American Data Privacy and Protection Act | Hacker News Reader

American Data Privacy and Protection Act

congress.gov

394 points1vuio0pswjnm7299 comments

It's not clear that ADPPA will move forward. The current version preempts California's CCPA/CPRA legislation, and (big surprise) California doesn't like that. But, that's far from the only issue with it. Here's an update from a couple of weeks ago which discusses some of the problems, as well as potential next steps. https://thenexusofprivacy.net/adppa-new-compromise/

And, here's EFF's position: " Americans Deserve More Than The Current American Data Privacy Protection Act" https://www.eff.org/deeplinks/2022/07/americans-deserve-more...

Preemption would be an enormous mistake. Federal legislation moves at a glacial pace. In a field like privacy, you may only get to pass one substantial bill every 10 or 15 years. Technology moves too quickly for lawmakers at the Federal level to keep up. States can move much faster. Justice Brandeis popularized the phrase that "[the] states are the laboratories of democracy" and digital privacy law is a text book case of an emerging field that will benefit enormously from iterative experimentation at the state level.

Yep, I personally only want federal pre-emption for restrictions on government. Shall not infringe type stuff.

This is exactly why Microsoft has been throwing money at lobbyists at the state level as well, pushing shitty "consumer privacy bills", both because they don't like strong legal privacy rights at the state level, but also in the hopes of forestalling and kneecapping a strong federal baseline privacy bill.

https://www.eff.org/deeplinks/2020/03/tech-lobbyists-are-pus...

Yep. We've fought them off here in Washington ... but they and Amazon just took it to other, more pliable states. Todd Feathers and Albert Ng had a very good article on this in The Markup a few months ago https://themarkup.org/privacy/2022/05/26/tech-industry-group...

Did we though? What bills does Washington have that could compare to the CCPA?

None yet. Big tech companies have pushed various versions of the Bad Washington Privacy Act, which is weaker than CCPA. In 2021 and 2022, civil liberties, civil rights, and immigrant rights groups have supported the People's Privacy Act, which is a lot stronger than CCPA or ADPPA, but tech lobbying kept it from even getting a hearing. We'll see what happens in 2023 ... the Bad Washington Privacy Act's sponsor is retiring from the Senate (and is generally expected to become a full-time lobbyist), so the landscape should be different.

> Preemption would be an enormous mistake

It creates a national standard. If we’re still debating the solution, sure, devolve to states. But if we’re near consensus, preëmption provides scale. This is American strength in a nutshell.

Yeah, nobody wants to have to constantly worry about compliance with 50+ different required standards which may or may not conflict with one another. Having one clear standard for services to follow is absolutely preferred so long as it actually does the job of protecting people's data privacy.

>>Preemption would be an enormous mistake

Preemption is always a mistake, i am not sure why everyone wants federal laws for everything, without even touching the fact that Data privacy is in no way even close to any of the enumerated power of the US Federal Government

Federal Laws almost always favor large companies, the exact companies these laws are needed to protect the consumer from

Facebook, Microsoft, etc would love nothing more than to have the federal government take over because has "stake holders" they will be called on to write their own legislation, and will start the revolving door of hiring current, former and future regulators to work in the very corporations they are supposed to regulate.

Federal laws never work for the average citizen

> Preemption is always a mistake, i am not sure why everyone wants federal laws for everything

So that my marriage is recognized across state lines, for a start.

eh poor example imo; that's guaranteed by the Constitution, not legislation.

oh? where, exactly? Is that why we needed Obergefell, and Loving, and … ?

Why would you the government to be involved in your marriage?

I think the point GP is trying to make is that sometimes state governments try to get involved in marriage and having a federal policy that preempts that can prevent further meddling.

This cuts both ways—with preemption, you can provide baseline rights or guarantees to citizens. The trade-off is that you have federal legislation in the mix and you then need to deal with laws that are slower/harder to change; a big issue if the law was badly written or needs to be changed in a timely manner.

Because that’s what marriage is?

Isn't a better question: why would you want /any/ government involved in your marriage?

This argues for federal legislation that defines marriage simply as a compact between two consenting adults with some basic legal record keeping.

The /impact/ of that marriage can be both federal and state (e.g., federal vs. state tax laws).

Individual state laws defining marriage could mean your next of kin could change if you die in the wrong state. That way lies dragons.

I dont think government should be in the business of regulated interpersonal relationships at all, for the finances it should be covered by contract law, for everything else it is none of the government's business

> without even touching the fact that Data privacy is in no way even close to any of the enumerated power of the US Federal Government

In what way is data privacy regulation for corporations not a regulation on interstate commerce? That's like, the whole deal. That's the entire internet. If anything, Internet regulations applying at the state level is even more insane, because of the inherently cross-state nature of globally networked communication.

Because the original concept of "interstate commerce" was trade disputes among the states.

Wickard that expanded that to include all commerce that may touch another state even indirectly was / is one of the WORST supreme court decision ever and it is eternal dream that the Supreme Court will reverse it and instantly shrink the power of federal government by at least 75%

> i am not sure why everyone wants federal laws for everything

I'm not sure why anyone wants to be held to 50+ different and conflicting privacy and data protection requirements just to have a website or provide a service online because that's what we'd be getting if we left online privacy regulation up the states.

I dont, I want to be held to the standard of my State, for which I would have more control over than the federal government's one which is often influenced more greatly by states like NY, CA, TX or FL none of which I reside in an have no desire to live under either extreme's of those states

> I dont, I want to be held to the standard of my State,

that's not possible for people who do business with people who live in other states. If I make a website in Ohio I'm responsible for following Florida's laws on how I handle data collected from Florida's citizens.

If you never create a business or service that anyone from any other state or country uses you'll never have to worry about compliance with their laws, but most of us want to build things for more than just the people in our immediate surroundings.

>>If I make a website in Ohio I'm responsible for following Florida's laws on how I handle data collected from Florida's citizens.

Why? For decades in the US we have had the concept of "Nexus", and just because a person visits your website in Ohio from Florida does not you have a Nexus in FL to where you need to follow FL Law

Just like today if I put up a website, and a person from the EU visits it, I as a US Citizen with no business interests in the EU have no obligation to follow GDPR or put up cookie notices or any other EU Laws

> Why?

Because the alternative is that businesses do for data privacy the same thing they already do for things like manufacturing and corporate taxes. That's even worse.

It's a lot easier for big business to control a single state government than all fifty of them.

> Just like today if I put up a website, and a person from the EU visits it, I as a US Citizen with no business interests in the EU have no obligation to follow GDPR or put up cookie notices or any other EU Laws

You'd possibly have an obligation under GDPR, but you are free to ignore that and face the consequences. Same with laws passed in other states. You're free to ignore them so long as you're fine with what ignoring them will cost you. If you enjoy being able to conduct business in and travel to places outside of your state it's probably a good idea not to violate the laws of those places.

In this case I think preemption gives you widespread uniformity so it makes adherence easier to achieve and more predictability. Is those island gonna come up with weird stipulations, maybe Montana… uniformity in this case may be better.

States move faster... so fast that a technology company would be constantly chasing 50 different state laws.

The Internet is a global entity, and it doesn't strike me as being well served by the "laboratory of the states".

Federal legislation is slow, but executive agencies can move faster if they are empowered by legislation to make rules. Congress sets broad principles, and it's not unreasonable that those principles should stay the same for a decade at a time, even in a fast-moving domain like privacy. And while regulatory agencies can be their own pieces of work, it is much easier to deal with one national agency's rules than 50 different ones.

> States move faster... so fast that a technology company would be constantly chasing 50 different state laws.

As a person who's data is being sold I would one up it and wish that each county would produce their own regulations. That business is a cancer.

County? I’ll do you one better, locality. Every hamlet the world over with so much as a post office should have their policies.

I'll do you one better: every individual has total domain over their own data.

That’s Authoritarianism!

I appreciate you and your idea.

After seeing how the ATF operates entirely autonomously to nearly eliminate the right to bear arms through increasingly more unnecessarily complex and ridiculous "rules" that make you felon for things that were previously (and should still be) totally legal, I have zero interest in giving executive agencies autonomy to make laws.

And it doesn't matter that the rules can be ruled as ineffective by a high court, because it takes ages to get through the whole court process. So in the time that the court took ruling something totally unconstitutional, people's rights are squandered (especially without any democratic consensus to enact it), and the people that enacted and enforced the later-deemed-unconstitutional rulings face zero repercussions. And guess what? They then move on to the next unconstitutional ruling that squanders as many rights as possible for as long as possible.

