13 ms·

Analysis of the California Delete Act

80 points by robbiet480 3y ago

nsenifty 3y ago
"Will soon be able"
- totetsu 3y ago
  “Data brokers who comply with California law”
  - xrd 3y ago
    Won't violators be subject to the many excited LA lawyers? I'm asking seriously, is this a toothless law?
    - 6stringmerc 3y ago
      Well we can start with Acxiom out in Arkansas
wkat4242 3y ago
Nice one. Time to bring that in in Europe too!
- breadwinner 3y ago
  You already have GDPR and other laws. California is catching up. The rest of the US needs to catch up as well, but probably won't.
  - wkat4242 3y ago
    Yeah but I don't think we have a "delete my data from all brokers" button yet. It would be very helpful, especially because they will keep collecting it. When we have it I'll automate something to trigger it every week or so.
    - orwin 3y ago
      You have though, you can send a mail. I had to give my data so that my sister could rent an apartment, once she got it i filled preformed Gdpr letters asking them to delete my data non necessary to their business, and if they sent my data to third parties, ask them to delete it too.
      - wkat4242 3y ago
        Yeah but not "all brokers" without having to figure out who they even are. California has that.
    - boudin 3y ago
      Under GDPR, if you request that a company deletes the PII they have on you, the company has the obligation to request deletion to any third parties they transferred the data to. One requirement that is less known is also that, if a company has PII about you and you never explicitly gave this data to them, you then have the right to be informed. What it means is that you can ask what data they hold on you and what is the source of the data. So if you get a cold call from a random sales person, you can ask them where they got your number, they have the obligation to tell you the data broker they bought it from. You can then request the deletion of your data from the data broker. I did it a few times.
      - wkat4242 3y ago
        Yeah but not "all brokers" without having to figure out who they even are. There's a huge forest of data brokers behind the big actors. California has that. But asking the people who they got the data from doesn't work. They just hang up as soon as you talk about it. Especially because I'm on the "do not call me" register and they are already in breach of the law by calling me in the first place.
        boudin 3y ago
        It's going to be the same in California for companies who just ignore the regulation though. I do agree with you that a centralised way to get your data to be deleted is great. It does feel like a band-aid to me though, I would just prefer that reselling PII would be made illegal. I don't see the point of allowing that.
offmycloud 3y ago
> In 2026 Californians will now have the ability to use this accessible deletion mechanism that the CPPA will set up over the next two years. Editorialized headline ("Californians now able") is false, not available for another two years.
- robbiet480 3y ago
  Fixed, apologies
silisili 3y ago
I wonder how strictly said tool will validate the user is actually a CA resident? Hopefully not much, I'd probably try to use it anyways as someone not living in CA. I remember emailing a site that apparently scraped LinkedIn, asking them to remove my information. They told me to fill out a form attesting I lived in California. When I told them I did not live in California, they told me to just sign it anyways and they'd proceed - and they did. So how many other companies are really checking each individual for truthiness? Doing so would seem impossible at such a scale.
- hn_230601 3y ago
  Having deleted a bunch of online accounts a year ago, a lot of companies used OneTrust and their privacy policy would typically specify for California residents but the process varied pretty widely. Some of the data deletion requests would ask "Are you a California resident (yes/no)" while some would ask for a California address, and some wouldn't ask at all. One of the companies had a support person respond back to my request when I had answered no to being a California resident strongly implying I should resubmit my request with it marked yes which I ended up doing and it resolved smoothly. I imagine companies that mainly make their money from the data would be a lot more strict on it though.
  - immibis 3y ago
    and it's not even fraud because they told you to lie
- singleshot_ 3y ago
  I’m sure if you wanted to find a lawyer who could help you become a de jure California resident for a sufficient time, it could be arranged. (For instance, there is one right here in this thread with you…)
  - nocoiner 3y ago
    The California Franchise Tax Board would probably be delighted with that arrangement as well. They have an office next to my dentist. I live in Texas!
RajT88 3y ago
I bet that button will be really hard to find.
- altairprime 3y ago
  If it’s anything like CCPA, that’s prohibited.
tzs 3y ago
> SB 362 received a cumulative vote of 153 for it and 38 against it the various times it was voted on the floor of the two houses and in multiple committees. That’s over 80%-win rate. It received a Republican vote on the Assembly floor, making it bipartisan. Wait...the final Senate vote was: D R Yes 31 0 No 1 8 and the final Assembly vote was: D R Yes 52 1 No 14 14 and it is considered bipartisan because a single R voted yes?!
- littlestymaar 3y ago
  That's literally what's written in your quote: > It received a Republican vote on the Assembly floor, making it bipartisan.
  - tzs 3y ago
