Hacker News Reader

CCPA has enough common elements with GDPR that companies are likely to look for a set of practices that meets both in as many cases as possible. I'm hopeful that while the CCPA may lack the full width of GDPR's effect, it will push companies that were special-casing the EU to apply GDPR practices to the US as a whole as well or the entire world.

Very few companies are going to want to maintain a separate GDPR strategy, a separate CCPA strategy, and an unregulated strategy, and then selectively apply each to various users. As more jurisdictions jump on board with privacy requirements, hopefully globally consumers will get the benefits of the strongest passed regulation in each category.

But there is no CCPA strategy. CCPA is so weak that compliance is easy: offer data exports and stop selling data on behalf of the handful people who request it. No need to encrypt stored data, or restrict what you collect, or how you collect it.

Yeah, I've heard similar at the Fortune 10 where I work. We could barely get our legal/compliance/privacy team to meet with us on it. They said our approach is wait and see, that based on the verbiage they see basically no risk of any real litigation resulting from it in the current form and from a business standpoint not to waste time with it.

ICO was not established by GDPR. It has been around since 1984, and was also the agency responsible for enforcing GDPR's predecessors.

I agree that a regulatory agency specialized to these issues would increase their importance, but it's not the whole solution. ICO already existed, it just didn't have teeth.

I think that the enforcement part is key, I’m very skeptical.

It likely won’t start until July 2020, and it’s hard to imagine the state AG prioritizing this except for cases you mention - very high profile/political.

Current estimates are that out of roughly 500,000 businesses in scope, only 2% will be in compliance by January 1st. Though to be fair, GDPR numbers were fairly similar at the onset.

Regardless of my skepticism, I can’t help but feel this is better than nothing, and likely better than an even more diluted federal regulation that all the big corps are lobbying for.

BounceX probably counts as a data sale, and CCPA allows you to restrict data sales via a required link labeled "Do Not Sell My Personal Information" (hereafter DNSMPI) that must be present on the home page and on pages where PI is collected.

It remains to be seen how many companies comply, but the law certainly does have some restrictions.

Furthermore, there is a CCPAv2 in progress for a proposition on the next ballot.

I am sure I can opt out of BounceX if I know BounceX exists.

But am I really supposed to fill out a DNSMPI form every time I interact with any business? How many new businesses do you think you interact with on a given day? I suspect it is a lot.

Opting out is an unreasonable burden and there's a reason why almost no one does it. And yet we know consumers want privacy, so there is clearly a larger structural problem here.

We already know the solution! Make data collection opt-in.

You can fill out DNSMPI once for a business and it applies for at minimum the next 365 days. You do not need to specifically enumerate systems; it is a blanket prohibition.

Right, once per business per year. Just remember to go back and renew next year!

And perhaps reconsider doing business with companies whose business practices you find objectionable

No, they can't sue the company. America has invented the concept of binding arbitration, that effectively allows the company to opt out from laws, as funny as it sounds. Your isp contract, your bank account contract, your insurance contract all likely contain the binding arbitration clause. Coincidentally, these are the companies that get the most accurate and valuable information on you.

GDPR is NOT entirely opt-in. For reasons of ‘legitimate interest’ a consent-less collection is warranted (ie. to perform the service). Yes, this does usually excludes data collection for marketing purposes. But it’s important to state that it’s not Entirely opt-in.

If the collection is truly necessary to provide a service, and the consumer has decided (opted in) to use that service, it seems pretty reasonable.

However, data collected for that "legitimate interest" may only be used for that specific legitimate interest. They can't turn around and use it to end-run the consent requirement.

Also, the "legitimate interest" of the business is required to be weighed against the interests of the data subject, so it isn't a blank check.

> GDPR the other hand is entirely opt-in.

As an European I don't feel like it's opt-in.

Last I've heard Google is still tracking me left and right.

The GDPR add a regulatory hurdle to jump over that is hard to small businesses to do properly, and affordable to Google to do it right and have a similar status quo.

I think most startup people would have no problem with the GDPR if it included the minimum limits that the CCPA has.