I've been thinking of making a service which automatically sends deletion requests for all my service companies every month. Like, I currently keep a bunch of spyware features in my car turned of, but I have to keep location turned on to use the built in navigation which keeps track of range for me. Would be nice to have a ceiling on that data's retention.
Long term, if compliance with data deletion requests becomes a pain, maybe companies will finally give us an opt out of surveillance capitalism? Or maybe they'll just lock me out of my own car (I guess it's their car since I don't have root on it, lol)
If it's a VW, pick up a Ross-Tech VAG-COM + VCDS, locate your Telematics unit (OCU, online communications unit) and remove it; mine was behind the instrument cluster. Then use VCDS on a laptop plugged into your car with VAG-COM, and code out the OCU from every module giving fault codes for its absence. You will probably lose the microphone, as in my Mk7 the microphone line goes through the OCU. Finally, optionally, you can code out your infotainment module's bluetooth features thus taking away another avenue for passive surveillance.
Does this mean people can delete comments from HN?
This is already a thing. One can reach out to dang to request their account or their comments be removed. They do not like to remove comments as it breaks some of the interaction and context people had on the site but they will not refuse to do it. hn@ycombinator.com
The Advertising ID field/ Nice of them to think of this, but it doesn't seem that I could actually get this from any of my Samsung TVs, Apple devices, apps?, etc? So while that field is nice and all, without transparency on getting the ad ID, those fields kind of do nothing.
Out of curiosity, does anyone know how this is enforceable for a company not based in California? Can CA fine a data broker that is based in another state but that is selling CA residents' information?
I hope other states adopt this. One of the biggest mistakes I have made is giving my real phone number to Dun & Bradstreet. Now the spam calls and messages (from people they sold my info to) won't stop. I don't want to change my phone number.
> Companies that fail to comply can face fines of $200 per day for each affected Californian.
Does this cover things like credit reports/scores? If someone submits a request to this DROP thing, is it possible data gets deleted that they don't intend?
I hope this is true! Consumer credit is a serious problem. How much better would it be if only corporate entities could take on debt? That goes for school, home, and car loans too. Imagine the return to sanity in pricing when Big Finance can no longer scam time-preferenced and desperate buyers! Society might have a real savings rate again!
“Data broker” does not include any of the following:
(1) An entity to the extent that it is covered by the federal Fair Credit Reporting Act (15 U.S.C. Sec. 1681 et seq.).
(2) An entity to the extent that it is covered by the Gramm-Leach-Bliley Act (Public Law 106-102) and implementing regulations.
(3) An entity to the extent that it is covered by the Insurance Information and Privacy Protection Act (Article 6.6 (commencing with Section 791) of Chapter 1 of Part 2 of Division 1 of the Insurance Code).
(4) An entity, or a business associate of a covered entity, to the extent their processing of personal information is exempt under Section 1798.146. For purposes of this paragraph, “business associate” and “covered entity” have the same meanings as defined in Section 1798.146.
As good intentioned as it is, I don't like the wording used around this law. "Request" and "Ask" and "please delete my information." Notice that regular users have to "ask nicely" but when it's something like the DMCA, which benefits corporations, they use "takedown notices" and "demand letters."
I don't want to ask data brokers, pretty please with sugar on top. I want to be able to demand they do it, and require them to immediately do it and provide proof that they did, under penalty of perjury.
Does this apply to Google, car companies, etc, or did they bribe in exceptions for themselves (like California grocery stores did for the Do Not Sell My Personal Information law)?
Also, who gets the $200/day? If I issue a drop request, wait 145 days, then buy my data from brokers, do they have to pay me $20,000 per record they return?
I've been building the infra for data brokers to connect to DROP (easy), actually effect deletions (hard), and make sure the data stays deleted (harder): forgetmenaut.com
DROP is pretty significant considering that it's the first compliance system meant to have an immediate effect (delete the data), backward-looking effect (forward a legally-binding deletion request to everyone that data was sold to or shared with), and a forward-looking effect (never let that record re-enter your system, in perpetuity). This is significantly more tracking and auditing infrastructure than anyone in the industry has ever normally run, not to mention that the request volume is 100-10000x what most of these brokers would process in previous years.
