4 ms·
Tell them that data breaches will be a thing of the past if they pass two laws: 1. Criminalize moving PII out of the country. 2. Personal liability for every p
by wang_li 9y ago
Tell them that data breaches will be a thing of the past if they pass two laws:
1. Criminalize moving PII out of the country.
2. Personal liability for every person involved in gathering and protecting the data, and those involved in managing the teams and companies.
The fact that people can get paid while externalizing the downsides of their failures is why this is a problem. Make the personally responsible and it goes away.
- deleted 9y ago[deleted]
- jstanley 9y agoWhat's the point of "Criminalize moving PII out of the country" ? Most of the risk comes from people who are already inside your country, or from people who break into your servers and therefore won't care about moving it outside your country.
- wang_li 9y agoPoint 2 becomes meaningless if a company can just move their operations off shore while fully operating in your country.
- jsmthrowaway 9y ago> 1. Criminalize moving PII out of the country. Please, please, don't. This forces global-scale operations to build computing in a number of places around the world to comply. National boundaries are meaningless on the Internet, and we already have enough of those jurisdictions in existence that doing global-scale operations with PII or even GIS data is an international legal minefield. Do you really want to suppress startup development by forcing global services to talk to 200+ different lawyers about what they're doing, in the long term? I've worked on products where entire datacenters are forced to exist in order to comply with a law somewhere. Like this law, which I bet you didn't even know existed: https://www.quora.com/Why-is-Google-Maps-unavailable-in-South-Korea-whereas-it-is-available-in-the-North https://www.quora.com/Why-is-Google-Maps-unavailable-in-Sout...
- DannyB2 9y ago> Personal liability for every person involved in gathering and protecting the data I think it should only be the business that incurs the penalty. That way it is the business that is motivated to sufficiently train and oversee the employees. Otherwise, you have employees on the hook, with employers incentivized to make them take shortcuts.
- ars 9y ago> Personal liability for every person involved in gathering and protecting the data So basically you want a law requiring all employees to hide any evidence of a breach? It reminds me of the law requiring all TV's to be quietly dropped of at night at a random neighbor, because it's no longer legal to throw them away, and the legal methods are expensive and inconvenient.
- thrownaway954 9y agoYou are out of your mind. Please just stop and think about what you are saying before posting. You essentially want to go to prison for something your co-worker overlooked.