    The point of my comment was to highlight that, and show the totals to make clear just how lopsided the vote was, and to ask if that usage was correct. Hence the "?!" at the end. By nearly every definition I've seen of "bipartisan" that would not be be bipartisan. There's no precise definition, but generally the usage I've seen is for these kinds of situations: 1. A majority of each party support it. 2. The majority party does not have enough votes within the party to pass it, so have to get cooperation from members of the minority party. This generally requires the majority party to make concessions to get those votes, which generally requires making some concessions that help advance the minority party's agenda. Politicians sometimes do call bills bipartisan with few (or even zero!) votes from the other party, but they get called out on that by fact checkers [1]. [1] https://www.factcheck.org/2019/12/pelosis-bipartisanship-boast/ https://www.factcheck.org/2019/12/pelosis-bipartisanship-boa...
dang 3y ago
Recent and related: California passes bill to make it easier to delete data from data brokers - https://news.ycombinator.com/item?id=37524158 https://news.ycombinator.com/item?id=37524158 - Sept 2023 (145 comments) Also: 'Delete Act' seeks to give Californians more power to block data tracking - https://news.ycombinator.com/item?id=35691243 https://news.ycombinator.com/item?id=35691243 - April 2023 (131 comments)
beebeepka 3y ago
Deleted or marked as deleted. I'll let you decide since I am too jaded.
bloppe 3y ago
"right now is being sold by hundreds of data brokers to anyone with a credit card." Has anybody tried to actually buy data from a data broker? I haven't found it to be nearly as easy as this makes it seem. Looking for tips / suggestions on brokers who might sell me my own information for decently cheap :) for academic purposes of course... I do like this law tho.
- Spooky23 3y ago
  When Enfamil Fedex’ed a case of baby formula as a “welcome baby” gift for the child that we lost to a miscarriage, I got pissed off and dug into it. They told me where they got the lost and I bought it for my zip code for $50. So I found out which neighbors were pregnant, had diabetes, were buying a car, etc. The medical information was sourced from “anonymized” insurance subrogation data and prescription data. They were able to correctly identify that my wife was pregnant and project the due date, but didn’t have the diagnosis or the reason for the hospital/OB admission.
  - smcin 3y ago
    The prescription data was presumably resold by pharmacies (which?) to data brokers. This was their workaround to sidestep HIPAA ("It's not medical information, it's prescription information"). This is also why pharmacies pester you for your phone number, and to participate in their loyalty programs (don't).
    - Spooky23 3y ago
      As far as I could tell, they could link the hospital admission, OB admission (the hospital runs a separate system for OB) and doctor to the scripts. The RhoGAM was filled by the hospital pharmacy, and other scripts were filled by CVS. My understanding is that "anonymized" data leaks from subrogration and the PBM as well that can be un-anonymized later.
      - smcin 3y ago
        That's shocking
404mm 3y ago
I’m going to identify as California resident more than usual. /s Cali has some decent laws when it comes to consumer protection. I’d love to see more of them on federal level.
- slimsag 3y ago
  I requested data be deleted from a data broker and live in Arizona: > We are in receipt of your request dated September 12, 2023. You are submitting a request from a jurisdiction that does not currently provide data rights.
  - hedora 3y ago
    What happens if you get a CA po box, or use a vpn?
    - rapind 3y ago
      90210
    - lcnPylGDnU4H9OF 3y ago
      They might require a non-PO box address and a VPN could be defeated by a manual verification. That said, doesn’t hurt to try!
  - manicennui 3y ago
    It's irritating that companies do the bare minimum required by law instead of doing the right thing.
    - jojobas 3y ago
      The first right thing a company is obligated to do is to earn money. You've agreed to their terms that don't violate the law, why would they forfeit their hard earned cash, even if it's the right thing to do?
      - 3y ago
jjtheblunt 3y ago
> Californians will be able to delete all personal online data in first-in-US law Considering the government has in no way regulated phone solicitors or spam, how could anyone assume this law would have any effect? I mean, lawbreakers ignore laws, and spammers hoard personal data. edit: the Los Angeles Times article's first sentence is less hyperbolic, more sober... > Californians will be able to make a single request asking that data brokers delete their personal information, under a bill Gov. Gavin Newsom signed into law Tuesday.
deleted 3y ago
[deleted]
ds 3y ago
Some things to note, unless the bill was modified from the version I read before being signed into law: This doesnt apply to any information which is public record as a matter-of-fact. So if you voted, your address and name is public record and can be used and displayed by these sites. If you got a DUI, your mugshot and arrest record may be public record and can be displayed. If you got into a custody battle and your court case was public, that can be displayed. And I guess that all makes sense in the end. If you got into a DUI, how does the government get to tell random website X that they are not allowed to say that you got into a DUI, especially when the information was public record. So to be clear, if the peoplefinder style websites want to keep whitepages.com/user/john-smith online with an address, phone number and mugshot- They can tell you to pound sand and do so. This bill cant stop that. Honestly, Theres alot of hype about this bill in general which is going to be... interesting... when people fail to understand what it can and cant be used for. Additionally, this bill comes with a caveat that the sites can request proof you are living in california currently, via a license scan or some other method you get to now hand over to the data broker. That said, in our research for https://redact.dev https://redact.dev supporting these features from a pure API only interaction, is that most of the sites just delete you if you use their form. They dont want the headache of insane users threatening them and doing crazy shit because they dont delete their profile. And honestly the people who go through these removal processes are less than 1% of the stored data, so its mostly just a cost of doing business.
