6 ms·

From the senate press release, > The CPPA would create a simple way for Californians to direct all data brokers to delete their personal information, free of c

From the senate press release, > The CPPA would create a simple way for Californians to direct all data brokers to delete their personal information, free of charge. I wonder how something like this would actually be enforced. At the moment I can request my personal information to be deleted, but there is no way for me to determine whether such request was actually fulfilled. Even with this option to direct "all data brokers", the problem remains, and it seems to be briefly acknowledged in this sentence > Tsukayama said that what most experts in the field agree on is that California law leads the nation in this space, but that it’s still barely enforced. I don't know of any good way to enforce this kind of legislation, even if I totally support it.

bobthepanda 4y ago
It sounds like a recipe for enforcement by lawsuit, which is similar to the ADA for example.
- mlyle 4y ago
  In order to enforce by lawsuit, the people who have standing to sue (or a regulator acting on their behalf) need to somehow know that an organization is out of compliance. For the ADA, you can see whether there's enough parking spaces or whether the ramp is legal or whether you were denied a reasonable accommodation. Here, there's a mandatory audit mechanism, but it's unclear whether the proper recordkeeping will be required to really allow issues to be spotted at audit.
  - d4mi3n 4y ago
    Is there any way to know if any audit mechanism works before it's actually been put into practice? I share your concerns, but it seems a bit early to worry that auditing + lawsuit enforcement isn't worth giving a spin. Do we have examples of similar legislation that has or hasn't been successful with similar contexts/enforcement? The closest examples I can think of are in finance, like fair lending laws or SOX compliance; both of which are heavily dependent on auditing data.
    - mlyle 4y ago
      As a sibling commenter puts out, a uniform deletion "certificate" or other notice that could be used as verification of requests would be useful to ensure that audits would have a corresponding record to use to determine what records should not be present. Then, data broker keeps a list of such deletion notices. If any of those notices ends up having data still stored, that's a violation. If any customer presents such a certificate but isn't in the list of such notices on the data broker, that could be a violation. This way there's an effective, enforceable mechanism. Otherwise, a broker can just lose deletion requests entirely and no one would know.
- kevingadd 4y ago
  It's surprisingly tough to find a lawyer willing to file an ada suit. Most search results are for companies to defend against suits, and my local bar association only had one firm to refer me to that didn't return my calls.
  - JohnFen 4y ago
    > Most search results are for companies to defend against suits Attorneys know each other. You could probably ask one of the lawyers who defend against such suits for referrals to lawyers who file such suits.
anticristi 4y ago
If it's any consolation, it look GDPR 7(-ish) years to make a difference. Hang in there!
- emodendroket 4y ago
  Yeah, all those annoying "we use cookies" pop-ups are inspiring
  - fknorangesite 4y ago
    You're welcome to blame the people putting those pop-ups there, not GDPR.
    - emodendroket 4y ago
      OK but why should I? If you think this is chauvinistic think of how California set out to root out a bunch of carcinogens and ended up assuring that every second thing I buy has a warning that it might cause cancer with no real way for me to determine how seriously I should take it.
  - bobwaycott 4y ago
    This is at least the billionth time it’s been pointed out, but the GDPR is not responsible for those annoying pop-ups. The GDPR is erroneously blamed for them, when in reality, the pop-ups are a deliberate choice made by site operators. Feel free to brush up on the GDPR, the EPD, and how they work together: https://gdpr.eu/cookies/ https://gdpr.eu/cookies/
    - digging 4y ago
      I don't think the GP is suggesting that the GDPR mandated those shitty popups, I think they're upset that the GDPR allowed them. They're basically a massive loophole. Of course the site operators are to blame for their individual popups. That's without addressing the fact that the EPD is what triggered them.
    - 4y ago
deleted 4y ago
[deleted]
frogblast 4y ago
I was wondering if a “chain of custody” law for personal information can make this enforceable. You can request your personal information from a holder of it, and along with that comes the identity of where/when/who that data was acquired from (and transitively who they got it from). Then you can tell who sold it, both to gauge violations and also to name and shame. And if they don’t have the chain of custody, then they are immediately in violation, and it is easily proven.
SnowProblem 4y ago
"Data brokers would have to undergo an independent third-party audit every three years to ensure compliance with the DELETE Act provisions and submit audit reports to the California Privacy Protection Agency." Source: https://privacyrights.org/resources/california-delete-act-bill-give-californians-more-control-over-their-personal-data https://privacyrights.org/resources/california-delete-act-bi...
- jerf 4y ago