> unnecessarily complex and ridiculous "rules" that make you felon for things that were previously (and should still be) totally legal

Not going into the US-centric gun debate and assuming that guns are simply tools, isn't it reasonable that gun owners need to monitor the regulations? If you operate heavy machinery or run a chemical lab, I'd expect you to keep a close eye on upcoming legislation and rules. I'd not be surprised if a food truck operator would need to keep track of more rules than gun owners.

Both of these examples are enterprises, not something a private citizen does. I would also hesitate to say that you can become a felon overnight with either of these scenarios (remember all of the rights lost, including gun ownership, by being labeled a felon). And a majority of businesses shield themselves such that if they do violate the law it’s the business itself penalized, not the workers. In the case of gun ownership it’s the individual being penalized.

To make your example equivalent, imagine if the food truck or some piece of equipment in that truck was suddenly made illegal. And if you’re in possession of it you are now a felon. Yesterday (literally) it was legal and you were not given advanced notice anymore than waking up this morning and receiving notice.

If heavy machinery and food industries operated this way there would be much less competition and likely no food trucks at all

Food trucks are under the purview of fda and the local and state authorities of the jurisdiction they do business in. Health and fire inspectors do audit these locations or trucks in the event of an entirely self contained food truck. These businesses are still subject to the whims of these oversight bodies and may be arbitrarily shut down overnight.

Your comparison is factually incorrect on every count. I do hope that you’re just ignorant of the mind boggling amount of legislation your average food truck is subject to.

To bring this full circle, gun owners are de facto legally assumed to be reasonable and responsible owners that abide the law and diligently pay attention to the changes of laws. If you become a felon “overnight” because of an illegal weapon; well that’s on you. Being responsible sucks because it demands humility and accountability. If you’re neither capable of admitting your mistakes nor following the glacial pace of state/federal law making then you’ve no business owning tools capable of killing masses of people in seconds from hundreds of yards away. Great power, great responsibility. Lately some politicians have become tunnel visioned on the power part, I’d like to remind you that in order to maintain a lawful society we must be responsible lest the unwashed masses take Justice for themselves in whatever capacity they can. This is the compromise of a civilized society, you would be wise to learn more about why things are they way they are before you write up factually incorrect justification for your grievances.

> Your comparison is factually incorrect on every count.

Please explain how, exactly.

> I do hope that you’re just ignorant of the mind boggling amount of legislation your average food truck is subject to.

Operating one on the side with some in-laws, I'm quite well aware of the legislation. Yet I'm still not aware of a single instance where a food truck operator became a felon overnight because they had a "high capacity grill". In what cases can a food truck operator become a felon when their activities that made them a felon were legal the literal day before?

> If you become a felon “overnight” because of an illegal weapon

Why is overnight in quotes? Do you not believe I was using the correct definition of literally?

> Being responsible sucks because it demands humility and accountability.

I think you'll find that a great majority of us are responsible, that's why we know about these laws and the ATF. I can't say the same for those that are pro gun control, they tend to be very ill informed on the subject and assume others are. Nobody is saying they shouldn't be responsible, we're saying they shouldn't be allowed to arbitrarily remove rights from people because of who's politically in control of the ATF. If you take a step back and remove personal bias, every sane person in the US would agree.

> If you’re neither capable of admitting your mistakes nor following the glacial pace of state/federal law making then you’ve no business owning tools capable of killing masses of people in seconds from hundreds of yards away. Great power, great responsibility. Lately some politicians have become tunnel visioned on the power part, I’d like to remind you that in order to maintain a lawful society we must be responsible lest the unwashed masses take Justice for themselves in whatever capacity they can. This is the compromise of a civilized society, you would be wise to learn more about why things are they way they are before you write up factually incorrect justification for your grievances.

You're clearly going on some rant here that I'm not sure where you're basing this argument from and it really shows your bias (which has no place on a forum of engineers and other technical people). The point being if this were laws being passed by congress, with months of advanced notice, nobody would be complaining. The ATF can release a rule right now stating owning an AR-15 with a pistol grip is a felony, active at midnight and you best hope you pay attention to the few hours notice you've been given.

> The ATF can release a rule right now stating owning an AR-15 with a pistol grip is a felony, active at midnight and you best hope you pay attention to the few hours notice you've been given.

ATF rules get published in the Code of Federal Regulations

https://www.law.cornell.edu/cfr/text/27/chapter-II

and are subject to the Administrative Procedure Act

https://en.wikipedia.org/wiki/Administrative_Procedure_Act_(...

and therefore are announced ahead of time in Notices of Proposed Rulemaking (NPRMs) published in the Federal Register

https://www.regulations.gov/search?agencyIds=ATF&documentTyp...

https://www.federalregister.gov/documents/search?conditions%...

and later, upon finalization, published again in the same place.

I don't mean to defend the scope of ATF's (or other agencies') power or discretion, which is quite broad, but the ambush rule with just a few hours' notice is pretty implausible under the APA. Normally the APA calls for at least 30 days' notice, and months are more typical.

https://www.federalregister.gov/uploads/2011/01/the_rulemaki...

There is an emergency rulemaking exception under the APA for "good-cause", but this is comparatively rarely used and (like other aspects of a rule) may be reviewed by the courts. ATF knows that it has a lot of critics who are likely to sue to challenge its rulemakings, and has often taken a considerable amount of time to make new rules even when there was a lot of political pressure brought to bear in favor of expanding regulations.

It's unfortunate that you might have to go to court to vindicate your rights under the APA, but that's almost equally unfortunately true of almost anything improper that any part of government might do to you. If a police officer decided to randomly seize your weapons because he just thought they looked scary and you oughtn't own something so dangerous-looking, you would also need to go to court to establish that the police office wasn't entitled to do that. Or if, like in the Hitchhiker's Guide, a local government authority decided to demolish your house without proper notice, you'd probably also have to go through the courts to get a remedy.

Great response, thank you.

To add, I’m down to talk to about governmental overreach if we can rationally prioritize issues. Gp seems to prioritize absolutist gun rights. I’m keen to consider extrajudicial murder, extrajudicial armed robbery by police, the separation of church and state, or the Supreme courts usurpation by the federalist society - before I think it’s worth discussing the loosening of gun rights in this country that has more gun involved MCEs (military conflicts excluded) than every other country combined.

As I’ve strayed a bit from the topic I’ll bring my point back by saying; sure there’s issues worth complaining about in almost every us regulatory process, but let’s prioritize by how many lives we can improve instead of lesser reasons that are used as a fundraising platform by the minority political party without regard for the trail of destruction their reckless policies engender.

I'm sure I'm quite a bit more sympathetic to the other poster's views than you are, but I found the idea of the ATF surprising people by banning something overnight to be implausible in terms of the way the U.S. administrative system works.

I worked on an issue a few years ago where the FCC was attempting to completely ban something, and it took them somewhere around a year to complete the process of actually banning it, despite having been very clear on their goal. If they'd simply said that people shouldn't have this, full stop, right away, well, I imagine the D.C. Circuit would have been even more upset with them than it actually was. :-)

I'm glad you found my reply helpful.

We’re agreed on U.S. courts, lawmakers, and regulatory bodies inability to effectively respond to emergent issues on a human time scale. I don’t expect anyone to agree with me on much, but if everyone could agree with that we need strong regulation to reduce gun violence, well thatwould be swell. I’ll even hold my tongue and not gloat when the statistics begin the inevitable sharp drop in MCEs.

If your interest in regulatory hell take a look at the fdas campaign against vaping. Then compare it to the nhs to see what a semi functional system can accomplish.

> we need strong regulation to reduce gun violence

With it already being illegal for certain criminals to own firearms, what regulation short of a total ban would help? This is where the "add more laws" logic fails. The thinking is that adding more laws will keep criminals hands off of guns. Criminals by definition ignore laws. Guns can be made via a 3d printer now. Ammunition used to be made (reloaded) by campfires. It's impossible in these days to keep guns out of the hands of those who shouldn't have them. If you have a CNC machine you can make your own AR-15.

Instead the solution is quite the opposite. More guns. You don't have to carry one yourself, just don't stop the rest of us. And by law if someone is carrying a concealed weapon near you and your life is in danger, they must protect it. We end up with peer to peer police. Nobody has a problem adding classroom work onto concealed carry permits to ensure carriers know the laws. Nobody has a problem with carriers also being required to qualify to ensure they can accurately shoot their weapon.

As far as school shootings, that solution is quite easy and technical. AI powered cameras in classrooms and hallways that alert if someone not in faculty or the student body steps on the grounds. Alert for gun shaped objects. Ballistic class on the interior and exterior windows with doors that partition the hallway when closed and locked to block in any assailants.

