Ready for the U. S. Consumer Privacy Acts in 2023?

[Anonymous]

If your product or service targets residents of my State, then you should know the residents of the State as of 2023 have the right to

1) access the personal data you keep about them

2) have their personal data deleted

3) obtain a copy of the personal data.

You'll also need to inform them of the type of personal data you keep; i. e., name, birth date, IP Address, email address, etc., and how the residents can go about exercising their rights.

https://hallboothsmith.com/north-carolina-introduces-consumer-privacy-act/

About 15 States are poised to enact CCPA-like consumer protection:
https://www.jdsupra.com/legalnews/which-states-will-consider-ccpa-like-8388058/

These acts go into effect Jan 2023. So are you ready?

[youngmix]

This law is not even an issue for programmers, businesses, or consumers. The EU has far more strict rules that require more intricate solutions, so much of what I have to say about this is in reference to how the industry has dealt with the EU restrictions. I hope to explain that the Consumer Privacy Act is not a real hurdle concerning programmatic or business implementation.

Most of the external cookie programs that are loaded via some IDE (Google Analytics, etc.) have already dealt with complex privacy laws because of the EU laws, so they have their remedies in place and ready to go. It's the in house code, usually some cookies and registered user data management, that's going to require revision. So most, if not all of the large companies have already dealt with this because of the EU laws.

Strict rules on data gathering has not adversely effected my interactions with web sites when visiting their sites from Europe. Web sites simply have users apply data access and record rules, over a simple UI box with radio buttons. Id est, "Do you want to allow [this category] cookies? YES/NO." And most of them allow you to click a link, that tells you about how they use your data, and what data they may use.

These laws provide no real inconvenience, and never would have. Coding the programs that are the remedies to issues like printing user information should be less than a day's work for a single rookie programmer. The user information is not hard to access or supply, as they are managed within a finite and defined schema along with specific tables (relational DBMS) or documents along with specified collections (noSQL). And queries on user data should be easy to build, as the web program's various source files make queries to user data to record it. So the location of user data is already within the program.

So dealing with user data requires a very simple program that simply formats and prints a database query, then emails or records the string in whatever file format you wish. This is very easy to implement.

The only serious issue will be when larger companies, tech giants like Google, have to print the information on paper.

And having to print these reports will create a hopscotch or chain like event, where accessing a single server will require several companies to print a visitors'/users' data, but this is also very easy to remedy. Simply ask each company to send a report. The company's are known because you know what API's that you use in your source files.

And any report generated will definitely fall under expenses that are written off for tax purposes.

In the end, the laws and regulations under discussion seem to be concerned with persistent, maintained user data, that has no expiration data, like Facebook's user data structure. If anyone is going to feel the effects of this law, it will probably be Facebook, Google, Amazon, Apple, Microsoft, Uber, and other ridershare and social media companies.

Let's see that user data, GAG.

[youngmix]

Oh, and I believe that these large companies should have to print massive user data reports, as it is a sign that they maintain far more data than they ever should have. We do not allow the government to record that much data, why are we allowing an ad company to?

If they wish to generate smaller reports, then gather more precise data. I do not need every conversation to be maintained forever, and queried by your social scientists to study (talking to you, FB). I think that their user data sets are going to be gargantuan.

[Asker]

I see your point with regard to technical implementation -- at best it amounts to a slight pain in the ass. But $5000 per violation is a very real liability -- anyone who has every dealt with the public knows what I mean. Because, even if your users don't have any personal funds to file a lawsuit, doesn't mean that they can't suck up resources making sure their rights aren't being violated.

[youngmix]

In my mind, at least for larger businesses, the solutions are very simple and have been implemented before: add to or create a user agreement page (it looks like they can just add to the page that they should already have), and create a form to deal with public requests. Give access to the form location if someone contacts customer service.

I wonder how smaller companies will deal with this, though? What if they have no data to report, can they simply state that they do not record user data? I think that most small sites do not store user data in a way that allows them to generate a report, because they cannot identify any particular user.

And I wonder what constitutes a violation? Not listing a user's rights? Not sending a report? Both?