  Well, I can see how that means well, but this doesn't scale to dozens of other jurisdictions doing the same thing. The audits would have to either be cheap and toothless or impossibly expensive, or, given the dozens of jurisdictions eventually doing these, probably both and other combinations besides. One can only imagine the nightmare of this jurisdiction deciding this bit of data is private, some other jurisdiction deciding it's mandatory to keep (e.g., "you must record this user's legal identity in order to ensure that future data you may receive is also deleted"), and yet a third jurisdiction deciding that it must be deleted but if and only if the user explicitly asks for it in the request. It won't take much for (real) compliance to exceed what even the big tech companies could afford. At least something like the EU legislating this covers a significant fraction of the world economy in one go.
  - minsc_and_boo 4y ago
    Most jurisdictions copy the main tenets* from each other, to make it easier for actors to enforce in their region - i.e. GDPR -> CCPA.
    - chrisweekly 4y ago
      tenets, not tenants
  - throwaway-blaze 4y ago
    You've obviously never dealt with the EU privacy machinery. There is a separate privacy directorate in every single EU country. There is also a privacy group at the EU level. These groups _fight_with_each_other_...the EU level authority recently forced Ireland's DPA to fine Facebook despite the Irish authorities initially finding no enforceable infringement. I get that everyone dislikes Facebook, but this is not a stable regulatory regime to do business in, nor is it covering all EU member countries "in one go".
fallingknife 4y ago
Easy way to enforce is to give anyone who reports a breach and provides evidence half of the fine. People will be constantly trying to buy data from the broker that they aren't supposed to have to get the reward. And any time they find something, it's payday.
emodendroket 4y ago
I think this is a pretty common problem with any kind of business regulation -- how do I know that a factory isn't just illegally dumping its waste? Regulators are usually working with less complete knowledge than the entities they regulate. You'd have to set up penalties large enough that the risks weren't worth it, but that ironically works better with larger companies since fly-by-night operations are free to just shut down and don't care that much about their reputations.
rekoil 4y ago
> I don't know of any good way to enforce this kind of legislation, even if I totally support it. What the EU does with GDPR is put a huge fine on actors caught ignoring GDPR deletion requests. It's up to €20m or 4% of the companies global turnover, whichever hurts the most.
- throwaway-blaze 4y ago
  And how many of those fines have been levied _and_ paid so far?
anigbrowl 4y ago
One popular (and somewhat successful) legislative strategy is to create a 'private right of action' whereby an injured party can sue an offending one easily by meeting a specific burden of proof - eg if you file a complaint with a data broker and the data is not removed within a defined reasonable period, you can go to court armed with a rebuttable presumption of the broker's liability and claim some statutorily specified amount of compensation. A well-known example would be violations of the Americans with Disabilities Act.
- InitialLastName 4y ago
  The comparison to the ADA is a good one, but it also illustrates the issue of how verifiable the remedies are. It's much easier to prove whether a business has a ramp than that they deleted some piece of data from all of their servers everywhere
  - anigbrowl 4y ago
    I think it will be based on availability rather than verification of deletion, but I'm just guessing.
scrum-treats 4y ago
There are relatively simple ways to enforce this. For instance, requiring companies to register all trackers prior to use. And in that registration process specify all metadata that would be collected. Terms of service for implementing trackers in California could include something along the lines of permitting independent E2E auditing of all trackers and any software linked to it, e.g., software related to personalization and feature creation/selection/optimization. There could also be something like more comprehensive enforcement of "(meta)data flushing," including a tighter turn-around time to ensure customer data that was supposed to be deleted is actually deleted, at more regular intervals. This would better ensure novelty at the time of model training/fine-tuning. These training logs would be audited as well. Training data size would decrease. It would also act as a natural guard against data hoarding, which disproportionately benefits huge corporations (e.g., Google, Amazon). Does it make personalization harder? In some ways yes. It also challenges us to invent solutions more sophisticated than "just feed the model more data."
thewebcount 4y ago
I wonder if some sort of "do not call"-style list that the government keeps would do the trick? The government maintains the list so some company can't say, "We never received any notice from them!" and the government can also audit whether each person on the list has data associated with them in any given company's database. The government would have to audit companies when a consumer contacts them (or just do it periodically for all companies, if that's feasible). I think the bigger problem is how does a consumer know whether any random company has data on them? I mean, sure, I can figure that Google, Amazon, and Meta probably would be on that list, but the real problem is all the smaller 3rd party resellers of such data. I don't even know their names, let alone how I would figure out if they have info on me.
- digging 4y ago
  It would not work. Not enough people would use it, for myriad reasons. The real answer is privacy by default. Opt-in for invasive harvesting. The science of design is well enough known that we could even legislate against dark patterns if we wanted to.
djfm 4y ago
Random audits in data brokers' data centers? Software on consumers' devices that records ads seen and file complaints if consumers are still being tracked? It's very easy to detect algorithmically that you're being shown personalized ads.

