4 ms·
Can companies be held responsible for damages from data breaches? If they could, it seems like it would incentivize more caution about what data is collected,
by haberman 6y ago
Can companies be held responsible for damages from data breaches?
If they could, it seems like it would incentivize more caution about what data is collected, and more investment in the security of that data.
I also imagine an insurance industry, where the insurers then have expectations about what kinds of security must be in place to get reasonable premiums.
- redler 6y agoYup, this is more or less how “cyber security” policies work.
- elliekelly 6y agoUnless it’s changed in the last two or three years cyber security insurance policies seem only to cover the cost of notifying customers of the breach and paying for credit monitoring for whatever period of time is required in each customer’s specific jurisdiction. (When last I looked, in most states it’s none.) Every time I looked into cyber security insurance it wasn’t worthwhile at all because it didn’t provide any meaningful coverage. Maybe for a small startup with a lot of PII it would make sense but I think most companies would probably come to the same conclusion.
- boston_clone 6y agoIt may be worth reviewing cybersecurity insurance policies with your legal team! At a former company, we had a nasty case of BEC with a vendor that ultimately cost us well over six figures - over 90% of the loss was recouped by filing a claim with our insurance.