4 ms·

Punishment is complex, but the solution isn’t. It could be mandated that companies are only permitted to request & store information that is necessary to provid

Punishment is complex, but the solution isn’t. It could be mandated that companies are only permitted to request & store information that is necessary to provide the service. A telco literally requires zero data from its users in order to provide a service. Maybe only payment details for postpaid.

p1necone 4y ago
This is basically what GDPR does.
- maxk42 4y ago
  And yet there are still breeches...
  - darekkay 4y ago
    GDPR doesn't prevent breaches, it limits the amount of data being breached.
    - maxk42 4y ago
      T-mobile is headquartered in Germany.
      - darekkay 4y ago
        For GDPR, it does not matter where a company is headquartered. GDPR applies to EU citizens (users, customers). That's why big companies often comply with GDPR for EU citizens but completely ignore it for people outside. It would be interesting to see if that's the case for T-Mobile. If the leak exposes GDPR violations, fines will most likely follow.
      - Nextgrid 4y ago
        When it comes to mobile carriers it's common for them to lease the name off each other as to appear the same even though it's different companies. The T-Mobile from Germany may be a totally different (though equally shitty) company than the T-Mobile we're talking about here.
hn_throwaway_99 4y ago
Part of the problem is caused by regulation. For example, financial companies are required to get reams of highly sensitive data to do KYC checks. The thing is, most companies would greatly prefer NOT to have to access and store this data, but they are legally required to. As a data point, when Stripe came out with their Stripe Identity product, many were surprised that, unlike their credit card processing where a merchant never gets to see any card data, with Stripe Identity the full image of highly sensitive data like drivers' licenses and passports are available to the Stripe clients. But the reason for this is that KYC rules require this data to be available to financial institutions. See top comment on https://news.ycombinator.com/item?id=27502993 https://news.ycombinator.com/item?id=27502993 and Patrick Collison's response. IMO the only way this problem will ever be solvable is with some sort of broad-based tokenization solution. It's just impossible for most large companies to keep this data secure forever.
- SamoyedFurFluff 4y ago
  This isn’t a financial institution though. This is a telco
- u801e 4y ago
  > financial companies are required to get reams of highly sensitive data to do KYC checks. The real problem is that the data is considered sensitive in the first place. It's essentially publicly available data at this point and entities that want to extend credit to a particular individual should not be able to solely rely on that data to extend credit. The law needs to be changed to allow an individual to sue creditors and credit bureaus for libel when they accuse them of failing to pay or defaulting on a line of credit.

p1necone 4y ago

This is basically what GDPR does.

maxk42 4y ago
And yet there are still breeches...
- darekkay 4y ago
  GDPR doesn't prevent breaches, it limits the amount of data being breached.
  - maxk42 4y ago
    T-mobile is headquartered in Germany.
    - darekkay 4y ago
      For GDPR, it does not matter where a company is headquartered. GDPR applies to EU citizens (users, customers). That's why big companies often comply with GDPR for EU citizens but completely ignore it for people outside. It would be interesting to see if that's the case for T-Mobile. If the leak exposes GDPR violations, fines will most likely follow.
    - Nextgrid 4y ago
      When it comes to mobile carriers it's common for them to lease the name off each other as to appear the same even though it's different companies. The T-Mobile from Germany may be a totally different (though equally shitty) company than the T-Mobile we're talking about here.

hn_throwaway_99 4y ago

Part of the problem is caused by regulation. For example, financial companies are required to get reams of highly sensitive data to do KYC checks. The thing is, most companies would greatly prefer NOT to have to access and store this data, but they are legally required to. As a data point, when Stripe came out with their Stripe Identity product, many were surprised that, unlike their credit card processing where a merchant never gets to see any card data, with Stripe Identity the full image of highly sensitive data like drivers' licenses and passports are available to the Stripe clients. But the reason for this is that KYC rules require this data to be available to financial institutions. See top comment on https://news.ycombinator.com/item?id=27502993 https://news.ycombinator.com/item?id=27502993 and Patrick Collison's response. IMO the only way this problem will ever be solvable is with some sort of broad-based tokenization solution. It's just impossible for most large companies to keep this data secure forever.

SamoyedFurFluff 4y ago
This isn’t a financial institution though. This is a telco
u801e 4y ago
> financial companies are required to get reams of highly sensitive data to do KYC checks. The real problem is that the data is considered sensitive in the first place. It's essentially publicly available data at this point and entities that want to extend credit to a particular individual should not be able to solely rely on that data to extend credit. The law needs to be changed to allow an individual to sue creditors and credit bureaus for libel when they accuse them of failing to pay or defaulting on a line of credit.