3 ms·

"Data maximisation is the norm" is a big point. Emphasize that. If they are looking for a punitive legislative approach to curb breaches, remind them it's not j

"Data maximisation is the norm" is a big point. Emphasize that. If they are looking for a punitive legislative approach to curb breaches, remind them it's not just the "how", but the "what". Between HIPAA and SOX and the like, they are familiar with the burdens that come with different data types. Hopefully, between differentiating types of data and discouraging storage of data for other (law enforcement?) use, we can just have less data stored in general. At some point, companies should see data as a liability.

Sir_Substance 9y ago
I agree, this is a nice convergence point between non-technical, comprehensibly regulateable and high impact. It's for sure the message I'd like to leave lingering in their mind.
jejeiinnh72828 9y ago
Yes, this last point. I’ve had to get legal involved to stop data nerds from warehousing PII we had no need to even collect in the first place Point out the liability of having information we shouldn’t and that stuff ends really fast Principle of least privilege access. If you don’t need my info, gfy
ryandrake 9y ago
> At some point, companies should see data as a liability. This is key. Currently, there appears to be no business downside to collecting PII, so companies collect as much as they possibly can. If, through regulation or some other means, data became a liability (or at least came with some downside risk) then perhaps companies would become more thoughtful about what they tried to collect and store.
- robinwassen 9y ago
  Seems to differ between companies. We have seen PII as a liability since early on, but more so as we move closer to GDPR. GDPR forces us to justify and be transparent about each data point we collect. This has increased the urgency of cleaning up any non required data points, adding expiration to data and moving data from subcontractors in house. Guess that a lot of companies are in our position.
  - syrrim 9y ago
    GDPR seems to be particular to europe. It might be better to say it differs between countries, rather than companies.
    - robinwassen 9y ago
      GDPR affects any company that has european customers. So a lot of non-EU companies will be affected. Guess it will be harder to enforce when a company does not have an EU sub though.
deleted 9y ago
[deleted]
vec 9y ago
I think this is key. All the conversations we're hearing are about data breaches. In my opinion, that's merely a predictable and unavoidable symptom of data hoarding. We need to move toward a recognition that collecting PII is inherently dangerous. Holding on to PII forever is inherently dangerous. And that's before the not insubstantial privacy risks these databases incur. I worry that any policy that solely concentrates on breaches is just going to lead companies to gamble that they won't be in the relatively small minority of companies that actually get hacked. What can we do to incentivize a CTO not to have a customer database, or failing that to keep her company's database as minimalist as possible, even if she is 100% certain that database will never be stolen?

Sir_Substance 9y ago

I agree, this is a nice convergence point between non-technical, comprehensibly regulateable and high impact. It's for sure the message I'd like to leave lingering in their mind.

jejeiinnh72828 9y ago

Yes, this last point. I’ve had to get legal involved to stop data nerds from warehousing PII we had no need to even collect in the first place Point out the liability of having information we shouldn’t and that stuff ends really fast Principle of least privilege access. If you don’t need my info, gfy

ryandrake 9y ago

> At some point, companies should see data as a liability. This is key. Currently, there appears to be no business downside to collecting PII, so companies collect as much as they possibly can. If, through regulation or some other means, data became a liability (or at least came with some downside risk) then perhaps companies would become more thoughtful about what they tried to collect and store.

robinwassen 9y ago
Seems to differ between companies. We have seen PII as a liability since early on, but more so as we move closer to GDPR. GDPR forces us to justify and be transparent about each data point we collect. This has increased the urgency of cleaning up any non required data points, adding expiration to data and moving data from subcontractors in house. Guess that a lot of companies are in our position.
- syrrim 9y ago
  GDPR seems to be particular to europe. It might be better to say it differs between countries, rather than companies.
  - robinwassen 9y ago
    GDPR affects any company that has european customers. So a lot of non-EU companies will be affected. Guess it will be harder to enforce when a company does not have an EU sub though.

deleted 9y ago

[deleted]

vec 9y ago

I think this is key. All the conversations we're hearing are about data breaches. In my opinion, that's merely a predictable and unavoidable symptom of data hoarding. We need to move toward a recognition that collecting PII is inherently dangerous. Holding on to PII forever is inherently dangerous. And that's before the not insubstantial privacy risks these databases incur. I worry that any policy that solely concentrates on breaches is just going to lead companies to gamble that they won't be in the relatively small minority of companies that actually get hacked. What can we do to incentivize a CTO not to have a customer database, or failing that to keep her company's database as minimalist as possible, even if she is 100% certain that database will never be stolen?