3 ms·

I thought this was an excellent comment with some very strong arguments, good food for thought. So yes, the problem is one here the credit bureaux get to exter

I thought this was an excellent comment with some very strong arguments, good food for thought. So yes, the problem is one here the credit bureaux get to externalize their risk. I was arguing with your rejection of the 'insurance model' for bringing some of those externalities back in house. Your proposal of strict liability is really just a banning of the industry in disguise: without the possibility of insuring away those risks it's not viable to stay in business - an agency is going to get breached even if they are as careful as possible. I don't think the lobby (and it'd be bureaux and lenders lobbying on the same side) would permit that outcome, no matter how strong the political will. It's too far reaching. My response is, insurance doesn't preclude elimination. Those bureaux aren't going anywhere tomorrow. Incremental reform along the lines proposed by whatever grandparent we are both under provides a path to improvement, better risk management for individuals, and it could perhaps ultimately lead to your desired end state of a completely restructured consumer credit market.

vec 9y ago
For the record, I'm not opposed to credit agencies buying data breach insurance on whatever terms they can negotiate. I'm just opposed to the idea that any amount of caution on their part should dissipate their (or their insurer's) legal liability in the event of a breach. I do agree that would probably be a de facto ban on the industry, or at least a radical restructuring thereof. My suspicion is that the industry is actually not a profitable enterprise once all the externalities are properly accounted for. But I'd be happy to be proved wrong, and I'm more than willing to give the industry a chance to figure out a model that works. Edit: Completely off topic, but this is the nicest internet argument I've had in a long time. Thanks, scrumper, for being an excellent debating partner!
- scrumper 9y ago
  > I'm just opposed to the idea that any amount of caution on their part should dissipate their (or their insurer's) legal liability in the event of a breach. Oh then yes we totally agree. If they're prudent, their insurer pays. Otherwise they do. You might be right about the credit reference industry being ultimately unprofitable as a standalone business, but I think there's a lot of arguing to be had about the magnitude of those externalities. That's why we need a law to provide some automatic, per-individual-leaked fine - the insurable risk from way up-thread.
- scrumper 9y ago
  Just saw your edit. Kind of you to say. Right back at ya vec :)

vec 9y ago

For the record, I'm not opposed to credit agencies buying data breach insurance on whatever terms they can negotiate. I'm just opposed to the idea that any amount of caution on their part should dissipate their (or their insurer's) legal liability in the event of a breach. I do agree that would probably be a de facto ban on the industry, or at least a radical restructuring thereof. My suspicion is that the industry is actually not a profitable enterprise once all the externalities are properly accounted for. But I'd be happy to be proved wrong, and I'm more than willing to give the industry a chance to figure out a model that works. Edit: Completely off topic, but this is the nicest internet argument I've had in a long time. Thanks, scrumper, for being an excellent debating partner!

scrumper 9y ago
> I'm just opposed to the idea that any amount of caution on their part should dissipate their (or their insurer's) legal liability in the event of a breach. Oh then yes we totally agree. If they're prudent, their insurer pays. Otherwise they do. You might be right about the credit reference industry being ultimately unprofitable as a standalone business, but I think there's a lot of arguing to be had about the magnitude of those externalities. That's why we need a law to provide some automatic, per-individual-leaked fine - the insurable risk from way up-thread.
scrumper 9y ago
Just saw your edit. Kind of you to say. Right back at ya vec :)