Hacker News Reader

Comment by jtokoph | Hacker News Reader

Let's say I run company A, and Company B wants to buy all of my user's information but I've already created policies that say I won't share user information with 3rd parties.

Could I:

1. Create a subsidiary (Company C)

2. Share info 'internally' with company C

3. Sell Company C to Company B

View on HN

Usually there's a unilateral T&C alteration clause, so you can do what you like just change the terms first. Change them right back a microsecond later if you like?

Just word it "not share with unrelated third parties" and it reads like "no sharing" but of course any party you're selling too is related by contract.

No-one reads the terms really, well I'd guess <<1%?

Probably what's needed is a general framework from law about not sharing without explicit consent banning the company; and that personal data expires in a company transfer/sale without consent (but perhaps a lower bar there).

Sometimes programmers' minds get infected with the idea that the whole world, especially courts and regulatory agencies, are just little virtual machines that will dutifully execute based on whatever steps you lay out at the beginning. They're not. Machines can't call bullshit on you, but people will.

I think that comment makes the mistake twice over, even. First, because T&C are (usually) not an immutable contract - companies can just change them without any legal shenanigans at all. Then second because, as you say, actions taken just to circumvent laws are usually themselves illegal.

It is pretty baffling to see how often programmers talk about law like it's an algorithm. Even the DAO didn't work out that way, and that was explicitly intended to turn contracts and law into algorithms. If that didn't resist social pressure to redress harms, why would we expect actual humans to do so?

(And frankly, thank god the law doesn't work like that. I don't want to live in a world where legal loopholes open up as often as software vulnerabilities.)

In what sense are you asking if you "Can" do it.

The FTC is fairly broadly empowered to stop deceptive practices, and most of the standards there are about what reasonable users would expect.

So you may be able to work around a contract implicit or explicit, but in practice it's unlikely you would get away with it.

Plus if you said this to a judge they'd laugh at you. They are not (and should not be) judging automatons.

Technically, of course you can, but practically, if someone sued, you would probably have a hard time convincing others that you are complying with your own policy. It's probably easier to just to change your ToS/privacy policy.

Most privacy policies have an "out" only for acquisition of substantially all of the assets of the parent org.

The reality is that if you're considering selling the golden goose of all your user data then you might as well just sell the business outright and be in 100% compliance without the expense of the proposed convolutions or risk of FTC ire.

With not a damn thing your users can do short of trying to delete their accounts.

What policies have you created? How are those enforced? Are they even enforceable?

Depending on how they are worded, either the share, and/oor the sale, and/or neither will break the policy

4. ???

5. Laugh all the way to the bank.

I don't think you need step 4.

Reply on news.ycombinator.com