OPPA: Ohio could become the third US state to enact a new consumer privacy law
portswigger.net
portswigger.net
There's no innovation quite like compliance-driven innovation! C'mon gang, let's get coding.
I feel like the second option would be feasible if you could somehow get the major sites to agree they would pull the data each request rather than storing it in their databases.
You did remind me of Tim Berners-Lee's SOLID project, not that it's "storageless" really.
Well, a milder version anyways. Look-up is only country level, not state, and what changes is generally the pop-up rather than the privacy policy. But the tools are already in the marketplace.
When Ford motors started cars already existed, when Facebook started social networks already existed, when Google started search engines already existed, etc.
In my opinion, getting demotivated for not being the first or being “the one” that came up with the idea prevents way too many people from starting their own thing.
In the end, execution and adoption are what really matters. In general is better to copy something and improve on it than trying to invent something completely new.
But of course, most companies assume that the default configuration is compliant, since that's the entire point of the product, right? Companies think the product is a compliance solution itself and therefore compliance is purely an IT problem of deploying the software and legal doesn't need to be involved. But in fact the software is actually a platform for scaling and automating enforcement, and legal actually needs to be involved to figure out what compliance looks like.
There are several studies showing that a huge fraction of GDPR/ePD violations are actually a result of using consent-management software but leaving it in the default configuration.
And then there's what those platforms do, use every dark pattern possible to get the user to perform an action that they can interpret as consent.
Like, if you have a legitimate interest (you need my address to do deliveries to me), then you don't need consent.
But clearly there's no legitimate interest in this case, it's just a dark pattern to get more data.
And this is why it's important for such legislation to apply to all citizens and permanent residents of the legislating juridiction, regardless of where they're physically or network-topologically located.
With Westphalian sovereigns (or gangs of such working together, like the EU), that’s possible in principle, because such entities can claim jurisdiction over anything anywhere; their sovereignty is unlimited, though their practical ability to enforce their laws may be more circumscribed.
For US states, however – “sovereign” though they may be – they cannot assert jurisdiction over commerce just because one of their citizens is involved, regardless of where they are physically located and where the other party is.
They were willing to pay a few hundred dollars every month just to be able to access up-to-date rules in one place.
I wonder how many of these compliance driven innovation opportunities (great term, btw) there are, thanks to bureaucracy.
Carl Malamud, an open access advocate (among other roles), has been championing the cause of open building codes for almost a decade.
Tons. I'd venture to say that the majority of B2B companies out there exist because they offer some form of assistance in dealing with compliance across the country/world. Even though we probably don't think of that as their primary service. Example: payroll services - the money transfers are the easy part, a company is really paying these services to do tax compliance.
One of the problems with starting a company like this is finding all of the niches that exist. You kind of have to have worked in a sector to learn what some of the pain points are that can be eliviated.
Tax filing, tiny house codes, building codes, customs fee at the borders…
What else?
Alas, the Venn diagram of domain knowledge (for any given niche) and any measure of competence developing products is tiny.
And the work just isn't interesting. A friend made good money writing property tax administration software for municipalities. Tried to recruit me for years. I helped on some stuff, enough to verify I wasn't well suited to that type of work. Older me could probably do it happily.
It's not all bad, Manufacturing compliance for Drugs for example, make sense.
Never the less, whether necessary (as in health) or primarily burdensome like SOX, they create tons and tons of high paying jobs. Small companies can't afford full timers so they make do with consultants who charge an arm and a leg.
SOX means well, but it's not going to stop the hanky-panky except for the inept. Is the cost of compliance worth the return on having less of incompetent fiscal malfeasance?
I think the GDPR comes closest to what I would want, with the requirement for explicit, informed, and freely given consent prior to any data collection that isn't strictly necessary for the site to function, and that access to the site can't be conditional on giving consent. What I'd want in addition is far stricter enforcement of it, such as heavy fines on every site that thinks a banner saying "Continued use of this site constitutes consent." is satisfies any of the conditions required.
All this against backdrop of nationwide corps having tried to stop this exact scenario ( patchwork of state privacy laws ).
It wasn't until early '70's when G.O.P. figured out they could win the ultra religious voters by catering to this specific issue. Noam Chomsky has an excellent dialogue about this
> Businesses that satisfy requirements for the affirmative defense are afforded protection from any cause of action brought under Ohio laws, or in Ohio courts, alleging a violation of the OPPA or similar claims based on alleged violations of the Ohio Consumer Sales Practices Act’s privacy-related provisions.
