5 ms·

According to this report [1] the appeal was about specific requirements like encryption, and he claimed he had delegated it. So it is clear that it is hard to a

According to this report [1] the appeal was about specific requirements like encryption, and he claimed he had delegated it. So it is clear that it is hard to actually hold people responsible. > The appellate court rejected the prosecution's argument and dismissed all charges. In its unanimous decision, the court stated that neither the GDPR nor the applicable Finnish healthcare legislation required encryption or pseudonymisation of patient data at the time in question. > Prosecutors alleged that Tapio knew about the March 2019 breach and failed to act. They claimed he neglected legal obligations to report and document the incident and did not take sufficient steps to protect the database. Tapio denied the claims, saying he was unaware of the breach until autumn 2020 and had delegated technical oversight to external IT professionals. > The court found there was no clear legal requirement at the time obliging Tapio, as CEO, to take the specific security measures cited by the prosecution. These included firewall management, password policies, access controls, VPN implementation, and security updates. > According to the ruling, the failure to adopt such measures did not, in the court’s view, constitute criminal negligence under Finnish law. > Tapio’s conduct during and after the 2019 breach did not meet the threshold for criminal liability, the court concluded. [1] https://www.helsinkitimes.fi/finland/finland-news/domestic/28328-court-clears-former-vastaamo-ceo-ville-tapio-of-data-protection-charges.html?tmpl=component&layout=default https://www.helsinkitimes.fi/finland/finland-news/domestic/2...

blell 9mo ago
No, it’s just that it’s crazy to hold the CEO liable for absolutely everything that can go wrong.
- butvacuum 9mo ago
  Privatize the gains and socialize the losses. egh?
- arresin 9mo ago
  So who?
- IshKebab 9mo ago
  It's normally the company directors that are personally liable.
- HighGoldstein 9mo ago
  Is it sane to reward them for almost absolutely everything that goes right? Because that's the status quo for this position.
- nkrisc 9mo ago
  But this is not “absolutely everything”. No one is saying CEOs should be accountable for every action of an individual employee. So if not the CEO, who is accountable when something like this breach happens? The CTO? The PM The DBA? Nobody? Maybe they’ll care developer who wrote the code or botched the configuration should be prosecuted? CEOs can justify their pay be being accountable for what their company does. They’re the CEO, after all. Maybe they’ll care more when they have some actual skin in the game.
  - galangalalgol 9mo ago
    When a bridge fails, it is the professional engineer that signed off on that part. If you want someone to sign off on software or IT you will need to pay them quite a lot.
    - nkrisc 9mo ago
      Yes, I would expect compensation to increase proportionally with accountability. What makes no sense is compensation that increases irrespective of accountability. Being the CEO of a company that handles risky, sensitive things should be risky for the CEO, personally. And their compensation can reflect that.
      - QuantumNomad_ 9mo ago
        In other words, they need to hire people whose job it is to “please”. Provide Legal Exculpation and Sign Everything https://how-i-met-your-mother.fandom.com/wiki/Provide_Legal_Exculpation_and_Sign_Everything https://how-i-met-your-mother.fandom.com/wiki/Provide_Legal_...
        nkrisc 9mo ago
        That could be outlawed as well as it probably wouldn’t be too difficult to show that person wasn’t actually making any of the decisions. Not that I expect any of this will ever happen.
    - 9mo ago
- fifilura 9mo ago
  The CEO is responsible for ensuring that there is a routine for security. If that is not created -> CEO responsibility. If that is not followed -> top level mgmt responsibility. And so on, further down the chain.
- louthy 9mo ago
  > “absolutely everything” It isn’t absolutely everything, it’s for negligence. If you don’t have basics in place, like independent pen-tests, ISO 27001 audits — or some equivalent — when you’re handling clinical data, then that’s negligence. If a breach happens and you were seen to have followed best practice, you won’t be found criminally negligent. That is part of being an executive. The buck stops with you — if you’re an executive, you’d better understand your obligations, you get the big bucks for a reason, it isn’t just a fancy job title. Other people in the organisation can be held accountable for criminal acts, but when it comes to criminal negligence, it’s the executives that are liable, because it’s a systemic failure and you’re deemed to be in-charge of the system.
  - hiAndrewQuinn 9mo ago
    >if you’re an executive [...] you get the big bucks for a reason In Finland? Notably wage-compressed Finland? No comment on the specifics of this case, I agree with you that the executive should be where the buck stops. But you would be surprised how many various execs I have met here over the years who admit behind closed doors they really do treat it as a fancy job title that barely pays above their last position, but comes with 3x the stress, and they do it simply because, well, someone has to. You can't really be surprised that most of the folks here who you might want to be in the C-suite decide it's just not worth it, that remaining a middle manager or even an IC is simply a far better value proposition.
    - anoncto97 9mo ago
      Posting anonymously here. I was on the leadership team of a Nordic public company, reporting to the CEO, presenting to the board and representing the company at the AGM. Total comp a little under $200k. The compensation really didn’t match what you take on in terms of responsibility and legal liability. The stress was significant too. That said, as you point out, the work needs doing. Recommended if you have an over-active sense of duty, not otherwise.
    - louthy 9mo ago
      > In Finland? Notably wage-compressed Finland? It's all relative.
- wolvoleo 9mo ago
  Well this is why they get paid so much isn't it? Because they carry the responsibility.