[youngmix]

Like, what if Jim Nobody is surfing the web, and arbitrarily lands on one of my testing servers, where I demo some APIs, have a demo login, test SEO, and record all IP addresses that communicate with my program? I do not intend to warn him, or anyone of anything. I consider my server's IP to be my personal space that happens to be accessible to the public. And I do not intend to change my testing behavior to fit a law that is being applied outside of their jurisdiction, both my source code development and my server. I did not make them use my server, either. They accessed my server without my permission. I wonder if they believe that I should warn their residents about their rights?

What about my business card that is a website. Do they expect me to warn them as well? That page is not a business or service, but I do collect visitor information.

[Asker]

@youngmix In my State the law only applies i you have 100,000 customers who are residents. So, I see the threat for a small business like this: You're basically exempt. But... you've got to be prepared to deal with "threats." People who decide they don't like you for whatever reason and want to scare you or make you uncomfortable. And, the possibility that you could have to provide a legal answer to one of those people in a legal environment. I wonder if these types of business should be transparent about the number of active customers they have in each state? Who the hell knows.

[genericname85]

this is already in place in Europe. it doesn't really change anything. cause really in this day and age, you can't "not" use the intenet, whether you like the data they gather or not. because usually if you disagree with the data they keep, they don't let you use their service, cause that's what they make the money with to offer their service for free to the end user.

[Asker]

So, in the EU, it's regarded as kind of a Catch 22, huh? Damned if you do, damned if you don't. My concern over here is that you probably have more than your fair chair of lawsuit-happy nutcases.

[Asker]

*fair share

[genericname85]

i don't know if the internet is like this where you are. but basically every site you go to here has this poppup that tells you the data they are rising and promts you to accept that. and if you don't accept it, usually, you just don't get to use the site. so like there has to be some sort of regulation and control in my opinion about what data is collected and what is done with that data. because the knowledge they gather about you is great for targeted advertisement, which is relatively harmless... but that same data "can" and is used for way more nefarious things by twitter and facebook for example. they are massively influencing people, in many countries having more power than national governments and traditional media when it comes to steering the public discourse about certain topics.

[Asker]

Yes, it's the same -- not really a technical challenge. But the audience is quite different -- I'm not sure how the residents of these States are going to react. Even at a big company like where I work, there's a pretty significant use of resources that goes to ensure that someone "waving a red flag" is dealt with properly -- we're talking full-time lawyers and technicians on staff. Not sure if all businesses are poised to deal with the people aspect.

[genericname85]

i don't quite undestand what you mean by "someone waving a red flag" being dealt with properly.

[Asker]

Language barrier? Or am I not being specific enough? I'm talking about nut cases who threaten a lawsuit with little provocation. We instantly send them to our legal team.

[genericname85]

oh. ok. well i was thinking of whistle blowers who try to rise awareness for legit problems. so how do you deal with those red flag wavers without throwing legit whistle blowers under the bus? i was thinking about this cause we have new regulations in germany, where there's a new institution created that is supposed to help negotiate things. a "neutral" instance that listens to the whistle blower and then tries to help the company sort that problem out in orer to avoid a public shitstorm that could fuck over the company and all the jobs they offered to people. but to me that smells a lot like corruption installed to silence whistle blowers.

[Asker]

Sounds like an interesting service. It could actually protect consumers, though. I mean, what if you do damage to a business out of your own ignorance? What if you call my product a scam when the reality is that you misused it? You could be a total idiot and tell my business that the binoculars I sold you are defective, but you're looking through them backwards. If my business if damaged, I have a case against you.

[genericname85]

i mean usually that's what reviews are for. like if there's 1000000 people complaining about issues with the product, then probably something is wrong with it. but if there's like only 5 star ratings with one odd guy complaining, you know it's probably just some random idiot who's too stupid.

[Juxtapose]

Sounds good to me. Looking into my personal details online should be a felony much like opening my mail in a mailbox.

[maximumpower]

AT LAST - something worthwhile posted to GAG!!
Good stuff to know.
Thanks for posting.

[Anonymous]

I don't like it.

[Asker]

hehe why?