- newman314 3y ago
  If you know the magic incantation to remove data from BlockShopper, I'm quite sure lots of folks would be interested in knowing how to do so.
  - therockspush 3y ago
    Used to be, in the good old days, getting yourself off lexisnexis did a good chunk of the heavy lifting out of these data pits. For anyone who doesn't know what BlockShopper does, what does it do?
    - 3y ago
JaceLightning 3y ago
[flagged]
JaceLightning 3y ago
[flagged]
rwhyan 3y ago
TLDR; > the Delete Act would empower the CPPA to develop a system by 2026 that allows residents to make a single data deletion request across the nearly 500 registered data brokers operating in the state. The CPPA would also be charged with enforcing provisions of the Delete Act, such as requiring data broker registration and ensuring brokers delete an individual's personal information every 45 days upon receipt of a verified request. Source: https://iapp.org/news/a/california-legislature-passes-delete-act-for-pi-aggregated-by-data-brokers/ https://iapp.org/news/a/california-legislature-passes-delete...
DamnYuppie 3y ago
I have not read the legislation so this maybe an obvious and silly question. Does this also apply to credit agencies?
- dmarti 3y ago
  No, they're regulated under the federal FCRA, not state law.
- pards 3y ago
  > Data brokers are defined in the bill as businesses that we don’t have a direct relationship with — and likely have never even heard of — that scrape and collect our personal information from various offline and online sources, and then aggregate our personal information, and then sell it to third parties Credit agencies like Equifax and TransUnion satisfy that condition. They should be subject to the law, especially given Equifax's security history [0] [0]: https://en.wikipedia.org/wiki/2017_Equifax_data_breach https://en.wikipedia.org/wiki/2017_Equifax_data_breach
deleted 3y ago
[deleted]
neilv 3y ago
Can someone who knows more about policy sausage-making than I do, comment on how good/bad this is? I don't know what to think about California seeming to set an upper limit on privacy policy for the country. California's revenues seem partly tied to some of the worst invaders of privacy, and presumably Californian legislation gets industry input. At one point, I naively wondered whether a wealthy and independent-minded state like Texas might lead this (a bit like they have with textbooks). I guess they're pretty tied now, too, and also have a lot of anti-regulation voters.
- jdp23 3y ago
  It's very good in that it's significant progress over other US-based laws. Then again if you compare it to the much stronger privacy protections in the EU, there's still a looooong way to go. It's true that California's legislation gets a lot of industry input, and they're not going to pass something puts the big tech companies out of business. On the other hand, there's a very effective coalition of privacy organizers there -- who are quite familiar with tech's tactics, and can be very effective at cutting through tech's spin with legislators. Plus, the California Privacy Protection Agency (which got established by a referendum, not through the legislature) has a lot of clout -- there isn't anything comparable in any other US state. Washington state has similar dynamics, although with the CPPA equivalent. Microsoft and Amazon are hugely influential here; but, grassroots organizers had repeatedly stopped them from getting the very weak Bad Washington Privacy Act through the legislature. And this year, we passed My Health My Data -- stronger in some ways than California's privacy law. Texas ... has been a disappointment. The privacy law they passed this year is based on the Bad Washington Privacy Act but significantly weaker.
  - dmarti 3y ago
    WA MHMD is a game changer because private right of action. Doesn't rely on the attorney general or a dedicated privacy agency to take action -- private lawyers can. (Technically not the first privacy law with private right of action because the Video Privacy Protection Act has one, but that law was originally passed to cover videotape rentals and the courts are still working out how it applies to video content on the Internet)
parhamn 3y ago
California's consumer protection feels like EU levels right now. With such a big economy and influence on other states, it feels like they're becoming a singular driving force for policy for (at least) blue states. e.g. I suspect Skittles won't have a "California recipe" to avoid Red No 3 which will effectively make it national law. Has the rate with which they're driving consumer protection gone up as a legitimate broader strategy or is it just part of the Newsome might run activity?
- irjustin 3y ago
  It's been like this for forever. Lots of key car safety and emissions started in CA.
  - andromeduck 3y ago
    Which his great because california's emissions policies have been a disaster for safety and emissions.
    - irjustin 3y ago
      Care to list any specifics?
      - andromeduck 3y ago
        https://youtu.be/mQDegCqiVnU?si=KIFM9Vc5vQ4rV_mM https://youtu.be/mQDegCqiVnU?si=KIFM9Vc5vQ4rV_mM https://youtu.be/jN7mSXMruEo?si=Ot3jkIPaJJrHwwmC https://youtu.be/jN7mSXMruEo?si=Ot3jkIPaJJrHwwmC
        irjustin 3y ago
        Ah so you don't like stricter emissions; not one for the long term of our planet I see.
        andromeduck 3y ago
ssss11 3y ago
[flagged]
- zeroonetwothree 3y ago
  [flagged]
behnamoh 3y ago
[flagged]
- k_roy 3y ago
  Do you know why? It makes sense. It's effectively a legal monopoly right now. He's going to manufacturing to bottom-line the costs.
- deleted 3y ago
  [deleted]
qingcharles 3y ago
