2 ms·
> Which is why it's so important to hold companies that screw it up accountable. That's the only way to get it to change. Forget about everything else, accounta
by BinaryIdiot 9y ago
> Which is why it's so important to hold companies that screw it up accountable. That's the only way to get it to change. Forget about everything else, accountability will force new rules for data storage and protection. Without accountability, nothing will change.
Sure but everyone on HN suggests accountability but never defines what they mean by it except for the few who think someone should just be thrown in jail.
So, what do you suggest for accountability?
- bluejekyll 9y agoI'm not sure it means jail time. It does need to be substantive. Holding the CEO, CTO and CSO directly accountable is a start. But I think it needs to be company wide. It needs to be punitive damage to the company and its shareholders. The risk of mishandling PII and similar data needs to outway the benefit (that may differ per type of PII). At that point it would be my theory that consolidation around best practices, software, security audits... would become the norm. It would raise the cost of a company taking on the responsibility itself, that they'd rely on others to reduce the cost through volume. It would probably start looking a lot like PCI and credit card co. Requirements. The big difference here being that there isn't an industry body responsible, but the government, which would always be political and probably not have enough teeth.