blell 9mo ago

No, it’s just that it’s crazy to hold the CEO liable for absolutely everything that can go wrong.

butvacuum 9mo ago
Privatize the gains and socialize the losses. egh?
arresin 9mo ago
So who?
IshKebab 9mo ago
It's normally the company directors that are personally liable.
HighGoldstein 9mo ago
Is it sane to reward them for almost absolutely everything that goes right? Because that's the status quo for this position.
nkrisc 9mo ago
But this is not “absolutely everything”. No one is saying CEOs should be accountable for every action of an individual employee. So if not the CEO, who is accountable when something like this breach happens? The CTO? The PM The DBA? Nobody? Maybe they’ll care developer who wrote the code or botched the configuration should be prosecuted? CEOs can justify their pay be being accountable for what their company does. They’re the CEO, after all. Maybe they’ll care more when they have some actual skin in the game.
- galangalalgol 9mo ago
  When a bridge fails, it is the professional engineer that signed off on that part. If you want someone to sign off on software or IT you will need to pay them quite a lot.
  - nkrisc 9mo ago
    Yes, I would expect compensation to increase proportionally with accountability. What makes no sense is compensation that increases irrespective of accountability. Being the CEO of a company that handles risky, sensitive things should be risky for the CEO, personally. And their compensation can reflect that.
    - QuantumNomad_ 9mo ago
      In other words, they need to hire people whose job it is to “please”. Provide Legal Exculpation and Sign Everything https://how-i-met-your-mother.fandom.com/wiki/Provide_Legal_Exculpation_and_Sign_Everything https://how-i-met-your-mother.fandom.com/wiki/Provide_Legal_...
      - nkrisc 9mo ago
        That could be outlawed as well as it probably wouldn’t be too difficult to show that person wasn’t actually making any of the decisions. Not that I expect any of this will ever happen.
  - 9mo ago
fifilura 9mo ago
The CEO is responsible for ensuring that there is a routine for security. If that is not created -> CEO responsibility. If that is not followed -> top level mgmt responsibility. And so on, further down the chain.
louthy 9mo ago
> “absolutely everything” It isn’t absolutely everything, it’s for negligence. If you don’t have basics in place, like independent pen-tests, ISO 27001 audits — or some equivalent — when you’re handling clinical data, then that’s negligence. If a breach happens and you were seen to have followed best practice, you won’t be found criminally negligent. That is part of being an executive. The buck stops with you — if you’re an executive, you’d better understand your obligations, you get the big bucks for a reason, it isn’t just a fancy job title. Other people in the organisation can be held accountable for criminal acts, but when it comes to criminal negligence, it’s the executives that are liable, because it’s a systemic failure and you’re deemed to be in-charge of the system.
- hiAndrewQuinn 9mo ago
  >if you’re an executive [...] you get the big bucks for a reason In Finland? Notably wage-compressed Finland? No comment on the specifics of this case, I agree with you that the executive should be where the buck stops. But you would be surprised how many various execs I have met here over the years who admit behind closed doors they really do treat it as a fancy job title that barely pays above their last position, but comes with 3x the stress, and they do it simply because, well, someone has to. You can't really be surprised that most of the folks here who you might want to be in the C-suite decide it's just not worth it, that remaining a middle manager or even an IC is simply a far better value proposition.
  - anoncto97 9mo ago
    Posting anonymously here. I was on the leadership team of a Nordic public company, reporting to the CEO, presenting to the board and representing the company at the AGM. Total comp a little under $200k. The compensation really didn’t match what you take on in terms of responsibility and legal liability. The stress was significant too. That said, as you point out, the work needs doing. Recommended if you have an over-active sense of duty, not otherwise.
  - louthy 9mo ago
    > In Finland? Notably wage-compressed Finland? It's all relative.
wolvoleo 9mo ago
Well this is why they get paid so much isn't it? Because they carry the responsibility.