I wish I could just get my data. There are laws that require this, but Google won't let me get my data from my account because I lost the phone number, even though I have the username, password, recovery email and all the email gets forwarded to my other account. They say they have no way to prove it is me. I have argued on the phone with them for hours about it.
- SteveNuts 3y ago
  How in the world did you get someone from Google on the phone? That's unironically, by far the most impressive thing I've seen on HN so far.
  - sofixa 3y ago
    If you pay for a Google One subscription (which is basically paying for more Gmail/Drive storage), you get phone, chat and email support.
    - qingcharles 3y ago
      I'm going to test the Google One support now on my (new) Google account to see if they'll help me get into my old Google account... wish me luck! "Thanks for contacting us! A Google expert will respond to you soon. For your reference, your case ID is 2-9118000034846."
    - qingcharles 3y ago
      Here was the response: "You've said you have access to your email address, password and recovery email but you lost your phone number in a fire. Based on that, we currently don't have any other account recovery suggestions for you. We encourage you to try to recover your account at g.co/recover. There's no limit to the number of times you can attempt to recover your account. To increase your chances of successful recovery, you can: Try different variations of your answers. Try recovery from a device you previously used to sign in. If you still can’t recover your account, we recommend you set up a new account."
  - 3y ago
rohit02092001 3y ago
[flagged]
datatrashfire 3y ago
*Californians will be able to delete personal online data at companies with staff competent enough to remove the data
CSSer 3y ago
As someone who’s been doing a lot of database design lately, how does everyone plan to handle referential integrity if laws like this become more commonplace or widely applicable? Is it silly to suggest that laws like these could make cascade on delete a whole lot more commonplace?
- rzmmm 3y ago
  In GDPR it's sufficient to anonymize the data. That is sometimes easier for data integrity.
  - mycall 3y ago
    Thanks for the tip, I'll use this for our company's needs.
- andersa 3y ago
  Isn't the common practice to just replace the personal data in the db with garbage and otherwise leave the records in place - i.e. to prevent accidental reuse of the ids which could have unforseen consequences? If their user now brings up "deleted user 12345", you've done your job and deleted the data they cared about.
- immibis 3y ago
  Don't ask the question about database systems. Ask the question about data. Instead of asking "how can rows in my posts table reference a deleted row in the users table?" ask "how can I show posts by deleted users?" And that's a business requirement. Either you delete the post, or you delete the post's author link, or you delete the post's author link and content. Find out which one, and design and implement it.
  - immibis 3y ago
    or you retain the author link but scrub all useful information from the author record
whatsup7123 3y ago
This is a good move, especially with the emergence of OpenAI/ChatGPT which makes the "data is more valuable than oil" statement increasingly accurate. Individuals should be in control of data they publish online, whether it is behind a password or not. You should be able to delete any data you post, instantly, from all backups, at any time and without any backlash.
aktuel 3y ago
So all this data here is actually about you, huh? Well, thanks for the confirmation!
ChrisArchitect 3y ago
Thought I was going crazy that this was already passed. There was already a ton of discussion about this a month ago. Anything new here? Other than it passing across the Governor's desk? https://news.ycombinator.com/item?id=37524158 https://news.ycombinator.com/item?id=37524158
PeterStuer 3y ago
As with many initiatives in this domain, you have to be cautious. First I want to say clearly I am vehemently opposed to the current state of "personal data brokering" which is basically the same or even goes far beyond what we condem in other totalitarion regimes. I also believe that anyone should have the right to know about, respond to and append comments with equal weight to personal information that is gathered and published on them. But the devil as always is in the details and more often than not these 'sounds good' initiatives on this front have perverse effects, either intentional or unintended though judging from the past the former is far more likely than the latter. A central registry for all personal profile data brokers makes it so very convenient for agencies that already can demand access to all the data on a peer basis, to now basically have a central shopping catalog in which you have to register by law. Also, their seem to be very many exemptions to the right to have your data purged. Things that people imagine might happen after they submit such a request in many cases wont. Admittedly I do not have the competence to the level of detail required to flesh out the exact consequences of each word in a bill , its interpretation or its implementation. If more competent experts can. Here's the current text as a start https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202320240SB362 https://leginfo.legislature.ca.gov/faces/billTextClient.xhtm...
deleted 3y ago
[deleted]
littlestymaar 3y ago
Does that mean HN will eventually start allowing deleting old posts (or even entire accounts)?
kanary 3y ago
This plan sounds like a billion dollars will go to a consulting firm to try to build a system that does a magic 1-click opt out. But it will be extremely difficult to accommodate all the edge cases that come with integrating 500+ varying sources of varying levels of quality of personal data. The legal system alone has the power to change enforcement, any thoughts on why they aren't focusing there?
deleted 3y ago
[deleted]

