Hacker News Reader

Comment by revolvingocelot | Hacker News Reader

>“This investigation sends a strong message to organizations that you can’t spy on your customers just because it fits in your marketing strategy. Not only is this kind of collection of information a violation of the law, it is a complete breach of customers’ trust. The good news in this case is that Tim Hortons has agreed to follow the recommendations we set out, and I hope other organizations can learn from the results of this investigation.” – Michael McEvoy, Information and Privacy Commissioner for British Columbia

Insane that there isn't any more forceful enforcement for "a violation of the law" than setting out "recommendations" and trusting that the guys under investigation for "violation" of the, presumably, privacy "law" will implement it.

View on HN

Surely, there's no "stronger message" than a company getting to make money hand over fist by exploiting their customers and then getting away with nothing but a slap on the wrist. That'll make sure no company ever decides to do that same thing since they'd obviously hate making tons of money and getting "recommendations" after a stern talking to.

Talk to me about "strong messages" when CEOs are sent to prison and a company's assets are seized.

edit: Jail? Asset seizure? Nah, you want to make it non-viable as a business decision. Something like…

Revoke their license retroactively to when they started doing this to consumers.

Charge them for all individual incidents at maximum allocation per law.

Allow the option of reduced fees per incident based on how quickly the business responds.

Hold a minimum value per incident that you do not go under.

Increase their tax responsibility by 15% for the next 5 years.

Why not do most of that too? Yes, it should be non-viable as a business decision, but also something that will result in very personal and life altering consequences for those running the company. If I spied on even just a single person like this I'd be thrown in prison as a stalker. "Charge them for all individual incidents at maximum allocation per law." would mean a life sentence for CEOs when really just a decade or two behind bars would be enough to ensure that companies don't risk it.

¿Por que no los dos?

The individual goes to jail, not the company. So how much does a fall guy cost a company? That’s just cost of business if responsibility is only held by the individual.

I think the GDPR has shown that all you need to do is set fines as a % of revenue, and they'll be taken seriously.

I would make a shell corp that held all revenue.

No obligation to fines.

The key is to set multiple avenues of responsibility. It may be easy to find loopholes individually, but collectively it would become too burdensome. At least, for the company, make skirting the charges be as costly as following suit.

There is a very long list of companies who have been fined for GDPR violations, and several which have been fined repeatedly. It's not working. Show me a list of companies which have been dissolved or were broken up and sold off after GDPR violations. Then it might be enough to be taken seriously.

Why do we have to make sure the company doesn't go under with our fines?

We don't make sure criminals aren't too impacted by jail, why should corporations be different?

> Talk to me about "strong messages" when CEOs are sent to prison and a company's assets are seized.

I love capitalism, but the fact that laws are so meek towards companies is a flaw of our implementation of it.

I know there are people who think capitalism is inherently harmful and unsalvageable, but I'm convinced that with enough regulation and oversight it can be kept in its place and beaten into something that does more good than harm. I suspect it'll be one hell of an uphill battle to get us there though.

for something like this, jail time plus asset seizures is surely too extreme (purdue pharma, on the other hand...). however a severe financial penalty for both company and executives (VPs and up, plus legal counsel) makes a ton of sense. for execs, you'd want to especially financially negate at least some past and future bonuses and stock compensation, because it makes up the bulk of most executive comp.

> for something like this, jail time plus asset seizures is surely too extreme

If you'd go to jail for acting that way, why is that suddenly too extreme for CEOs? The fact is that very very personal details including things like sexual preferences, the medical history, the political views, the sexual partners, and the religious practices of millions of people were exposed by this data collection and that can't be taken back. All that data will exist forever and will likely be used against these people for the rest of their lives.

I don't want Canada to become the dystopian prison-nation that the US is. The "Land of the Free" has more of its population behind bars than any other country on Earth, but some jail time (not life behind bars) is completely appropriate for the scale and scope of what was done here and it is necessary to prevent it from happening again.

you'd be wont to find anyone who'd support exective prison time more than me, but i'm against prison time as a de facto punishment for exactly the reason that it results in too many people being locked up frivolously. i agree that the scale and scope here are atrocious, but again, take away all their gains and more, especially in regards to prestige and esteem, and you'll deter this type of behavior as effectively as incarceration without any of the downsides of prisons (especially the perverse incentives and the exhorbitant costs).

the punishment should fit the crime. that's why i'd throw the sacklers in prison (because they ruined countless lives, up to and including death), but not these executives.

> take away all their gains and more, especially in regards to prestige and esteem, and you'll deter this type of behavior as effectively as incarceration

I guess that'll have be left to speculation until somebody actually manages to convince their government to try it, but I suspect that any financial penalties that don't outright end a company will rarely be enough on its own to act as a deterrent, and that absolving CEOs of any responsibility or accountability and placing the financial burden of fines for violating the rights of millions on the company as a whole will just cause it to be seen as an acceptable gamble for CEOs. It's not even a bad one. The gains to be made exploiting people are very great after all, and the risk of being caught fairly low.

CEOs certainly don't care about prestige and esteem. They are often sociopaths and psychopaths who care very little about others or how they are viewed. Even when their actions do destroy a company they'll just deploy their golden parachutes and happily drift off to another one. As much as our legal systems fail to hold CEOs accountable corporations themselves are certainly no better at it.

