News for hackers. Stuff that matters.
Re:CCPA Will Hit Dev Teams Harder Than GDPR by lxe on Thursday January 31, 2019 @05:48PM (#19049796)
> if a data breach occurs, the law permits consumers to recover up to $750 per incident

This is great!

Re:CCPA Will Hit Dev Teams Harder Than GDPR by kevin_b_er on Thursday January 31, 2019 @06:25PM (#19050078)
Simple, you just add this to clickwrap agreement:

The Parties mutually agree that any and all disputes arising from or relating to this Agreement, including the interpretation or application of this Agreement will be submitted exclusively to final and binding arbitration pursuant to the Federal Arbitration Act. The arbitration will be conducted the state of Delaware or such other location as the Parties may agree, by a single arbitrator in accordance with the substantive laws of the State of Delaware.

Boom. No more pesky California law.

Re:CCPA Will Hit Dev Teams Harder Than GDPR by wahern on Thursday January 31, 2019 @07:32PM (#19050572)
Setting aside potential flaws in your thesis, theoretically the Federal Arbitration Act (FAA) can be circumvented by making the state the real party in interest but permitting a victim to sue and recover on behalf of the state. Because the state wouldn't be a party to any contract (and also because it's a state), the FAA wouldn't apply.

California does this for labor violations through it's Private Attorneys General Act (PAGA): https://www.dir.ca.gov/Private-Attorneys-General-Act/Private...

Glancing at the Wikipedia page for CCPA, it's possible that the CCPA is structured similarly--"Companies ... can be ordered in civil class action lawsuits ... subject to an option of the California Attorney General's Office to prosecute the company instead of allowing civil suits to be brought against it."

That said, I don't think California's PAGA has ever been tested vis-a-vis the FAA in the Supreme Court because it was only recently that they decided to strictly apply the FAA to employment contracts.

Re:CCPA Will Hit Dev Teams Harder Than GDPR by neuland on Friday February 01, 2019 @01:23PM (#19056845)
Section 1798.192 covers that:

    Any provision of a contract or agreement of any kind that purports to waive or limit in any way a consumer’s rights under this title, including, but not limited to, any right to a remedy or means of enforcement, shall be deemed contrary to public policy and shall be void and unenforceable
Edit: I suppose that I should say that I'm not a lawyer. This isn't legal advice. And it's completely possible that I have misunderstood this section of the law.
Re:CCPA Will Hit Dev Teams Harder Than GDPR by carbocation on Thursday January 31, 2019 @06:50PM (#19050251)
I dislike how the minute someone mentions a legal hack, the responses are "oh, are you a lawyer?"

Why not consider this reply on its merits?

Re:CCPA Will Hit Dev Teams Harder Than GDPR by jordigh on Thursday January 31, 2019 @06:59PM (#19050305)
Because it is super-risky to consider these things on their own merits if you are not the kind of person who regularly interacts with judges and juries. Laws are something that are applied within a particular kind of, ah, culture. You have to be familiar with the body of work of that culture and how they will likely interpret the law. Trying to interpret laws in ignorance of that culture is likely to lead to interpretations contrary to those with the power to enforce the laws, and land you in a lot of trouble.

In other words, laws aren't code or mathematics. They're not pure exercises of abstract thought to be considered in isolation. Trying to treat them that way is going to lead to trouble.

Re:CCPA Will Hit Dev Teams Harder Than GDPR by carbocation on Thursday January 31, 2019 @07:32PM (#19050570)
Does everyone downvote all medical speculation in the numerous health threads on this site?

No.

It's fine for people to speculate about medical ideas, legal ideas, etc. Especially on a forum like this where there is no pretense that people are offering genuine legal advice.

Re:CCPA Will Hit Dev Teams Harder Than GDPR by skybrian on Thursday January 31, 2019 @07:44PM (#19050637)
Or maybe we should express less confidence in our assertions about medicine?

After all, most of the time, people are writing about things they don't know all that much about.

Re:CCPA Will Hit Dev Teams Harder Than GDPR by carbocation on Thursday January 31, 2019 @07:47PM (#19050652)
To be honest, one or the other should be the case.

Either wild speculation on medicine and law should be fine (this is my position).