The guns rights group has many solutions to the problems, but the gun control group doesn't want them. Gun control groups have created a situation where it's easier for criminals to get guns and use them than it is for law abiding citizens.

I agree with everything except for:

> Nobody has a problem adding classroom work onto concealed carry permits to ensure carriers know the laws. Nobody has a problem with carriers also being required to qualify to ensure they can accurately shoot their weapon.

This is untrue. Half the country has constitutional carry established. I carry every day and do not have a permit. I get myself to the range frequently enough to be proficient. I do not need the government to "allow" me to practice my rights.

> This is untrue. Half the country has constitutional carry established. I carry every day and do not have a permit. I get myself to the range frequently enough to be proficient. I do not need the government to "allow" me to practice my rights.

There is a difference in practicing one's rights and endangering others. We require the same of our police officers. While I'm a fan of constitutional carry, I have no problem taking 8 hours of classroom courses and qualifying with my carry pistols.

The solution is recognizing that the 2a side is belligerent regarding the consequences of easy access to cheap weapons. Once we accept that all we need to do stateside is adopt sensible legislation that demonstrably works in countries without a belligerent group incapable of intelligent debate. I’m not going to engage with you on a slippery slope argument.

Your solution is naive, unsupported by research, reasonably hypothesized by people far more intelligent and accomplished than either of us, to be a failure on arrival, and conveniently requires no requires no acceptance of responsibility in the current horrific state of affairs nor does it requires a change in mind on anything.

More guns = more suicides and accidents. You should already know this.

the nra/federalist society, and similar organizations have been using their lackey’s to prevent progress on gun control for decades. Mitch McConnell has publicly taken pride in his ability to prevent anything from getting done regarding anything.

https://www.theguardian.com/us-news/2022/may/27/texas-shooti...

> The solution is recognizing that the 2a side is belligerent regarding the consequences of easy access to cheap weapons

So now only wealthy people can exercise a right?

> Once we accept that all we need to do stateside is adopt sensible legislation that demonstrably works in countries without a belligerent group incapable of intelligent debate.

Again, what legislation. I want specific laws you think will work.

> I’m not going to engage with you on a slippery slope argument.

It honestly sounds like you have no argument, just that you don't like guns and want them gone.

> More guns = more suicides and accidents. You should already know this.

I don't count suicides as deaths. This is used by the pro gun control groups to artificially inflate the numbers. Suicidal people will use other means if you take the guns away. And yes of course, the increased use of any object results in increased accidents with those objects. That's why some parents teach their kids gun safety early (I was handed a shotgun at age 8) and we develop proper procedures for handling weapons (Such as always visual and physically ensure the chamber is clear even if you "know" it's unloaded).

> the nra/federalist society, and similar organizations have been using their lackey’s to prevent progress on gun control for decades. Mitch McConnell has publicly taken pride in his ability to prevent anything from getting done regarding anything.

Do you think that perhaps the NRA is just representing the people that belong to its organization? Or said another way, if the NRA had nobody to represent would they exist?

While it may be hard for you to understand my position and the position of others like me, it's not the NRA fighting. It's me, other's like me. And we certainly aren't giving up anytime soon.

You’ve made liberal use of fallacious argument, taken my arguments exceptionally uncharitably, and have conveniently ignored many other of my arguments while projecting your own shortcomings onto me. You should read the site guidelines. At this point it is clear that you are arguing in bad faith and it is not worth the effort of even reading your replies as you have made it abundantly clear that you have no interest in engaging in a rational discussion. Instead it is obvious that your goal is to spread to your widely debunked talking points; truth, evidence, merits, respect be dammed.

What have I ignored and what have I taken uncharitably? I’m asking for specific laws that you would enact that would help the situation. You have not provided any and you’re now attempting to derail this conversation.

Every scenario you’ve presented Ive disproven. Remember this was started when it was said that food truck operators can become felons.

Further what site guidelines have I violated?

I want specific laws you’d enact to resolve the issues as you see them. Can you provide them or not?

> but let’s prioritize by how many lives we can improve instead of lesser reasons that are used as a fundraising platform by the minority political party without regard for the trail of destruction their reckless policies engender

What other enumerated rights shall we remove under the guise of saving lives? Should we remove access to vehicles? Alcohol? Shall we enact a speech control board that if you violate it you lose your enumerated rights? This would open the door for the same abuse gun owners receive for exercising their right.

You're right, I'm a gun rights absolutist. I will not settle for the removal of this right nor the government making it difficult to exercise. They don't do this with any other right why this one? Can other rights not be just as dangerous? (See Democrats stating they needed to misinformation due to the damage caused to democracy).

The entire argument used by belligerent guns right absolutists (belligerency follows absolutist views like butter on bread) is based on a maliciously broad understanding of the second amendment. Note that no one talks about militias, just the right for every angry terrified fan of tucker carlsons propaganda (legally not News remember) to go to their local gun shop and buy dozens of semi automatic long guns with 10+ round clips and have a few pallets of ammo delivered to their house with merely a signature and maybe a waiting period. But no, it’s too hard to buy a gun./s have you tried the dark web, other Americans have figured out how to carry straw purchases en masse.

https://theintercept.com/2022/06/24/supreme-court-gun-second...

> Note that no one talks about militias

Wait a second, who doesn’t? In fact on this board they have been discussed more than a few time, including by myself.

> just the right for every angry terrified fan of tucker carlsons propaganda (legally not News remember) to go to their local gun shop and buy dozens of semi automatic long guns with 10+ round clips and have a few pallets of ammo delivered to their house with merely a signature and maybe a waiting period.

This is a biased rant again. None of what you said sounds dangerous to me. The problem is now with what law abiding citizens buy and own, they will never use the “dozens of long guns” kill innocent people. Why are you conflating criminals and law abiding citizens?

Can you also tell me, using your example, why any waiting period past the first one does anything? If someone already owns a gun, why are they being subjected to yet another waiting period? The entire point of a waiting period was to cool off and not do something stupid with your new purchase. But if the person already has a gun on hand then what is the point of it?

> ATF rules get published in the Code of Federal Regulations > and are subject to the Administrative Procedure Act > and therefore are announced ahead of time in Notices of Proposed Rulemaking (NPRMs) published in the Federal Registe

Only if there is no exception that allows them to wave the comment period. The key being "emergency actions".

https://www.archives.gov/federal-register/laws/administrativ... https://www.reginfo.gov/public/reginfo/Regmap/REG_MAP_2020.p...

> There is an emergency rulemaking exception under the APA for "good-cause", but this is comparatively rarely used

Bingo. Now imagine living in fear because of a particular government body's overreach. You can clearly see that this can and will be abused based on political bent. The exceptions are the problem. Remove them. Require all rules have a 180 day waiting period.

I left the exercise of relating my arguments to your statements to you and am doing the same here.

Are you aware of the origins of the fda? Chefs and pharmacists got rightfully chilled by the dozens of bills it took to fully reign in their murderous proclivities.

https://en.m.wikipedia.org/wiki/History_of_the_Food_and_Drug...

The only reasons that we’re having this discussion is because of elementary (bad faith) disagreements over the semantic interpretation of laws that predate world changing technologies our great grand parents took for granted in their childhood.

https://www.pbs.org/wgbh/frontline/article/how-conservatives...

Overnight is in quotes because your use of it is needlessly inflammatory. One felony conviction equates a lifetime felon. Your usage of overnight is superfluous and only acts as a conservative dog whistle in your comments.

Who is us, precisely? Names, addresses, and gun permit numbers please. I like to stay as far away from anti-regulation outspoken second amendment types as possible. They’re too shooty and screamy. That said, what are you and your “responsible” gun owners doing to control the irresponsible ones? If responsible people set the rules we wouldn’t have drunk driving laws, or urine screens at work, or even currency. The nra has only supported gun control legislation when its toothless or black people are effectively asserting the same rights. If not The nra being the de facto national steering body and figure head for the “responsible gun owner” cohort then who? I’ve not heard of any organization with a fraction the membership of that side of the gun control war.

https://www.history.com/news/black-panthers-gun-control-nra-...

Funny how you cast the people with your beliefs in a broad positive brush and those who consider your beliefs the direct cause of countless deaths in a broad negative brush. Some might consider that an argument in bad faith. The anarchist and socialist gun owners I know all know to code switch when talking to people proudly exclaiming the same beliefs as you.

Your appeal to authority is dehumanizing, fallacious, and thoroughly refuted by a sibling comment to your post. It’s up to you recognize that your beliefs create a perverse incentive to engage in illegal vigilantism and thus in order to protect democracy and secure the most rights for the most people we must continue to aggressively regulate firearms until their misuse is inline with peer countries. All other domestic attempts to curtail wanton gun violence and vigilantism have failed to have substantial. The time has passed for 2a absolutists to be taken rationally as we’re witnessing countless preventable murders of children go unaddressed.

https://www.unodc.org/documents/data-and-analysis/gsh/Bookle...