> "CEOs certainly don't care about prestige and esteem."

oh quite the opposite, even for psycho/sociopaths. it's really the core thing that humans care about, with everything else, even money (beyond subsistence), only being proxy metrics for it. people kill other people simply for damaging their (self-)image/reputation (the jilted lover being a classic example).

the point of this punishment is to strike right at the heart of what humans care most about by knocking them down a number of rungs on the status ladder (prison time alone doesn't do this, as they'll be just a rich and statused coming out and they were going in, though maybe a bit more humble/shameful). you don't necessarily need to make them poor, just relatively poorer than who they believe their peers are. but yes, the key to any of this is to raise the risk considerably, as you noted. no punishment can be effective without credible enforcement.

Ah you know, it's a multimillion dollar corporation, so laws are just tough to enforce, because reasons. It's not like if a regular person was caught doing this, because then it'd be simple: that person would go to jail.

Also, there's no way that every other fast food app isn't doing the exact same thing. There's no way that mcdonald's is going to give me a free big mac just for having the app installed if they aren't collecting as much data as they can access on my device.

Agreed - especially when you consider the provincial and federal tax dollars needed to prop up the various privacy commissions and launch an investigation like this one.

You'd need a lawsuit for that. The investigation FTA was by "privacy agencies" which have no ability to enforce anything more severe than recommendations

I actually did read the article; I even grabbed a quote from it! Still, the governmental privacy authorities suggest that the law was broken; I'm aware that they aren't enforcement, because I read the article, but the language is pretty clear that they think these actions broke the law.

>You'd need a lawsuit for that

Can you elaborate? Is there Canadian privacy law being violated here that doesn't stipulate any penalty other than exposing Tim Hortons to private lawsuits? Forgive the directness of my question, your comment reads like you'd know.

edit: reading the Report of Findings [0] on the page itself suggests that because the violations ceased once, er, the violating entity had been informed of the investigation and had suggested that it'd delete the harvested data, the joint investigation "therefore found this matter to be well-founded and conditionally resolved". So, nobody really cares

[0] https://www.priv.gc.ca/en/opc-actions-and-decisions/investig...

Yeah Canada isn't the US, we have remedies available to us other than sending people to jail.

>Yeah Canada isn't the US, we have remedies available to us other than sending people to jail

...to be perfectly honest, "launch a civil suit and get pennies!" sounds much more American than throwing people in jail for privacy violations. The data is already out there.

Yeah I can, the The Office of the Privacy Commissioner of Canada, Commission d’accès à l’information du Québec, Office of the Information and Privacy Commissioner for British Columbia, and Office of the Information and Privacy Commissioner of Alberta collectively and individually do not have the power to imprison people. There is no determination they can make under the law that results in people or corporations going to jail.

Kind of a non-sequitur of a response, not sure you read my comment, with its direct question? Even if you were responding to the second paragraph only -- and construed it as my suggesting people be imprisoned -- weird! Anyway, you answered, in a roundabout way, my direct question in another comment, namely

>>They also have the power to refer their determinations to other branches of government / Attorneys General etc for further enforcement of the law should their concerns not be addressed [0]

from which I can infer that this ""voluntary" "compliance"" thing they've got going on is the extent of the shit they're willing to give. My layman's reading of PIPEDA [1] suggests that court orders are eventually possible, but this act of obvious malfeasance (or, if that encroaches on a legal term, try 'fuckery') deserves a... promise to do better?

Seems like the message is "if you get caught, we'll politely ask you to stop". Not the kind of response I'd like for the granularity of this kind of tracking. Sets a bad standard.

[0] https://news.ycombinator.com/item?id=31588094

[1] https://laws-lois.justice.gc.ca/eng/acts/P-8.6/index.html

Lol, nothin'. Serves me right for trying to engage with an Internet Lawyer

What are they in this case? And I guess your comment is true as long as you ignore the incarceration rates for First Nations. Which is coincidentally something we canadians really like to do whenever it's time to feel smug about our southern neighbors.

> And I guess your comment is true as long as you ignore the incarceration rates for First Nations. Which is coincidentally something we canadians really like to do whenever it's time to feel smug about our southern neighbors.

The US is at least as bad, absolutely and even relative to the White population, with Native Americans, though it gets less attention because Native Americans get less attention in US politics than First Nations do in Canada, and because it's further masked by the attention to both the general runaway incarceration in the US and the racial impact on Blacks of unequal incarceration.

That might be all true but saying "what about the US! they are even worse" is irrelevant to the fact that it also happens in Canada. While GP was saying that it doesn't happen here because we're not like those stupid Americans.

Though I'd still heavily dispute your claim. Native Americans in the US have much stronger treaty rights, much more autonomy and while they still face tons of discrimination, IME its very hard to beat Canada in that regard. In any case, between the Highway of tears and the fact that some reservations don't even have access to water in the north... comparing ourselves with other countries just comes off as pointless deflection.

I mean, given the article, it doesn't seem like Canada has availed itself of any remedy, let alone sending people to jail, which is the point in this thread.

Like, in America, we might slap the company on the wrist, fine them something like the equivalent of $1 for a normal person. And then business continues as usual.

There's not even an ineffectual fine, here.

Reply on news.ycombinator.com