3 ms·
This is how the civil legal system is supposed to function. There needs to be some very large class action lawsuits brought against these companies, and huge aw
by bparsons 9y ago
This is how the civil legal system is supposed to function. There needs to be some very large class action lawsuits brought against these companies, and huge awards need to be extracted in order increase the financial risk of having shitty infosec.
- koheripbal 9y agoFor PCI Compliance purposes, at least, holding user credit card information is already seen as a liability because maintaining compliance is a cost center. That's why there's been some shift towards tokenizing transactions on the fly and directly submitting to the CC company via javascript so that shopping websites never see your CC number even when you enter it on their website - even if you're scheduling future payments. Maybe we should include other data elements under PCI or similar regulations. SSN? I imagine HIPAA has similar requirements and associated costs.
- bparsons 9y agoEven just a fragment of someone's personal information can be combined with other data points in order to commit identity theft. Other impacts may not have direct monetary damages, but could be even more devastating (ie Ashley Madison). Until the courts start clamping down on negligent handling of personal data, firms will continue to cheap out on infosec.