80 points by robbiet480 3y ago

nsenifty 3y ago

"Will soon be able"

totetsu 3y ago
“Data brokers who comply with California law”
- xrd 3y ago
  Won't violators be subject to the many excited LA lawyers? I'm asking seriously, is this a toothless law?
  - 6stringmerc 3y ago
    Well we can start with Acxiom out in Arkansas

wkat4242 3y ago

Nice one. Time to bring that in in Europe too!

breadwinner 3y ago
You already have GDPR and other laws. California is catching up. The rest of the US needs to catch up as well, but probably won't.
- wkat4242 3y ago
  Yeah but I don't think we have a "delete my data from all brokers" button yet. It would be very helpful, especially because they will keep collecting it. When we have it I'll automate something to trigger it every week or so.
  - orwin 3y ago
    You have though, you can send a mail. I had to give my data so that my sister could rent an apartment, once she got it i filled preformed Gdpr letters asking them to delete my data non necessary to their business, and if they sent my data to third parties, ask them to delete it too.
    - wkat4242 3y ago
      Yeah but not "all brokers" without having to figure out who they even are. California has that.
  - boudin 3y ago
    Under GDPR, if you request that a company deletes the PII they have on you, the company has the obligation to request deletion to any third parties they transferred the data to. One requirement that is less known is also that, if a company has PII about you and you never explicitly gave this data to them, you then have the right to be informed. What it means is that you can ask what data they hold on you and what is the source of the data. So if you get a cold call from a random sales person, you can ask them where they got your number, they have the obligation to tell you the data broker they bought it from. You can then request the deletion of your data from the data broker. I did it a few times.
    - wkat4242 3y ago
      Yeah but not "all brokers" without having to figure out who they even are. There's a huge forest of data brokers behind the big actors. California has that. But asking the people who they got the data from doesn't work. They just hang up as soon as you talk about it. Especially because I'm on the "do not call me" register and they are already in breach of the law by calling me in the first place.
      - boudin 3y ago
        It's going to be the same in California for companies who just ignore the regulation though. I do agree with you that a centralised way to get your data to be deleted is great. It does feel like a band-aid to me though, I would just prefer that reselling PII would be made illegal. I don't see the point of allowing that.

offmycloud 3y ago

> In 2026 Californians will now have the ability to use this accessible deletion mechanism that the CPPA will set up over the next two years. Editorialized headline ("Californians now able") is false, not available for another two years.

robbiet480 3y ago
Fixed, apologies

silisili 3y ago

I wonder how strictly said tool will validate the user is actually a CA resident? Hopefully not much, I'd probably try to use it anyways as someone not living in CA. I remember emailing a site that apparently scraped LinkedIn, asking them to remove my information. They told me to fill out a form attesting I lived in California. When I told them I did not live in California, they told me to just sign it anyways and they'd proceed - and they did. So how many other companies are really checking each individual for truthiness? Doing so would seem impossible at such a scale.

hn_230601 3y ago
Having deleted a bunch of online accounts a year ago, a lot of companies used OneTrust and their privacy policy would typically specify for California residents but the process varied pretty widely. Some of the data deletion requests would ask "Are you a California resident (yes/no)" while some would ask for a California address, and some wouldn't ask at all. One of the companies had a support person respond back to my request when I had answered no to being a California resident strongly implying I should resubmit my request with it marked yes which I ended up doing and it resolved smoothly. I imagine companies that mainly make their money from the data would be a lot more strict on it though.
- immibis 3y ago
  and it's not even fraud because they told you to lie
singleshot_ 3y ago
I’m sure if you wanted to find a lawyer who could help you become a de jure California resident for a sufficient time, it could be arranged. (For instance, there is one right here in this thread with you…)
- nocoiner 3y ago
  The California Franchise Tax Board would probably be delighted with that arrangement as well. They have an office next to my dentist. I live in Texas!

RajT88 3y ago

I bet that button will be really hard to find.

altairprime 3y ago
If it’s anything like CCPA, that’s prohibited.

tzs 3y ago

> SB 362 received a cumulative vote of 153 for it and 38 against it the various times it was voted on the floor of the two houses and in multiple committees. That’s over 80%-win rate. It received a Republican vote on the Assembly floor, making it bipartisan. Wait...the final Senate vote was: D R Yes 31 0 No 1 8 and the final Assembly vote was: D R Yes 52 1 No 14 14 and it is considered bipartisan because a single R voted yes?!