bobthepanda 4y ago

It sounds like a recipe for enforcement by lawsuit, which is similar to the ADA for example.

mlyle 4y ago
In order to enforce by lawsuit, the people who have standing to sue (or a regulator acting on their behalf) need to somehow know that an organization is out of compliance. For the ADA, you can see whether there's enough parking spaces or whether the ramp is legal or whether you were denied a reasonable accommodation. Here, there's a mandatory audit mechanism, but it's unclear whether the proper recordkeeping will be required to really allow issues to be spotted at audit.
- d4mi3n 4y ago
  Is there any way to know if any audit mechanism works before it's actually been put into practice? I share your concerns, but it seems a bit early to worry that auditing + lawsuit enforcement isn't worth giving a spin. Do we have examples of similar legislation that has or hasn't been successful with similar contexts/enforcement? The closest examples I can think of are in finance, like fair lending laws or SOX compliance; both of which are heavily dependent on auditing data.
  - mlyle 4y ago
    As a sibling commenter puts out, a uniform deletion "certificate" or other notice that could be used as verification of requests would be useful to ensure that audits would have a corresponding record to use to determine what records should not be present. Then, data broker keeps a list of such deletion notices. If any of those notices ends up having data still stored, that's a violation. If any customer presents such a certificate but isn't in the list of such notices on the data broker, that could be a violation. This way there's an effective, enforceable mechanism. Otherwise, a broker can just lose deletion requests entirely and no one would know.
kevingadd 4y ago
It's surprisingly tough to find a lawyer willing to file an ada suit. Most search results are for companies to defend against suits, and my local bar association only had one firm to refer me to that didn't return my calls.
- JohnFen 4y ago
  > Most search results are for companies to defend against suits Attorneys know each other. You could probably ask one of the lawyers who defend against such suits for referrals to lawyers who file such suits.

anticristi 4y ago

If it's any consolation, it look GDPR 7(-ish) years to make a difference. Hang in there!

emodendroket 4y ago
Yeah, all those annoying "we use cookies" pop-ups are inspiring
- fknorangesite 4y ago
  You're welcome to blame the people putting those pop-ups there, not GDPR.
  - emodendroket 4y ago
    OK but why should I? If you think this is chauvinistic think of how California set out to root out a bunch of carcinogens and ended up assuring that every second thing I buy has a warning that it might cause cancer with no real way for me to determine how seriously I should take it.
- bobwaycott 4y ago
  This is at least the billionth time it’s been pointed out, but the GDPR is not responsible for those annoying pop-ups. The GDPR is erroneously blamed for them, when in reality, the pop-ups are a deliberate choice made by site operators. Feel free to brush up on the GDPR, the EPD, and how they work together: https://gdpr.eu/cookies/ https://gdpr.eu/cookies/
  - digging 4y ago
    I don't think the GP is suggesting that the GDPR mandated those shitty popups, I think they're upset that the GDPR allowed them. They're basically a massive loophole. Of course the site operators are to blame for their individual popups. That's without addressing the fact that the EPD is what triggered them.
  - 4y ago

deleted 4y ago

[deleted]

frogblast 4y ago

I was wondering if a “chain of custody” law for personal information can make this enforceable. You can request your personal information from a holder of it, and along with that comes the identity of where/when/who that data was acquired from (and transitively who they got it from). Then you can tell who sold it, both to gauge violations and also to name and shame. And if they don’t have the chain of custody, then they are immediately in violation, and it is easily proven.

SnowProblem 4y ago

"Data brokers would have to undergo an independent third-party audit every three years to ensure compliance with the DELETE Act provisions and submit audit reports to the California Privacy Protection Agency." Source: https://privacyrights.org/resources/california-delete-act-bill-give-californians-more-control-over-their-personal-data https://privacyrights.org/resources/california-delete-act-bi...

