8 ms·

This can be fixed by a small change to privacy liability law. Current law requires litigants to show actual economic harm. That is hard to do in cases of iden

This can be fixed by a small change to privacy liability law. Current law requires litigants to show actual economic harm. That is hard to do in cases of identity theft and privacy violations, which is why the OPM case was just dismissed [1]. If this was changed so that a privacy violation could be litigated, companies like Equifax would need to buy insurance against such actions. Alternatively, there could be a new law that any company storing SSN-type data owed some nominal amount (say, $10) to the owner of that data if it is compromised for any reason. Either way, companies that aggregate large amounts of such data would end up buying insurance. No insurance company would sell such policies without due diligence -- they would establish security requirements and pen testing. Consumers are protected by the existence of an actuarially fair insurance policy. not by the (nominal) compensation. Note that Equifax's customers are (primarily) not consumers. Regulations (in the form of liability law reform or nominal compensation) may not be required in industries where companies only hold the data of their own customers, but such companies could cite their insurance policy to convince their customers that they take security seriously. (Now it's always empty words.) [1] https://www.washingtonpost.com/news/powerpost/wp/2017/09/20/federal-court-denies-cash-awards-to-22-million-opm-data-theft-victims/ https://www.washingtonpost.com/news/powerpost/wp/2017/09/20/...