littlestymaar 3y ago
That's literally what's written in your quote: > It received a Republican vote on the Assembly floor, making it bipartisan.
- tzs 3y ago
  The point of my comment was to highlight that, and show the totals to make clear just how lopsided the vote was, and to ask if that usage was correct. Hence the "?!" at the end. By nearly every definition I've seen of "bipartisan" that would not be be bipartisan. There's no precise definition, but generally the usage I've seen is for these kinds of situations: 1. A majority of each party support it. 2. The majority party does not have enough votes within the party to pass it, so have to get cooperation from members of the minority party. This generally requires the majority party to make concessions to get those votes, which generally requires making some concessions that help advance the minority party's agenda. Politicians sometimes do call bills bipartisan with few (or even zero!) votes from the other party, but they get called out on that by fact checkers [1]. [1] https://www.factcheck.org/2019/12/pelosis-bipartisanship-boast/ https://www.factcheck.org/2019/12/pelosis-bipartisanship-boa...

dang 3y ago

Recent and related: California passes bill to make it easier to delete data from data brokers - https://news.ycombinator.com/item?id=37524158 https://news.ycombinator.com/item?id=37524158 - Sept 2023 (145 comments) Also: 'Delete Act' seeks to give Californians more power to block data tracking - https://news.ycombinator.com/item?id=35691243 https://news.ycombinator.com/item?id=35691243 - April 2023 (131 comments)

beebeepka 3y ago

Deleted or marked as deleted. I'll let you decide since I am too jaded.

bloppe 3y ago

"right now is being sold by hundreds of data brokers to anyone with a credit card." Has anybody tried to actually buy data from a data broker? I haven't found it to be nearly as easy as this makes it seem. Looking for tips / suggestions on brokers who might sell me my own information for decently cheap :) for academic purposes of course... I do like this law tho.

Spooky23 3y ago
When Enfamil Fedex’ed a case of baby formula as a “welcome baby” gift for the child that we lost to a miscarriage, I got pissed off and dug into it. They told me where they got the lost and I bought it for my zip code for $50. So I found out which neighbors were pregnant, had diabetes, were buying a car, etc. The medical information was sourced from “anonymized” insurance subrogation data and prescription data. They were able to correctly identify that my wife was pregnant and project the due date, but didn’t have the diagnosis or the reason for the hospital/OB admission.
- smcin 3y ago
  The prescription data was presumably resold by pharmacies (which?) to data brokers. This was their workaround to sidestep HIPAA ("It's not medical information, it's prescription information"). This is also why pharmacies pester you for your phone number, and to participate in their loyalty programs (don't).
  - Spooky23 3y ago
    As far as I could tell, they could link the hospital admission, OB admission (the hospital runs a separate system for OB) and doctor to the scripts. The RhoGAM was filled by the hospital pharmacy, and other scripts were filled by CVS. My understanding is that "anonymized" data leaks from subrogration and the PBM as well that can be un-anonymized later.
    - smcin 3y ago
      That's shocking

404mm 3y ago

I’m going to identify as California resident more than usual. /s Cali has some decent laws when it comes to consumer protection. I’d love to see more of them on federal level.

slimsag 3y ago
I requested data be deleted from a data broker and live in Arizona: > We are in receipt of your request dated September 12, 2023. You are submitting a request from a jurisdiction that does not currently provide data rights.
- hedora 3y ago
  What happens if you get a CA po box, or use a vpn?
  - rapind 3y ago
    90210
  - lcnPylGDnU4H9OF 3y ago
    They might require a non-PO box address and a VPN could be defeated by a manual verification. That said, doesn’t hurt to try!
- manicennui 3y ago
  It's irritating that companies do the bare minimum required by law instead of doing the right thing.
  - jojobas 3y ago
    The first right thing a company is obligated to do is to earn money. You've agreed to their terms that don't violate the law, why would they forfeit their hard earned cash, even if it's the right thing to do?
    - 3y ago

jjtheblunt 3y ago

> Californians will be able to delete all personal online data in first-in-US law Considering the government has in no way regulated phone solicitors or spam, how could anyone assume this law would have any effect? I mean, lawbreakers ignore laws, and spammers hoard personal data. edit: the Los Angeles Times article's first sentence is less hyperbolic, more sober... > Californians will be able to make a single request asking that data brokers delete their personal information, under a bill Gov. Gavin Newsom signed into law Tuesday.

deleted 3y ago

[deleted]

ds 3y ago

Some things to note, unless the bill was modified from the version I read before being signed into law: This doesnt apply to any information which is public record as a matter-of-fact. So if you voted, your address and name is public record and can be used and displayed by these sites. If you got a DUI, your mugshot and arrest record may be public record and can be displayed. If you got into a custody battle and your court case was public, that can be displayed. And I guess that all makes sense in the end. If you got into a DUI, how does the government get to tell random website X that they are not allowed to say that you got into a DUI, especially when the information was public record. So to be clear, if the peoplefinder style websites want to keep whitepages.com/user/john-smith online with an address, phone number and mugshot- They can tell you to pound sand and do so. This bill cant stop that. Honestly, Theres alot of hype about this bill in general which is going to be... interesting... when people fail to understand what it can and cant be used for. Additionally, this bill comes with a caveat that the sites can request proof you are living in california currently, via a license scan or some other method you get to now hand over to the data broker. That said, in our research for https://redact.dev https://redact.dev supporting these features from a pure API only interaction, is that most of the sites just delete you if you use their form. They dont want the headache of insane users threatening them and doing crazy shit because they dont delete their profile. And honestly the people who go through these removal processes are less than 1% of the stored data, so its mostly just a cost of doing business.

