6 ms·

Ok I will be the one to start it. This it's why we needed GDPR. The courts have been totally unwilling to combat this kind of corporate malpractice, assessing

Ok I will be the one to start it. This it's why we needed GDPR. The courts have been totally unwilling to combat this kind of corporate malpractice, assessing the costs of a breach to be puny. My opinion is, if your business is sensitive data then being careless with it should be an existential threat to that business.

lwansbrough 8y ago
We don’t need GDPR. We need sane penalties for data breaches caused by incompetence. The last thing Canada needs is to put ourselves at any more disadvantage with the US market.
- Sharlin 8y ago
  You mean data breaches are fine as long as they’re intentional?
  - iamdave 8y ago
    That's the exact opposite of what they meant and is what Hanlon preaches to us about.
    - wongarsu 8y ago
      If you divide causes into "accidental" and "intentional", and assume "caused by incompetence" belongs into the "accidential" catagory, then the comment "We don’t need [X]. We need sane penalties for [Y] caused by incompetence" can be read as arguing against penalties for intential actions. If they meant the opposite of that, then that's a really weird way to express it.
    - Sharlin 8y ago
      So what did they mean? GDPR is basically what they said, plus that you have to show you have made a meaningful effort to stop data breaches from happening before they happen. Is that bad? Intentional data breach is basically the business model where you sell private information without getting meaningful consent from your users. Do you think that is okay because you need that to stay competitive with US companies?
- simion314 8y ago
  If company does not leak your data but sells it then your law for security breaches are not enough.
- johnnyfaehell 8y ago
  GDPR has sane penalties, that’s why it’s such a big deal. GDPR seems to put the EU in a better position for the US Market since it has better data laws so is more attractive for US customers. The only downside is for companies not in the EU targeting the EU market, either follow the EU law or withdraw from that market. It basically puts the US in a worse position in my opinion.
  - tomnipotent 8y ago
    $10MM minimum penalty is not sane.
    - maxsilver 8y ago
      It's very sane -- For a mistake as large as Equifax, a $10MM penalty is basically a slap on the wrist.
    - mmaurizi 8y ago
      The law states "up to 10,000,000 EUR" which is the opposite of minimum I'd say.
      - s_dev 8y ago
        The law does not state that. It states €10 million or 2% of gross worldwide revenue -- whichever is higher.
        zaarn 8y ago
        Those are still the maximum, the 10 million is still not the minimum. The EU could fine a corporation with 10 billion turnover 10$ but they also could fine up to 200 million $. It doesn't mean they have to fine atleast 10 million once you're over the 2% switchover.
        s_dev 8y ago
        You're missing my point -- what you said the law says and what the laws says are different. You're maximum/minimum argument relates to the guy above your post. That additional option of a 2% figure changes the dynamic of how the fines work completely.
kodablah 8y ago
> This it's why we needed GDPR. The courts have been totally unwilling to combat this kind of corporate malpractice It should come as no surprise that the legislative enforcement arm is unwilling to also. I know you dream of laws like the GDPR working, but it doesn't and neither did its predecessor. Instead of asking for new laws, why are you not asking for enforcement of existing ones? And what makes you think a new law will be magically enforced where current ones aren't?
- craftyguy 8y ago
  What current law are you referring to (in the US..), that makes what Equifax did illegal?
  - kodablah 8y ago
    SEC disclosure timeliness requirements since it affects financial outlook at the very least. If they can't even be heavily punished by public institutions for at least that, how can they be expected to punish when given more breakable rules? Or, as the EU erroneously thought, does the US really believe the lack of punishment is due to legal handcuffs instead of political will, resources, and lobbying? More paper will not magically turn handshakes into arrest warrants.
- deleted 8y ago
  [deleted]
- icebraining 8y ago
  I know you dream of laws like the GDPR working, but it doesn't and neither did its predecessor Didn't it? Maybe I'm biased, but I don't remember breaches like Equifax's or Target's in the EU. I also don't remember the records of 154 million EU voters being exposed. According to this report[1], the "U.S. accounted for 728 of the 974 incidents around the globe in the first half of 2016." They do say part of the difference may be the disclosure laws, but is that all? [1] https://blog.gemalto.com/security/2016/09/20/data-breach-statistics-2016-first-half-results/ https://blog.gemalto.com/security/2016/09/20/data-breach-sta...
IshKebab 8y ago
GDPR is not enough unfortunately to stop the abuses of credit check agencies. As far as I understand it, them sucking up all your data is a legitimate business use, and you do have to give consent for it. What we really need is regulation to limit the amount of information that can be used for credit checks (and insurance premium calculations while we're at it). Actually that is partly done in the UK - e.g. gender cannot be used while calculating car insurance premiums. But sadly they can still ask for your profession, marital status, etc.
- TheCoelacanth 8y ago
  GDPR does not only regulate what data a business can collect. It also has many other provisions that would be relevant in the Equifax data breach. It requires that appropriate security measures be taken to secure any personal data that you collect, which Equifax obviously failed to do. It also requires that data breeches be disclosed within 72 hours of when they are discovered while Equifax took about nine months to do so.
  - mycall 8y ago
    What about the Right to Forget? Can't we ask Equifax to delete all of our information?
    - TheCoelacanth 8y ago
      Right to forget is basically the right to withdraw consent. You can only make them delete things that they needed your consent for in the first place.
      - mikekchar 8y ago
        This is not actually true. The right to withdraw consent, the right to object and the right to be forgotten are all different. In the first and second case, the company has to stop processing the data, but they don't have to remove it. In the last case, they actually have to remove the data. The removal of data has a caveat that the company doesn't have to do it if it would be onerous (but what that means is left up in the air... so we'll have to see some judgements before we know exactly what it means). In the case of Equifax, they are a third-party processor. Under GDPR, you would have to be informed if the processing was necessary under contract basis. Once the contract is finished, you can request that your data is removed and the original processor must inform all third party processors. So Equifax would be required to remove the data. For legitimate interest or consent basis, you can ask to be removed at any time. You don't have the right to be removed wrt data collected for regulatory reasons. I think the key here is that Equifax (being a third party processor) does not have to respond to you if you say "Please remove all of my data". I think you have to go to the original processor (which sucks, because you have to track down how they got your information). I may be wrong about that, though (the company I work for doesn't collect 3rd party info, so I didn't pay much attention to that part of the law).