mediocrejoker 9y ago
This sounds like the most efficient solution to me. There is no need (and for many, no desire) for the government to take on the role of tracking citizens. A minor but strategic change in liability law around privacy would shift incentives in the way you describe and suddenly it becomes in the best financial interests of the companies to protect the data. Indeed this is the only kind of incentive they will respond to. Nationalizing the credit industry doesn't really solve any real problems as far as I can tell.
- Frondo 9y ago
  Frankly speaking, if we're going to be tracked (and we are, lots and lots), I want the government as involved as possible, whether through strict regulations or through being the central repository for that information. Maybe do it state-by-state, so long as each state follows some federal guidelines and each state provides a way to interoperate with the rest, and with private businesses that need access to that information, if the feds freak you out. Why? Because I can, in theory, have my say in how the government operates. I can vote, I can submit comments, I can go talk to elected officials, whatever. I have zero recourse when private companies schlep my data around and wreck my life. Voting with your vote is best, but I can't even vote with my dollar with Equifax.
  - turk184 9y ago
    You have too much faith in government--voting has not reined in the rogue elements of the US government. Far from it. $2Trillion budget, black programs, black sites, renditions, and then plenty of run of the mill bullcrap going on, too like IRS targeting groups for political purposes, ATF "gun walking" schemes that backfired, PATRIOT Act, mass surveillance programs, do I need to even go on?
  - blowski 9y ago
    Totally agree with you. I know people who refuse to vote, use doctors, etc, to "prevent the government getting data about them" - but are registered on Facebook, Google, carry a smartphone, etc. I don't understand how people can be so paranoid about the government, and simultaneously so trusting of large corporations.
    - nopzor 9y ago
      I think people who have that view feel that corporations can't arrest you, can't seize your assets, can't restrict your travel, etc etc.
      - ethbro 9y ago
        Let me tell them about two little companies called United Fruit and Standard Fruit... (now Chiquita and Dole respectively)
      - devdas 9y ago
        Like say, the East India Company?
    - jnicholasp 9y ago
      The opposite condition also exists: I don't understand how some people can be so paranoid about large corporations, and so trusting of government. They are both merely human organizations with large powers, and subject to corruption. We should be wary of both of them.
- codemac 9y ago
  You and I have different meanings for the word, efficiency. My definition: the most efficient has the least wasted effort and the maximum productivity. I do not think having individuals & classes going off and suing everyone they can, every company buying piles of insurance against these suits (because how could they reasonably guarantee perfect privacy?) and having insurance providers coming to evaluate each institution... This is only legally efficient, in that it requires the least amount of nuance in law. There's a reason we have public infrastructure and services, and it is for efficiency.
- ethbro 9y ago
  We already have this in the US for another industry: HIPAA for health records. And it generally works pretty well. In the law, the government lays out rough things it wants to see (e.g. access restrictions, auditing logs, etc) + penalties (financial and otherwise) and then lets the industry find a way to meet them. Furthermore, there's a legal distinction between willful and accidental non-compliance. It's absolutely added cost, but generally seems to accomplish its privacy intent.
  - Aloha 9y ago
    No one I know who works with HIPAA would call it a 'good' solution. http://www.medscape.com/viewarticle/810648 http://www.medscape.com/viewarticle/810648
    - mmagin 9y ago
      Unfortunately this link wants me to login.
      - Aloha 9y ago
        https://www.google.com/search?q=Problems+with+HIPAA https://www.google.com/search?q=Problems+with+HIPAA I just googled it, and it was the first result
    - ethbro 9y ago
      What specific components do you think are problematic? I've worked as a developer with health care providers and insurance companies for 5 years, and other than it being annoying as "some regulation exists" no one I've talked to feels it's a bad solution to the problem. Asking industries to be happy about privacy regulation seems an unreasonable goalpost.
    - mikestew 9y ago
      By my quick reading, the majority of that article is spent dismantling the complaints of those at the beginning of the article. In summary, the complainers appear to be either overly cautious, or flat out misinterpret the law. Besides, I’d be willing to bet that those at Equifax would have similar things to say about a comparable credit reporting law, just like how some medical practitioners don’t like HIPAA.
- smnrchrds 9y ago
  The US government is already tracking the financials of its citizens. Even foreign financial institutions are required to report financial activities of all US citizens. Otherwise, they will face heavy sanctions and fines. IRS would not become any more invasive if they are also tasked with maintaining credit histories. They are already as invasive as it can get.
justherefortart 9y ago
Or you could just do what other countries do, regulate it and make it a government function.
- deleted 9y ago
  [deleted]
- pps43 9y ago
  OPM recently demonstrated how well the government can protect the data it collects.
  - awj 9y ago
    So did Equifax, and Target, and Home Depot, and... I don't see the point you're trying to make. If we're going by "who has made the news for hacks lately", the private sector is by far the worse choice.
    - coredog64 9y ago
      OPM can't be sued into oblivion. The federal government gets to decide if you even have standing to sue them. What are the odds that they'll react accordingly?
      - awj 9y ago
        If "being sued into oblivion" is such an existential threat to these corporations, why does this keep happening? Nobody is getting sued into oblivion, so I don't see why that's part of the argument. It's not "suing to destroy a corporation" vs "trying to sue the government", it's "free credit reporting and a BS 'we are REALLY sorry' letter" on both sides. Also, OPM does not get to decide if you have standing to sue them. That's up to parts of the government so far removed from OPM they might as well be a different entity entirely.
