undefined | Better HN

0 pointsnradov3y ago0 comments

Wrong. Under US federal law, Twitter has no legal obligation to protect PII. Internal controls for user data are optional.

https://pro.bloomberglaw.com/brief/data-privacy-laws-in-the-...

To be clear, I am not thrilled with this situation. But even if social networks were legally required to protect PII they would still suffer occasional breaches by advanced persistent threats and state intelligence agencies. Don't post anything important on social media. Just pictures of family vacations and such.

0 comments

weard_beard3y ago

While you may be correct about criminal law, I'm certain this would impact their SOX compliance (https://en.wikipedia.org/wiki/Sarbanes%E2%80%93Oxley_Act) and would put their ability to participate and operate in US securities markets in serious jeopardy.

nradovOP3y ago

Wrong again. That law only covers financial controls. It doesn't address user data.

weard_beard3y ago

SOX compliance has expanded in recent years to cover a gamut of Cybersecurity process and policy. Go look it up. I recently compiled all the documentation necessary for a client I am serving in order to pass. It includes handling of PII, access controls for code repositories and production environments, and tools for ensuring code quality like performing static analysis and mitigating DDOS attacks such as a decent WAF.

nradovOP3y ago

Yes I have looked it up and you obviously have no clue what you're talking about. The law is the law, and regardless of what nonsense some random corporate trainer might have fed you, SOX compliance requirements haven't expanded in recent years. Go read the actual law instead of spreading misinformation.

Some businesses do require their partners to have additional controls on PII handling. But that's purely a business issue and has no relationship to SOX.

1 more reply

MichaelZuo3y ago

Has an SOX compliance case regarding personal information ever been tried in court?

1 more reply

m00x3y ago

Wrong and small minded.

Twitter is an international company with international users, and the law protects the users of that country/legislation.

Under GDPR, and other international laws, PII is legally protected.

Even if you're an American company, you can't disregard laws of other countries if they're going to be using your product.

j / k navigate · click thread line to collapse

0 comments

weard_beard3y ago

nradovOP3y ago

Wrong again. That law only covers financial controls. It doesn't address user data.

weard_beard3y ago

nradovOP3y ago

Some businesses do require their partners to have additional controls on PII handling. But that's purely a business issue and has no relationship to SOX.

1 more reply

MichaelZuo3y ago

Has an SOX compliance case regarding personal information ever been tried in court?

1 more reply

m00x3y ago

Wrong and small minded.

Twitter is an international company with international users, and the law protects the users of that country/legislation.

Under GDPR, and other international laws, PII is legally protected.

Even if you're an American company, you can't disregard laws of other countries if they're going to be using your product.

j / k navigate · click thread line to collapse