Or, people should fear medical speculation as much as they do legal speculation (I think this is the more pathetic option).

[dead]
Re:CCPA Will Hit Dev Teams Harder Than GDPR by dang on Thursday January 31, 2019 @10:58PM (#19051452)
Personal attacks are not ok on HN. I appreciate your concern for the quality of the site, but doing this is one of the worst ways to destroy itt. So if you'd please review https://news.ycombinator.com/newsguidelines.html and follow the rules when posting here, we'd be grateful.

carbocation is right about the underlying point, btw. This is an internet forum, the purpose is good conversation, and speculation is a normal part of conversation. It can of course be dumb and low-information, but it needn't be.

Re:CCPA Will Hit Dev Teams Harder Than GDPR by yowlingcat on Thursday January 31, 2019 @11:33PM (#19051592)
EDIT: Taking the L on this one.
Re:CCPA Will Hit Dev Teams Harder Than GDPR by tptacek on Friday February 01, 2019 @12:34AM (#19051906)
You might take a second to click on 'carbocation's name and see what his background is. I think you've missed some subtext.
Re:CCPA Will Hit Dev Teams Harder Than GDPR by yowlingcat on Friday February 01, 2019 @12:52AM (#19051985)
EDIT: Taking the L on this one.
Re:CCPA Will Hit Dev Teams Harder Than GDPR by ChrisSD on Thursday January 31, 2019 @06:58PM (#19050295)
"Legal hacks" are rarely, if ever, as clever as their proponents think. Scepticism is natural and warranted.

Judges aren't complete morons and will take a dim view of "hacks". There could be loopholes somewhere but you'd need a lawyer to spot them.

Re:CCPA Will Hit Dev Teams Harder Than GDPR by jordigh on Thursday January 31, 2019 @07:06PM (#19050361)
One of the most famous "legal hacks", Richard Stallman's copyleft, had to be rewritten by a lawyer. rms wrote GPLv1 by himself and you should never use it. GPLv2 is the version that was actually vetted by a lawyer.

A similar thing happened with Perl's Artistic License. Its version 2 is basically also a lawyer-approved rewrite.

In other words, hackers, don't try this at home. There are professionals who can do this for you.

Re:CCPA Will Hit Dev Teams Harder Than GDPR by nickpeterson on Thursday January 31, 2019 @07:16PM (#19050448)
I find it somewhat sad that law is basically a guild where arcane language is used to gatekeep what should be a much more straightforward exercise.
Re:CCPA Will Hit Dev Teams Harder Than GDPR by Karrot_Kream on Thursday January 31, 2019 @07:19PM (#19050480)
It's not. It's the equivalent of saying "I can do this better" and producing unreliably, buggy code. Sure you can, but a more experienced professional can point out all the corner cases you missed.
Re:CCPA Will Hit Dev Teams Harder Than GDPR by sbov on Thursday January 31, 2019 @08:05PM (#19050732)
Then when it fails, you blame the programming language rather than your experience in programming.
Re:CCPA Will Hit Dev Teams Harder Than GDPR by jancsika on Thursday January 31, 2019 @07:49PM (#19050667)
I find it somewhat sad that programming is basically a guild where arcane language is used to gatekeep what should be a much more straightforward exercise.
Re:CCPA Will Hit Dev Teams Harder Than GDPR by rhacker on Thursday January 31, 2019 @10:57PM (#19051450)
Hahaha, actually at some point in the future, I suspect 25 years or so, our programming guild will likely have taken over and replace the legal guild.
Re:CCPA Will Hit Dev Teams Harder Than GDPR by majewsky on Friday February 01, 2019 @05:03AM (#19052947)
This would make an interesting entry on http://longbets.org/
Re:CCPA Will Hit Dev Teams Harder Than GDPR by heavenlyblue on Thursday January 31, 2019 @07:33PM (#19050576)
I mean, if you pay attention to the names of the kernel API functions, you'd probably end up with the same conclusion.
Re:CCPA Will Hit Dev Teams Harder Than GDPR by TeMPOraL on Friday February 01, 2019 @05:04AM (#19052961)
Very relevant xkcd: https://xkcd.com/1494/.
Re:CCPA Will Hit Dev Teams Harder Than GDPR by eridius on Thursday January 31, 2019 @07:01PM (#19050318)
Probably because anyone who isn't a lawyer has no hope of considering this reply "on its merits".