    - closeparen 9y ago
      The sentiment that a more regulated or entirely governmental entity would mitigate the risk of compromise is baseless.
aaronhoffman 9y ago
Privacy WRT contracts could also be improved. Why is my payment history shared with any credit company? Perhaps people will slowly choose companies similar to duckduckgo over google.
- sailfast 9y ago
  100% this. Allow consumers to opt-in or out of data sharing with credit bureaus. This at least would make room for alternate models of credit rating / risk that would not centralize this information in a couple of annoying locations.
  - turk184 9y ago
    I don't see why opt-in wouldn't work. You could at least have control over who is amassing all this data on you and change credit agencies in a sort-of marketplace.
Fjolsvith 9y ago
It wouldn't work. Suppose Equifax gets hacked and the data gets out. Would TransUnion then be liable because they also had that data? What if TransUnion subsequently got hacked? Would they be able to argue, "Sorry, your data was already in the public domain," and get out of the liability?
- swsieber 9y ago
  It could work. Just write the law to account for edge cases like that.
- mattnewton 9y ago
  The bigger problem I see is it incentivizes them never to come forward, or to massively downplay an attack. I guess if the damage is small enough and the penalties for nondisclosure astronomical enough (or that pierce the corporate veil), it could still work though.
- scrumper 9y ago
  Why wouldn't they both be liable? The violation is the breach, not the existence of a pice of PII data outside of their firewall.
ascagnel_ 9y ago
Why not establish a formula for theoretical damages from identity theft, and then allow that as a standing for damages?
criddell 9y ago
> any company storing SSN-type data owed some nominal amount (say, $10) to the owner of that data if it is compromised for any reason I think a company should be able to avoid a fine if they disclose breaches immediately and are able to document that they followed best practices. From what I've read about the Equifax breach, they would definitely be found negligent.
- scrumper 9y ago
  Well no, because under jedbrown's scheme the insurance is there to pay the claim. Simple analogy: a homeowner still has to make a claim if their locked, alarmed house is ransacked while they're away. Insurance may subsequently deny the claim if it's shown that the homeowner failed to follow best practices, such as locking doors and windows. In other words, adherence to best practices is a condition of insurance.
  - criddell 9y ago
    Ok, I see it now and I agree. I think negligence or fraud on the part of the company should multiply the penalty and it probably release the insurer from being responsible.
- philipodonnell 9y ago
  That documentation would already be available because they would have prepared it during the insurance underwriting process. And suddenly there would be a much more litigious and powerful entity on the side of protecting consumer data, the insurance company that underwrote the policy. They deny the claim and Equifax suddenly has a lot more problems.
- vec 9y ago
  No, it needs to be strict liability. If an entity is as responsible as possible and still accidentally causes millions of dollars of damage, they've still caused millions of dollars of damage. Some things cannot be done safely, and if entities want to do them anyway they should be prepared to bear the consequences. It may be the case that once all the privacy related externalities are pushed back onto credit reporting agencies then their business model is no longer viable. I, for one, am fine with that outcome. If that's the case then credit reporting agencies were never a net good for society in the first place, and all the regulations are doing is exposing that truth.
moomin 9y ago
You say "this can be fixed", but don't seem to have read the article. Your proposal only speaks to one of a myriad problems a firm like Equifax presents.
danjoc 9y ago
>This can be fixed by a small change to privacy liability law. People in glass houses shouldn't throw rocks. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. This too can be "fixed" with a small change to liability laws.
- imgabe 9y ago
  How is that even remotely similar? If I download a piece of software, then yes, I can expect to take responsibility for verifying it serves my purposes. I never asked Equifax to keep me in their database and send my information to creditors.
  - danjoc 9y ago
    >If I download a piece of software, then yes, I can expect to take responsibility for verifying it serves my purposes. Under current law. Since the Equifax break in, journalists have been demanding legislation to change that, https://www.nytimes.com/2017/09/11/opinion/equifax-accountability-security.html https://www.nytimes.com/2017/09/11/opinion/equifax-accountab... https://www.emptywheel.net/2017/09/14/software-is-a-long-con/ https://www.emptywheel.net/2017/09/14/software-is-a-long-con... >I never asked Equifax to keep me in their database and send my information to creditors. It seems you can't be expected to take responsibility for reading the fine print in your loan agreements. Quite an interesting bit of cognitive dissonance you have there.
    - imgabe 9y ago
      Agreeing to something is not the same as asking for something. Consumers are not the customers for credit bureaus. We tolerate them, but now maybe not.
user5994461 9y ago
Bullshit. The way to stop this is to prohibit using and collecting personal information of citizens without their consent and against their will. In non insane countries, a company doing that would be closed and the perpetrators would go to jail.
- closeparen 9y ago
  Credit reporting is always consensual. In the same way you agree on the interest rate, fees, payment schedule, etc., you agree to a credit pull at the beginning of a loan and reporting on your payments over time. Maybe you feel entitled to be extended a loan without any credit reporting. I, personally, feel entitled to a loan without any interest. But neither of us are going to get what we want.
  - user5994461 9y ago
    I am not American and not living in the USA. I am not subject to any of this contrary to what you think.
    - closeparen 9y ago
      Tell me more about this magical country where there are no repetitional consequences or persistent records when you don't pay your debts. I strongly suspect you are subject to all of this via a state-owned CRA or little to no borrowing activity (also an option in the US).
deleted 9y ago
[deleted]

