3 ms·

I agree with the sentiment here, but I'm not sure how that could ever really be implemented. Our laws shouldn't punish people for honestly doing the best they

I agree with the sentiment here, but I'm not sure how that could ever really be implemented. Our laws shouldn't punish people for honestly doing the best they know how to, especially with a caveat that it doesn't matter if it was industry standard. Not only is that confusing and at serious risk of punishing all the wrong people, it creates incentives to help hack your competition and throw them to the legal wolves.

cuu508 3y ago
> Our laws shouldn't punish people for honestly doing the best they know how to Sure, but holding on to data you do not strictly need is not doing the best
- AnthonyMouse 3y ago
  Sometimes there is data you do strictly need but it's still sensitive. Then someone finds 0-day and relieves you of it. It would not be just or prudent for this to bankrupt anyone it happens to, who is just as much a victim as the person whose data it is.
- _heimdall 3y ago
  Who gets to decide what data is needed? I'd argue that my bank doesn't need to retain details of my transactions, only the amount paid/owed. For sure they don't need that data indefinitely. Do I legally go after them because I don't think they need that data? And does the defendant in such a case just need to provide any potential use case for a specific piece of data they store?
  - cuu508 3y ago
    What you should do when you believe your bank is mishandling your personal information depends on your local laws. In European countries, you would first contact your bank and get them to clarify precisely what data they are storing about you, and what legal basis they are relying on to do so (they should have this already available in their privacy policy, so perhaps you would just go and read that). If the bank refuses to answer, or if you disagree with them about the lawfulness of processing your data, you would then file a complaint with your local data protection authority. After the DPA is done with the case if you disagree with their conclusion, the next step would be to go to the court.
vharuck 3y ago
The government should assign punishing penalties for leaks that scale with the quantity and invasiveness of the data, and help grow an insurance industry for paying those penalties. That way, the law dictates how "bad" leaks are with fines, and the insurers encourage/require best practices. Externalities become internalities.
- _heimdall 3y ago
  Wouldn't assigning leaks a specific value and creating an industry to insure against it make it easier to weigh the relative risk of cutting corners and ignoring risk? If anything, an insurance policy for it allows the companies to externalize and distribute the fines.

cuu508 3y ago

> Our laws shouldn't punish people for honestly doing the best they know how to Sure, but holding on to data you do not strictly need is not doing the best

AnthonyMouse 3y ago
Sometimes there is data you do strictly need but it's still sensitive. Then someone finds 0-day and relieves you of it. It would not be just or prudent for this to bankrupt anyone it happens to, who is just as much a victim as the person whose data it is.
_heimdall 3y ago
Who gets to decide what data is needed? I'd argue that my bank doesn't need to retain details of my transactions, only the amount paid/owed. For sure they don't need that data indefinitely. Do I legally go after them because I don't think they need that data? And does the defendant in such a case just need to provide any potential use case for a specific piece of data they store?
- cuu508 3y ago
  What you should do when you believe your bank is mishandling your personal information depends on your local laws. In European countries, you would first contact your bank and get them to clarify precisely what data they are storing about you, and what legal basis they are relying on to do so (they should have this already available in their privacy policy, so perhaps you would just go and read that). If the bank refuses to answer, or if you disagree with them about the lawfulness of processing your data, you would then file a complaint with your local data protection authority. After the DPA is done with the case if you disagree with their conclusion, the next step would be to go to the court.

vharuck 3y ago

The government should assign punishing penalties for leaks that scale with the quantity and invasiveness of the data, and help grow an insurance industry for paying those penalties. That way, the law dictates how "bad" leaks are with fines, and the insurers encourage/require best practices. Externalities become internalities.

_heimdall 3y ago
Wouldn't assigning leaks a specific value and creating an industry to insure against it make it easier to weigh the relative risk of cutting corners and ignoring risk? If anything, an insurance policy for it allows the companies to externalize and distribute the fines.