We'll see how well companies actually managed to comply when audits are performed for every registered broker in 24 months. I also think the impending prosecutions (and likely bankruptcies) of several unregistered data brokers will encourage the others to take it more seriously.
One thing to flag from Europe and GDPR is all the malicious compliance of companies and governments using the law as an excuse to not meet some basic obligations to users like storing and retrieving useful information, or getting pretty basic customer support. It's very reminiscent of companies deliberately making cookie warnings annoying instead of protecting user privacy. Who knows, maybe this will be used to obstruct FOIA too.
Because of this, be sure to pay attention to companies getting too clever in interpreting this law, even after it's passed. It ain't over 'til it's over, so be sure to keep fighting it until we actually get the desired outcome, and track the actual compliance with the law.
The law itself sounds great, just remember that people often aren't.
26 comments
[ 1.1 ms ] story [ 34.9 ms ] threadLong term, if compliance with data deletion requests becomes a pain, maybe companies will finally give us an opt out of surveillance capitalism? Or maybe they'll just lock me out of my own car (I guess it's their car since I don't have root on it, lol)
Problem is though, you'd be revealing more data about them than I probably have by sending it.
All of the requests are SHA-256 hashvalues, they aren't transmitting any usable information in the process of sending the deletion requests.
This is already a thing. One can reach out to dang to request their account or their comments be removed. They do not like to remove comments as it breaks some of the interaction and context people had on the site but they will not refuse to do it. hn@ycombinator.com
Does this cover things like credit reports/scores? If someone submits a request to this DROP thing, is it possible data gets deleted that they don't intend?
“Data broker” does not include any of the following:
(1) An entity to the extent that it is covered by the federal Fair Credit Reporting Act (15 U.S.C. Sec. 1681 et seq.).
(2) An entity to the extent that it is covered by the Gramm-Leach-Bliley Act (Public Law 106-102) and implementing regulations.
(3) An entity to the extent that it is covered by the Insurance Information and Privacy Protection Act (Article 6.6 (commencing with Section 791) of Chapter 1 of Part 2 of Division 1 of the Insurance Code).
(4) An entity, or a business associate of a covered entity, to the extent their processing of personal information is exempt under Section 1798.146. For purposes of this paragraph, “business associate” and “covered entity” have the same meanings as defined in Section 1798.146.
<https://leginfo.legislature.ca.gov/faces/codes_displayText.x...>
Credit bureaus are, I think, covered as item (1).
The Delete Act
https://news.ycombinator.com/item?id=46449694
California residents can now request all data brokers delete personal info
https://news.ycombinator.com/item?id=46495220
I don't want to ask data brokers, pretty please with sugar on top. I want to be able to demand they do it, and require them to immediately do it and provide proof that they did, under penalty of perjury.
Also, who gets the $200/day? If I issue a drop request, wait 145 days, then buy my data from brokers, do they have to pay me $20,000 per record they return?
DROP is pretty significant considering that it's the first compliance system meant to have an immediate effect (delete the data), backward-looking effect (forward a legally-binding deletion request to everyone that data was sold to or shared with), and a forward-looking effect (never let that record re-enter your system, in perpetuity). This is significantly more tracking and auditing infrastructure than anyone in the industry has ever normally run, not to mention that the request volume is 100-10000x what most of these brokers would process in previous years.
We'll see how well companies actually managed to comply when audits are performed for every registered broker in 24 months. I also think the impending prosecutions (and likely bankruptcies) of several unregistered data brokers will encourage the others to take it more seriously.
Because of this, be sure to pay attention to companies getting too clever in interpreting this law, even after it's passed. It ain't over 'til it's over, so be sure to keep fighting it until we actually get the desired outcome, and track the actual compliance with the law.
The law itself sounds great, just remember that people often aren't.