Hacker News Reader

Comment by koito17 | Hacker News Reader

From the senate press release,

> The CPPA would create a simple way for Californians to direct all data brokers to delete their personal information, free of charge.

I wonder how something like this would actually be enforced. At the moment I can request my personal information to be deleted, but there is no way for me to determine whether such request was actually fulfilled. Even with this option to direct "all data brokers", the problem remains, and it seems to be briefly acknowledged in this sentence

> Tsukayama said that what most experts in the field agree on is that California law leads the nation in this space, but that it’s still barely enforced.

I don't know of any good way to enforce this kind of legislation, even if I totally support it.

View on HN

"Data brokers would have to undergo an independent third-party audit every three years to ensure compliance with the DELETE Act provisions and submit audit reports to the California Privacy Protection Agency."

Source: https://privacyrights.org/resources/california-delete-act-bi...

Well, I can see how that means well, but this doesn't scale to dozens of other jurisdictions doing the same thing. The audits would have to either be cheap and toothless or impossibly expensive, or, given the dozens of jurisdictions eventually doing these, probably both and other combinations besides. One can only imagine the nightmare of this jurisdiction deciding this bit of data is private, some other jurisdiction deciding it's mandatory to keep (e.g., "you must record this user's legal identity in order to ensure that future data you may receive is also deleted"), and yet a third jurisdiction deciding that it must be deleted but if and only if the user explicitly asks for it in the request. It won't take much for (real) compliance to exceed what even the big tech companies could afford.

At least something like the EU legislating this covers a significant fraction of the world economy in one go.

Most jurisdictions copy the main tenets* from each other, to make it easier for actors to enforce in their region - i.e. GDPR -> CCPA.

tenets, not tenants

You've obviously never dealt with the EU privacy machinery. There is a separate privacy directorate in every single EU country. There is also a privacy group at the EU level. These groups _fight_with_each_other_...the EU level authority recently forced Ireland's DPA to fine Facebook despite the Irish authorities initially finding no enforceable infringement.

I get that everyone dislikes Facebook, but this is not a stable regulatory regime to do business in, nor is it covering all EU member countries "in one go".

Fair enough. It is true that I was being a bit idealistic for sure.

The sad reality is probably that there is no solution to this. If one imagines that the regulatory apparatus for some operation requires some percentage of the complexity and velocity of the underlying thing being regulated, well, government can manage the requisite complexity probably (though getting the correct complexity is another matter), but the velocity is just never going to happen, and the attempts are just going to look like this. By the time this is pushed through California, the actual regulations written to comply with the law as passed by the legislature, and enforcement actions begin, it will already not know what to do with things like AIs using personal information or complicated cross-company AI-based data washing schemes ("we use AIs to transfer summary data about the individuals in a complicated manner that makes it look like all the data is anonymized but in practice the data is so rich in its own complicated manner that the receiving company is de facto operating on private information but good luck proving that in a court of law, have fun with this one regulators!", etc.).

I was wondering if a “chain of custody” law for personal information can make this enforceable.

You can request your personal information from a holder of it, and along with that comes the identity of where/when/who that data was acquired from (and transitively who they got it from).

Then you can tell who sold it, both to gauge violations and also to name and shame.

And if they don’t have the chain of custody, then they are immediately in violation, and it is easily proven.

I think this is a pretty common problem with any kind of business regulation -- how do I know that a factory isn't just illegally dumping its waste? Regulators are usually working with less complete knowledge than the entities they regulate. You'd have to set up penalties large enough that the risks weren't worth it, but that ironically works better with larger companies since fly-by-night operations are free to just shut down and don't care that much about their reputations.

It sounds like a recipe for enforcement by lawsuit, which is similar to the ADA for example.

In order to enforce by lawsuit, the people who have standing to sue (or a regulator acting on their behalf) need to somehow know that an organization is out of compliance.

For the ADA, you can see whether there's enough parking spaces or whether the ramp is legal or whether you were denied a reasonable accommodation.

Here, there's a mandatory audit mechanism, but it's unclear whether the proper recordkeeping will be required to really allow issues to be spotted at audit.

Is there any way to know if any audit mechanism works before it's actually been put into practice?

I share your concerns, but it seems a bit early to worry that auditing + lawsuit enforcement isn't worth giving a spin.

Do we have examples of similar legislation that has or hasn't been successful with similar contexts/enforcement? The closest examples I can think of are in finance, like fair lending laws or SOX compliance; both of which are heavily dependent on auditing data.

As a sibling commenter puts out, a uniform deletion "certificate" or other notice that could be used as verification of requests would be useful to ensure that audits would have a corresponding record to use to determine what records should not be present.

Then, data broker keeps a list of such deletion notices.

If any of those notices ends up having data still stored, that's a violation. If any customer presents such a certificate but isn't in the list of such notices on the data broker, that could be a violation.

