12 ms·
If this had been exploited and the job applicants to Target, Subway, Dunkin et al, had bank/credit fraud committed in their name's, would the big companies be l
by j-bos 3y ago
If this had been exploited and the job applicants to Target, Subway, Dunkin et al, had bank/credit fraud committed in their name's, would the big companies be liable for not performing due dilligence on chatter.ai? To be clear, I'm asking from a legal standpoint not a practical one.
- mihaaly 3y agoI assume it is more like the chattr.ai where the responsibility falls, except if the companies were using it as a tool and configuring the services falls with them. Down to the contractual circumstances. 'Tool provided works well' vs. 'using the provided tool well' kind of thing I guess.
- qznc 3y agoThere is probably at least one European citizen in there, so GDPR applies.
- MrBruh 3y agoProbably yeah, although it just comes down to if they get Sued or not I guess. NOTE: I am not a legal professional, just making my guess.
- n2d4 3y agoFor more crucial PII (such as SSN, health data, payment info, etc), vendors are generally required to have certifications from a third-party auditor (such as SOC2). If the big companies fail to check that, then yes, they can be made liable.
- adrr 3y agoNo rules or laws that require it. Closest requirement would be PCI around credit cards but you need lots of volume to be required to do an audit. HIPPA just requires you to do risk analysis and implement risk management. SOX is up to the auditor, when I was CTO at a public company, they were fine with me signing at attestation of all things we had implemented. Same with banks, no explicit requirement in both glba and fdic rules. Core bank systems are so old, none of that data is even encrypted neither is network traffic. Stuff is still in cobol. Forcing function would be cyberinsurance policies that typically want to see audit results if you have multi-million dollar policy limits.
- supafastcoder 3y ago> No rules or laws that require it It will just be FTC knocking on your door…
- malfist 3y agoThe FTC will absolutely not knock on your door if you expose users's SSN to the internet.
- jacobr1 3y agoOr the SEC, because one the breach/incident is public, the share price drops and failure to have disclosed those factors prior constitutes "securities fraud." Increasingly this it the default method of corporate regulation.
- adrr 3y agoFTC will come knocking at your door even if you do pass an external audit and have Soc2/soc1/iso certification. Equifax is an example.
- stackskipton 3y agoWho will promptly slap you on the wrist, wag their finger at you and send you on your way.
- throwawaaarrgh 3y agoHIPAA requires that no entity involved leak any PHI or penalties will be applied, you absolutely have to do more than "do risk analysis/management".
- adrr 3y agohttps://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html https://www.hhs.gov/hipaa/for-professionals/security/laws-re...
- zelon88 3y ago
- callalex 3y agoSomeone applying to work at Taco Bell or Subway couldn’t afford a lawyer even if they worked for a full year and saved every penny.
- amenghra 3y agoThat why the existence of class action suits is a good thing (imho). It balances power to some extent. The unfortunate reality is that only the lawyers make money in such cases.