Drop the bad faith flame bait and transparent insults. You’re sidestepping my points and demanding I engage you on your terms. It’s uncouth and ironically hypocritical. This is no rant, but I can understand why someone of your beliefs may feel that way. I am a recovered 1-2a absolutist libertarian myself, and I cannot help but full body cringe at the ridiculous justifications and mental gymnastics I used to justify my hatred, prejudices, and wave away the inevitable externalities in such a society that is so improbable it cannot even exist in fiction.

I am sorry to hear that you're a "recovered" libertarian. As a scholar of history, I will keep my guns, and die for it if I have to.

Flame bait? Libertarianism is a stereotypical collegiate belief system that collapses explosively and hilariously whenever it’s been attempted. Keep your guns, I’m fine with civilian gun ownership. I’m not fine with school shootings. First world countries manage responsible gun ownership without school shootings. Let’s get there and then quibble about these things.

> eliminate the right to bear arms

This is clearly not true as evidenced by the high rate of mass shootings in the US

I’m sorry, but if you really think gun rights are nearly eliminated in the US, you’re delusional.

I didn't say they were completely eliminated. I'm saying that is the inevitable conclusion if they are allowed to continue on the track they're on.

If fewer jurisdictions = better, then just adopt the GDPR as-is.

That seems obviously bad to me, having more jurisdictions to work out what the best laws are seems like a better idea.

I'm somewhat skeptical that giving more power and discretion to federal regulators will result in increasing freedoms for the American people.

I'm somewhat skeptical that the increasing power of private companies to gather and sell your personal data is increasing freedoms for the American people.

So a pragmatic person chooses a solution that maximizes the benefit and mitigates the tradeoffs.

That's weird that it was implement to preempt. Normally bills add on top of each other so why it is different here?

As a Californian I would prefer that bills add additional protections especially when it comes to privacy.

EFF is quite popular among "nerds" but as a source for information and advocacy about electronic privacy I actually prefer EPIC.^1

Perhaps someone reading this can explain why, but I did not see anyone from the EFF at the 8 September 2022 public forum on the FTC's ANPR on Commercial Surveillance and Data Security. EPIC was there providing cogent commentary. The operater of thenexusofprivacy.net was there, too.^2

1. For example, here is a comparison of the ADPPA with the CCPA from the folks at EPIC.

https://techpolicy.press/evaluating-the-american-data-privac...

2. This is another topic that may interest HN thread readers. This is Section 18 "Mag-Moss" rulemaking so public input is mandatory. Those who understand the issues should submit comment to the FTC to support the process. The deadline is 21 October. https://www.regulations.gov/comment/FTC-2022-0053-0001

https://news.ycombinator.com/item?id=32947397

You can also see which companies sent lobbyists to work on this bill.

https://www.opensecrets.org/federal-lobbying/bills/summary?c...

That is a lot worse than I imagined. So basically this would be terrible or meaningless for workers/consumers?

So basically, this is a mostly toothless law, that requires small companies to follow to the extreme detriment of the large companies... which already likely do the bare minimum.

I'm not sure of the term. It's like a regulatory legal barrier that keeps new companies from entering the market.

Regulatory capture.

It's almost like blindly calling for regulation without accounting for the political/monetary influence of those being regulated is a bad idea or something

> blindly calling for regulation [...] is a bad idea

What do you expect people to do instead?

Call for individual protections, possibly with a solvent soaked rag in a bottle, typically.

It's like a genie wish. You have to be very specific in what you are asking for.

Yep, always used to stifle competition. Regulate the hell out of it, so new companies can't even begin without millions up front.

Small companies are exempt from CCPA?

The term is probably "regulatory capture"

> It's like a regulatory legal barrier that keeps new companies from entering the market.

barriers to entry [1]

1. https://en.wikipedia.org/wiki/Barriers_to_entry

> So basically, this is a mostly toothless law, that requires small companies to follow to the extreme detriment of the large companies

The bill outlines exemptions for business making less than 40 million annually. I haven't read the whole thing so it's possible I missed something, could you point out which sections you're referring to to draw that conclusion?

Great, we have the usual anti-privacy companies there as well as ByteDance .. what can go wrong.

It's insane enough letting Big Corps lobby your legislature and even write language that eventually gets enshrined as law.

It's even more insane we allow the state-affiliated entities of our adversaries to do this.

> It's insane enough letting Big Corps lobby your legislature

Well, it would be rather pointless to elect to hire a representative to represent you and then not take time to make your position known with them. They certainly are not mind readers.

And you can't realistically remove big businesses from citizenry as those who are stakeholders in big business are going to bias their position to what benefits their business. Business is people, after all. ByteDance certainly has stakeholders who are American citizens.

So we make a best effort to register those biases for the sake of transparency. The only real alternative, short of abandoning democracy entirely, is to leave it a mystery who talked to their representatives.

Isn't it the job of the representatives in a representational democracy to have working mechanisms to understand what their constituents' demands are? Shouldn't such mechanisms be equally accessible to all constituents irrespective of their ability to spend $$?

Also, don't the representatives have pre-election issues based manifesto when they are seeking votes to get elected? Shouldn't they stay true to the promises they made?

> Isn't it the job of the representatives in a representational democracy to have working mechanisms to understand what their constituents' demands are?

The advantage big business has is scale. Big business, by definition, has many more stakeholders. This means that big business will be disproportionately represented by the constituents. If those biases weren't made clear, and each constituent's position was taken at face value, then the unified front would appear stronger than it would actually be if each actor were acting without those biases.

> Shouldn't they stay true to the promises they made?

I'm not sure why you'd want them to. The state of the world is constantly changing and new information continues to flow in. You will be constantly reevaluating your position in the face of new information. A representative will respond to that.

Representatives know that some segment of the population honestly believe that they are mind readers and will offer up some examples of how they might try to read the minds of those who buy into that witchcraft to attract their vote, but marketing and reality are quite different.

I have a representative who I agree pretty much on all issues. The problem though is that he is one of 435 people in the House. He can just vote for, against, or propose changes. But then will have to fight against those who will easily accept money to ruin it.

I'm glad that Pelosi is using her position to impose some changes on the bill so maybe something good will come out of it, but I really can't stand that in US bribery is essentially legal.

What is more insane is that this is not considered corruption. Usually if this happens outside US, the US government itself will call that corruption.

Freedom of speech. All they do is pay people to speak for them. They have money to do that. Gifts and other tomfoolery is obviously no good but I'm not sure how you could gate this without running afoul of the first amendment.

It's pretty simple, you pass an amendment that says corporations are not people for the purpose of political spending.

*briberies

The first thing to know about US Laws/Bills is that whatever they name it, it typically achieves the opposite

Sadly true.

I assume "Data Privacy" means privacy for the company that collected the data and "Protection" means protection from the people they collected it from.

The U.S. government makes often use of the data that many companies keep about us. Android geofencing is my clasic example for non tech.

Completely, especially if it has the words "Digital", "Online" or "Data". I haven't read the bill or read about the bill but I'd wager a coffee there's also some form of entertainment/copyright industry hostility in there.

I'm really trying not to be cynical here, but I started so I might as well finish. Step #2 is if it does happen to pass, the parts of the bill that are actually consumer protections will be unenforceable, be ruled unconstitutional or have unintended negative consequences. The bad parts of the law will have no issues in the courts or with enforcement. They, too, will have unintended added negative consequences.

You forgot the words “Inflation“, “Equality“, “Infrastructure”, “Dream”, “People”, “Save”, “Health”, Budget” or “Climate”.

Patriot

"Families", or "Children"

this is because the title of a bill has very little to do with the function of the bill turned law.

obfusication of a bills content and intention by using a dissociative title must stop

Or something unrelated. The "infrastructure" bill got renamed to "inflation-reduction" bill despite its contents not changing much. If the pandemic were still a massive concern, I'll bet it'd be called the "covid19 relief" bill... oh right, there was one of those, and it included foreign military aid.

Alphabet and amazon are on the last page, alphabet having spent ~3mil and amazon ~5mil

I think the theme is just that they're big companies.

There's been some good reporting on the lobbying on ADPPA

What Microsoft, IBM and others won as the privacy bill evolved - https://www.protocol.com/newsletters/policy/cloud-enterprise...

