12 ms·

"In January 2016, the New York attorney general fined Uber $20,000 for failing to promptly disclose an earlier data breach in 2014." Because you know...20k rea

"In January 2016, the New York attorney general fined Uber $20,000 for failing to promptly disclose an earlier data breach in 2014." Because you know...20k really really hurts for a company like Uber.

mewmew 9y ago
This would have been interesting if GDPR was applied. https://www.gdpr.associates/data-breach-penalties/ https://www.gdpr.associates/data-breach-penalties/ "There will be two levels of fines based on the GDPR. The first is up to €10 million or 2% of the company’s global annual turnover of the previous financial year, whichever is higher. The second is up to €20 million or 4% of the company’s global annual turnover of the previous financial year, whichever is higher. The Parliament had requested for fines to reach €100 million or 5% of the company’s global annual turnover. The agreed fines are the compromise that was reached."
- Scoundreller 9y ago
  > The first is up to €10 million or 2% of the company’s global annual turnover of the previous financial year, whichever is higher. Why do big firms get off easier than the smaller firms?
  - will4274 9y ago
    That's not necessarily the case. Consider two firms one that has $1 billion in revenue and one that has $100 million in revenue. You'd argue that the bigger firm is getting off easier with a $20 million fine vs the smaller firm's $10 million because the fine is 2% instead of 10%. OTOH, consider that the bigger firm is made up of a collection of 10 services, each earning $100 million. The breach is only in one business unit - is the global revenue a fair metric if the breach is not global? It will be interesting to see how this is enforced against giant corporations when (inevitably) some small piece of data is missed on some small service in a business unit nobody at the c level has ever heard of.
  - dannyw 9y ago
    The fines say “up to”. I don’t think a small mom n pop shop will get fined 10 million.
- rbag 9y ago
  Something nice is also the fact that the people impacted by the breach must be told 72 hours max after the company is aware of the hack.
vm 9y ago
Even larger fines seem to draw weak behavior change. The U.S. corporate structure is remarkable in that sense. It shields employees (especially executives who often don't carry out orders) from criminal and financial responsibility for their actions.
- sp527 9y ago
  This is not true. Back when JPM was being fined billions of dollars when the Southern District of NY was after them, they were quaking in their boots internally while at the same time redlining PR efforts to project external calmness. Huge fines do exactly what they’re intended to do. JPM for instance responded by making legitimate operational changes to detect all manner of financial malfeasance within their organization.
untog 9y ago
I recall a story (that I'll probably recount incorrectly) about a daycare business deciding that too many parents were arriving late to pick up their children (meaning that staff had to stay late with the kids), so they instituted a fine for late pickups. The result was that more parents were late. The reason being that the parents effectively considered the fine a "late pickup fee", and one they were more than willing to pay. If the parents were fined a day's daycare fee for being ten minutes late you can bet their attitude would change. I see company fines in the same light - they formalise the process of absolving responsibility and moving on. Just pay the toll and continue to handle your customer data cavalierly.
- gr3yh47 9y ago
  >Just pay the toll especially when the cost of doing the right thing is higher. i mean look at HSBC - laundered trillions of dollars of mega-organized-crime money. for a decade. 400m dollar fine probably isnt even .01% of what they made off that endeavor
  - tedunangst 9y ago
    If HSBC was making profits of $4 trillion, they were also lying on their financial statements.
    - kbenson 9y ago
      If ever you need evidence that people see really large numbers and lose perspective, look to this conversation and how many people completely glossed over the use of trillions instead of billions, a mistake so small it puts HSBC revenue in the realm of well developed nation states...
      - kinkrtyavimoodh 9y ago
        Apparently, when wielding numbers for outrage, the quantitative details are merely a trivial annoyance.
  - 9y ago
dajohnson89 9y ago
more than 100% of their profits?
zitterbewegung 9y ago
The bad PR might hurt more but I would error on the side of caution and say it has little effect. I have talked to drivers and passengers and they are unaware of those things .
HenryBemis 9y ago
What? Uber acted in an unethical manner? Seriously, is anyone surprised? I kinda hope (but not really) that they get hacked again in June 2018 and play the same trick.. us in the EU will have a party on Uber's corpse over GDPR.
- briandear 9y ago
  And then we can go back to getting ripped off by taxis. I’ve lost more money in taxi rip offs than I ever spent on Uber. Other than the sexist nonsense of the CEO, there really is an irrational hatred of Uber. Are many of us secretly moonlighting as cab drivers? Uber’s nonsense is minuscule compared to generations of taxi corruption. This isn’t me excusing Uber but it does seem like many people, especially Europeans have an inordinate amount of glee over anytime AirBnB or Uber get in trouble. Has the hacker ethic really devolved into statism? We should be cheering over disruption of the status quo. Does anyone actually long for the days of getting ripped off by over-regulated and over taxed hotels and taxis? Do you people actually like having government pick winners and losers? Do you actually trust government to do the right thing? Governments have a strong track record of stifling innovation, abridging freedom and giving regulatory handouts to the privileged classes. People here get all kinds of sanctimonious when it comes to patents and copyrights yet seem to fall firmly on the side of the entrenched incumbents when it comes to things like disrupting hotels and taxis. It’s a weird double standard; a hatred of government when they want to prevent people from stealing movies, but a love of government when they want to prop-up taxis and hotels.
  - kenshi 9y ago
    Or maybe it's because people have valid concerns about little things like privacy, ethics, sexism, and the longer term effects of disruption that places more money and power into the hands of companies that are more than willing to overlook whatever regulations they deem are irrelevant. Having those concerns isn't the same as unfailingly supporting incumbents, out of date regulation or a love of government.
  - jayess 9y ago
    > Do you people actually like having government pick winners and losers Yes, many many people do.
beager 9y ago
I bet the statutes define fines the same for any party with some maximum. States could charge a percentage of revenue, cash on hand, valuation, but those are easily fudged to minimize liability.

mewmew 9y ago

This would have been interesting if GDPR was applied. https://www.gdpr.associates/data-breach-penalties/ https://www.gdpr.associates/data-breach-penalties/ "There will be two levels of fines based on the GDPR. The first is up to €10 million or 2% of the company’s global annual turnover of the previous financial year, whichever is higher. The second is up to €20 million or 4% of the company’s global annual turnover of the previous financial year, whichever is higher. The Parliament had requested for fines to reach €100 million or 5% of the company’s global annual turnover. The agreed fines are the compromise that was reached."