This way there's an effective, enforceable mechanism. Otherwise, a broker can just lose deletion requests entirely and no one would know.

It's surprisingly tough to find a lawyer willing to file an ada suit. Most search results are for companies to defend against suits, and my local bar association only had one firm to refer me to that didn't return my calls.

> Most search results are for companies to defend against suits

Attorneys know each other. You could probably ask one of the lawyers who defend against such suits for referrals to lawyers who file such suits.

There are relatively simple ways to enforce this. For instance, requiring companies to register all trackers prior to use. And in that registration process specify all metadata that would be collected. Terms of service for implementing trackers in California could include something along the lines of permitting independent E2E auditing of all trackers and any software linked to it, e.g., software related to personalization and feature creation/selection/optimization.

There could also be something like more comprehensive enforcement of "(meta)data flushing," including a tighter turn-around time to ensure customer data that was supposed to be deleted is actually deleted, at more regular intervals. This would better ensure novelty at the time of model training/fine-tuning. These training logs would be audited as well.

Training data size would decrease. It would also act as a natural guard against data hoarding, which disproportionately benefits huge corporations (e.g., Google, Amazon).

Does it make personalization harder? In some ways yes. It also challenges us to invent solutions more sophisticated than "just feed the model more data."

One popular (and somewhat successful) legislative strategy is to create a 'private right of action' whereby an injured party can sue an offending one easily by meeting a specific burden of proof - eg if you file a complaint with a data broker and the data is not removed within a defined reasonable period, you can go to court armed with a rebuttable presumption of the broker's liability and claim some statutorily specified amount of compensation. A well-known example would be violations of the Americans with Disabilities Act.

The comparison to the ADA is a good one, but it also illustrates the issue of how verifiable the remedies are. It's much easier to prove whether a business has a ramp than that they deleted some piece of data from all of their servers everywhere

I think it will be based on availability rather than verification of deletion, but I'm just guessing.

I wonder if some sort of "do not call"-style list that the government keeps would do the trick? The government maintains the list so some company can't say, "We never received any notice from them!" and the government can also audit whether each person on the list has data associated with them in any given company's database. The government would have to audit companies when a consumer contacts them (or just do it periodically for all companies, if that's feasible).

I think the bigger problem is how does a consumer know whether any random company has data on them? I mean, sure, I can figure that Google, Amazon, and Meta probably would be on that list, but the real problem is all the smaller 3rd party resellers of such data. I don't even know their names, let alone how I would figure out if they have info on me.

It would not work. Not enough people would use it, for myriad reasons.

The real answer is privacy by default. Opt-in for invasive harvesting. The science of design is well enough known that we could even legislate against dark patterns if we wanted to.

Easy way to enforce is to give anyone who reports a breach and provides evidence half of the fine. People will be constantly trying to buy data from the broker that they aren't supposed to have to get the reward. And any time they find something, it's payday.

Random audits in data brokers' data centers?

Software on consumers' devices that records ads seen and file complaints if consumers are still being tracked? It's very easy to detect algorithmically that you're being shown personalized ads.

> I don't know of any good way to enforce this kind of legislation, even if I totally support it.

What the EU does with GDPR is put a huge fine on actors caught ignoring GDPR deletion requests. It's up to €20m or 4% of the companies global turnover, whichever hurts the most.

And how many of those fines have been levied _and_ paid so far?

If it's any consolation, it look GDPR 7(-ish) years to make a difference. Hang in there!

Yeah, all those annoying "we use cookies" pop-ups are inspiring

You're welcome to blame the people putting those pop-ups there, not GDPR.

OK but why should I? If you think this is chauvinistic think of how California set out to root out a bunch of carcinogens and ended up assuring that every second thing I buy has a warning that it might cause cancer with no real way for me to determine how seriously I should take it.

This is at least the billionth time it’s been pointed out, but the GDPR is not responsible for those annoying pop-ups. The GDPR is erroneously blamed for them, when in reality, the pop-ups are a deliberate choice made by site operators. Feel free to brush up on the GDPR, the EPD, and how they work together: https://gdpr.eu/cookies/

I don't think the GP is suggesting that the GDPR mandated those shitty popups, I think they're upset that the GDPR allowed them. They're basically a massive loophole. Of course the site operators are to blame for their individual popups.

That's without addressing the fact that the EPD is what triggered them.

The GDPR is very much responsible. They exist solely because of the GDPR.

And you don’t just “brush up” on an 11 chapter 99 section law.

I'm looking at this page and it seems like the annoying pop-ups are a way to comply with the regulations as described, so I'm not sure why you think I'm being unfair attributing them to the GDPR. That might not be the vision they had in mind when they drafted the law but it is the actual result.

The website you linked to itself has a cookie banner. One that says they'll assume I consented if I continue to use the site.

Reply on news.ycombinator.com