It also prohibits citizens from suing violators of the law.
Sounds to me like this is more about protecting businesses from litigation than it is about protecting consumers. I'm curious if the CCPA or Colorado's law have similar language; my suspicion is that they don't.
Though, I'd love it if my beliefs were proven wrong here.
A cudgel’s a cudgel though, and this one came with blueprints.
>The Korean word Oppa (오빠) is used when you are a woman and talking with an older male (related to you or not). For example, Oppa (오빠) is used to address an older male friend, even if he is not your older brother by blood.
[0] Ohio Public Policy Archives, Ohio Psychiatric Physicians Association, etc.
This seems really arbitrary and pointless. Especially since it's gross revenue and not profit. Sounds like a perfect excuse for some creative accounting.
The California version (CCPA) imposes restrictions on large businesses, and on data brokers. "Large business" is defined by revenue and number of data subjects. "Data brokers" are defined purely by deriving majority of revenue from sale of personal data.
Notably, CCPA does not have a lower bound on the size of data brokers. If your business is to sell personal data, then you are a data broker and CCPA applies, even if you're just one guy hawking a spreadsheet of a dozen data subjects.
The Ohio version seems to have modified this so that data brokers have a lower size bound. I.e. it applies to any Business over X size, and data brokers over X/4. That's... I don't see the point. If you're gonna protect personal data, then the long tail of small-size data brokers is something that I would consider kind of a big concern. Like, datasets about medical conditions could conceivably be very small and I want that shit regulated into the ground.
* Annual gross revenue generated in Ohio above $25 million.
* Controls or processes the personal data of 100,000 or more consumers during the calendar year.
* Derives more than 50% of its gross revenue from the sale of personal data and processes/controls the personal data of 25,000 or more consumers during a calendar year.
If you control or process the personal data of more than 100K consumers, or have more than $25M in Ohio revenue, then it doesn't matter where your revenue comes from.
Also, gross revenue from sale of personal data is straightforward to measure and verify: How much did you get paid for the data? Profit is not since this depends on how you allocate expenses to various parts of the business.
I really wouldn't say that it's straightforward at all. How much money would you guess Google (or any AdTech firm) "makes" under that definition in Ohio? I would bet you the farm that it's actually $0, because they're not selling data, they're selling ad space ("retargeting").
Is there some clever argument they can use to avoid admitting that they process data that they process?
Of course Google is still subject to the law because it qualifies on the other two criteria.
>> Sec. 1355.01.(J) "Personal data" means any information that relates to an identified or identifiable consumer processed by a business for a commercial purpose. "Personal data" does not include [...]
>> (G) "Consumer" means a natural person who is a resident of this state acting only in an individual or household context. "Consumer" does not include a natural person acting in a business capacity or employment context, including contractors, job applicants, officers, directors, or owners.
>> 1355.02.(B) This chapter does not apply to any of the following: (1) Any body, authority, board, bureau, commission, district, or agency of this state or of any political subdivision of this state;
>> 1355.02.(F) The obligations imposed on businesses or processors under this chapter shall not be construed as restricting a business's or processor's ability to collect, use, or retain data as necessary to do any of the following: (1) Conduct internal research solely to improve or repair products, services, or technology; [...]
>> Sec. 1355.01.(J) [...] "Personal data" does not include [...] (2) Pseudonymized, deidentified, or aggregate data. [...]
Because ad-tech at large doesn't care about actually identifying an individual as long as they can engage with it. Example: Facebook provides access to large amounts of "pseudonymized" data to the SCL group, who runs their own analysis resulting in a map of pseudonym->propaganda. They then pay FB to engage the users based on that.
I am not a lawyer, but this case seems to not fall under OPPA, because everyone can argue that they did not share personal data. So the user has no right to be informed about their "pseudonymized data" being processed by the SCL group for the purpose of feeding them propaganda.
Similar case is google analytics. A webapp sets 'anonymize_ip: true' and avoids pushing the consumers name and postal address in the data layer and can then argue the collection of tracking data by the third party affiliate google is pseudonymized. Nevermind that google doesn't actually care about the consumers address as long as they can create a profile for the pseudonym.
The european unions GDPR has a chapter on profiling, which OPPA has not.
>> Sec. 1355.07.(B) A business may charge different prices or rates for goods or services for individuals who exercise their rights under this chapter for legitimate business reasons or as otherwise permitted or required by applicable law.