mediocrejoker 9y ago

This sounds like the most efficient solution to me. There is no need (and for many, no desire) for the government to take on the role of tracking citizens. A minor but strategic change in liability law around privacy would shift incentives in the way you describe and suddenly it becomes in the best financial interests of the companies to protect the data. Indeed this is the only kind of incentive they will respond to. Nationalizing the credit industry doesn't really solve any real problems as far as I can tell.

Frondo 9y ago
Frankly speaking, if we're going to be tracked (and we are, lots and lots), I want the government as involved as possible, whether through strict regulations or through being the central repository for that information. Maybe do it state-by-state, so long as each state follows some federal guidelines and each state provides a way to interoperate with the rest, and with private businesses that need access to that information, if the feds freak you out. Why? Because I can, in theory, have my say in how the government operates. I can vote, I can submit comments, I can go talk to elected officials, whatever. I have zero recourse when private companies schlep my data around and wreck my life. Voting with your vote is best, but I can't even vote with my dollar with Equifax.
- turk184 9y ago
  You have too much faith in government--voting has not reined in the rogue elements of the US government. Far from it. $2Trillion budget, black programs, black sites, renditions, and then plenty of run of the mill bullcrap going on, too like IRS targeting groups for political purposes, ATF "gun walking" schemes that backfired, PATRIOT Act, mass surveillance programs, do I need to even go on?
- blowski 9y ago
  Totally agree with you. I know people who refuse to vote, use doctors, etc, to "prevent the government getting data about them" - but are registered on Facebook, Google, carry a smartphone, etc. I don't understand how people can be so paranoid about the government, and simultaneously so trusting of large corporations.
  - nopzor 9y ago
    I think people who have that view feel that corporations can't arrest you, can't seize your assets, can't restrict your travel, etc etc.
    - ethbro 9y ago
      Let me tell them about two little companies called United Fruit and Standard Fruit... (now Chiquita and Dole respectively)
    - devdas 9y ago
      Like say, the East India Company?
  - jnicholasp 9y ago
    The opposite condition also exists: I don't understand how some people can be so paranoid about large corporations, and so trusting of government. They are both merely human organizations with large powers, and subject to corruption. We should be wary of both of them.
codemac 9y ago
You and I have different meanings for the word, efficiency. My definition: the most efficient has the least wasted effort and the maximum productivity. I do not think having individuals & classes going off and suing everyone they can, every company buying piles of insurance against these suits (because how could they reasonably guarantee perfect privacy?) and having insurance providers coming to evaluate each institution... This is only legally efficient, in that it requires the least amount of nuance in law. There's a reason we have public infrastructure and services, and it is for efficiency.
ethbro 9y ago
We already have this in the US for another industry: HIPAA for health records. And it generally works pretty well. In the law, the government lays out rough things it wants to see (e.g. access restrictions, auditing logs, etc) + penalties (financial and otherwise) and then lets the industry find a way to meet them. Furthermore, there's a legal distinction between willful and accidental non-compliance. It's absolutely added cost, but generally seems to accomplish its privacy intent.
- Aloha 9y ago
  No one I know who works with HIPAA would call it a 'good' solution. http://www.medscape.com/viewarticle/810648 http://www.medscape.com/viewarticle/810648
  - mmagin 9y ago
    Unfortunately this link wants me to login.
    - Aloha 9y ago
      https://www.google.com/search?q=Problems+with+HIPAA https://www.google.com/search?q=Problems+with+HIPAA I just googled it, and it was the first result
  - ethbro 9y ago
    What specific components do you think are problematic? I've worked as a developer with health care providers and insurance companies for 5 years, and other than it being annoying as "some regulation exists" no one I've talked to feels it's a bad solution to the problem. Asking industries to be happy about privacy regulation seems an unreasonable goalpost.
  - mikestew 9y ago
    By my quick reading, the majority of that article is spent dismantling the complaints of those at the beginning of the article. In summary, the complainers appear to be either overly cautious, or flat out misinterpret the law. Besides, I’d be willing to bet that those at Equifax would have similar things to say about a comparable credit reporting law, just like how some medical practitioners don’t like HIPAA.
smnrchrds 9y ago
The US government is already tracking the financials of its citizens. Even foreign financial institutions are required to report financial activities of all US citizens. Otherwise, they will face heavy sanctions and fines. IRS would not become any more invasive if they are also tasked with maintaining credit histories. They are already as invasive as it can get.

justherefortart 9y ago

Or you could just do what other countries do, regulate it and make it a government function.

deleted 9y ago
[deleted]
pps43 9y ago
OPM recently demonstrated how well the government can protect the data it collects.
- awj 9y ago
  So did Equifax, and Target, and Home Depot, and... I don't see the point you're trying to make. If we're going by "who has made the news for hacks lately", the private sector is by far the worse choice.
  - coredog64 9y ago
    OPM can't be sued into oblivion. The federal government gets to decide if you even have standing to sue them. What are the odds that they'll react accordingly?
    - awj 9y ago
      If "being sued into oblivion" is such an existential threat to these corporations, why does this keep happening? Nobody is getting sued into oblivion, so I don't see why that's part of the argument. It's not "suing to destroy a corporation" vs "trying to sue the government", it's "free credit reporting and a BS 'we are REALLY sorry' letter" on both sides. Also, OPM does not get to decide if you have standing to sue them. That's up to parts of the government so far removed from OPM they might as well be a different entity entirely.
  - closeparen 9y ago
    The sentiment that a more regulated or entirely governmental entity would mitigate the risk of compromise is baseless.

aaronhoffman 9y ago

Privacy WRT contracts could also be improved. Why is my payment history shared with any credit company? Perhaps people will slowly choose companies similar to duckduckgo over google.

sailfast 9y ago
100% this. Allow consumers to opt-in or out of data sharing with credit bureaus. This at least would make room for alternate models of credit rating / risk that would not centralize this information in a couple of annoying locations.
- turk184 9y ago
  I don't see why opt-in wouldn't work. You could at least have control over who is amassing all this data on you and change credit agencies in a sort-of marketplace.

