5 ms·
This will continue until we make having a huge collection of personal data into a liability and not an asset for companies. Actual jail terms for CEOs for leaks
by dmitrygr 2y ago
This will continue until we make having a huge collection of personal data into a liability and not an asset for companies. Actual jail terms for CEOs for leaks would be a wonderful start. Or, at least, we should have fines that are not wrist-slaps. For example, a fine of $1000 paid to each individual per leak would be a good starting point. Then, companies will properly start minimizing the amount of data they store, in fear of a crippling loss.
- hedora 2y agoAlso, the money should go into an escrow account with a list of claimants. Some neutral third party should handle getting the checks to individuals. That way, there's no financial incentive to make it hard to claim damages, and people won't need to bother filling out a form every few weeks to claim the cash.
- robertonoa 2y ago> a fine of $1000 paid to each individual per leak would be a good starting point They would just fold the company and start another? Most data brokers do not have 3 trillion dollars.
- dmitrygr 2y agoSome people will still get some money. And spinning up a new company still has costs. However, this is precisely why this is the second-best option, after actual jail time for actual CEOs. Then they can fold whatever they want in their prison cells
- Gibbon1 2y agoCan make the board personally liable.
- tithe 2y agoCan't you do this via class action seeking to demonstrate negligence?
- csdreamer7 2y agoAt best the fees class action lawyers would charge would change that $1000 into $0.10. I already pay taxes; why not have the government do their job and protect my digital information and fine the companies and their executives so they learn to care about it. The government allows the corporate barrier to be pierced if employee salaries are not paid.
- Gibbon1 2y agoPersonal liability tends to get board members attention. Stuffed down the memory hole. Before Reagan board members were liable for unpaid non exempt wages. If a company went bankrupt owing hourly workers back wages the bankruptcy court could liquidate the boards assets.
- gagagaga7 2y agoThey will need to be insured for that amount then. Can’t afford to insure against that liability? Can’t legally operate.
- dcist 2y agoAgree with this. An insurance requirement would solve this problem. It would also incentivize robust security audits by the insurance companies and the data collectors.
- wing-_-nuts 2y ago'Crippling loss'? Haha. Look at the equifax debacle. They set aside some paltry amount of money for the class action, almost instantly ran out and then everyone collectively shrugged. Regs are rarely ever meant to actually favor the average citizen over the corporation. Just look how quickly the consumer protection agency was killed.
- JackYoustra 2y agoThe CFPB survived the lawsuit against it?
- FireBeyond 2y agoThen they offered free enrollment in their credit protection services. But... you had to supply a credit card to enroll. And... after six/twelve months they'd automatically roll you over to their highest tier plan, and start billing you. It might as well have been a promo scheme.
- pknomad 2y agoI agree with your sentiment but I feel like that's an impossible expectation/standard to set for certain companies that don't have the luxury of dropping data whenever they see fit. For example consumer banks abide by the Bank Secrecy Act which mandates the banks to keep wire records that exceed $100 for at least 5 years.
- brewdad 2y agoThen those companies need to take out very expensive insurance policies that protect the individuals whose data they must hold. If they can't afford that then they can find a new line of business.
- toomuchtodo 2y agohttps://news.ycombinator.com/item?id=40203558 https://news.ycombinator.com/item?id=40203558
- ipaddr 2y agoA simple tax on every personal record you hold would work.
- flemhans 2y agoCould be paid to the person instead of the government
- fwip 2y agoWould be nice, but wouldn't that limit the taxable set of data records to those that have enough info to route payment to? Either paid directly by the company, or enough information for the government to identify you.
- nox101 2y agoThat sounds like unintended consequences to me.
- robertonoa 2y agoWhile in this collective pipe dream, why not just make it a felony to have unauthorized possession or transmission of this data, make sentencing gravity based on attributes like unsecured, breached, willfully sold, etc?
- CamperBob2 2y agoBest metaphor I've heard is that personal data should be treated like toxic waste. If you're a company that works with it, it should only be because you have to, not because you want to. And then, you want to keep as little of it around as possible. You definitely don't want to leak it, because then the EPA will come down on you like a ton of bricks. All of your processes should be geared toward minimizing or eliminating exposure to it whenever possible. Unfortunately, companies are incentivized to treat personal data like something to be aggressively gathered and hoarded instead... but not necessarily like something to be guarded against leakage.
- mindslight 2y agoHow about just jail time for owners, executives, and management of companies/organizations who collect and store this information to begin with? That's what we do for Peeping Toms outside people's windows. I don't see why something more creepy, more invasive, more permanent, and more harmful should be treated less seriously.