4 ms·

I would like to see a Professional Personal Data Engineer license similar to becoming a PE in other engineering fields that would specifically qualify an engine

I would like to see a Professional Personal Data Engineer license similar to becoming a PE in other engineering fields that would specifically qualify an engineer to build systems that contain PII. Then if you have a data breach you can investigate and potentially pull the license and assign personal liability similar to if a bridge fell over.

MrQuimico 6y ago
Something like Europe's GDPR should be enough. And of course product certifications.
- henryfjordan 6y ago
  I disagree. The GDPR and CCPA only have teeth against corporations. You will lose some money but nobody is going to jail over a GDPR violation. The investors will be sad but they aren't even really responsible, the employees who built the data-systems are. At the same time, you can ruin someone's life through a data-breach. Imagine you are on one of these dating apps and your boss takes a gander at the leaks and fires you because of your private life. Or worse, some bigots show up at your house and burn a cross in your yard. So how do we fix a situation where the person responsible for securing your data has no skin in the game? Put their head on the block. Other engineering disciplines hold the PE liable for mistakes because they recognize the stakes involved. I think that assigning liability is absolutely appropriate for building systems with PII. Product certifications would be great too, although that would be done by a PE so you'd kill two birds with one stone by licensing Data Engineers.
  - MrQuimico 6y ago
    How do you enforce that when the service is provided by a company in another country? GDPR solves that because if you want to do business with European citizens you must comply with it no matter where you are. GDPR is not only about the fines, it stablishes protocols to communicate breaches, makes somebody responsible for it (the DPO) and makes distinctions between the different types of data and the requirements to handle it. Also, enforcing GDPR is no joke, and we are still learning its consequences (http://www.london-registrars.co.uk/first-prison-sentence-arising-from-the-gdpr-should-remind-firms-of-their-responsibilities/ http://www.london-registrars.co.uk/first-prison-sentence-ari...). As I see it, Licensed Data Engineers won't make companies more careful with our data, since all they need to do is to sue them and fire them when there is a problem. We need laws that make data hard to use, so companies will only ask for what they really need, will use the data with a purpose and will store it only while it's useful. Software is more similar to a car than it is to a bridge. Companies build and sell them all over the world. Cars are certified at each country as needed, but it doesn't matter who is building them, as long as they meet all the requirements. Software should be similar.
    - henryfjordan 6y ago
      I didn't realize the gdpr had such teeth. I was wrong, the gdpr will help solve data breaches.
  - ntsplnkv2 6y ago
    > So how do we fix a situation where the person responsible for securing your data has no skin in the game? Put their head on the block. This implies there is a perfect scenario of security, but even the best security experts can still have breaches, it's unfair to punish people acting in good faith.
txcwpalpha 6y ago
I've seen this comparison a lot and on some level I agree with the idea, but I don't think the comparison is actually that applicable. This big difference is that this isn't just "the bridge fell over". In the case of a cyber attack, it's more like "a terrorist detonated a bomb on the bridge and blew it up". And in such a case, I think it would be a pretty big stretch to blame the engineer who designed the bridge.
- majormajor 6y ago
  There's a scale, here. "Somone crashed into the bridge support pillar in the median and the bridge fell down" sounds like the fault of the engineer. "A foreign nation sent a fighter jet" doesn't. I don't have any ideas on how to have a reasonable standard of "this is the sort of attack you shouldn't fall to," though. How do you keep this from being years outdated very quickly?
- henryfjordan 6y ago
  I agree that if a nation-state breaks into your system with a 0-day exploit, that's very very different than leaving your S3 bucket set to public. I'm not suggesting that every data breach results in jail time, just like not every bridge collapse results in jail time either. There should be an investigation that determines the cause and whether that cause was foreseeable. The other engineering disciplines seem to have it adequately figured out, software isn't that different. I also don't think you should be facing life or anything, maybe something as small as a fine would work. Ultimately the data breaches will continue to happen as long as the personal incentives of the people building data systems aren't aligned with the users, and the GDPR does nothing to address that.

MrQuimico 6y ago

Something like Europe's GDPR should be enough. And of course product certifications.

henryfjordan 6y ago
I disagree. The GDPR and CCPA only have teeth against corporations. You will lose some money but nobody is going to jail over a GDPR violation. The investors will be sad but they aren't even really responsible, the employees who built the data-systems are. At the same time, you can ruin someone's life through a data-breach. Imagine you are on one of these dating apps and your boss takes a gander at the leaks and fires you because of your private life. Or worse, some bigots show up at your house and burn a cross in your yard. So how do we fix a situation where the person responsible for securing your data has no skin in the game? Put their head on the block. Other engineering disciplines hold the PE liable for mistakes because they recognize the stakes involved. I think that assigning liability is absolutely appropriate for building systems with PII. Product certifications would be great too, although that would be done by a PE so you'd kill two birds with one stone by licensing Data Engineers.
- MrQuimico 6y ago
  How do you enforce that when the service is provided by a company in another country? GDPR solves that because if you want to do business with European citizens you must comply with it no matter where you are. GDPR is not only about the fines, it stablishes protocols to communicate breaches, makes somebody responsible for it (the DPO) and makes distinctions between the different types of data and the requirements to handle it. Also, enforcing GDPR is no joke, and we are still learning its consequences (http://www.london-registrars.co.uk/first-prison-sentence-arising-from-the-gdpr-should-remind-firms-of-their-responsibilities/ http://www.london-registrars.co.uk/first-prison-sentence-ari...). As I see it, Licensed Data Engineers won't make companies more careful with our data, since all they need to do is to sue them and fire them when there is a problem. We need laws that make data hard to use, so companies will only ask for what they really need, will use the data with a purpose and will store it only while it's useful. Software is more similar to a car than it is to a bridge. Companies build and sell them all over the world. Cars are certified at each country as needed, but it doesn't matter who is building them, as long as they meet all the requirements. Software should be similar.
  - henryfjordan 6y ago
    I didn't realize the gdpr had such teeth. I was wrong, the gdpr will help solve data breaches.
- ntsplnkv2 6y ago
  > So how do we fix a situation where the person responsible for securing your data has no skin in the game? Put their head on the block. This implies there is a perfect scenario of security, but even the best security experts can still have breaches, it's unfair to punish people acting in good faith.

txcwpalpha 6y ago

I've seen this comparison a lot and on some level I agree with the idea, but I don't think the comparison is actually that applicable. This big difference is that this isn't just "the bridge fell over". In the case of a cyber attack, it's more like "a terrorist detonated a bomb on the bridge and blew it up". And in such a case, I think it would be a pretty big stretch to blame the engineer who designed the bridge.

majormajor 6y ago
There's a scale, here. "Somone crashed into the bridge support pillar in the median and the bridge fell down" sounds like the fault of the engineer. "A foreign nation sent a fighter jet" doesn't. I don't have any ideas on how to have a reasonable standard of "this is the sort of attack you shouldn't fall to," though. How do you keep this from being years outdated very quickly?
henryfjordan 6y ago
I agree that if a nation-state breaks into your system with a 0-day exploit, that's very very different than leaving your S3 bucket set to public. I'm not suggesting that every data breach results in jail time, just like not every bridge collapse results in jail time either. There should be an investigation that determines the cause and whether that cause was foreseeable. The other engineering disciplines seem to have it adequately figured out, software isn't that different. I also don't think you should be facing life or anything, maybe something as small as a fine would work. Ultimately the data breaches will continue to happen as long as the personal incentives of the people building data systems aren't aligned with the users, and the GDPR does nothing to address that.