4 ms·

I disagree, you're citing an agreement between me and my bank. The bank may have authorized Equifax to store the data, but I did not. The bank was authorized

by yebyen 9y ago

I disagree, you're citing an agreement between me and my bank. The bank may have authorized Equifax to store the data, but I did not. The bank was authorized to share the data (by me), and Equifax was authorized to store the data (by the bank), it is a fine point but it is a fact. So in all of this, the bank is the one who is not in the wrong. I can't say whether Equifax's agreement with the bank provides any clauses to allow for revocation of Equifax rights to store the information about me, but if it does not then I need to go out and find me a new bank with some better lawyers. (I'm saying that a scenario such as this whole series of negligent behavior and events, should trigger one of those clauses.)

protomyth 9y ago
You are going with the assumption that your sharing agreement with the bank has limits that don't really exist. I doubt you will be able to file a case based on the idea that the entity you have allowed your bank to share data with cannot actually store that data. I doubt a court would go along with that.
- yebyen 9y ago
  I'm not arguing that they weren't allowed to store the data. It would be less controversial apparently if I argued that Amazon grants a revokable license to consume the content on Prime Video and it is governed by the click-wrapped Terms of Service. Im not saying they never had a right to store the data, I'm simply saying that it should be revoked. Let's not give them more responsibility and more data, they've already proven repeatedly that they can't handle it.
caseysoftware 9y ago
And when you sign up for [website X], there's never an explicit "and I authorize you to store my data in AWS" and yet that's exactly what happens. You are trying to draw boundaries that don't exist.
- yebyen 9y ago
  They don't need permission to store the identifying personal data about me for some reason (they, Equifax, the entity that I have no direct relationship with...) what was that reason exactly? Medical providers would not store your personally identifying information without permission, even if it was shared with them. You can ask a health care provider to furnish you with your records and delete their copy at any time, if I'm not mistaken. Shouldn't they have some kind of licensing requirement in order to be held accountable for their security practices? Where is the line, that when they cross it, they should lose their accreditation? There isn't one, because there is no such accreditation (not to my knowledge anyway.) It is not reasonable if there are only 3 credit reporting agencies and they do not have any licensing requirements. If I am mistaken about this, please correct me.
  - caseysoftware 9y ago
    I agree that some boundaries, licensing, and potentially security requirements make a ton of sense. I'm cautiously for them. (Only cautiously because the govt can't get their own act together most of the time.) But as of now, those requirements don't apply to them. So acting like they do is distracting at best. Let's figure out ways: a) to know what they have, b) to force them to accept corrections, and c) add major negative consequences if/when they f* up.
    - yebyen 9y ago
      If we can't have reasonable licensing requirements, then we need a "right to be erased" like they have across all of the European states. If 140MM Americans (or even 50MM, let's be reasonable) told Equifax that they wanted to be removed from their database in response to the breach, and Equifax was required to honor those requests, it would be a step in the right direction. That would be enough to put some "fear of God" into the shareholders at the remaining credit reporting agencies, and it does not sound like an unreasonable request at all. Companies going forward would have a disincentive to do business with Equifax, because 1/3 of people are missing from their database. (Instead, we're all permitted to buy more "Credit Freeze and Monitoring" solutions from Equifax, for the low price of $0, plus a low low payment of $10 every time we need to freeze or unfreeze our credit again to access it in the future. So let's dig the hole even deeper!) Citizens that want to have credit would not be incentivized to remove their credit history from all three reporting agencies; as you probably already know, having no credit history is worse than having a bad credit history. Then again, if we allowed that, then what's to stop those hackers from benevolently making the request on behalf of all 140MM people whose information they have appropriated. There is no negative consequence that will incentivize Equifax to do better next time, if the result of this breach and their subsequent bungling of the response, is that they are allowed to continue operating their business without interruption. Take the keys to the car away from the drunk driver. That's step one.

by yebyen 9y ago

protomyth 9y ago

You are going with the assumption that your sharing agreement with the bank has limits that don't really exist. I doubt you will be able to file a case based on the idea that the entity you have allowed your bank to share data with cannot actually store that data. I doubt a court would go along with that.

yebyen 9y ago
I'm not arguing that they weren't allowed to store the data. It would be less controversial apparently if I argued that Amazon grants a revokable license to consume the content on Prime Video and it is governed by the click-wrapped Terms of Service. Im not saying they never had a right to store the data, I'm simply saying that it should be revoked. Let's not give them more responsibility and more data, they've already proven repeatedly that they can't handle it.

caseysoftware 9y ago

And when you sign up for [website X], there's never an explicit "and I authorize you to store my data in AWS" and yet that's exactly what happens. You are trying to draw boundaries that don't exist.

yebyen 9y ago
They don't need permission to store the identifying personal data about me for some reason (they, Equifax, the entity that I have no direct relationship with...) what was that reason exactly? Medical providers would not store your personally identifying information without permission, even if it was shared with them. You can ask a health care provider to furnish you with your records and delete their copy at any time, if I'm not mistaken. Shouldn't they have some kind of licensing requirement in order to be held accountable for their security practices? Where is the line, that when they cross it, they should lose their accreditation? There isn't one, because there is no such accreditation (not to my knowledge anyway.) It is not reasonable if there are only 3 credit reporting agencies and they do not have any licensing requirements. If I am mistaken about this, please correct me.
- caseysoftware 9y ago
  I agree that some boundaries, licensing, and potentially security requirements make a ton of sense. I'm cautiously for them. (Only cautiously because the govt can't get their own act together most of the time.) But as of now, those requirements don't apply to them. So acting like they do is distracting at best. Let's figure out ways: a) to know what they have, b) to force them to accept corrections, and c) add major negative consequences if/when they f* up.
  - yebyen 9y ago
    If we can't have reasonable licensing requirements, then we need a "right to be erased" like they have across all of the European states. If 140MM Americans (or even 50MM, let's be reasonable) told Equifax that they wanted to be removed from their database in response to the breach, and Equifax was required to honor those requests, it would be a step in the right direction. That would be enough to put some "fear of God" into the shareholders at the remaining credit reporting agencies, and it does not sound like an unreasonable request at all. Companies going forward would have a disincentive to do business with Equifax, because 1/3 of people are missing from their database. (Instead, we're all permitted to buy more "Credit Freeze and Monitoring" solutions from Equifax, for the low price of $0, plus a low low payment of $10 every time we need to freeze or unfreeze our credit again to access it in the future. So let's dig the hole even deeper!) Citizens that want to have credit would not be incentivized to remove their credit history from all three reporting agencies; as you probably already know, having no credit history is worse than having a bad credit history. Then again, if we allowed that, then what's to stop those hackers from benevolently making the request on behalf of all 140MM people whose information they have appropriated. There is no negative consequence that will incentivize Equifax to do better next time, if the result of this breach and their subsequent bungling of the response, is that they are allowed to continue operating their business without interruption. Take the keys to the car away from the drunk driver. That's step one.