Google weeps as its home state of California passes its own GDPR

I seriously hope that's $7,500 per person else Google, Facebook etc will be breaking the law every day and not notice it on the bank balance.

Easy Enough

Requests immediate deletion of all records.

49 to go

Mr. Mactaggart, please come to Texas. And every other damned state. And please add a small amendment to your bill that excludes these protections for any Congressmen or Senator who takes money from lobbyists affiliated with data collection companies.

> "We think there's a set of ramifications that's really difficult to understand," said a Google spokesperson

Erm... no, it's not difficult to understand. You just don't want to listen, but it's not difficult to understand at all.

> adding: "Complying with the law needs to be thoughtfully balanced against legitimate business needs."

Ok, he didn't say exactly that, but that was the gist of it.

Good

Fuck Google and all the other spy companies. Now, here's hoping that other states will do similar things.

From the article:

Of course, Google, Facebook et al are going to spend the next decade doing everything they can trying to unravel it. And as we saw just last week, lawmakers are only too willing to do the bidding of large corporate donors. But it is much harder to put a genie back in the bottle than it is to stop it getting out. ®

Also, trying to reverse this will always, always look incredibly slimy. Even mentioning it would be a very blatant public admission.

Personally speaking I find it hilarious how this has come about. The hilarity is the speed with which it's happened, and in a country which looked like it would be the last place on earth for this to happen. Well CA, welcome to the club.

There's been a variety of warning signs over the past years that the ad funded data slurping business model was on shaky ground, especially in Europe. Well, they've had plenty of time to consider their business model lest some legislative catastrophe smite them from an unexpected angle. And so it's happened.

If they don't start taking the risk to their continued profitability seriously, their shareholders are quite rightly going to be furious. And they may see an extinction of their business (Facebook), or a severe curtailment of their revenue (Google). I've been saying for a while now that the companies should take a brave pill and just conduct business in a normal way; charge for their services. Microsoft seem to do quite well by that (selling O365). Why can't Google or Facebook charge too? Are they afraid that no one will buy them?

And that's the problem. Google's search, maps, perhaps gmail are useful services for which Google could probably get away with charging $5 / year. I'd pay that, possibly even a bit more, but it'd better be slurp free. But Facebook? SnapChat? WhatsApp? Instagram? A lot of these are of dubious appeal, especially as they all do basically similar things. A lot of these are going to fall by the wayside.

The problem that would then arise is that Google and WhatsApp would become actual monopolies, the last ones left standing, followed by regulation, followed then by enforced open standards, and a break up of the companies, just as happened to the telecoms industry all those decade ago. If this happens, it's a disaster for today's shareholders. Also if today's new law leads to the decline of the companies and the burning up of their cash piles to stay in business / maintain share price, one day there's going to be nothing left.

Sell. Fast.

Tears

The tears are real because a couple of well crafted state laws can become the basis of a federal law. It takes a couple of states to start the ball rolling. The real risk for Suck and Chocolate Factory is they could end with 50 similar but different enough laws to make get sales taxes correct look trivial. If they had any functioning grey matter they need to take CA law and have it become the federal toot suit. But that assumes intelligence.

About California's initiative process

Until 1911, California's venal legislature was fully in the pockets of the Big 4 (Huntington, Crocker, Hopkins and Stanford, yes, that Stanford). They controlled the Southern Pacific Railroad, and were not shy of abusing their monopoly to extract rents from Californians (most of the markets for agricultural produce were on the East Coast, which meant Southern Pacific could charge pretty much whatever it wanted).

In 1911, Hiram Johnson, a Progressive governor was elected, with a mandate to reform the corrupt legislature. He did that by creating the initiative, referendum and recall processes that give California an unusual level of democracy for the US. In this case the initiative process is working exactly as intended, allowing the people to prevail over entrenched interests that captured the legislature.