Privacy bill triggers lobbying surge by data brokers - Privacy bill triggers lobbying surge by data brokers

Microsoft has been a particularly bad actor in this space. They have been hiring lobbyists to advocate at the state level for shitty "consumer privacy bills", specifically because they want to forestall and kneecap federal legislation.

https://www.eff.org/deeplinks/2020/03/tech-lobbyists-are-pus...

What's Microsoft's interest in this? They don't have a big search or ads business. What are they doing with Consumer data?

Their interest is in their bottom line and avoiding regulation. Pretty much any company that has a lot of users creating accounts will be impacted by even the most milquetoast privacy regulation to some degree or another, and I guess microsoft sees the cost of hiring a bunch of lobyists as cheaper then having to deal with the regulation that might come about if they dont.

"They don't have a big search or ads business."

$11.5 billion is not small.

From 10K

     Revenue, classified by significant product and service offerings, was as follows:
  
     (In millions)                                                                
                                                                                  
     Year Ended June 30,                  2022          2021          2020        
                                                                      
     Server products and cloud services   $ 67,321      $ 52,589      $ 41,379    
     Office products and cloud services     44,862        39,872        35,316    
     Windows                                24,761        22,488        21,510    
     Gaming                                 16,230        15,370        11,575    
     LinkedIn                               13,816        10,289        8,077     
     Search and news advertising            11,591        9,267         8,524     
     Enterprise Services                    7,407         6,943         6,409     
     Devices                                6,991         6,791         6,457     
     Other                                  5,291         4,479         3,768     
                                                                                  
     Total                                $ 198,270     $ 168,088     $ 143,015

The real co-sponsors. Or at least, cosponsors-lite.

I see they are also annoyed at cookie banners:

> SEC. 210. UNIFIED OPT-OUT MECHANISMS. For the rights established under sections 204(b) and (c), and section 206(c)(3)(D) not later than 18 months after the date of enactment of this Act, the Commission shall establish one or more acceptable privacy protective, centralized mechanisms, including global privacy signals such as browser or device privacy settings, for individuals to exercise all such rights through a single interface for a covered entity to utilize to allow an individual to make such opt out designations with respect to covered data related to such individual.

halle-fuckin-lujah please don't make it some bullshit centralized service where you have to have a specific cookie from a random website to actually use it. please just expand DNT.

In the sick world we live in, ad companies would love a more granular DNT response from your browser so they can use it to fingerprint you.

More likely it will be GPC (https://globalprivacycontrol.org).

Was scanning for this thanks for pointing it out. Some of these banners are infuriating, and if I use firefox containers sometimes I see them over and over, especially if I'm clearing my cookies. It is insane to me that this isn't already a standard.

Standardization was attempted. https://en.wikipedia.org/wiki/Do_Not_Track

the tl;dr for that story is that it wasn't mandated to be honored, the industry didn't voluntarily adopt it widely, and when IE 10 tried to turn it on by default and the standard's lead supporter responded by submitting a patch to Apache web server to ignore the DNT signal coming from IE 10 because "does not protect anyone's privacy unless the recipients believe it was set by a real human being, with a real preference for privacy over personalization," that situation pretty much killed it in the crib.

The problem is technologically simple to solve; all the challenges are social and legal.

It's kind of hilarious that of all the datapoints websites will gorge upon, DNT is the one thing they all toss out.

I believe DNT was used for better browser fingerprinting.

I wonder if a browser plugin that utilizes AI would work as a sidestep to a standardized cookie dialog. Granted someone would have to build such a tool and standardization seems inevitable at some point. Shouldn't be too difficult to build something like that.

There's a browser plugin called uMatrix that lets you block cookies and javascript on a per-site basis. I just have it blocking all cookies by default unless its a site I need to log in to.

There is a standard that has some recognition and uptake (though needs more) - Global Privacy Control. It’s been adopted by some browsers and publishers, and IIRC is a requirement for CCPA (California Consumer Privacy Act) compliance. https://globalprivacycontrol.org/

They'll just make it so complicated where you have to use an embed from Google or something to implement it properly, similar to CCPA.

In the end Google ends up in a script on the page somehow in the name of privacy.

uBlock Origins has "annoyances" blocklists that takes care of most of those banners.

They need to specify that this has to work in an anonymous, per device way (like DNT).

Otherwise, google could claim its current policies are compliant. ("Just log in if you want to be 'anonymous'...")

Google does not rely on a user being logged in. Go to adsettings.google.com in a logged out state, for example. I'm not sure what you're referring to.

That's only for ad personalization. If you want to turn off web and app activity, you have to be logged in.

The ad industry has had these opt-outs for a while, but you have to set opt-out cookies on about 500 sites, so it's not practical. DNT solves that problem, but the industry won't voluntarily adopt any solution that has any realistic chance of making a difference.

I went to the site. (They misspelled the DNS name "adssettings.google.com)

I opted out.

I pressed the trash can button in Firefox Focus.

I reopened the site. It said I was opted in.

Their "disable tracking" button simply does not work.

I'm not enabling cookies so I can opt out and they can just buy my tracking information from some other ad network. There is a reason I disable persistent cookies and want DNT headers to be legally binding.

Sigh. I have my cookies enabled because I want to use them. If I didn't, I wouldn't enable them. I wish there were a "fuck GDPR, I agree to whatever terms" browser setting.

GDPR doesn't disallow cookies, it disallows tracking cookies, afaik. Tracking data is not yours too see, so how could you use them? Do you mean that you want personalized ads?

I want to use the site without getting a banner. Some require me to agree to cookies. I don't care what they do with the cookies. Almost nobody does.

I sure care. I never agree to any cookies, and instead, I use an ad blocker to hide the banner. I can't speak for most people but of you care about your privacy, tracking cookies should become an opt-in mechanism.

Yeah, you care, but most people probably just click accept. I want an "I don't care" option. Ad-blocking the banner only goes so far and is harder on mobile.

Principle of least privilege. If websites ask for camera permission they should have a good reason, and you should be able to disable it in the browser. Unfortunately, you can't enforce what cookies will be used for technically, so it's done legally instead. But the preference could still be in the browser, where it belongs. I'd be fine being denied service if I don't allow tracking cookies.

Another option would be to spoof/containerize/pollute/sabotage the cookies through the browser or an extension, and opt back in for sites that you need persistence with.

Principle of least privilege is for things the client can control, like sending the cookies in the first place. There has already been a "do not track" option since 2010. It got basically deprecated because nobody respected it. And even if they tried to enforce it, and I actually cared about being tracked, I wouldn't trust it.

> (B) any time beyond the initial 2 times described in subparagraph (A), may allow the individual to exercise such right for a reasonable fee for each request.

Paying any sum of money to receive a copy of or request to delete my private data is unreasonable in nature.

This is normal:

https://www.techrepublic.com/article/how-to-request-your-per...

>Although, the ICO also notes that a firm may charge a “reasonable fee” when “a request is manifestly unfounded or excessive, particularly if it is repetitive.”

Privacy request shouldn't enable mechanisms of denial of service type attacks against companies.

I wonder if a company can be DoS'd via privacy request maybe they are collecting more data than they can effectively handle and that should be re-examined.

The problem is, "reasonable" is subjective. Things like this need to be tethered to something. "The fee may not exceed 50% of the hourly federal minimum wage."

That’s just not true. “Reasonable” is a binding term used in contracts all of the time. The court system is extremely experienced in determining what is and is not reasonable.

"The court system is extremely experienced in determining what is and is not reasonable."

Almost always to the dismay of one party, and sometimes to the dismay of the general public.

Not always. According to lemon law lawyer Mr. Lehto (who runs a Youtube channel Lehto's Law), RVs are not covered under most state lemon laws, and thus defers to the federal Magnuson Moss Warranty Act which just says repairs must be under a reasonable time frame, and the RV companies say something like 10 repairs, 6 months each, is the industry standard and thus reasonable, and judges don't have anything else to base that on, so they agree.

I don’t want to have to go to court to not be extorted over my data.

It's certainly experienced in making stuff up.

Much like passing a bill to find out what's in it, going to court to discover the rules is not a healthy way for society to run.

Going to court to discover the rules is precisely how common law systems work

Leaving the fee uncapped creates an incentive for business to put zero effort into making the reporting process efficient. That way, they can demonstrate that compliance requires 5 skilled hours (for example) and "reasonably" charge $250 per report.

Courts rule on the evidence provided. If a user challenges the fee, the company can easily document where every penny went, and therefore claim it is a reasonable charge. The user's only real recourse would be to prove that company is over-billing, but that would require evidence.

Pegging the cost to a set number of labor hours by law signals to companies that part of the cost of collecting this data is they must develop their internal systems in a way that they can quickly and easily comply with requests.