lwansbrough 8y ago

We don’t need GDPR. We need sane penalties for data breaches caused by incompetence. The last thing Canada needs is to put ourselves at any more disadvantage with the US market.

Sharlin 8y ago
You mean data breaches are fine as long as they’re intentional?
- iamdave 8y ago
  That's the exact opposite of what they meant and is what Hanlon preaches to us about.
  - wongarsu 8y ago
    If you divide causes into "accidental" and "intentional", and assume "caused by incompetence" belongs into the "accidential" catagory, then the comment "We don’t need [X]. We need sane penalties for [Y] caused by incompetence" can be read as arguing against penalties for intential actions. If they meant the opposite of that, then that's a really weird way to express it.
  - Sharlin 8y ago
    So what did they mean? GDPR is basically what they said, plus that you have to show you have made a meaningful effort to stop data breaches from happening before they happen. Is that bad? Intentional data breach is basically the business model where you sell private information without getting meaningful consent from your users. Do you think that is okay because you need that to stay competitive with US companies?
simion314 8y ago
If company does not leak your data but sells it then your law for security breaches are not enough.
johnnyfaehell 8y ago
GDPR has sane penalties, that’s why it’s such a big deal. GDPR seems to put the EU in a better position for the US Market since it has better data laws so is more attractive for US customers. The only downside is for companies not in the EU targeting the EU market, either follow the EU law or withdraw from that market. It basically puts the US in a worse position in my opinion.
- tomnipotent 8y ago
  $10MM minimum penalty is not sane.
  - maxsilver 8y ago
    It's very sane -- For a mistake as large as Equifax, a $10MM penalty is basically a slap on the wrist.
  - mmaurizi 8y ago
    The law states "up to 10,000,000 EUR" which is the opposite of minimum I'd say.
    - s_dev 8y ago
      The law does not state that. It states €10 million or 2% of gross worldwide revenue -- whichever is higher.
      - zaarn 8y ago
        Those are still the maximum, the 10 million is still not the minimum. The EU could fine a corporation with 10 billion turnover 10$ but they also could fine up to 200 million $. It doesn't mean they have to fine atleast 10 million once you're over the 2% switchover.
        s_dev 8y ago
        You're missing my point -- what you said the law says and what the laws says are different. You're maximum/minimum argument relates to the guy above your post. That additional option of a 2% figure changes the dynamic of how the fines work completely.

