6 ms·

Given the amount of personal data now being held not only by credit companies, but also big tech, it seems like the liability for data breaches needs adjusted.

Given the amount of personal data now being held not only by credit companies, but also big tech, it seems like the liability for data breaches needs adjusted. If a companies main asset is their data, that means that you can ascribe a value to each person's data that they hold. If your data is stolen, they should be on the hook for value of that data to each of the people whose data was stolen. They need to stop being able to value the data at the cost of credit protection service on the liability side while booking value significantly higher on their assets ledger. This would encourage them to be much more careful in both protecting the data and mitigating breaches versus the current blase approach.

londons_explore 6y ago
Data is a copyable asset. Most other assets are not. Any copyable asset is worth zero as long as any copy is in the hands of someone likely to make more copies.
- s_dev 6y ago
  >Data is a copyable asset. Most other assets are not. The consent to have that data is not copyable though.
- rectang 6y ago
  By that reasoning, if a file containing bank passwords leaks, its value is "zero" despite the fact that somebody can now go in and steal from all those accounts with ease. Experian has created a massive liability for all the individuals in the leaked data pool. The amount of damage this leak does to innocent people is staggering.
- csommers 6y ago
  I didn’t consent to have my passwords or SSN leaked though, so your argument is naive at best, idiotic at worst.
  - rorykoehler 6y ago
    I never consented to a credit scoring company to ever have my data. The first time I found out this was a thing as a teenager really made me think about the world and how it works. I couldn't believe something like this existed.
    - jakeva 6y ago
      I believe it's part of the fine print when opening a credit account like a credit card, so I imagine you consented whether you were aware or not.
    - quickthrowman 6y ago
      You couldn’t believe that lenders have a system that helps them classify borrowers into different risk pools? Why is that hard to believe. You consented to have your data reported to the credit reporting agencies when you applied for credit. You may not have been aware of it, but you did.
      - coddle-hark 6y ago
        That’s a strange definition of consent.
        quickthrowman 6y ago
        Signing a contract isn’t consenting?
      - bleepblorp 6y ago
        Coerced consent is not consent. It is not possible to function fully in most western societies without access to banking services and payment cards. "Consent" to share financial data with credit rating services is consent extracted under duress. Most people have no other choice but to apply for bank accounts and credit accounts unless they are able to live off-grid. If a robber points a gun at someone and tells them to hand over their wallet, the fact that they had a choice between cooperating and being shot does not mean that cooperation is a consensual act. The existence of an even worse alternative to an unwanted compelled act does not make the compelled act consensual. It also should not be overlooked that the US financial credit reporting system functions as a Chinese-style Sesame Credit social credit reporting system in practice. Credit reporting agencies harvest non-financial data to evaluate individual behaviors and credit scores are widely used to control access to employment and housing. This amounts to a human rights violation to which no one can meaningfully consent regardless of its formal legality.
- deftnerd 6y ago
  There is a lot of case law regarding digital media, such as movies, tv, books, etc, stating that the digital version doesn't lose value despite the ease of copying it. It's an interesting conundrum that "big business" claims that personal data being copied doesn't necessarily have value, but entertaining data does.
  - bleepblorp 6y ago
    It all makes sense if you accept that the purpose of modern intellectual property law is to protect the wealth of the rich from the people they exploited to get rich in the first place.
- arrosenberg 6y ago
  Then Facebook should have no problem deleting their worthless databases. I'll wait while you explain it to them.
- rmujica 6y ago
  I think it could be more precisely defined as: the value of any copiable and spreadable asset is inverse proportional to the amount of available copies
Silhouette 6y ago
If a companies main asset is their data, that means that you can ascribe a value to each person's data that they hold. If your data is stolen, they should be on the hook for value of that data to each of the people whose data was stolen. I respectfully disagree. The value of the data to the company when used for its intended purpose is not necessarily the same as the amount of damage that can be caused to you if someone else gets hold of the data and uses it for other purposes. It seems reasonable that a company that is negligent in its handling of personal data should be on the hook for, at a minimum, any actual damages caused by a resulting breach. I think the negligence condition is important, because a company that has taken reasonable and proportionate measures to safeguard personal data and has generally acted in good faith is also a victim if it is subsequently hacked through criminal action. The problem with personal data in particular is that there may well be damage caused by a leak that is difficult to quantify or to attribute to any specific failure in managing the data. Suppose two businesses are both compromised, and someone whose personal data was in both databases is subsequently the victim of identity theft six months later. It is quite possible that the victim will then spend several months of their life trying to clean up a mess that was made through no fault of their own, possibly at considerable financial cost and certainly wasting a lot of their time and causing a lot of stress. However, the businesses will likely argue that there is nothing to link the identity thieves to the specific breach at that business so they should bear no responsibility for the consequences. And in a sense, they are right, because there probably is no way to know which of those two breaches was responsible for that particular identity thief obtaining the data, or indeed whether some other unidentified breach was the true origin of that leak. For this reason, I think some form of presumed damages should probably also be allowed in law, at least for types of personal data that are particularly vulnerable to exploitation by bad actors if they can get hold of it -- financial details, health records, correspondence or photos/videos of a personal nature, etc. Different legal systems handle this kind of issue very differently, and in some cases I'm not sure they're really up to the task at the moment, but I suspect that will need to change before certain businesses see data protection as important and the penalties as more than just a "cost of doing business".
- nathanyz 6y ago
  This definitely makes a lot of sense. What you are saying is that if Company A borrows your TV for a trade show and subsequently someone steals the TV, then your damages are basically the replacement cost of the TV. Even if Company A used your TV to generate 4 million in new sales, that is not your value and/or damage. In this scenario though, Company A would likely have replacement cost of the TV on their assets for example, and the same replacement cost on the liabilities side since they owe you that much or the TV back at some point. So it would be very clear to everyone involved that if a thief steals the TV, then their insurance would owe them the TV's value, and they in turn would then need to pay you that same amount. Easy breezy. Where this falls down though is that in most of these companies, you are exchanging your personal data for the value of the service or product that they provide for free. Doesn't apply to Equifax, but just bear with me on this one. So the value of my personal data is not actually in some sort of damage, the value of my personal data is equal to the value of the services I received in exchange from you. You give me permission and access to your services in exchange for me giving you access and use of my data for a set of purposes. Great, that seems fair. But if the data is now stolen and used in ways that are impossible to capture and value, now what? I mean who can determine the value that those who stole the data derived from it. It has to be somewhere between $0 and infinity, but we don't know at all where it falls. At minimum it should be worth the value that the company who I made the original agreement with was ascribing to it on their books, right? Of course their algorithms and software have a value as well, and in combination with many other assets which determine the company's value. It would at least seem reasonable like in the TV example that the value they assign to the data is the minimum they should pay in damages upon a breach of that data.

