3 ms·

When I think about a small, bootstrapped operation, that kind of fine would bankrupt them. When I think about Facebook, that kind of fine wouldn’t even bother t

by aksss 6y ago

When I think about a small, bootstrapped operation, that kind of fine would bankrupt them. When I think about Facebook, that kind of fine wouldn’t even bother them. Not sure what the answer there is. At some level a very harsh fine says, no matter the value of the product, if you screw up we shut you down, unless you’re big enough to not care at all.

RankingMember 6y ago
Perhaps the fine amount should be a function of market cap for public companies.
- briandear 6y ago
  The fine should be proportional to the damage. A tiny medical startup that leaks psychotherapy records “hurts” more than a company that leaks your shoe size. Perhaps companies should buy insurance for this and then that would incentivize insurance companies to help protect their clients. Insurance requirements are a significant safety factor at many physical businesses. The law is important, but being denied insurance claims is a great private-sector solution. Or course for insurance to be meaningful, the penalties have to have significant teeth. However, a mega-Corp (by revenue) would likely self-insure, however they’d still have incentive to do right if the penalties were per record, not per breach. For HIPAA, there’s a fine of up to $10k per record for a breach. 10k times 200,000,000 users affected becomes real money even to Facebook. And, let’s make the fines payable to the user, not the government. The user is the one incurring the harm, not the government. The government still gets their slice since such awards are taxable.
  - RankingMember 6y ago
    > The fine should be proportional to the damage. A tiny medical startup that leaks psychotherapy records “hurts” more than a company that leaks your shoe size. I agree. I meant that market cap should be taken into account along with factors such as damage. The goal is that for the same wrong, a small and a large company face the same penalty, but adjusted in proportion to their financials.
  - aksss 6y ago
    > Perhaps companies should buy insurance for this They literally do, and I think it lightens the blow more than anything.
xtracto 6y ago
The fine is "up to" that amount. There have been smaller companies that have been fined way less than the top. One thing I will tell you, when I was in charge of the data of a FinTech in Mexico, we were VERY aware of those fines and took a lot of care regarding our security.

by aksss 6y ago

RankingMember 6y ago

Perhaps the fine amount should be a function of market cap for public companies.

briandear 6y ago
The fine should be proportional to the damage. A tiny medical startup that leaks psychotherapy records “hurts” more than a company that leaks your shoe size. Perhaps companies should buy insurance for this and then that would incentivize insurance companies to help protect their clients. Insurance requirements are a significant safety factor at many physical businesses. The law is important, but being denied insurance claims is a great private-sector solution. Or course for insurance to be meaningful, the penalties have to have significant teeth. However, a mega-Corp (by revenue) would likely self-insure, however they’d still have incentive to do right if the penalties were per record, not per breach. For HIPAA, there’s a fine of up to $10k per record for a breach. 10k times 200,000,000 users affected becomes real money even to Facebook. And, let’s make the fines payable to the user, not the government. The user is the one incurring the harm, not the government. The government still gets their slice since such awards are taxable.
- RankingMember 6y ago
  > The fine should be proportional to the damage. A tiny medical startup that leaks psychotherapy records “hurts” more than a company that leaks your shoe size. I agree. I meant that market cap should be taken into account along with factors such as damage. The goal is that for the same wrong, a small and a large company face the same penalty, but adjusted in proportion to their financials.
- aksss 6y ago
  > Perhaps companies should buy insurance for this They literally do, and I think it lightens the blow more than anything.

xtracto 6y ago

The fine is "up to" that amount. There have been smaller companies that have been fined way less than the top. One thing I will tell you, when I was in charge of the data of a FinTech in Mexico, we were VERY aware of those fines and took a lot of care regarding our security.