4 ms·

The financial penalty needs to be in two parts. 1. a cost for losing personal data. 2. a cost per person's data that was stolen. That ensures there is a mini

The financial penalty needs to be in two parts. 1. a cost for losing personal data. 2. a cost per person's data that was stolen. That ensures there is a minimum penalty. Enough to make it CHEAPER to take a lot of security measures, even if you don't have many people's data yet. But also a gigantic penalty for the next Equifax.

ars 9y ago
Be careful of not setting the fine high enough to motivate companies to cover up breaches instead. No one would have known about Equifax if they had not self disclosed. It doesn't even have to be the CEO - if I am the employee who is about to cost my company $$$$, I might just quietly fix it and say nothing.
- jakelazaroff 9y ago
  Covering up data breaches should be straight-up illegal, as in prison time. If I am the employee who is about to cost my company $$$$, I'd much rather report it than risk going away.
  - deleted 9y ago
    [deleted]
  - ars 9y ago
    > Covering up data breaches should be straight-up illegal, as in prison time. Is it also illegal to cause a breach? Do you understand the backwards motivations you are giving people? He can disclose the breach, cause himself (or his co-workers) to risk prison, and cost his company $$$$, which is likely to get people fired. Or, Cover the whole thing up (i.e. quietly fix the bug), and no one will ever know. And if they do find out, he can say "I didn't know anything about a breach, I proactively fixed a bug, I didn't realize someone had taken advantage of the bug" - i.e. he's safe either way.
    - jakelazaroff 9y ago
      There are two separate infractions here that shouldn't be conflated: allowing a data breach to occur, and failing to disclose a breach. As far as I can tell, the perverse incentive you're describing is that the if the penalty for a breach occurring is too harsh, it could lead companies to cover up a breach rather than disclose it. A penalty for failing to disclose a breach would be meant to discourage that, and I don't see how that penalty is itself a perverse incentive. The penalty for a data breach must be harsh enough that it would cost a company more than it would to guard against it. I don't believe that there exists a penalty that satisfies that condition yet is also light enough that a company wouldn't cover up any breaches that occurred.
      - simcop2387 9y ago
        Triple the fines in the event of a coverup would probably help too.
      - irascible 9y ago
        I agree. If my boss instructs me to implement data collection, then the company must be liable for everything that proceeds from there. Full stop. If that is too much of a risk, then companies will have to NOT COLLECT DATA.
  - jimnotgym 9y ago
    Under the European GDPR regs coming in next may it will be illegal not to disclose.
    - toomuchtodo 9y ago
      And GDPR regs apply not only to EU citizens, but also US citizens residing in the EU.
      - zaarn 9y ago
        And to US companies who do business with EU citizens and to the data of US citizens who have business with EU companies Or anything that touches the EU, really.
- freedomben 9y ago
  This is a good point. The higher the penalty, the more incentive we provide for sweeping things under the rug. We have to have a sane balance.
  - JepZ 9y ago
    I understand the problem but I am not sure what a sane balance might be. In general a data breach is something companies want to avoid already.
- electrograv 9y ago
  If we had the will to implement law, this would be laughably easy to solve: A 'checks and balances' approach of [personal criminal liability of the individual] vs [financial liability of the company] would work quite well: Person(s) act to cover up a data breach -> Individual criminal liability -> A long time in federal PRISON. A data breach is disclosed -> Massive FINES on the company (up to and including liquidating and shutting the company down), but no personal liability or criminal charges. So, the only really hard part of this problem is the political will (vs lobbying / powerful people) to implement law at all to address this. Until we start taking privacy and data leaks VERY SERIOUSLY from the perspective of liability, nothing will happen. Sadly, to me this means nothing will happen :(
  - ars 9y ago
    So basically if I disclose a breach I lose my job because my company no longer exists? Vs. Pretend I never saw any breach (how will you prove different?) and have a chance to avoid all penalties?
    - djrogers 9y ago
      This is a very legitimate question if the corporate death penalty is on the table. Maybe a better option would be C-level or VP and above have to go?
    - richardknop 9y ago
      If you disclose a breach you might lose your job as the company might go down (financial liability for the company for losing personal data). But if you try to cover up the breach (pretend you never saw it) then you risk going to jail (personal criminal liability). You get the idea. If the legal system was setup like that, you would be better off disclosing the breach and losing your job rather then risking prison time. You can always find another job.
      - civilitty 9y ago
        No, if you disclose a data breach you get a small part (1-10%) of the total liquidation of the company before it goes out to pay the rest of the claims. Perhaps have some sort of national unemployment insurance for the rest of the employees paid for by another small part of the liquidation.
- slavik81 9y ago
  Have the standard penalty for if a third-party discovers and reports the breach. Reduce the penalty if the breached company finds and discloses it themselves. Increase the penalty if they knew about the breach but did not disclose, and give the difference to the whistleblower.
  - Tomminn 9y ago
    Ha, this would actually totally work.
voidmain 9y ago
This is a bad idea; it just raises the cost of entry for startups unnecessarily. Liability should be in proportion to harm actually done, and harm actually done is in proportion to how much personal data is compromised.

