3 ms·

This definitely makes a lot of sense. What you are saying is that if Company A borrows your TV for a trade show and subsequently someone steals the TV, then you

This definitely makes a lot of sense. What you are saying is that if Company A borrows your TV for a trade show and subsequently someone steals the TV, then your damages are basically the replacement cost of the TV. Even if Company A used your TV to generate 4 million in new sales, that is not your value and/or damage. In this scenario though, Company A would likely have replacement cost of the TV on their assets for example, and the same replacement cost on the liabilities side since they owe you that much or the TV back at some point. So it would be very clear to everyone involved that if a thief steals the TV, then their insurance would owe them the TV's value, and they in turn would then need to pay you that same amount. Easy breezy. Where this falls down though is that in most of these companies, you are exchanging your personal data for the value of the service or product that they provide for free. Doesn't apply to Equifax, but just bear with me on this one. So the value of my personal data is not actually in some sort of damage, the value of my personal data is equal to the value of the services I received in exchange from you. You give me permission and access to your services in exchange for me giving you access and use of my data for a set of purposes. Great, that seems fair. But if the data is now stolen and used in ways that are impossible to capture and value, now what? I mean who can determine the value that those who stole the data derived from it. It has to be somewhere between $0 and infinity, but we don't know at all where it falls. At minimum it should be worth the value that the company who I made the original agreement with was ascribing to it on their books, right? Of course their algorithms and software have a value as well, and in combination with many other assets which determine the company's value. It would at least seem reasonable like in the TV example that the value they assign to the data is the minimum they should pay in damages upon a breach of that data.

ta1234567890 6y ago
> What you are saying is that if Company A borrows your TV for a trade show and subsequently someone steals the TV, then your damages are basically the replacement cost of the TV. It's more like you lend someone your smartphone, they leave it in their car overnight and it gets stolen. The thieves then use your smartphone to gain access to your email, social media and bank accounts. Is the person who borrowed your phone liable only for the cost of the device, or are they liable for the damages you suffered as a consequence of the device being stolen and misused?
- Silhouette 6y ago
  Yes, this is more like the argument I was trying to make. I don't think the value of personal data to anyone -- either the authorised user or the unauthorised party or parties who got hold of it -- is particularly relevant here. Making good the damage caused by any leak of the data is the priority, IMHO. That damage could be less than the value to the authorised user, or it could be many times greater, depending on the nature of the data that was compromised and what is, or could in future be, done with it. Of course some damage can't be reversed by any amount of monetary compensation. Then maybe you get into questions about how much is an appropriate financial penalty to make up for doing damage to someone's quality of life in some way. But even to the extent that it's "only money", there is still a difficulty here in that you have to somehow quantify the potential harm of any given incident. For one thing, there might have been multiple relevant incidents. Some of them might not be known. It won't necessarily be realistic to determine which incident(s) actually led to the harm. However, the harm was caused all the same, and at least one relevant incident contributed to that. For another thing, harm could be caused in the future, possibly far into the future. The subject of the compromised data may have to live with that prospect, perhaps forever, and do what they can to protect themselves against the possibility. So the difficult situation is that we have an uncertain amount of harm being caused if data is compromised, attributable to uncertain specific incident(s). However, we do know that in some cases the damage could be great, and we do know of at least one incident and one responsible data controller (assuming it's reasonable to hold the controller responsible under the circumstances, which was my point about negligence being an important condition). So you have to try to build a fair and reasonable system for penalising the responsible party or parties and compensating the victim, with much uncertainty about the actual situation.

ta1234567890 6y ago

> What you are saying is that if Company A borrows your TV for a trade show and subsequently someone steals the TV, then your damages are basically the replacement cost of the TV. It's more like you lend someone your smartphone, they leave it in their car overnight and it gets stolen. The thieves then use your smartphone to gain access to your email, social media and bank accounts. Is the person who borrowed your phone liable only for the cost of the device, or are they liable for the damages you suffered as a consequence of the device being stolen and misused?

Silhouette 6y ago
Yes, this is more like the argument I was trying to make. I don't think the value of personal data to anyone -- either the authorised user or the unauthorised party or parties who got hold of it -- is particularly relevant here. Making good the damage caused by any leak of the data is the priority, IMHO. That damage could be less than the value to the authorised user, or it could be many times greater, depending on the nature of the data that was compromised and what is, or could in future be, done with it. Of course some damage can't be reversed by any amount of monetary compensation. Then maybe you get into questions about how much is an appropriate financial penalty to make up for doing damage to someone's quality of life in some way. But even to the extent that it's "only money", there is still a difficulty here in that you have to somehow quantify the potential harm of any given incident. For one thing, there might have been multiple relevant incidents. Some of them might not be known. It won't necessarily be realistic to determine which incident(s) actually led to the harm. However, the harm was caused all the same, and at least one relevant incident contributed to that. For another thing, harm could be caused in the future, possibly far into the future. The subject of the compromised data may have to live with that prospect, perhaps forever, and do what they can to protect themselves against the possibility. So the difficult situation is that we have an uncertain amount of harm being caused if data is compromised, attributable to uncertain specific incident(s). However, we do know that in some cases the damage could be great, and we do know of at least one incident and one responsible data controller (assuming it's reasonable to hold the controller responsible under the circumstances, which was my point about negligence being an important condition). So you have to try to build a fair and reasonable system for penalising the responsible party or parties and compensating the victim, with much uncertainty about the actual situation.