18 ms·

If a companies main asset is their data, that means that you can ascribe a value to each person's data that they hold. If your data is stolen, they should be on

If a companies main asset is their data, that means that you can ascribe a value to each person's data that they hold. If your data is stolen, they should be on the hook for value of that data to each of the people whose data was stolen. I respectfully disagree. The value of the data to the company when used for its intended purpose is not necessarily the same as the amount of damage that can be caused to you if someone else gets hold of the data and uses it for other purposes. It seems reasonable that a company that is negligent in its handling of personal data should be on the hook for, at a minimum, any actual damages caused by a resulting breach. I think the negligence condition is important, because a company that has taken reasonable and proportionate measures to safeguard personal data and has generally acted in good faith is also a victim if it is subsequently hacked through criminal action. The problem with personal data in particular is that there may well be damage caused by a leak that is difficult to quantify or to attribute to any specific failure in managing the data. Suppose two businesses are both compromised, and someone whose personal data was in both databases is subsequently the victim of identity theft six months later. It is quite possible that the victim will then spend several months of their life trying to clean up a mess that was made through no fault of their own, possibly at considerable financial cost and certainly wasting a lot of their time and causing a lot of stress. However, the businesses will likely argue that there is nothing to link the identity thieves to the specific breach at that business so they should bear no responsibility for the consequences. And in a sense, they are right, because there probably is no way to know which of those two breaches was responsible for that particular identity thief obtaining the data, or indeed whether some other unidentified breach was the true origin of that leak. For this reason, I think some form of presumed damages should probably also be allowed in law, at least for types of personal data that are particularly vulnerable to exploitation by bad actors if they can get hold of it -- financial details, health records, correspondence or photos/videos of a personal nature, etc. Different legal systems handle this kind of issue very differently, and in some cases I'm not sure they're really up to the task at the moment, but I suspect that will need to change before certain businesses see data protection as important and the penalties as more than just a "cost of doing business".

nathanyz 6y ago
This definitely makes a lot of sense. What you are saying is that if Company A borrows your TV for a trade show and subsequently someone steals the TV, then your damages are basically the replacement cost of the TV. Even if Company A used your TV to generate 4 million in new sales, that is not your value and/or damage. In this scenario though, Company A would likely have replacement cost of the TV on their assets for example, and the same replacement cost on the liabilities side since they owe you that much or the TV back at some point. So it would be very clear to everyone involved that if a thief steals the TV, then their insurance would owe them the TV's value, and they in turn would then need to pay you that same amount. Easy breezy. Where this falls down though is that in most of these companies, you are exchanging your personal data for the value of the service or product that they provide for free. Doesn't apply to Equifax, but just bear with me on this one. So the value of my personal data is not actually in some sort of damage, the value of my personal data is equal to the value of the services I received in exchange from you. You give me permission and access to your services in exchange for me giving you access and use of my data for a set of purposes. Great, that seems fair. But if the data is now stolen and used in ways that are impossible to capture and value, now what? I mean who can determine the value that those who stole the data derived from it. It has to be somewhere between $0 and infinity, but we don't know at all where it falls. At minimum it should be worth the value that the company who I made the original agreement with was ascribing to it on their books, right? Of course their algorithms and software have a value as well, and in combination with many other assets which determine the company's value. It would at least seem reasonable like in the TV example that the value they assign to the data is the minimum they should pay in damages upon a breach of that data.
- ta1234567890 6y ago
  > What you are saying is that if Company A borrows your TV for a trade show and subsequently someone steals the TV, then your damages are basically the replacement cost of the TV. It's more like you lend someone your smartphone, they leave it in their car overnight and it gets stolen. The thieves then use your smartphone to gain access to your email, social media and bank accounts. Is the person who borrowed your phone liable only for the cost of the device, or are they liable for the damages you suffered as a consequence of the device being stolen and misused?

nathanyz 6y ago

This definitely makes a lot of sense. What you are saying is that if Company A borrows your TV for a trade show and subsequently someone steals the TV, then your damages are basically the replacement cost of the TV. Even if Company A used your TV to generate 4 million in new sales, that is not your value and/or damage. In this scenario though, Company A would likely have replacement cost of the TV on their assets for example, and the same replacement cost on the liabilities side since they owe you that much or the TV back at some point. So it would be very clear to everyone involved that if a thief steals the TV, then their insurance would owe them the TV's value, and they in turn would then need to pay you that same amount. Easy breezy. Where this falls down though is that in most of these companies, you are exchanging your personal data for the value of the service or product that they provide for free. Doesn't apply to Equifax, but just bear with me on this one. So the value of my personal data is not actually in some sort of damage, the value of my personal data is equal to the value of the services I received in exchange from you. You give me permission and access to your services in exchange for me giving you access and use of my data for a set of purposes. Great, that seems fair. But if the data is now stolen and used in ways that are impossible to capture and value, now what? I mean who can determine the value that those who stole the data derived from it. It has to be somewhere between $0 and infinity, but we don't know at all where it falls. At minimum it should be worth the value that the company who I made the original agreement with was ascribing to it on their books, right? Of course their algorithms and software have a value as well, and in combination with many other assets which determine the company's value. It would at least seem reasonable like in the TV example that the value they assign to the data is the minimum they should pay in damages upon a breach of that data.

ta1234567890 6y ago
> What you are saying is that if Company A borrows your TV for a trade show and subsequently someone steals the TV, then your damages are basically the replacement cost of the TV. It's more like you lend someone your smartphone, they leave it in their car overnight and it gets stolen. The thieves then use your smartphone to gain access to your email, social media and bank accounts. Is the person who borrowed your phone liable only for the cost of the device, or are they liable for the damages you suffered as a consequence of the device being stolen and misused?