From a foia perspective the courts and government agencies aren't great at "reasonable".

GDPR is filled with "reasonableness" expectations and unspecified guidelines that aren't tethered to anything. Why the concern over this one specifically?

This one, I dunno.

But in general, EU/EC law is full of policy that gets interpreted as human judgement calls, and US law is full of details that are interpreted as badly-written code with a choice of parsers. The two styles are not compatible.

Yes because a 99 section 11 chapter law is really easy for small companies to follow…

EU laws can often be written in such a way and are a bit looser in their language in ways when compared to how it may be written in the US. EU courts are more experienced with dealing with interpretations of "reasonableness" for a given law when compared to the US, so it's not really a fair comparison.

Yes, what's reasonable to a company may not be reasonable to a consumer. Ie, as a company can create process that uses 10 man hours and my cheapest labor with overhead is $50/hr, but we can find countless CNBC articles that say the average consumer can't afford a $500 expense.

I agree privacy request shouldn't enable mechanisms of denial of service type attacks against companies. But I don't think that justifies allowing companies to put in place fees to access personal data.

If cloudflare required people to pay to bypass their denial of service protections... well, I guess I dont know what would happen, other then that I would hate them even more then I already do for all the terrible things they do for my experience as a default tor browser user.

DoS is an understandable concern, but charging for a service is probably one of the least sensible ways to prevent it. To me, it just looks like the most profitable and impeding hurdle that companies can set up to prevent users who want to access their own data. I would be frustrated if any application made me pay even a small fine because they suspect a DoS attack. For example, entering my credit card info because I've searched a phrase too much just isn't efficient.

> Privacy request shouldn't enable mechanisms of denial of service type attacks against companies.

How would this even happen? I genuinely don't understand what you mean.

Users don't like a company, they automatically spam the company with large numbers of requests for personal information which they would legally be required to provide.

Does the same logic apply to FOIA requests?

Most FOIA requests involve a small fee as well for the same reason.

https://www.hhs.gov/foia/faqs/what-is-the-cost-for-getting-r...

And those fees have been infamously exploited to functionally deny access to material or financially harm the requester. Perfectly illustrating why charging fees for these things is such a bad idea.

Guess they'd better figure out how to get people their data in a more rapid manner. I guess they could use a computer or something to automate it so that users can just click a button to download their data.

I mean, what year is this? We've been hearing "automate it, automate it, etc" for years and years now. But to get your personal data, these companies just throw up their hands and say that it's too hard?

I couldn't agree more. Even if it does require a person to do something that isn't automated, they should be required to have people on staff whose first priority is responding to these requests. It seems ridiculous to me that people are claiming this is just too hard for a company so they should get to profit off of it.

It's our data, dammit!

>that people are claiming this is just too hard for a company so they should get to profit off of it.

Completely disingenuous argument. Literally nobody claimed that.

By the same token of strawmanning, you're claiming that businesses should do nothing than hire people to send your data back to you. Why even have businesses if that's the only thing you think they should do?

If you're so invested in "your data, damnit", then don't give it to them in the first place.

When we implemented CCPA lookups, one of the many necessary lookups was through a decade of glacier'd request logs (necessary to hold onto for compliance).

Even ignoring implementation cost, there was a significant computational cost that's pretty hard to avoid.

When GDPR was new, several people sent "nightmare letters", deliberately and publicly designed to cause as much cost and hassle as possible. To my knowledge, no one was punished or even inconvenienced for blatantly abusing the law in this way.

https://duckduckgo.com/?q=gdpr+nightmare+letters

The "nightmare GDPR letter" is trivial to deal with: https://jacquesmattheij.com/so-your-start-up-receive-the-nig...

For our company, all privacy requests are handled manually by a team I am on. We manually do name searches in about a dozen platforms to see if there are any matching records.

4/5 times there aren't any - people doing the requests often use services that submit blanket requests.

Strong disagree. There are already other options for malicious actors, most notably Americans with Disability act.

Maybe they should automate the requests then. There's zero reason why they couldn't just write something where you log into your account and click "download my data."

These companies are happy to harvest up all your data, run all this crazy automation, spend millions analyzing algorithms, setting up machine learning, NFTs, run datacenters, networks, etc etc, but they can't figure out how to automate GDPR requests? FUCKING BULLSHIT.

There is literally zero reason why a data request should add any burden to a tech company.

So you could have something like each person is allowed two free data requests per year, after that you can charge for it, or something like that.

I mean, at our company, GDPR requests have to cost at least $50 a pop. It goes to a human team to review and process with a dedicated legal representative.

Not my problem. You're the one collecting the data. You pay for the costs. Can't afford to collect my data? Go out of business then.

We have to process the request regardless of whether we actually have your data or not.

seems like you should either make the lookup automatable or stop collecting. eu citizens wont have such a fee.

>make the lookup automatable

Yes we should. But there are a few too many systems, and we add and drop systems with such regularity that it would still be a non-stop engineering challenge.

>stop collecting

For the few records we do return as part of GDPR requests, they are usually associated to customer and billing data. I don't know how you run a business without that.

> eu citizens wont have such a fee.

They do and it's collected in the cost of higher product costs.

It's your problem until there's a law saying otherwise.

Sounds like an appropriate cost of doing business with data. If you don’t want to pay for it, collect less data.

Very fair point, and I understand the necessity of data collection in some cases. I do feel like that's a cost that's incurred voluntarily, though, and shouldn't fall on the shoulders of users/customers. Some people might not want data to be collected to begin with, so the cost ends up being your company's fault and not theirs.

But we have to process every request even if we do not find any of their data.

A majority of requests are actually this way - people use online services that submit blanket removal requests.

Yeah, that's definitely the case and I see where the hassle is, but to restate my point, those costs are simply a part of overhead and not the business of users. Unless the users are given an opt-out first and foremost, they're owed ownership over their personal data.

Again, the language of the proposed bill is requiring 2 free requests per person.

$100 for an occasional person? No biggie.

Potentially infinite? That's a bit more than normal overhead.

While we haven't seen this sort of DDoS attack through our GDPR process yet, the potential is already there if bad actors or competitors wanted to exploit it.

Now if we could just get a bill that actually limited the governments ability to collect data on its citizens. I'm not really worried about targeted ads, I'm worried about targeted assassinations.

You talk to people and ask them why they are worried about companies collecting data, and a certain percentage will tell you they don't like that the government could get it with a court order. That'd be a HUGE improvement over the current situation where they don't have to, they just collect it directly.

You need both.

Companies collecting data on you directly or indirectly is a problem, even if they don't do anything malevolent with it (and some already do). The issue is that eventually they'll be breached, and then that data can end up in the hands of malicious actors that might use it in a way that could harm you (e.g. identity theft, compromising other accounts thanks to peronal info, etc.).

Why would they need a court order when they are already just buying the data with zero oversight? The panopticon works like this: fund startups that will create a data treasure trove -> legally buy / access the dataset and add it to xkeyscore.

This poses an interesting question: if the government mandates a company to collect data, are they exempt from this? What's stopping them from using that data for commerical purposes?

Section 101 part b "Permissible Purposes," defines when data is allowed to be collected. The sixth such purpose: "To comply with a legal obligation imposed by Federal, Tribal, Local, or State law..."

A close reading of the wording implies this only covers requests backed by a law, i.e. it does not cover "polite requests" from a government agency. However that is a theoretic protection, practice could be different.

That is incredibly shortsighted considering one of the prime ways the US Government skirts protections against domestic data collection is by simply buying it from private entities.

There's a large difference though between what governments could presumably buy from ad trackers or data warehouses and what they can get by intercepting unencrypted web traffic at the ISP level.

Wouldn't it be the same if the ISP sold the gov. the extracted info they want ?

In this setting the gov can hint at what data it wants, and private parties will manage to get it for resale.

I think to OP's point, if we are worried about government wrongdoing we should pass laws against government wrongdoing. It really doesn't matter what the private industry does or doesn't do if the government still has the right to take it.

I am not afraid of my data being used against me to sell products. I am afraid of the government abusing their monopoly on violence. The first seems like misdirection.

Technically we already have protection under the 4th amendment, to me this falls squarely under "papers, and effects" and is an unreasonable search. It seems that the court doesn't agree though considering the current state of things.

I see your point and the appeal of pushing for toughness on the worst side with leniency on the lighter issues.

It just seems irrealistic to have basically a "don't be evil" policy on gov side while letting gorrilla size businesses roam free.