kodablah 8y ago

> This it's why we needed GDPR. The courts have been totally unwilling to combat this kind of corporate malpractice It should come as no surprise that the legislative enforcement arm is unwilling to also. I know you dream of laws like the GDPR working, but it doesn't and neither did its predecessor. Instead of asking for new laws, why are you not asking for enforcement of existing ones? And what makes you think a new law will be magically enforced where current ones aren't?

craftyguy 8y ago
What current law are you referring to (in the US..), that makes what Equifax did illegal?
- kodablah 8y ago
  SEC disclosure timeliness requirements since it affects financial outlook at the very least. If they can't even be heavily punished by public institutions for at least that, how can they be expected to punish when given more breakable rules? Or, as the EU erroneously thought, does the US really believe the lack of punishment is due to legal handcuffs instead of political will, resources, and lobbying? More paper will not magically turn handshakes into arrest warrants.
deleted 8y ago
[deleted]
icebraining 8y ago
I know you dream of laws like the GDPR working, but it doesn't and neither did its predecessor Didn't it? Maybe I'm biased, but I don't remember breaches like Equifax's or Target's in the EU. I also don't remember the records of 154 million EU voters being exposed. According to this report[1], the "U.S. accounted for 728 of the 974 incidents around the globe in the first half of 2016." They do say part of the difference may be the disclosure laws, but is that all? [1] https://blog.gemalto.com/security/2016/09/20/data-breach-statistics-2016-first-half-results/ https://blog.gemalto.com/security/2016/09/20/data-breach-sta...

IshKebab 8y ago

GDPR is not enough unfortunately to stop the abuses of credit check agencies. As far as I understand it, them sucking up all your data is a legitimate business use, and you do have to give consent for it. What we really need is regulation to limit the amount of information that can be used for credit checks (and insurance premium calculations while we're at it). Actually that is partly done in the UK - e.g. gender cannot be used while calculating car insurance premiums. But sadly they can still ask for your profession, marital status, etc.

TheCoelacanth 8y ago
GDPR does not only regulate what data a business can collect. It also has many other provisions that would be relevant in the Equifax data breach. It requires that appropriate security measures be taken to secure any personal data that you collect, which Equifax obviously failed to do. It also requires that data breeches be disclosed within 72 hours of when they are discovered while Equifax took about nine months to do so.
- mycall 8y ago
  What about the Right to Forget? Can't we ask Equifax to delete all of our information?
  - TheCoelacanth 8y ago
    Right to forget is basically the right to withdraw consent. You can only make them delete things that they needed your consent for in the first place.
    - mikekchar 8y ago
      This is not actually true. The right to withdraw consent, the right to object and the right to be forgotten are all different. In the first and second case, the company has to stop processing the data, but they don't have to remove it. In the last case, they actually have to remove the data. The removal of data has a caveat that the company doesn't have to do it if it would be onerous (but what that means is left up in the air... so we'll have to see some judgements before we know exactly what it means). In the case of Equifax, they are a third-party processor. Under GDPR, you would have to be informed if the processing was necessary under contract basis. Once the contract is finished, you can request that your data is removed and the original processor must inform all third party processors. So Equifax would be required to remove the data. For legitimate interest or consent basis, you can ask to be removed at any time. You don't have the right to be removed wrt data collected for regulatory reasons. I think the key here is that Equifax (being a third party processor) does not have to respond to you if you say "Please remove all of my data". I think you have to go to the original processor (which sucks, because you have to track down how they got your information). I may be wrong about that, though (the company I work for doesn't collect 3rd party info, so I didn't pay much attention to that part of the law).