5 ms·
If these kinds of breaches were actually costly, then people would indeed treat PII as toxic. But they aren't. The media brouhaha blows over within a week or so
by jwr 4mo ago
If these kinds of breaches were actually costly, then people would indeed treat PII as toxic. But they aren't. The media brouhaha blows over within a week or so, and things are fine again.
Leaking PII should be very, very expensive, and then this idiocy would stop.
- nicbou 4mo agoThis one is a clear breach of the GDPR. If the Spanish enforcers have any teeth, there will be a hefty fine.
- runroader 4mo agoIt looks like Spain is the most aggressive about pursuing cases, but they also settle for smaller fines than other countries. https://www.enforcementtracker.com/statistics https://www.enforcementtracker.com/statistics
- delta_p_delta_x 4mo ago> Leaking PII should be very, very expensive It should be criminal to leak PII, and company leadership should face imprisonment.
- animuchan 4mo agoYes please! Making PII leaks an expense (like rent and cloud costs) means it's paid by the customer. I strongly believe we should distinguish the price of doing the operation (aka rent) and the price of doing crime (ideally, jail).
- philipallstar 4mo agoEverything is paid for by the customer. If you spend an absolute fortune protecting someone's named and address combination, that will be paid for by the customer.
- deleted 4mo ago[deleted]
- animuchan 4mo agoYep -- and it's good. Before: customer pays fines for bad security, rolled into the price of the offering. After: customer pays for actual good security, rolled into the price of the offering. If the customer doesn't care, no change. If the customer cares (and let's low key assume PII is important) -- they see net gain from this change.
- bigfishrunning 4mo agoIf only! I would much rather the bill go up then my information get leaked. But instead, I get both.
- zahlman 4mo ago> If you spend an absolute fortune protecting someone's named and address combination, that will be paid for by the customer. And then you get your lunch eaten by a competitor who understands that the PII is unnecessary for the business relationship. But only if that externality is actually accounted for in regulation.
- nroets 4mo agoThen over confident, short sighted or shady characters will accept those directorships and/or sign off on the design because they think nothing will happen or don't care for jail.
- cucumber3732842 4mo agoSo then the customer will just pay more, because the "prevent you from getting fined into oblivion" insurance businesses you just created with the flick of a pen will need to get paid their overhead and won't do it without a profit.
- tiahura 4mo agoI shouldn't be able to say your name? What sort of authoritarian regime do people like you want?
- tiahura 4mo agoI shouldn't be able to say your name? There's always a budding authoritarian ready to trample freedom of expression for the common good.
- paulddraper 4mo agoI used to have a book dropped off at my house that had the names, phone numbers, and physical addresses of everyone in my area.
- FatherOfCurses 4mo agoAre you seriously comparing an analog phonebook to machine-searchable structured data made available in a data breach?
- paulddraper 4mo agoI'm saying allowing distributing books but criminalizing distributing the digital version is an overrotation. As much as extreme viewpoints play well on the internet.
- delta_p_delta_x 4mo agoWhat you didn't have was a computerised database which could spam everyone on that list in milliseconds, or profile everyone's character, purchase history, medical history, and more. We used to do a lot of worse stuff too, like eat radium hoping for brighter skin.
- pylua 4mo agoEvery time I send a work email I leak my pii. We should all use government issued uuids on linked in / facebook.
- Tangurena2 4mo agoThe Payment Card Industry takes breaches deadly seriously. It is my opinion that any organization that collects PII should be held to the same standard (and penalties) that any organization that collects/processes credit card information. https://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Security_Standard https://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Sec...
- NoSalt 4mo ago> "If these kinds of breaches were actually costly, then people would indeed treat PII as toxic." But they are costly ... just not to big business or government. They couldn't give two flips about our misery.