For instance we already have a very bad time dealing with VISA/Mastercard policies that straight dictate what businesses are allowed to thrive online. VISA/MC duopoly is not the gov, yet it has arguably more power on the online cultural landscape. And any gov making their life easier can have them implicitely return the favor in some way would be basically untraceable (the gov might not even need to ask for anything. VISA/MC would just apply changes in line with the gov.'s stated policies)

User surveillance is the same, you can't have unruled gigantic entities allowed to do whatever they want, with the gov limited to a small set. That chinese wall is just bound to leak.

Pretty sure everyone who wants gov data collection of private individuals would want this to be illegal as well.

I'm disappointed to find most of the complaining on this thread about businesses collecting personal data, rather than the government. Even more so that the first comment's top response regarding this is shooting it down because of an imagined loophole.

It disgusted me about CCPA that a private company can have a breach and be fined millions, but the CA govt is immune. Same thing here, and it should disgust everyone who supposedly cares about privacy.

They only need a court order (which can be from a secret court providing secret guidance, and can be a infinite standing order that covers vast amounts of arbitrary collection AUMF-style) to force companies to turn things over. Companies can just hand your data over because they don't want to be retaliated against (or in return for favors), and nobody needs a warrant, nobody ever has to tell anyone. Depending on agency internal rules, they may not even have to keep a record themselves of having done it (if they break their rules, they'll be responsible for punishing themselves though, I'm sure they'll be harsh.)

That's your targeted ads (and your cellphone tracking, and your transaction records.)

A lot of the time they just buy it from data brokers.

Hell, I'd be happy if the DMV, post office, and voter records stopped publishing my address.

Fun fact: the lack of this is actually THE reason why Google Fonts is banned in the EU right now

> I'm not really worried about targeted ads, I'm worried about targeted assassinations.

Who's after you? I'm not making the lame "only wrongdoers have something to fear" argument, just wondering what circumstances you're dealing with.

The ADPPA seems like a great example of regulatory capture and gridlock of the federal government by rich corporations and individuals and how federalism (state's rights) is a crucial and increasingly fragile element in holding our economy and our society together. Privacy is a particularly fraught area. SCOTUS says it's not a constitutional right at all (unless it's your money, in which case it's speech), which means states will have to define not data privacy and the limits of the surveillance economy but abortion and marriage and contraception too.

( typo : i think you meant "not only data privacy..." )

because of the "war on drugs" was supposed to be about the health of americans, which turned out to be a lie...

I think this is not about protecting the rights to data and privacy of american indivudal citizens...the other kind of american citizen, the american corporation, on the other hand, stands to gain a lot from this.

> To provide consumers with foundational data privacy rights, create strong oversight mechanisms, and establish meaningful enforcement.

ah, so corporations can well-foundedly and meaningfully consume the data of 'consumers' (an euphenism for fuel) in a way such that the historic shadow suckers of everything's energy (banks) can continue to partake on the sucking down of everybody's data/information (with real time measurements, which is a novelty in this ancient system build around trade, commerce, insurance, and power-authority concentration).

For those following along at home:

So far five states have passed local Data Privacy laws (CA, VA, UT, CT, MA). They are all different. This situation makes it much more likely that federal data privacy legislation will happen: while companies wish they could have 0 laws, they would still much rather prefer 1 law rather than 5 (trending towards 50) different laws that contradict each other.

There's a whole buncha specifics about what data is covered and what companies are covered and bleh blah bluh. That's not the most important thing. There are two things which are more important than that. These two issues also happen to be the topics most hotly debated between Dems & Repubs.

1. Private Right of Action, aka "Can I, a private citizen, sue someone?"

Everyone violates GDPR a dozen ways to Sunday, and nothing happens. Why? Because no one can actually enforce the law except for the local regulators who are underfunded. By contrast, the ADA lets anyone sue over violations, and as a result companies care a lot about handicap accessibility.

To my understanding the current negotiations are trending towards a limited Private Right of Action. Meaning it will exist for some violations but not others. This is how CCPA works in California right now: private citizens can sue over data breaches, but any other violation can only be enforced by the Office of the Attorney General.

2. Pre-emption, aka "Does this repeal CCPA."

Can states give additional protections to their residents, or is the Federal government removing the ability of states to define additional requirements for businesses. Again, the current state of negotiations seems to trend towards partial, but not total, pre-emption.

Partial preemption leads to supreme court decisions that lead to near total preemption.

Only if it's not a highly contentious issue. Otherwise the bigger states just go "We control X amount of the American population/economy, and thus we are going to enforce our own law anyway"

Granted they would be in the wrong since this is clearly and unambiguously interstate commerce, but that hasn't stopped them before

Its not unambiguous. Google is based in CA, I am based in CA. Packets may go across state lines, but the commercial transaction (a search query) has occurred between two CA entities and should fall under state law.

It doesn't work like that. Once Congress enacts something then it can be preempted by federal law. Just because the activity took place in a single state doesn't mean that the Federal courts don't have jurisdiction. Erisa is a good example.

I wasn't arguing that, I was saying that it's not an unambiguous case of interstate commerce. Congress shouldn't be pre-empting the laws of California insofar as they apply to intrastate commerce. You can set a federal minimum and let each state enhance laws as they see fit.

Agreed, but as we've seen with many other federal laws once you have preemption then it is usually interpreted to the broadest extent and not the minimum.

Is there a right, as a private individual, to sue everyone who has sent spam/fraud texts to me?

Spam email, yes, due to the CAN-SPAM Act explicitly authorizing it. I believe that at least one individual has literally made a living out of pursuing such lawsuits.

Texts, nope.

> they would still much rather prefer 1 law rather than 5 (trending towards 50) different laws that contradict each other

A perfect example of how these megacorps destroy the fabric of our political process. The fact that dealing with state regulations is a burden isn't our (the people's) problem, we have a right to have our state's reflect our will. They want to scale up to this massive size raking in billions of dollars, that should come with the territory.

> Everyone violates GDPR a dozen ways to Sunday, and nothing happens. Why? Because no one can actually enforce the law except for the local regulators who are underfunded.

Individuals can enforce GDPR in court:

---------------

Art. 79 GDPR

Right to an effective judicial remedy against a controller or processor

1. Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Article 77, each data subject shall have the right to an effective judicial remedy where he or she considers that his or her rights under this Regulation have been infringed as a result of the processing of his or her personal data in non-compliance with this Regulation.

2. Proceedings against a controller or a processor shall be brought before the courts of the Member State where the controller or processor has an establishment. Alternatively, such proceedings may be brought before the courts of the Member State where the data subject has his or her habitual residence, unless the controller or processor is a public authority of a Member State acting in the exercise of its public powers.

  SEC. 203. INDIVIDUAL DATA OWNERSHIP AND CONTROL.

  (e) Verification And Exceptions.—

  (1) REQUIRED EXCEPTIONS.—A covered entity shall not permit an individual to exercise a right described in subsection (a), in whole or in part, if the covered entity—

  (C) determines that the exercise of the right would require access to or correction of another individual’s sensitive covered data; or

Simple: store all your user data in an intermingled fashion, such that a read or update of any individual record necessarily involves a read or update of one or more unrelated records. Now you don't need to act on data access requests.

Doubtful any court would accept that practice.

I chuckled at the thought of U.S. judges being forced to have opinions on software design principles.

Can't read legalese much, and -judging by how these things tend to go- I bet it's butchered beyond recognition before it gets to a vote (if at all). Instead, we should consider a constitutional amendment that enshrines digital privacy as a fundamental human right.

Why would a constitutional amendment be less prone to getting butchered beyond all recognition? An amendment may not have its text butchered, but there's no guarantee at all that it will be interpreted the way you hope.

It probably will be interpreted in all the wrong ways you can't even anticipate. All you need for an example is 2A.

For any enterprising young legal authors, I'm sure a "rewritten for laypeople" paragraph-by-paragraph blog post would garner a large volume of views and impressions to your site...

> Instead

No way. The threshold of consensus required to put a constitutional amendment through is far higher than that of passing a bill (maybe too high, but that's another conversation). The fact that such an ammendment would consist of terse, high-level, abstract statements rather than pages and pages concrete specifics would also make it harder to achieve consensus because too many people would be afraid of it getting read by SCOTUS in a way they didn't want.

We need to work on federal laws here and not wait for a pie-in-the-sky constitutional ammendment. (State-by-state laws don't make a whole lot of sense on this topic. Glad CA has been test-driving some, but we need a unified approach.).

> digital privacy as a fundamental human right

Why would digital privacy be a fundamental human right before normal privacy?

we don't even have food and shelter as a human right

We do have food in a sense. I began cooking for the homeless and quickly learned they all had EBT cards and didn't want my bland cooking.

the comment I was responding to was specifically referencing rights as outlined by the constitution

You do realize that you can waive your constitutional rights like a jury trial, and that these companies would just make that part of their standard terms of service... Right?