jerf 4y ago
Well, I can see how that means well, but this doesn't scale to dozens of other jurisdictions doing the same thing. The audits would have to either be cheap and toothless or impossibly expensive, or, given the dozens of jurisdictions eventually doing these, probably both and other combinations besides. One can only imagine the nightmare of this jurisdiction deciding this bit of data is private, some other jurisdiction deciding it's mandatory to keep (e.g., "you must record this user's legal identity in order to ensure that future data you may receive is also deleted"), and yet a third jurisdiction deciding that it must be deleted but if and only if the user explicitly asks for it in the request. It won't take much for (real) compliance to exceed what even the big tech companies could afford. At least something like the EU legislating this covers a significant fraction of the world economy in one go.
- minsc_and_boo 4y ago
  Most jurisdictions copy the main tenets* from each other, to make it easier for actors to enforce in their region - i.e. GDPR -> CCPA.
  - chrisweekly 4y ago
    tenets, not tenants
- throwaway-blaze 4y ago
  You've obviously never dealt with the EU privacy machinery. There is a separate privacy directorate in every single EU country. There is also a privacy group at the EU level. These groups _fight_with_each_other_...the EU level authority recently forced Ireland's DPA to fine Facebook despite the Irish authorities initially finding no enforceable infringement. I get that everyone dislikes Facebook, but this is not a stable regulatory regime to do business in, nor is it covering all EU member countries "in one go".

fallingknife 4y ago

Easy way to enforce is to give anyone who reports a breach and provides evidence half of the fine. People will be constantly trying to buy data from the broker that they aren't supposed to have to get the reward. And any time they find something, it's payday.

emodendroket 4y ago

I think this is a pretty common problem with any kind of business regulation -- how do I know that a factory isn't just illegally dumping its waste? Regulators are usually working with less complete knowledge than the entities they regulate. You'd have to set up penalties large enough that the risks weren't worth it, but that ironically works better with larger companies since fly-by-night operations are free to just shut down and don't care that much about their reputations.

rekoil 4y ago

> I don't know of any good way to enforce this kind of legislation, even if I totally support it. What the EU does with GDPR is put a huge fine on actors caught ignoring GDPR deletion requests. It's up to €20m or 4% of the companies global turnover, whichever hurts the most.

throwaway-blaze 4y ago
And how many of those fines have been levied _and_ paid so far?

anigbrowl 4y ago

One popular (and somewhat successful) legislative strategy is to create a 'private right of action' whereby an injured party can sue an offending one easily by meeting a specific burden of proof - eg if you file a complaint with a data broker and the data is not removed within a defined reasonable period, you can go to court armed with a rebuttable presumption of the broker's liability and claim some statutorily specified amount of compensation. A well-known example would be violations of the Americans with Disabilities Act.

InitialLastName 4y ago
The comparison to the ADA is a good one, but it also illustrates the issue of how verifiable the remedies are. It's much easier to prove whether a business has a ramp than that they deleted some piece of data from all of their servers everywhere
- anigbrowl 4y ago
  I think it will be based on availability rather than verification of deletion, but I'm just guessing.

scrum-treats 4y ago

There are relatively simple ways to enforce this. For instance, requiring companies to register all trackers prior to use. And in that registration process specify all metadata that would be collected. Terms of service for implementing trackers in California could include something along the lines of permitting independent E2E auditing of all trackers and any software linked to it, e.g., software related to personalization and feature creation/selection/optimization. There could also be something like more comprehensive enforcement of "(meta)data flushing," including a tighter turn-around time to ensure customer data that was supposed to be deleted is actually deleted, at more regular intervals. This would better ensure novelty at the time of model training/fine-tuning. These training logs would be audited as well. Training data size would decrease. It would also act as a natural guard against data hoarding, which disproportionately benefits huge corporations (e.g., Google, Amazon). Does it make personalization harder? In some ways yes. It also challenges us to invent solutions more sophisticated than "just feed the model more data."

thewebcount 4y ago

I wonder if some sort of "do not call"-style list that the government keeps would do the trick? The government maintains the list so some company can't say, "We never received any notice from them!" and the government can also audit whether each person on the list has data associated with them in any given company's database. The government would have to audit companies when a consumer contacts them (or just do it periodically for all companies, if that's feasible). I think the bigger problem is how does a consumer know whether any random company has data on them? I mean, sure, I can figure that Google, Amazon, and Meta probably would be on that list, but the real problem is all the smaller 3rd party resellers of such data. I don't even know their names, let alone how I would figure out if they have info on me.

digging 4y ago
It would not work. Not enough people would use it, for myriad reasons. The real answer is privacy by default. Opt-in for invasive harvesting. The science of design is well enough known that we could even legislate against dark patterns if we wanted to.

djfm 4y ago

Random audits in data brokers' data centers? Software on consumers' devices that records ads seen and file complaints if consumers are still being tracked? It's very easy to detect algorithmically that you're being shown personalized ads.