3 ms·

So the answer is to put the same kind of onerous penalties that companies pay for leaking healthcare data and apply them to any PII / user data. If it can't hit

So the answer is to put the same kind of onerous penalties that companies pay for leaking healthcare data and apply them to any PII / user data. If it can't hit the bottom line bigcorps don't care; liability is the only language they understand.

reaperducer 2y ago
So the answer is to put the same kind of onerous penalties that companies pay for leaking healthcare data and apply them to any PII / user data Then you get people on HN shouting "regulatory capture!" and "stifling innovation!"
- infogulch 2y ago
  Yeah it sucks, but what can you do when you have titanic amoral agents stomping through society? You gotta speak their language. Maybe scale the penalty with the size of the company.
- jjmarr 2y ago
  You have to provide your email to sign up for HN, however, it is not publicly visible. If YCombinator had to pay $10,000 for leaking a user email, this site isn't going to exist since it's not their core business and represents a huge liability. It's also disproportionate. If my email is leaked in the context of receiving treatment for a stigmatized disease, that's a lot worse than an MMORPG leaking my real name. Maybe some penalty is necessary but $10k or above per user is disproportionate for the vast majority of people. A $50/person penalty with gradations for sensitivity of the information is going to work better in practice. If leaking an SSN is more expensive than an email or site-specific ID, corporations might stop using SSNs to identify people to reduce their exposure
  - pbhjpbhj 2y ago
    Have the C-suite hand back their compensation above minimum wage for the last 3 years. Fine the company, all profits, or a percentage of global revenue (and pay that back to customers). If the outcome of ignoring data security is to not make any money then companies will actually do something about it. Penalities should push the company to the point of failing.
- robertlagrant 2y ago
  > Then you get people on HN shouting "regulatory capture!" and "stifling innovation!" You phrasing it like this is not a substitute for explaining why it wouldn't be those things. Also, the most obvious thing is: if you're a healthcare provider, you would probably hire some hackers to go after your competition, and let heavy-handed fines take them down. Much easier than providing better value.
  - terribleperson 2y ago
    Wouldn't that strongly incentivize companies to secure their data better, thereby achieving the goal?
    - robertlagrant 2y ago
      It might achieve that goal, at the too-high expense of other things.
theoreticalmal 2y ago
Then I (a normal user) find myself in the position of my data being stolen/mishandled AND have to either pay for it via increase fees, or my healthcare provider goes belly-up and I have to find a new one.

reaperducer 2y ago

So the answer is to put the same kind of onerous penalties that companies pay for leaking healthcare data and apply them to any PII / user data Then you get people on HN shouting "regulatory capture!" and "stifling innovation!"

infogulch 2y ago
Yeah it sucks, but what can you do when you have titanic amoral agents stomping through society? You gotta speak their language. Maybe scale the penalty with the size of the company.
jjmarr 2y ago
You have to provide your email to sign up for HN, however, it is not publicly visible. If YCombinator had to pay $10,000 for leaking a user email, this site isn't going to exist since it's not their core business and represents a huge liability. It's also disproportionate. If my email is leaked in the context of receiving treatment for a stigmatized disease, that's a lot worse than an MMORPG leaking my real name. Maybe some penalty is necessary but $10k or above per user is disproportionate for the vast majority of people. A $50/person penalty with gradations for sensitivity of the information is going to work better in practice. If leaking an SSN is more expensive than an email or site-specific ID, corporations might stop using SSNs to identify people to reduce their exposure
- pbhjpbhj 2y ago
  Have the C-suite hand back their compensation above minimum wage for the last 3 years. Fine the company, all profits, or a percentage of global revenue (and pay that back to customers). If the outcome of ignoring data security is to not make any money then companies will actually do something about it. Penalities should push the company to the point of failing.
robertlagrant 2y ago
> Then you get people on HN shouting "regulatory capture!" and "stifling innovation!" You phrasing it like this is not a substitute for explaining why it wouldn't be those things. Also, the most obvious thing is: if you're a healthcare provider, you would probably hire some hackers to go after your competition, and let heavy-handed fines take them down. Much easier than providing better value.
- terribleperson 2y ago
  Wouldn't that strongly incentivize companies to secure their data better, thereby achieving the goal?
  - robertlagrant 2y ago
    It might achieve that goal, at the too-high expense of other things.

theoreticalmal 2y ago

Then I (a normal user) find myself in the position of my data being stolen/mishandled AND have to either pay for it via increase fees, or my healthcare provider goes belly-up and I have to find a new one.