3 ms·

I recently negotiated two service contracts, one for a company that helps administer employment verification (e.g., if an employee applies for a loan), and anot

I recently negotiated two service contracts, one for a company that helps administer employment verification (e.g., if an employee applies for a loan), and another with a company that handles COBRA documentation post-termination. Both of these require the service providers hold some confidential information concerning our employees. Both contracts explicitly provided (i) they will not indemnify me for state/federal penalties if they fail to do their job, and (ii) the only remedies they would provide following their data breach is one year of credit monitoring. I told them that was crazy, and if there's a breach they need to indemnify me for all losses and liability, full stop. Both companies refused so I had our broker approach different companies. Those companies proposed contracts with the same terms and also refused to change them. As the employer here merely contracting with service providers, I can't even find contractors who will take this liability on. I would 100% support legislation that would impose on these bastards penalties for the losses associated with their data breaches or failure to provide the services they say they are going to provide. I am also comfortable with the fact that may cost more, but at least then the costs will be internalized by the proper actor. And those who can efficiently provide secure services to me will get my business.

throwaway2037 6y ago
What a great story. Thank you to share you experience. I wonder if (i) is not enforceable. That said, it is the legal equivalent of David and Goliath to win that case. Even if the clause is legally enforceable, could you win a civil suit on the grounds of negligence (poor service)? Again, maybe, but probably very expensive to discover! I agree: These kinds of clauses should not be allowed. I cannot imagine this same thing happens in EU with GPDR.
- zonethundery 6y ago
  (i) is enforceable. You could have a negligence claim, but customer (if a regulated entity) is generally required (on a principles basis, not necessarily prescriptive) to do their own due diligence on the adequacy of the vendor's security practices. The shift away from assigning liability to vendors was part of Dodd-Frank, and NYDFS has taken a similar tack with its cybersecurity rules.
AnthonyMouse 6y ago
> I am also comfortable with the fact that may cost more, but at least then the costs will be internalized by the proper actor. The problem with these situations is that liability would induce bankruptcy by a factor of a thousand. If one of these companies screws up, likely they did so for each of their customers, who each have their own customers. Plausibly millions of people, for vendors that aren't exactly Google-sized. So for any non-trivial damages they're out of business and you get three cents on the dollar of your indemnity because so did everybody else. Which is all but worthless. It doesn't even give them much incentive to not screw up, because they're only paying 3% of the damages before they file bankruptcy and start over, which itself only happens if they're unlucky. Plenty of companies would be willing to take those odds and they'll still be the ones with the lowest price. The only way for them to cover the full amount is to buy insurance, but then you have the liability on the wrong party again and they lose the entire incentive to avoid screwing up. We might like to believe that insurance companies have some magic to reduce claims, but mostly they don't and they just spread the cost of the liability across all their customers. So really all you're asking for is a law that forces you to pay extra in order to buy insurance. But can't you already buy insurance from an ordinary liability insurance company instead of the vendor?
- kova12 6y ago
  There's something wrong with a notion that a single actor can cause enormous damages, spread them out between community members and suffer no consequences, and I'm not even talking about only credit companies. For example, take an action which makes everybody spend an hour of their time. Disposing snail mail for example. Lets say there's 300M people in USA. Lets say only 100M of them are affected. Lets also be charitable and say that an hour of their time is worth $10. That's a 1B damage right away. It is a Fukushima level damage. I don't have a solution, but it is disturbing that we allow actors capable of causing such damage just go do their business, take risks, and if risks don't work out - just file for bankruptcy and suffer essentially no consequences
  - AnthonyMouse 6y ago
    The underlying problem is that people are capable of causing more damages than they can cover. If you cause a billion dollars in damages, but you don't have a billion dollars, who pays? Not you, for sure, because you can't. Some of these have decent solutions. We want people to recycle aluminum cans, so we have a deposit which you get back when you take the can to the recycling machine. If you're too lazy to do that, now it's a means for the homeless to make a buck, you don't get your deposit back, and the cans still get recycled. For other things the solution isn't obvious. You could require anyone who wants to operate in these industries to post a massive bond of their own money to pay the claims if there are any, but that's just asking for market consolidation. You end up with an abusive monopoly or possibly even nobody willing to offer a product in the market at all. The cure is worse than the disease. In some sense what you need is the opposite. If there are a thousand competitors then there is no one company who can breach a hundred million users. Moreover, there is plenty of competition, so companies that get breached have to worry about reputational harm and customers switching to a competitor. Then you would expect the companies with good long-term records to take over. And then we're back to the problem with credit reporting agencies. The problem is that the victim has no way to opt out of the system. One solid solution would be to eliminate social security numbers whatsoever and otherwise put them out of business. The entire credit system is just a zero-sum bidding war anyway. Making it harder for everyone to get credit only reduces the bidding war for housing and makes it more affordable to everyone.

