4 ms·

I'll take it as being tough when companies are financially liable for data exposure along the same lines of HIPAA. Maybe something akin to: * $10 per element o

by olliej 3y ago

I'll take it as being tough when companies are financially liable for data exposure along the same lines of HIPAA. Maybe something akin to: * $10 per element of data not directly required for legal purposes or for the direct provision of services explicitly requested by customers (e.g. their shipping address) * $2 for element of data not legally mandated. For data stored to meet legal data retention requirements: * If the law requires that information be made available in a fully automated and online manner, then $0.50 per element of data, and $5 per element of data from the government (state vs federal) that mandated the data be stored and accessible * If the law does not require fully automated online access, then if the data is not encrypted such that it requires concurrent action by multiple employees to decrypt, then it's $100/data (e.g. no claiming it's needed for legal reasons but keeping it accessible for profit reasons). Essentially, make it so customer data is not purely a balance sheet asset. Also make it so credit agencies knowingly reporting incorrect information is a crime, and make them liable for all costs incurred (higher interest rates) and financial penalties for extreme cases (refusing loans outright, refusing rental, demanding higher deposits, etc). The fact that the agencies themselves are selling "monitoring services" shows that they are aware that their reporting is fraudulent.

balderdash 3y ago
There should also be a sliding scale element e.g. fines doubled if for more than 100k customers affected, if over a million the greater of 20% of gross profit or 10x the fine…etc.
everforward 3y ago
I would make it even simpler. If a company is breached and customer data is stolen, the company is liable as a coconspirator via negligence to any resulting fraud or scam claims on affected customers. They may make an affirmative defense that the scam was not due to their breach, if they can prove their leaked data was not used. > Also make it so credit agencies knowingly reporting incorrect information is a crime, and make them liable for all costs incurred (higher interest rates) and financial penalties for extreme cases (refusing loans outright, refusing rental, demanding higher deposits, etc). This is already a thing, under US libel laws. Not 100% sure about the damages and how they would be calculated, but they are liable. The underlying issue is that I'm doubtful they ever "knowingly" lie. They're basically information aggregators; other people report info to them and they republish it. They might suspect some entries of being unreliable, but I don't think they ever truly know. They live on probabilities. A second underlying issue is that the government has consistently exempted credit agencies from normal applications of libel. Presuming you aren't famous enough to be a public figure, under normal libel law you would only have to demonstrate that a) the information is incorrect (regardless of whether they think it's true or not), b) that they distributed it, and c) that it was written (spoken would be defamation instead of libel). If you are a public official or public figure, you would also have to show actual malice (intent to harm, or reckless disregard for the truth). The government (the judiciary, really) has consistently applied the malice standard to private citizens under the argument that the system provides substantial benefits to it's users (businesses) and that it effectively cannot exist with normal libel laws. The malice part effectively shields them from all claims. It's an incredibly high bar to reach, because it's also what protects newspapers from drowning in libel claims. So we're granting credit agencies reporting on private citizens the same protections as a newspaper reporting on the president. Any significant changes to credit agencies would need to start with rolling back their libel protections to some degree to make them actually liable for what they publish.

by olliej 3y ago

balderdash 3y ago

There should also be a sliding scale element e.g. fines doubled if for more than 100k customers affected, if over a million the greater of 20% of gross profit or 10x the fine…etc.

everforward 3y ago

I would make it even simpler. If a company is breached and customer data is stolen, the company is liable as a coconspirator via negligence to any resulting fraud or scam claims on affected customers. They may make an affirmative defense that the scam was not due to their breach, if they can prove their leaked data was not used. > Also make it so credit agencies knowingly reporting incorrect information is a crime, and make them liable for all costs incurred (higher interest rates) and financial penalties for extreme cases (refusing loans outright, refusing rental, demanding higher deposits, etc). This is already a thing, under US libel laws. Not 100% sure about the damages and how they would be calculated, but they are liable. The underlying issue is that I'm doubtful they ever "knowingly" lie. They're basically information aggregators; other people report info to them and they republish it. They might suspect some entries of being unreliable, but I don't think they ever truly know. They live on probabilities. A second underlying issue is that the government has consistently exempted credit agencies from normal applications of libel. Presuming you aren't famous enough to be a public figure, under normal libel law you would only have to demonstrate that a) the information is incorrect (regardless of whether they think it's true or not), b) that they distributed it, and c) that it was written (spoken would be defamation instead of libel). If you are a public official or public figure, you would also have to show actual malice (intent to harm, or reckless disregard for the truth). The government (the judiciary, really) has consistently applied the malice standard to private citizens under the argument that the system provides substantial benefits to it's users (businesses) and that it effectively cannot exist with normal libel laws. The malice part effectively shields them from all claims. It's an incredibly high bar to reach, because it's also what protects newspapers from drowning in libel claims. So we're granting credit agencies reporting on private citizens the same protections as a newspaper reporting on the president. Any significant changes to credit agencies would need to start with rolling back their libel protections to some degree to make them actually liable for what they publish.