Of course, the lobbies adapted and learned to abuse the initiative process for their own ends, as the sugary-drinks lobby is using the same tactic to blackmail the legislature into preempting city soda taxes like Berkeley or San Francisco's.

Interesting

The number of comments from USAains on GDPR along the lines of "fuck the EU, block the EU, hah, try and fine us EU" was quite astounding just days ago. (Not all USAians, obviously!!)

My response to them was that GDPR will likely become a model for other countries to follow and eventually the USA would have to follow suit. Little did I realise that it could happen so rapidly and (part of) the USA would be the first to follow where the EU leads! ;-)

Translation

"User privacy needs to be thoughtfully balanced against legitimate business needs."

-->

"Noooooooooooooooooooooo! No no no! Please, leave us alone! We're f****d without your personal data to whore out! Just let us carry on making loads of money"

Sensational!

you'll be amazed to hear why the privacy law passed so fast

Tactic copied from the Daily Mail

Click Bait?

Now for gun laws?

Could get interesting..

"User privacy needs to be thoughtfully balanced against legitimate business needs."

"User privacy needs to be subservient to business needs."

As it should be.

We are Borg.

Resistance is Fut>KZERRRRT<

Cat out of the bag

As someone who had worked around the Internet for a long time, I think the issue here for the big companies is that people and businesses are going to realise that Internet marketing doesn't work nearly as well as is claimed. I even think they would rather take the hit on Cambridge analytics to maintain the lie. A small number of people will click and buy it, even if it's a political message but most of us won't, but don't tell the people paying by the click!

Google is known to cause cancer by the state of California...

10chars

CA leading the way?

Before you open that (CA) champagne, note that the current administration is hell bent on eliminating things like the CA emissions standards. And with the recent resignation from SCOTUS, they'll have the power to do it. Say goodbye to regulation of pollution, data-whoring, gerrymandering, purging voter rolls, etc.

"that's really difficult to understand"

according to the recent Norwegian report, the above Google statement best describes how Google explains GDPR options to their users, crocodile tears, etc.:

https://fil.forbrukerradet.no/wp-content/uploads/2018/06/2018-06-27-deceived-by-design-final.pdf

(via bloomberg:

https://www.bloomberg.com/view/articles/2018-06-29/facebook-and-google-exploit-loopholes-in-eu-s-data-privacy-rules)

Excluded

Any company that holds data on more than 50,000 people is subject to the law, and each violation carries a hefty $7,500 fine.

I guess that leaves the IBM HR department out then...

Sill Alert!

I see that almost every single post lauding this new law or dissing the data slurpers has at least one, usually 2 downvotes, but there are no post opposing the law. I wonder who s/he works for and why they are afraid of putting up an argument?

I find it ironic...

I am grateful for the hard work and perfectly executed initiative that Alastair Mactaggart and his crew was able to get pushed through and I can only hope the rest of the US follows this example.

The usual suspects put up a fuss of course (AT&T, ConCast, Google, Faceborg)

but realizing if they fought it at this level it could get worse for them

I did a quick search to find where I may be able to assist and/or donate to the cause and found:

https://www.caprivacy.org/about-us

It just goes to show you just how bad things are that when I went to the donation page on that site uMatrix alerted me of some Facebook activity.

I find it ironic that the Facebook Pixel was embedded in there too.

Hmmm

Business needs (read profits) NEVER TRUMP (sorry no pun intended here) citizens right to privacy! Wake up corporate America or you will wake up one morning to find we the people have revoked your corporate charter! "Corporations" have no Constitutional right to exist. Therefore corporations are both created and terminated at the will and please of the people. This idiotic notion held by corporate CEO's the world over that somehow or another it is the other way around is going to spell the end of many evil, vile and essentially undesirable corporate entities in America. Google/Facebook/Youtube, Microsoft etc, you have been repeated warned. Put another way; you need America, but the American people most emphatically do not need the likes of you...................

Why did McTaggart drop it?