My gut feeling is this "legal hack" wouldn't work, because if it did someone would have used it by now against some other law that provides for damages, and someone else would have figured out how to neuter the hack. Which is to say, there's probably an existing law that prevents this hack from working. But you'd need a lawyer to be able to say whether that's true or not.

Re:CCPA Will Hit Dev Teams Harder Than GDPR by ionised on Friday February 01, 2019 @11:39AM (#19055637)
I'd love to see them try this in the EU.
Re:CCPA Will Hit Dev Teams Harder Than GDPR by wilg on Thursday January 31, 2019 @06:45PM (#19050220)
Oh are you a lawyer?
Re:CCPA Will Hit Dev Teams Harder Than GDPR by dbdjfjrjvebd on Friday February 01, 2019 @02:11AM (#19052249)
OP needs to be not just a lawyer, but your lawyer. I.e. someone who is accountable to you if their advice is wrong.
Re:CCPA Will Hit Dev Teams Harder Than GDPR by heavyset_go on Thursday January 31, 2019 @06:41PM (#19050194)
There shouldn't be a cap to liability, this reeks of tort reform-esque legislation.

If my identity gets stolen, there is much more than $750 at stake on my end.

Re:CCPA Will Hit Dev Teams Harder Than GDPR by tzs on Thursday January 31, 2019 @06:47PM (#19050235)
It's up to $750 or actual damages if greater.
Re:CCPA Will Hit Dev Teams Harder Than GDPR by b_tterc_p on Thursday January 31, 2019 @06:31PM (#19050119)
good time to make a bot that signs up for things
Re:CCPA Will Hit Dev Teams Harder Than GDPR by jhanschoo on Thursday January 31, 2019 @11:33PM (#19051595)
Only if you don't value your PII. If you don't use PII in your bot then you can't claim.
Re:CCPA Will Hit Dev Teams Harder Than GDPR by llukas on Thursday January 31, 2019 @05:50PM (#19049810)
"up to"

Are there any guidelines for determining actual compensation?

Re:CCPA Will Hit Dev Teams Harder Than GDPR by Groxx on Thursday January 31, 2019 @06:13PM (#19049997)
The full sentence is this fwiw:

>Additionally, if a data breach occurs, the law permits consumers to recover up to $750 per incident (or actual damages, if greater).

So that might just be $750 as part of a punitive fee.

Re:CCPA Will Hit Dev Teams Harder Than GDPR by tzs on Thursday January 31, 2019 @07:01PM (#19050317)
It sounds more like a statutory damages thing, although note I have not read the law.

The idea with statutory damages is that determining the actual damages can be difficult and uncertain, so some laws allow plaintiffs to elect to ask for damages from a standard range, and the court will decide where damages should fall in that range based. It's basically saying "just give me about what is typical for cases like this one".

Re:CCPA Will Hit Dev Teams Harder Than GDPR by chmod775 on Thursday January 31, 2019 @05:53PM (#19049841)
Presumably it's a scale from

"Leaked (e-mail) adresses"

to

"Leaked nude photographs".

Re:CCPA Will Hit Dev Teams Harder Than GDPR by llukas on Thursday January 31, 2019 @06:03PM (#19049918)
I don't mind my nude photographs. I mind if somebody takes loan in my name and dumb bank would send it to collections.
Re:CCPA Will Hit Dev Teams Harder Than GDPR by jusssi on Friday February 01, 2019 @03:21AM (#19052526)
Someone else might mind your nudes. E.g. your employer, the school your kids go to, the parents of your kids' friends, etc.

At least in the US, rest of the world isn't that shocked of our natural form.

Re:CCPA Will Hit Dev Teams Harder Than GDPR by flakss on Thursday January 31, 2019 @06:23PM (#19050065)
Presumambly the upper end of the scale would be closer to identity theft with total asset loss and fraudulent lines of debt, which is likely would occur if eg google got hacked.
Re:CCPA Will Hit Dev Teams Harder Than GDPR by icoe on Thursday January 31, 2019 @06:05PM (#19049925)
It would be decided in a civil court, most likely.