londons_explore 6y ago

Data is a copyable asset. Most other assets are not. Any copyable asset is worth zero as long as any copy is in the hands of someone likely to make more copies.

s_dev 6y ago
>Data is a copyable asset. Most other assets are not. The consent to have that data is not copyable though.
rectang 6y ago
By that reasoning, if a file containing bank passwords leaks, its value is "zero" despite the fact that somebody can now go in and steal from all those accounts with ease. Experian has created a massive liability for all the individuals in the leaked data pool. The amount of damage this leak does to innocent people is staggering.
csommers 6y ago
I didn’t consent to have my passwords or SSN leaked though, so your argument is naive at best, idiotic at worst.
- rorykoehler 6y ago
  I never consented to a credit scoring company to ever have my data. The first time I found out this was a thing as a teenager really made me think about the world and how it works. I couldn't believe something like this existed.
  - jakeva 6y ago
    I believe it's part of the fine print when opening a credit account like a credit card, so I imagine you consented whether you were aware or not.
  - quickthrowman 6y ago
    You couldn’t believe that lenders have a system that helps them classify borrowers into different risk pools? Why is that hard to believe. You consented to have your data reported to the credit reporting agencies when you applied for credit. You may not have been aware of it, but you did.
    - coddle-hark 6y ago
      That’s a strange definition of consent.
      - quickthrowman 6y ago
        Signing a contract isn’t consenting?
    - bleepblorp 6y ago
      Coerced consent is not consent. It is not possible to function fully in most western societies without access to banking services and payment cards. "Consent" to share financial data with credit rating services is consent extracted under duress. Most people have no other choice but to apply for bank accounts and credit accounts unless they are able to live off-grid. If a robber points a gun at someone and tells them to hand over their wallet, the fact that they had a choice between cooperating and being shot does not mean that cooperation is a consensual act. The existence of an even worse alternative to an unwanted compelled act does not make the compelled act consensual. It also should not be overlooked that the US financial credit reporting system functions as a Chinese-style Sesame Credit social credit reporting system in practice. Credit reporting agencies harvest non-financial data to evaluate individual behaviors and credit scores are widely used to control access to employment and housing. This amounts to a human rights violation to which no one can meaningfully consent regardless of its formal legality.
deftnerd 6y ago
There is a lot of case law regarding digital media, such as movies, tv, books, etc, stating that the digital version doesn't lose value despite the ease of copying it. It's an interesting conundrum that "big business" claims that personal data being copied doesn't necessarily have value, but entertaining data does.
- bleepblorp 6y ago
  It all makes sense if you accept that the purpose of modern intellectual property law is to protect the wealth of the rich from the people they exploited to get rich in the first place.
arrosenberg 6y ago
Then Facebook should have no problem deleting their worthless databases. I'll wait while you explain it to them.
rmujica 6y ago
I think it could be more precisely defined as: the value of any copiable and spreadable asset is inverse proportional to the amount of available copies