I think that must be the question of the forthcoming election; apparently he dropped it because he doesn't think that he could certainly win the ballot measure. I understand that, but it is that lack of guts that will kill us all in November.

"We think there's a set of ramifications that's really difficult to understand," said a Google spokesperson, adding: "User privacy needs to be thoughtfully balanced against legitimate business needs."

Yeah, really hard for them, perhaps.

Whose business is that, then?

Come to think of it, there is no need for any balance at all, really. Privacy could be 100%, and it would be just be fine by me.

Fascinating article, and very well written, thank you.

More of the same

" that consumers – and especially Californians who tend to be more tech-savvy than the rest of the country given the concentration of tech companies in the state – understand the issues around data privacy rules..." More arrogant, self-centered posturing from the Reg's blatant ego on the US west coast. I'd like to see your data which supports your assertion. Otherwise, stop the self superiority labeling.

"California's unusual ballot measure system"

Not *that* unusual-- roughly half the US has systems like it: http://www.ncsl.org/research/elections-and-campaigns/chart-of-the-initiative-states.aspx

Now if it could only grow and be applied and enforced to hamper fed.gov spying and data collection too (countless .gov alphabet orgs, including the NSA and FBI, which typically ignore the law and U.S. Bill of Rights regardless). After all, we are all forced to be government "consumers" too!

Data transfer

I don't use FB and many young people don't use it because they don't want to be on the same site as their parents. This is why FB tries to grab them with instagram and whats app - also to expand into different countries to compensate for a shrinking base.

How long before FB says, most of our members are now in the southern hemisphere so let's move our data storage down there?

Quid pro quo

You really need to read the actual bill https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180AB375

A few things stand out to me:

1) The fines and penalties are weak:

(a) Class action suits can be raised for civil action and the fines are for $100 - $750 or ACTUAL damages per consumer per incident. Proving damages is not so easy and in the instances of data breach it can be very difficult unless you can show that a breach caused your identity to be stolen and used to cause you harm.

(b) In order to be liable for the $7500 penalty the business must INTENTIONALLY violate the law - good luck proving that... Negligence doesn't even play into this!

2) This entire effort was to rush a bill through in order to get a ballot measure off the ballot. You see if the ballot measure was pushed forward then legislators would be hamstrung because if Californians vote and pass a bill it is law and legislators have a very difficult time changing a measure the public voted into law. The https://www.caprivacy.org/ was pushing for a ballot measure and the giant Silly Valley companies pressures legislators to broker a deal to get this ballot measure stopped by passing something fast. The new law, which doesn't even go into effect until 2020, has an explicit section 1798.198. (b) requiring the ballot measure be dropped.

3) Government, NPOs, political campaigns, and the like are completely protected... Hmm, I wonder why that is. Essentially, if you are using this data to get re-elected or to manipulate voters then you are not governed by this shat law.

This bill has all sorts of shortcomings and does little to actually protect the consumer. In fact, if you opt out of data collection the company providing the services can charge you for the services based on what they can make off selling your data. There are all sorts of carve outs if you “Pseudonymize" or de-identify data, keep in mind this is exactly where tech companies are going. If they separate your "personal" data from behavioral data and make it difficult for anyone without deep knowledge and access to the data schema to tie the elements back together then they are good to go and protected. Sure that helps in the event that data is breached but I think the real issue is how are we being manipulated or influenced to make decisions we would otherwise not make. The goal is to be fully informed and transparent not fully duped and deceived. How can we trust that the results we see in a search are not manipulated if we don't know the algorithm used to display the results? Why can't we control what data is or isn't collected about our use of devices, applications, the internet? How do I gain better control of my information and usage patterns without transparency?

What do you think about the actual law? What should be required of businesses that watch our every move so they can sell "marketing" information. What obligation do they have to protect their end points and other various data compromise threat vectors? Should they require solutions like https://drivestrike.com BitLocker FDE Biometric Security

Should they be required to tell us how the data could be used to harm us?