throwaway2037 6y ago

What a great story. Thank you to share you experience. I wonder if (i) is not enforceable. That said, it is the legal equivalent of David and Goliath to win that case. Even if the clause is legally enforceable, could you win a civil suit on the grounds of negligence (poor service)? Again, maybe, but probably very expensive to discover! I agree: These kinds of clauses should not be allowed. I cannot imagine this same thing happens in EU with GPDR.

zonethundery 6y ago
(i) is enforceable. You could have a negligence claim, but customer (if a regulated entity) is generally required (on a principles basis, not necessarily prescriptive) to do their own due diligence on the adequacy of the vendor's security practices. The shift away from assigning liability to vendors was part of Dodd-Frank, and NYDFS has taken a similar tack with its cybersecurity rules.

AnthonyMouse 6y ago

> I am also comfortable with the fact that may cost more, but at least then the costs will be internalized by the proper actor. The problem with these situations is that liability would induce bankruptcy by a factor of a thousand. If one of these companies screws up, likely they did so for each of their customers, who each have their own customers. Plausibly millions of people, for vendors that aren't exactly Google-sized. So for any non-trivial damages they're out of business and you get three cents on the dollar of your indemnity because so did everybody else. Which is all but worthless. It doesn't even give them much incentive to not screw up, because they're only paying 3% of the damages before they file bankruptcy and start over, which itself only happens if they're unlucky. Plenty of companies would be willing to take those odds and they'll still be the ones with the lowest price. The only way for them to cover the full amount is to buy insurance, but then you have the liability on the wrong party again and they lose the entire incentive to avoid screwing up. We might like to believe that insurance companies have some magic to reduce claims, but mostly they don't and they just spread the cost of the liability across all their customers. So really all you're asking for is a law that forces you to pay extra in order to buy insurance. But can't you already buy insurance from an ordinary liability insurance company instead of the vendor?

kova12 6y ago
There's something wrong with a notion that a single actor can cause enormous damages, spread them out between community members and suffer no consequences, and I'm not even talking about only credit companies. For example, take an action which makes everybody spend an hour of their time. Disposing snail mail for example. Lets say there's 300M people in USA. Lets say only 100M of them are affected. Lets also be charitable and say that an hour of their time is worth $10. That's a 1B damage right away. It is a Fukushima level damage. I don't have a solution, but it is disturbing that we allow actors capable of causing such damage just go do their business, take risks, and if risks don't work out - just file for bankruptcy and suffer essentially no consequences
- AnthonyMouse 6y ago
  The underlying problem is that people are capable of causing more damages than they can cover. If you cause a billion dollars in damages, but you don't have a billion dollars, who pays? Not you, for sure, because you can't. Some of these have decent solutions. We want people to recycle aluminum cans, so we have a deposit which you get back when you take the can to the recycling machine. If you're too lazy to do that, now it's a means for the homeless to make a buck, you don't get your deposit back, and the cans still get recycled. For other things the solution isn't obvious. You could require anyone who wants to operate in these industries to post a massive bond of their own money to pay the claims if there are any, but that's just asking for market consolidation. You end up with an abusive monopoly or possibly even nobody willing to offer a product in the market at all. The cure is worse than the disease. In some sense what you need is the opposite. If there are a thousand competitors then there is no one company who can breach a hundred million users. Moreover, there is plenty of competition, so companies that get breached have to worry about reputational harm and customers switching to a competitor. Then you would expect the companies with good long-term records to take over. And then we're back to the problem with credit reporting agencies. The problem is that the victim has no way to opt out of the system. One solid solution would be to eliminate social security numbers whatsoever and otherwise put them out of business. The entire credit system is just a zero-sum bidding war anyway. Making it harder for everyone to get credit only reduces the bidding war for housing and makes it more affordable to everyone.