3 ms·
Surely you can - that could amount to criminal negligence which is definitely a crime.
by spaceheretostay 7y ago
Surely you can - that could amount to criminal negligence which is definitely a crime.
- gtirloni 7y agoYes, you can and should. But how do you define negligence in IT? We don't have the same codified norms as civil engineering so it'd be very subjective.
- TACIXAT 7y agoI feel the best test was "did you get breached? what data was taken?", if the answers are yes and PII, you were collecting data that you didn't have the capability to protect and should face a fine. There is a lot a company can do to protect data. If they demonstrate that they were following all those best practices re: encryption, storage, least privilege, etc. then that should absolutely factor in. At least to hold people accountable who store stuff in plain text and leave it on publicly accessible storage.