3 ms·

Hopefully. A few days ago my wife received a letter from OPM saying that some of her data was mixed up in their recent snafu. She received three years of free

by cdubzzz 11y ago

Hopefully. A few days ago my wife received a letter from OPM saying that some of her data was mixed up in their recent snafu. She received three years of free identity fraud monitoring. I believe she now has two of these monitoring services running as a result of data breaches. I also have two from different companies. I'd love to see more serious penalties/compensation for these sorts of breaches.

pc86 11y ago
You are due compensation if you are damaged as a result of the breach. Your data being accessible as part of a breach does not entitle you to damages if nothing actually happens to you.
- cdubzzz 11y ago
  > Your data being accessible as part of a breach does not entitle you to damages if nothing actually happens to you. Why not? This seems like an incredibly unnecessary and near impossible burden on me if anything actually did happen. Let's say five years down the line my identity is stolen and somehow, magically, we know it is because someone had access to my SSN. If my SSN was exposed in two or three different breaches, how do I prove anything?
- Silhouette 11y ago
  Your data being accessible as part of a breach does not entitle you to damages if nothing actually happens to you. The trouble with relying on a compensation principle alone is that invasion of privacy is typically one of the harms you cannot entirely make good retrospectively. A lot of personal data is like Pandora's box: once released, it is out there forever and the data subject is forever at risk of adverse consequences. Not all of those adverse consequences can be quantified in purely economic terms. Financial awards are merely the most pragmatic mechanism we have been able to establish so far to give some form of compensation after the fact. If you've ever been the victim of identity theft, or of a physical crime like burglary, you'll probably understand the sense of violation I am talking about. You'll probably also know that it doesn't go away just because you have a monitoring service on your financials or you changed the locks on your home. Financial compensation for actual damages can't remove the feeling of being vulnerable that haunts you after you've been the victim of such an incident, and so there is also a need for processes and deterrents to reduce the risk of the incident happening in the first place.

by cdubzzz 11y ago

pc86 11y ago

You are due compensation if you are damaged as a result of the breach. Your data being accessible as part of a breach does not entitle you to damages if nothing actually happens to you.

cdubzzz 11y ago
> Your data being accessible as part of a breach does not entitle you to damages if nothing actually happens to you. Why not? This seems like an incredibly unnecessary and near impossible burden on me if anything actually did happen. Let's say five years down the line my identity is stolen and somehow, magically, we know it is because someone had access to my SSN. If my SSN was exposed in two or three different breaches, how do I prove anything?
Silhouette 11y ago
Your data being accessible as part of a breach does not entitle you to damages if nothing actually happens to you. The trouble with relying on a compensation principle alone is that invasion of privacy is typically one of the harms you cannot entirely make good retrospectively. A lot of personal data is like Pandora's box: once released, it is out there forever and the data subject is forever at risk of adverse consequences. Not all of those adverse consequences can be quantified in purely economic terms. Financial awards are merely the most pragmatic mechanism we have been able to establish so far to give some form of compensation after the fact. If you've ever been the victim of identity theft, or of a physical crime like burglary, you'll probably understand the sense of violation I am talking about. You'll probably also know that it doesn't go away just because you have a monitoring service on your financials or you changed the locks on your home. Financial compensation for actual damages can't remove the feeling of being vulnerable that haunts you after you've been the victim of such an incident, and so there is also a need for processes and deterrents to reduce the risk of the incident happening in the first place.