Silhouette 6y ago

If a companies main asset is their data, that means that you can ascribe a value to each person's data that they hold. If your data is stolen, they should be on the hook for value of that data to each of the people whose data was stolen. I respectfully disagree. The value of the data to the company when used for its intended purpose is not necessarily the same as the amount of damage that can be caused to you if someone else gets hold of the data and uses it for other purposes. It seems reasonable that a company that is negligent in its handling of personal data should be on the hook for, at a minimum, any actual damages caused by a resulting breach. I think the negligence condition is important, because a company that has taken reasonable and proportionate measures to safeguard personal data and has generally acted in good faith is also a victim if it is subsequently hacked through criminal action. The problem with personal data in particular is that there may well be damage caused by a leak that is difficult to quantify or to attribute to any specific failure in managing the data. Suppose two businesses are both compromised, and someone whose personal data was in both databases is subsequently the victim of identity theft six months later. It is quite possible that the victim will then spend several months of their life trying to clean up a mess that was made through no fault of their own, possibly at considerable financial cost and certainly wasting a lot of their time and causing a lot of stress. However, the businesses will likely argue that there is nothing to link the identity thieves to the specific breach at that business so they should bear no responsibility for the consequences. And in a sense, they are right, because there probably is no way to know which of those two breaches was responsible for that particular identity thief obtaining the data, or indeed whether some other unidentified breach was the true origin of that leak. For this reason, I think some form of presumed damages should probably also be allowed in law, at least for types of personal data that are particularly vulnerable to exploitation by bad actors if they can get hold of it -- financial details, health records, correspondence or photos/videos of a personal nature, etc. Different legal systems handle this kind of issue very differently, and in some cases I'm not sure they're really up to the task at the moment, but I suspect that will need to change before certain businesses see data protection as important and the penalties as more than just a "cost of doing business".

nathanyz 6y ago
This definitely makes a lot of sense. What you are saying is that if Company A borrows your TV for a trade show and subsequently someone steals the TV, then your damages are basically the replacement cost of the TV. Even if Company A used your TV to generate 4 million in new sales, that is not your value and/or damage. In this scenario though, Company A would likely have replacement cost of the TV on their assets for example, and the same replacement cost on the liabilities side since they owe you that much or the TV back at some point. So it would be very clear to everyone involved that if a thief steals the TV, then their insurance would owe them the TV's value, and they in turn would then need to pay you that same amount. Easy breezy. Where this falls down though is that in most of these companies, you are exchanging your personal data for the value of the service or product that they provide for free. Doesn't apply to Equifax, but just bear with me on this one. So the value of my personal data is not actually in some sort of damage, the value of my personal data is equal to the value of the services I received in exchange from you. You give me permission and access to your services in exchange for me giving you access and use of my data for a set of purposes. Great, that seems fair. But if the data is now stolen and used in ways that are impossible to capture and value, now what? I mean who can determine the value that those who stole the data derived from it. It has to be somewhere between $0 and infinity, but we don't know at all where it falls. At minimum it should be worth the value that the company who I made the original agreement with was ascribing to it on their books, right? Of course their algorithms and software have a value as well, and in combination with many other assets which determine the company's value. It would at least seem reasonable like in the TV example that the value they assign to the data is the minimum they should pay in damages upon a breach of that data.