawsuits to get their rights restored. They are also morally corrupt and will do anything in their power to tighten control over citizens of California.
- chmod600 4y ago
  Examples?
  - systemvoltage 4y ago
    https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202120220SB918 https://leginfo.legislature.ca.gov/faces/billTextClient.xhtm... Bonta's is busy infringing fundamental rights. CCW would essentially be banned in California despite of Bruen. FYI https://en.wikipedia.org/wiki/Mia_Bonta https://en.wikipedia.org/wiki/Mia_Bonta Mia + Robert Bonta are a husband-wife duo that exemplifies corruption at the highest level. Mia is a state representative and Robert is the Attorney general of California. One is helping write unconstitutional legislation, the other is helping with litigation with the 9th circuit to make sure Americans are deprived of their rights. CA DOJ + 9th Circuit is one of the most corrupt judicial branches. Just recently Miller vs. Bonta was shoved back down to CA District court by 9th in light of Bruen even though they knew it would get appealed back to them. It deprived the rest of the west coast of liberties along with states such as Arizona, Montana and Idaho. It is absolutely hilarious when Newsom, et. al. calls California a free state. Freedom is being eroded here at an alarming but consistent pace for last 3 decades. Thanks to CA DOJ. The shining example of liberal states which still respect freedom, individualism and liberty is New Hampshire. Starkly different than California which wants to give free pass to criminals and punishes law abiding citizens. As a Californian, I want my damn pre-90's California back.
    - mint2 4y ago
      Okay so apparently you have beef about concealed carry permits and want more gun freedom. Any other examples that don’t involve gun ownership as that issue is way too debatable?

sillystuff 4y ago

I'm curious what HN folks' experiences with CCPA have been (from the consumer side)? For instance, I filled out a form for CCPA data deletion, at a very large data broker, to receive a report on data they had collected and to request my data not be sold, and then had evidence that my data was both retained and continued to be sold several months later. I wish surveillance was opt-in (yes, no one would and that is the point). It is quite a burden to try to "opt out" from data collection and sales with so many companies collecting, aggregating and selling this personal information.

AlotOfReading 4y ago
Most of the companies I've tried to opt-out from either don't recognize their obligations (you're not a 'customer' even though we're collecting your data), don't have a way to opt out short of contacting a legal department that has no public contact info, or failed to actually resolve the issue. I can only recall one case where I succeeded, in a couple dozen attempts.
- ThrustVectoring 4y ago
  > short of contacting a legal department that has no public contact info All corporations are required to have an "agent for service of process" in the state they are registered in, and the secretary of state should maintain a lookup tool for this (haven't checked all 50 but it's common). Opt-out should take you approximately ten minutes - look up their agent for service of process, and send a certified letter explaining the action you want them to take to avoid the lawsuit you are considering.
__derek__ 4y ago
> I wish surveillance was opt-in (yes, no one would and that is the point). The European Data Protection Board is moving in that direction for "virtual voice assistants": requiring active consent to store data beyond what's necessary to execute the immediate request.[1] [1]: https://edpb.europa.eu/news/news/2021/july-7-12-plenaries-adopted-documents_en https://edpb.europa.eu/news/news/2021/july-7-12-plenaries-ad...
4y ago

henryfjordan 4y ago

The settlement was for $1.2M and some promises. Sephora has more than 100 locations in California. I bet some of their more prominent locations charge close to that $1.2M in rent. What a pittance of a settlement...