Just a reminder any email you have online that is over six months old can be read without a warrant.

Hm, I have 10 years worth of emails in my dovecot, on my metal, in my basement, online. Can you please describe how can it be read without a warrant by people who don't have my imap password or wheel ssh key to my server?

Do you ever send email to other servers? If so, there are copies out there.

Well that's the "proper" version of the clinton email server in the basement.

But I meant the major services all must give access to virtually any federal government entity on request, warrantless. I think they even have portals, imagine how that is abused by anyone and everyone.

Not sure how it would be enforced but I would guess if the feds wanted access to your server, even without a warrant, you'd be forced to give it to them.

https://www.wired.com/2010/04/emailprivacy/

https://en.wikipedia.org/wiki/Electronic_Communications_Priv...

Can you describe how it could be read with a warrant, or how it's relevant at all to people who have email accounts with online services?

Unless you are just emailing yourself on your server, chances are that 80% of your email is searchable between Google, Microsoft or Amazon.

I just checked on my mail (look at headers, for smtp hosts not just senders and receivers).

For me its 76% for the past 7 years, that either originated or ended in one of the big three silos.

Any source for this?

Ten years or so ago, I was participating in a small business roundtable discussion with one of our state senators. At the time, I ran a consumer research agency and would often have multinational projects involving consumer data collection in both the US and EU; this is before GDPR had become ratified, but Safe Harbor was failing and there was ambiguity about what the future state would look like.

Of the 15 or 20 business owners in the room, I was the only "pro privacy" voice. People were very focused on what would be the perceived additional cost of complying with any GDPR-style rules in the US, and weren't yet thinking about the negative effects of having different privacy rules in different markets. "Different markets have different rules all the time," in short.

I maintain that it would be less complicated, less expensive, and more human-friendly to use data privacy rules as globally universal as can be achieved. There will always be capitalism leeches that drain money through arbitrage between the policy gaps, yes, but it would help.

(Also: there is zero chance this gets through the current US Senate. Would never clear filibuster.)

I would be interested to hear why you think it has no chance in Senate.

> Would never clear filibuster.

A filibuster by who? Neither party would support any privacy rules that placed any undue importance on privacy.

I'm mostly just projecting based on the current 48+2+50 state of the Senate where virtually everything gets held up. If the Democrats brought it forward, I would expect the Republicans to filibuster just on principle.

Slight historical aside here: for those too young to have been politically aware before the Obama era, the filibuster (a) is in the modern form a relatively recent invention (b) was rarely used prior to the Mitch McConnell era. McConnell and the Fox News generation of the Republican Party turned what was meant to be a tool for a last-resort veto into a sledgehammer continuously used to bludgeon the other side.

> I maintain that it would be less complicated, less expensive, and more human-friendly to use data privacy rules as globally universal as can be achieved.

I think this is a bit naive. As someone who has had to dwell a lot on the specific nuances of German privacy laws vs GDPR or South Korea's, I have come to the conclusion that conflicting privacy laws are a designed feature.

I think lawmakers certainly have consumer protection as one of their goals, most privacy legislation has many features intended to benefit domestic industries at the expense of foreign ones. Or to benefit national security in some way (such as requirements for certain types of data to be stored on servers inside the country).

Even if the US was to homogenize with GDPR in some way, I wouldn't doubt that the EU would fast follow with a slightly different spin on it just to give US tech companies an extra set of hoops to jump through.

In a way, this is already how safety regulations work in the automobile industry.

I agree that we're not going to see a US privacy framework that's identical to GDPR and where all players have the same obligations and enforcement mechanisms. What is extremely problematic, IMHO, is the US having _no_ privacy framework to speak of while the rest of the world does. Beyond HIPPA and COPPA (and CCPA if you happen to live in Cali), there's really not much recourse for US citizens besides their collection of company-paid credit monitoring after each security breach.

If one outcome of GDPR is that 10-15 years later, the US adopts some sort of national privacy framework that motivates industry to reevaluate their data monetization business models, that's a good outcome.

The corporate captured government will only protect their privacy and profits. The quicker people realize this, the better.

Always good to see links to direct text of bills.

Reading the tea leaves a bit, Speaker Pelosi seems dead set against it and I dont think will allow it to be moved as is. she has publicly stated that "states must be allowed to address rapid changes in technology", IE, the bill preempts to many state privacy regulations, esp in California. But as a rule my default assumption for the "real reason" why Pelosi is against something is because she thinks it will harm chance of caucus holding majority in house.

https://pelosi.house.gov/news/press-releases/pelosi-statemen...

Skeptical as I am of her motives / methods, I'm inclined to agree with her in this case. Act should be a floor not a ceiling.

If we can let lobbyists write bills, we should be able to let privacy advocates write bills. We can do better than this.

Privacy advocates such as the ACLU and EFF do have lobbyists as well.

but not tens of billions of dollars between them.

You can help them if you want! :)

https://supporters.eff.org/donate/

The ACLU also does a lot of great privacy work, so donating to them is also a good idea if you care about this stuff. National ACLU does a lot of great work, but I personally suggest giving to your local affiliate https://www.aclu.org/about/affiliates, as they are often the ones who work on local issues that are likely to directly impact you. We do privacy lobbying at the municipal and state level and our local ACLU affiliate has been a huge, huge ally.

There are also other great privacy orgs that are not quite as big but are also fantastic in their own ways, like Restore the Fourth (which also has local chapters like shameless plug) rt4mn) Fight for the Future, Demand Progress, Cato, and Privacy International

Also, If you want to do more then just donate, you can help the EFF with its lobbying efforts by joining the Electronic Frontier Alliance https://www.eff.org/fight We participate, its pretty great.

You have not been paying attention to the ACLU.

I pay pretty damn close attention to the ACLU.

> We do privacy lobbying at the municipal and state level and our local ACLU affiliate has been a huge, huge ally.

I disagree with them on a whole range of issues, but when it comes to privacy and mass surveillance they are almost always spot on. Most of my disagreements in that area have to do more with political tactics and messaging then anything else.

Maybe something in the middle is nicest? I'm not looking forward to every single website having two cookie warnings I need to close!

One of the logistical issues with a law like this, and with the CCPA, is verification of the user requesting things such as account deletion. How are people supposed to do that without providing KYC-level details to every service provider?

Will you guys get to click popups on every.single.site.? If so believe it’s annoying. There must be a better way.

Why on earth would we want MORE restrictions and government interference / intrusion in our affairs? Especially in this era of worldwide creeping authoritarianism?

The only way implement these sorts of mandates is stomping all over a developer's right to freedom of expression. I'm a firm believer that code is speech and that limiting what a developer can do is infringing on his own right to free speech.

Could they have picked a better sounding acronym? Maybe APPA (American Privacy and Protection Act)?

anyone know the gist of what tech companies will have to do in order to be compliant?

Less than they do now. This washes away CCPA protections that are already nationalized-by-default.

Maybe I'm too romantic, but I'd like to see an american GDPR (not saying that the eu name or the bill itself is better), and then an Asian and so on till we have one global GDPR protecting all consumer data.

</daydream>

GDPR is a horrible horrible solution and only helps the big corporations who can afford all the extra work to ensure that users who actually end up agreeing to the terms are locked in.

It helps no one besides politicians who now have create more work for them selves, and is an abomination just like the cookie policy.

Not sure what y'all are complaining about. The amount of privacy work that happens with governments at big tech companies is substantial. The language in this doc seems like a better, less oppressive version of GDPR.

I find the gdpr is much easier to read than this.

2nd rate claptrap of a bill. Just make the CCPA national.

I kind of wish they would just copy the EU rules. Once set of rules for the US and all of Europe would be pretty nice.

The effort put in is commendable but this doesn't yet reach the levels of GDPR and the US market is too large for it to be likely to pass. Maybe eventually ...

Worst administration in History.

The Biden Administration? This is a bill introduced in an entirly different branch of government. AFAIK Bidens got squat to do with this

Giggety

This is the proverbial shaking of the tree, whereby elected officials will ask (threaten) tech lobbyists for campaign contributions in exchange for their vote against the act

It's also potentially a huge score for some Democratic politicians, because for every Republican that supports the bill, they're going to need a Democrat to defect.

Lol.. gotta love when they propose acts before even understanding technology. Things like this need to be collectively written by some of the best privacy advocates. Not a bunch of interns that have no clue how technology works.

If there's a piece of the bill that illustrates your objection, please do share. As is this feels like a canned response based on a stereotype, not a substantial objection.

Reply on news.ycombinator.com