Scoundreller 9y ago
> The first is up to €10 million or 2% of the company’s global annual turnover of the previous financial year, whichever is higher. Why do big firms get off easier than the smaller firms?
- will4274 9y ago
  That's not necessarily the case. Consider two firms one that has $1 billion in revenue and one that has $100 million in revenue. You'd argue that the bigger firm is getting off easier with a $20 million fine vs the smaller firm's $10 million because the fine is 2% instead of 10%. OTOH, consider that the bigger firm is made up of a collection of 10 services, each earning $100 million. The breach is only in one business unit - is the global revenue a fair metric if the breach is not global? It will be interesting to see how this is enforced against giant corporations when (inevitably) some small piece of data is missed on some small service in a business unit nobody at the c level has ever heard of.
- dannyw 9y ago
  The fines say “up to”. I don’t think a small mom n pop shop will get fined 10 million.
rbag 9y ago
Something nice is also the fact that the people impacted by the breach must be told 72 hours max after the company is aware of the hack.

vm 9y ago

Even larger fines seem to draw weak behavior change. The U.S. corporate structure is remarkable in that sense. It shields employees (especially executives who often don't carry out orders) from criminal and financial responsibility for their actions.

sp527 9y ago
This is not true. Back when JPM was being fined billions of dollars when the Southern District of NY was after them, they were quaking in their boots internally while at the same time redlining PR efforts to project external calmness. Huge fines do exactly what they’re intended to do. JPM for instance responded by making legitimate operational changes to detect all manner of financial malfeasance within their organization.

untog 9y ago

I recall a story (that I'll probably recount incorrectly) about a daycare business deciding that too many parents were arriving late to pick up their children (meaning that staff had to stay late with the kids), so they instituted a fine for late pickups. The result was that more parents were late. The reason being that the parents effectively considered the fine a "late pickup fee", and one they were more than willing to pay. If the parents were fined a day's daycare fee for being ten minutes late you can bet their attitude would change. I see company fines in the same light - they formalise the process of absolving responsibility and moving on. Just pay the toll and continue to handle your customer data cavalierly.

gr3yh47 9y ago
>Just pay the toll especially when the cost of doing the right thing is higher. i mean look at HSBC - laundered trillions of dollars of mega-organized-crime money. for a decade. 400m dollar fine probably isnt even .01% of what they made off that endeavor
- tedunangst 9y ago
  If HSBC was making profits of $4 trillion, they were also lying on their financial statements.
  - kbenson 9y ago
    If ever you need evidence that people see really large numbers and lose perspective, look to this conversation and how many people completely glossed over the use of trillions instead of billions, a mistake so small it puts HSBC revenue in the realm of well developed nation states...
    - kinkrtyavimoodh 9y ago
      Apparently, when wielding numbers for outrage, the quantitative details are merely a trivial annoyance.
- 9y ago

dajohnson89 9y ago

more than 100% of their profits?

zitterbewegung 9y ago

The bad PR might hurt more but I would error on the side of caution and say it has little effect. I have talked to drivers and passengers and they are unaware of those things .

HenryBemis 9y ago

What? Uber acted in an unethical manner? Seriously, is anyone surprised? I kinda hope (but not really) that they get hacked again in June 2018 and play the same trick.. us in the EU will have a party on Uber's corpse over GDPR.

briandear 9y ago
And then we can go back to getting ripped off by taxis. I’ve lost more money in taxi rip offs than I ever spent on Uber. Other than the sexist nonsense of the CEO, there really is an irrational hatred of Uber. Are many of us secretly moonlighting as cab drivers? Uber’s nonsense is minuscule compared to generations of taxi corruption. This isn’t me excusing Uber but it does seem like many people, especially Europeans have an inordinate amount of glee over anytime AirBnB or Uber get in trouble. Has the hacker ethic really devolved into statism? We should be cheering over disruption of the status quo. Does anyone actually long for the days of getting ripped off by over-regulated and over taxed hotels and taxis? Do you people actually like having government pick winners and losers? Do you actually trust government to do the right thing? Governments have a strong track record of stifling innovation, abridging freedom and giving regulatory handouts to the privileged classes. People here get all kinds of sanctimonious when it comes to patents and copyrights yet seem to fall firmly on the side of the entrenched incumbents when it comes to things like disrupting hotels and taxis. It’s a weird double standard; a hatred of government when they want to prevent people from stealing movies, but a love of government when they want to prop-up taxis and hotels.
- kenshi 9y ago
  Or maybe it's because people have valid concerns about little things like privacy, ethics, sexism, and the longer term effects of disruption that places more money and power into the hands of companies that are more than willing to overlook whatever regulations they deem are irrelevant. Having those concerns isn't the same as unfailingly supporting incumbents, out of date regulation or a love of government.
- jayess 9y ago
  > Do you people actually like having government pick winners and losers Yes, many many people do.

beager 9y ago

I bet the statutes define fines the same for any party with some maximum. States could charge a percentage of revenue, cash on hand, valuation, but those are easily fudged to minimize liability.