newman314 3y ago
If you know the magic incantation to remove data from BlockShopper, I'm quite sure lots of folks would be interested in knowing how to do so.
- therockspush 3y ago
  Used to be, in the good old days, getting yourself off lexisnexis did a good chunk of the heavy lifting out of these data pits. For anyone who doesn't know what BlockShopper does, what does it do?
  - 3y ago

JaceLightning 3y ago

[flagged]

JaceLightning 3y ago

[flagged]

rwhyan 3y ago

TLDR; > the Delete Act would empower the CPPA to develop a system by 2026 that allows residents to make a single data deletion request across the nearly 500 registered data brokers operating in the state. The CPPA would also be charged with enforcing provisions of the Delete Act, such as requiring data broker registration and ensuring brokers delete an individual's personal information every 45 days upon receipt of a verified request. Source: https://iapp.org/news/a/california-legislature-passes-delete-act-for-pi-aggregated-by-data-brokers/ https://iapp.org/news/a/california-legislature-passes-delete...

DamnYuppie 3y ago

I have not read the legislation so this maybe an obvious and silly question. Does this also apply to credit agencies?

dmarti 3y ago
No, they're regulated under the federal FCRA, not state law.
pards 3y ago
> Data brokers are defined in the bill as businesses that we don’t have a direct relationship with — and likely have never even heard of — that scrape and collect our personal information from various offline and online sources, and then aggregate our personal information, and then sell it to third parties Credit agencies like Equifax and TransUnion satisfy that condition. They should be subject to the law, especially given Equifax's security history [0] [0]: https://en.wikipedia.org/wiki/2017_Equifax_data_breach https://en.wikipedia.org/wiki/2017_Equifax_data_breach

deleted 3y ago

[deleted]

neilv 3y ago

Can someone who knows more about policy sausage-making than I do, comment on how good/bad this is? I don't know what to think about California seeming to set an upper limit on privacy policy for the country. California's revenues seem partly tied to some of the worst invaders of privacy, and presumably Californian legislation gets industry input. At one point, I naively wondered whether a wealthy and independent-minded state like Texas might lead this (a bit like they have with textbooks). I guess they're pretty tied now, too, and also have a lot of anti-regulation voters.

jdp23 3y ago
It's very good in that it's significant progress over other US-based laws. Then again if you compare it to the much stronger privacy protections in the EU, there's still a looooong way to go. It's true that California's legislation gets a lot of industry input, and they're not going to pass something puts the big tech companies out of business. On the other hand, there's a very effective coalition of privacy organizers there -- who are quite familiar with tech's tactics, and can be very effective at cutting through tech's spin with legislators. Plus, the California Privacy Protection Agency (which got established by a referendum, not through the legislature) has a lot of clout -- there isn't anything comparable in any other US state. Washington state has similar dynamics, although with the CPPA equivalent. Microsoft and Amazon are hugely influential here; but, grassroots organizers had repeatedly stopped them from getting the very weak Bad Washington Privacy Act through the legislature. And this year, we passed My Health My Data -- stronger in some ways than California's privacy law. Texas ... has been a disappointment. The privacy law they passed this year is based on the Bad Washington Privacy Act but significantly weaker.
- dmarti 3y ago
  WA MHMD is a game changer because private right of action. Doesn't rely on the attorney general or a dedicated privacy agency to take action -- private lawyers can. (Technically not the first privacy law with private right of action because the Video Privacy Protection Act has one, but that law was originally passed to cover videotape rentals and the courts are still working out how it applies to video content on the Internet)

parhamn 3y ago

California's consumer protection feels like EU levels right now. With such a big economy and influence on other states, it feels like they're becoming a singular driving force for policy for (at least) blue states. e.g. I suspect Skittles won't have a "California recipe" to avoid Red No 3 which will effectively make it national law. Has the rate with which they're driving consumer protection gone up as a legitimate broader strategy or is it just part of the Newsome might run activity?

irjustin 3y ago
It's been like this for forever. Lots of key car safety and emissions started in CA.
- andromeduck 3y ago
  Which his great because california's emissions policies have been a disaster for safety and emissions.
  - irjustin 3y ago
    Care to list any specifics?
    - andromeduck 3y ago
      https://youtu.be/mQDegCqiVnU?si=KIFM9Vc5vQ4rV_mM https://youtu.be/mQDegCqiVnU?si=KIFM9Vc5vQ4rV_mM https://youtu.be/jN7mSXMruEo?si=Ot3jkIPaJJrHwwmC https://youtu.be/jN7mSXMruEo?si=Ot3jkIPaJJrHwwmC
      - irjustin 3y ago
        Ah so you don't like stricter emissions; not one for the long term of our planet I see.
        andromeduck 3y ago

ssss11 3y ago

[flagged]

zeroonetwothree 3y ago
[flagged]

behnamoh 3y ago

[flagged]

k_roy 3y ago
Do you know why? It makes sense. It's effectively a legal monopoly right now. He's going to manufacturing to bottom-line the costs.
deleted 3y ago
[deleted]

qingcharles 3y ago

I wish I could just get my data. There are laws that require this, but Google won't let me get my data from my account because I lost the phone number, even though I have the username, password, recovery email and all the email gets forwarded to my other account. They say they have no way to prove it is me. I have argued on the phone with them for hours about it.