Fjolsvith 9y ago

It wouldn't work. Suppose Equifax gets hacked and the data gets out. Would TransUnion then be liable because they also had that data? What if TransUnion subsequently got hacked? Would they be able to argue, "Sorry, your data was already in the public domain," and get out of the liability?

swsieber 9y ago
It could work. Just write the law to account for edge cases like that.
mattnewton 9y ago
The bigger problem I see is it incentivizes them never to come forward, or to massively downplay an attack. I guess if the damage is small enough and the penalties for nondisclosure astronomical enough (or that pierce the corporate veil), it could still work though.
scrumper 9y ago
Why wouldn't they both be liable? The violation is the breach, not the existence of a pice of PII data outside of their firewall.

ascagnel_ 9y ago

Why not establish a formula for theoretical damages from identity theft, and then allow that as a standing for damages?

criddell 9y ago

> any company storing SSN-type data owed some nominal amount (say, $10) to the owner of that data if it is compromised for any reason I think a company should be able to avoid a fine if they disclose breaches immediately and are able to document that they followed best practices. From what I've read about the Equifax breach, they would definitely be found negligent.

scrumper 9y ago
Well no, because under jedbrown's scheme the insurance is there to pay the claim. Simple analogy: a homeowner still has to make a claim if their locked, alarmed house is ransacked while they're away. Insurance may subsequently deny the claim if it's shown that the homeowner failed to follow best practices, such as locking doors and windows. In other words, adherence to best practices is a condition of insurance.
- criddell 9y ago
  Ok, I see it now and I agree. I think negligence or fraud on the part of the company should multiply the penalty and it probably release the insurer from being responsible.
philipodonnell 9y ago
That documentation would already be available because they would have prepared it during the insurance underwriting process. And suddenly there would be a much more litigious and powerful entity on the side of protecting consumer data, the insurance company that underwrote the policy. They deny the claim and Equifax suddenly has a lot more problems.
vec 9y ago
No, it needs to be strict liability. If an entity is as responsible as possible and still accidentally causes millions of dollars of damage, they've still caused millions of dollars of damage. Some things cannot be done safely, and if entities want to do them anyway they should be prepared to bear the consequences. It may be the case that once all the privacy related externalities are pushed back onto credit reporting agencies then their business model is no longer viable. I, for one, am fine with that outcome. If that's the case then credit reporting agencies were never a net good for society in the first place, and all the regulations are doing is exposing that truth.

moomin 9y ago

You say "this can be fixed", but don't seem to have read the article. Your proposal only speaks to one of a myriad problems a firm like Equifax presents.

danjoc 9y ago

>This can be fixed by a small change to privacy liability law. People in glass houses shouldn't throw rocks. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. This too can be "fixed" with a small change to liability laws.

imgabe 9y ago
How is that even remotely similar? If I download a piece of software, then yes, I can expect to take responsibility for verifying it serves my purposes. I never asked Equifax to keep me in their database and send my information to creditors.
- danjoc 9y ago
  >If I download a piece of software, then yes, I can expect to take responsibility for verifying it serves my purposes. Under current law. Since the Equifax break in, journalists have been demanding legislation to change that, https://www.nytimes.com/2017/09/11/opinion/equifax-accountability-security.html https://www.nytimes.com/2017/09/11/opinion/equifax-accountab... https://www.emptywheel.net/2017/09/14/software-is-a-long-con/ https://www.emptywheel.net/2017/09/14/software-is-a-long-con... >I never asked Equifax to keep me in their database and send my information to creditors. It seems you can't be expected to take responsibility for reading the fine print in your loan agreements. Quite an interesting bit of cognitive dissonance you have there.
  - imgabe 9y ago
    Agreeing to something is not the same as asking for something. Consumers are not the customers for credit bureaus. We tolerate them, but now maybe not.

user5994461 9y ago

Bullshit. The way to stop this is to prohibit using and collecting personal information of citizens without their consent and against their will. In non insane countries, a company doing that would be closed and the perpetrators would go to jail.

closeparen 9y ago
Credit reporting is always consensual. In the same way you agree on the interest rate, fees, payment schedule, etc., you agree to a credit pull at the beginning of a loan and reporting on your payments over time. Maybe you feel entitled to be extended a loan without any credit reporting. I, personally, feel entitled to a loan without any interest. But neither of us are going to get what we want.
- user5994461 9y ago
  I am not American and not living in the USA. I am not subject to any of this contrary to what you think.
  - closeparen 9y ago
    Tell me more about this magical country where there are no repetitional consequences or persistent records when you don't pay your debts. I strongly suspect you are subject to all of this via a state-owned CRA or little to no borrowing activity (also an option in the US).

deleted 9y ago

[deleted]