4 ms·

The laws around PII breaches due to carelessness are largely nonexistent in the US. Laws around insider trading have had more than a century to develop their po

The laws around PII breaches due to carelessness are largely nonexistent in the US. Laws around insider trading have had more than a century to develop their pointy end.

craftyguy 9y ago
Well that's a problem. PII breaches should have pointed ends as pointed, if not more, than insider trading.
- ars 9y ago
  That's really hard to do. PII breaches are virtually always by mistake (irrelevant if that mistake is negligence). Insider trading is intentional. You can't really legislate serious penalties for mistakes, and negligence is really really hard to prove.
  - craftyguy 9y ago
    > You can't really legislate serious penalties for mistakes, and negligence is really really hard to prove. You can legislate serious penalties for negligence, of which a great number of PII breaches would, IMHO, be candidates for.
  - theptip 9y ago
    The EU already has legislated serious penalties for data breaches, and AFAIK whether it was a "mistake" or negligence is irrelevant: https://en.wikipedia.org/wiki/General_Data_Protection_Regulation#Data_breaches https://en.wikipedia.org/wiki/General_Data_Protection_Regula... The US doesn't seem to have much appetite for this kind of regulation though.
    - DoofusOfDeath 9y ago
      It's worth distinguishing the US congress and executive branch from the US citizenry, in cases like this.
      - theptip 9y ago
        Very true. I'd be interested to know how this issue polls in the US, I haven't seen any data on that.
  - rosser 9y ago
    Negligence is not "really really hard to prove". In the US, negligence as a tort is a four-pronged test. In the case of Equifax, did they have a duty to protect your PII? Did they breach that duty? Was that breach the proximate cause of your PII being disclosed? Did that disclosure result in an injury?
- QAPereo 9y ago
  Absolutely, and there needs to be a statutory value placed on PII so that the Equifaxes of the world will have to be insured, and insurers will perform due diligence. Until then...
chatmasta 9y ago
I think `downrightmike was referencing the alleged insider trading at equifax around the PII breach, not the PII breach itself. Some top executives unloaded stock just before the breach was revealed. So you're both referring to insider trading laws. Honestly the two situations seem very similar. One is a vulnerability leading to PII, the other leading to performance degradation. Both could have negative impact on stock price, and both had executives unloading stock just before their announcement.

The laws around PII breaches due to carelessness are largely nonexistent in the US. Laws around insider trading have had more than a century to develop their pointy end.

craftyguy 9y ago

Well that's a problem. PII breaches should have pointed ends as pointed, if not more, than insider trading.

ars 9y ago
That's really hard to do. PII breaches are virtually always by mistake (irrelevant if that mistake is negligence). Insider trading is intentional. You can't really legislate serious penalties for mistakes, and negligence is really really hard to prove.
- craftyguy 9y ago
  > You can't really legislate serious penalties for mistakes, and negligence is really really hard to prove. You can legislate serious penalties for negligence, of which a great number of PII breaches would, IMHO, be candidates for.
- theptip 9y ago
  The EU already has legislated serious penalties for data breaches, and AFAIK whether it was a "mistake" or negligence is irrelevant: https://en.wikipedia.org/wiki/General_Data_Protection_Regulation#Data_breaches https://en.wikipedia.org/wiki/General_Data_Protection_Regula... The US doesn't seem to have much appetite for this kind of regulation though.
  - DoofusOfDeath 9y ago
    It's worth distinguishing the US congress and executive branch from the US citizenry, in cases like this.
    - theptip 9y ago
      Very true. I'd be interested to know how this issue polls in the US, I haven't seen any data on that.
- rosser 9y ago
  Negligence is not "really really hard to prove". In the US, negligence as a tort is a four-pronged test. In the case of Equifax, did they have a duty to protect your PII? Did they breach that duty? Was that breach the proximate cause of your PII being disclosed? Did that disclosure result in an injury?
QAPereo 9y ago
Absolutely, and there needs to be a statutory value placed on PII so that the Equifaxes of the world will have to be insured, and insurers will perform due diligence. Until then...

chatmasta 9y ago

I think `downrightmike was referencing the alleged insider trading at equifax around the PII breach, not the PII breach itself. Some top executives unloaded stock just before the breach was revealed. So you're both referring to insider trading laws. Honestly the two situations seem very similar. One is a vulnerability leading to PII, the other leading to performance degradation. Both could have negative impact on stock price, and both had executives unloading stock just before their announcement.