ars 9y ago

Be careful of not setting the fine high enough to motivate companies to cover up breaches instead. No one would have known about Equifax if they had not self disclosed. It doesn't even have to be the CEO - if I am the employee who is about to cost my company $$$$, I might just quietly fix it and say nothing.

jakelazaroff 9y ago
Covering up data breaches should be straight-up illegal, as in prison time. If I am the employee who is about to cost my company $$$$, I'd much rather report it than risk going away.
- deleted 9y ago
  [deleted]
- ars 9y ago
  > Covering up data breaches should be straight-up illegal, as in prison time. Is it also illegal to cause a breach? Do you understand the backwards motivations you are giving people? He can disclose the breach, cause himself (or his co-workers) to risk prison, and cost his company $$$$, which is likely to get people fired. Or, Cover the whole thing up (i.e. quietly fix the bug), and no one will ever know. And if they do find out, he can say "I didn't know anything about a breach, I proactively fixed a bug, I didn't realize someone had taken advantage of the bug" - i.e. he's safe either way.
  - jakelazaroff 9y ago
    There are two separate infractions here that shouldn't be conflated: allowing a data breach to occur, and failing to disclose a breach. As far as I can tell, the perverse incentive you're describing is that the if the penalty for a breach occurring is too harsh, it could lead companies to cover up a breach rather than disclose it. A penalty for failing to disclose a breach would be meant to discourage that, and I don't see how that penalty is itself a perverse incentive. The penalty for a data breach must be harsh enough that it would cost a company more than it would to guard against it. I don't believe that there exists a penalty that satisfies that condition yet is also light enough that a company wouldn't cover up any breaches that occurred.
    - simcop2387 9y ago
      Triple the fines in the event of a coverup would probably help too.
    - irascible 9y ago
      I agree. If my boss instructs me to implement data collection, then the company must be liable for everything that proceeds from there. Full stop. If that is too much of a risk, then companies will have to NOT COLLECT DATA.
- jimnotgym 9y ago
  Under the European GDPR regs coming in next may it will be illegal not to disclose.
  - toomuchtodo 9y ago
    And GDPR regs apply not only to EU citizens, but also US citizens residing in the EU.
    - zaarn 9y ago
      And to US companies who do business with EU citizens and to the data of US citizens who have business with EU companies Or anything that touches the EU, really.
freedomben 9y ago
This is a good point. The higher the penalty, the more incentive we provide for sweeping things under the rug. We have to have a sane balance.
- JepZ 9y ago
  I understand the problem but I am not sure what a sane balance might be. In general a data breach is something companies want to avoid already.
electrograv 9y ago
If we had the will to implement law, this would be laughably easy to solve: A 'checks and balances' approach of [personal criminal liability of the individual] vs [financial liability of the company] would work quite well: Person(s) act to cover up a data breach -> Individual criminal liability -> A long time in federal PRISON. A data breach is disclosed -> Massive FINES on the company (up to and including liquidating and shutting the company down), but no personal liability or criminal charges. So, the only really hard part of this problem is the political will (vs lobbying / powerful people) to implement law at all to address this. Until we start taking privacy and data leaks VERY SERIOUSLY from the perspective of liability, nothing will happen. Sadly, to me this means nothing will happen :(
- ars 9y ago
  So basically if I disclose a breach I lose my job because my company no longer exists? Vs. Pretend I never saw any breach (how will you prove different?) and have a chance to avoid all penalties?
  - djrogers 9y ago
    This is a very legitimate question if the corporate death penalty is on the table. Maybe a better option would be C-level or VP and above have to go?
  - richardknop 9y ago
    If you disclose a breach you might lose your job as the company might go down (financial liability for the company for losing personal data). But if you try to cover up the breach (pretend you never saw it) then you risk going to jail (personal criminal liability). You get the idea. If the legal system was setup like that, you would be better off disclosing the breach and losing your job rather then risking prison time. You can always find another job.
    - civilitty 9y ago
      No, if you disclose a data breach you get a small part (1-10%) of the total liquidation of the company before it goes out to pay the rest of the claims. Perhaps have some sort of national unemployment insurance for the rest of the employees paid for by another small part of the liquidation.
slavik81 9y ago
Have the standard penalty for if a third-party discovers and reports the breach. Reduce the penalty if the breached company finds and discloses it themselves. Increase the penalty if they knew about the breach but did not disclose, and give the difference to the whistleblower.
- Tomminn 9y ago
  Ha, this would actually totally work.

voidmain 9y ago

This is a bad idea; it just raises the cost of entry for startups unnecessarily. Liability should be in proportion to harm actually done, and harm actually done is in proportion to how much personal data is compromised.