SteveNuts 3y ago
How in the world did you get someone from Google on the phone? That's unironically, by far the most impressive thing I've seen on HN so far.
- sofixa 3y ago
  If you pay for a Google One subscription (which is basically paying for more Gmail/Drive storage), you get phone, chat and email support.
  - qingcharles 3y ago
    I'm going to test the Google One support now on my (new) Google account to see if they'll help me get into my old Google account... wish me luck! "Thanks for contacting us! A Google expert will respond to you soon. For your reference, your case ID is 2-9118000034846."
  - qingcharles 3y ago
    Here was the response: "You've said you have access to your email address, password and recovery email but you lost your phone number in a fire. Based on that, we currently don't have any other account recovery suggestions for you. We encourage you to try to recover your account at g.co/recover. There's no limit to the number of times you can attempt to recover your account. To increase your chances of successful recovery, you can: Try different variations of your answers. Try recovery from a device you previously used to sign in. If you still can’t recover your account, we recommend you set up a new account."
- 3y ago

rohit02092001 3y ago

[flagged]

datatrashfire 3y ago

*Californians will be able to delete personal online data at companies with staff competent enough to remove the data

CSSer 3y ago

As someone who’s been doing a lot of database design lately, how does everyone plan to handle referential integrity if laws like this become more commonplace or widely applicable? Is it silly to suggest that laws like these could make cascade on delete a whole lot more commonplace?

rzmmm 3y ago
In GDPR it's sufficient to anonymize the data. That is sometimes easier for data integrity.
- mycall 3y ago
  Thanks for the tip, I'll use this for our company's needs.
andersa 3y ago
Isn't the common practice to just replace the personal data in the db with garbage and otherwise leave the records in place - i.e. to prevent accidental reuse of the ids which could have unforseen consequences? If their user now brings up "deleted user 12345", you've done your job and deleted the data they cared about.
immibis 3y ago
Don't ask the question about database systems. Ask the question about data. Instead of asking "how can rows in my posts table reference a deleted row in the users table?" ask "how can I show posts by deleted users?" And that's a business requirement. Either you delete the post, or you delete the post's author link, or you delete the post's author link and content. Find out which one, and design and implement it.
- immibis 3y ago
  or you retain the author link but scrub all useful information from the author record

whatsup7123 3y ago

This is a good move, especially with the emergence of OpenAI/ChatGPT which makes the "data is more valuable than oil" statement increasingly accurate. Individuals should be in control of data they publish online, whether it is behind a password or not. You should be able to delete any data you post, instantly, from all backups, at any time and without any backlash.

aktuel 3y ago

So all this data here is actually about you, huh? Well, thanks for the confirmation!

ChrisArchitect 3y ago

Thought I was going crazy that this was already passed. There was already a ton of discussion about this a month ago. Anything new here? Other than it passing across the Governor's desk? https://news.ycombinator.com/item?id=37524158 https://news.ycombinator.com/item?id=37524158

PeterStuer 3y ago

As with many initiatives in this domain, you have to be cautious. First I want to say clearly I am vehemently opposed to the current state of "personal data brokering" which is basically the same or even goes far beyond what we condem in other totalitarion regimes. I also believe that anyone should have the right to know about, respond to and append comments with equal weight to personal information that is gathered and published on them. But the devil as always is in the details and more often than not these 'sounds good' initiatives on this front have perverse effects, either intentional or unintended though judging from the past the former is far more likely than the latter. A central registry for all personal profile data brokers makes it so very convenient for agencies that already can demand access to all the data on a peer basis, to now basically have a central shopping catalog in which you have to register by law. Also, their seem to be very many exemptions to the right to have your data purged. Things that people imagine might happen after they submit such a request in many cases wont. Admittedly I do not have the competence to the level of detail required to flesh out the exact consequences of each word in a bill , its interpretation or its implementation. If more competent experts can. Here's the current text as a start https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202320240SB362 https://leginfo.legislature.ca.gov/faces/billTextClient.xhtm...

deleted 3y ago

[deleted]

littlestymaar 3y ago

Does that mean HN will eventually start allowing deleting old posts (or even entire accounts)?

kanary 3y ago

This plan sounds like a billion dollars will go to a consulting firm to try to build a system that does a magic 1-click opt out. But it will be extremely difficult to accommodate all the edge cases that come with integrating 500+ varying sources of varying levels of quality of personal data. The legal system alone has the power to change enforcement, any thoughts on why they aren't focusing there?

deleted 3y ago

[deleted]