4 ms·
If there was some kind of fixed minimum compensation - even a single dollar per affected person - and strict liability (doesn't matter how you allegedly did eve
by tgsovlerkhgsel 1mo ago
If there was some kind of fixed minimum compensation - even a single dollar per affected person - and strict liability (doesn't matter how you allegedly did everything to protect the data, if it leaked it's on you), companies would suddenly be very motivated to a) secure b) minimize the data they hold.
Without penalties, e.g. Hertz has little reason not to keep 10+ years of drivers licenses just in case they come in useful in a fraud case or as ML training data later. If having the data was a $153 million liability, they'd think twice.
- tencentshill 1mo agoMake Customer Data a Liability
- MaKey 1mo agoI'm in Europe and got ~$350 because of three data leaks. The amount per instance was vastly different though - $255, $80 and $15.
- consp 1mo agoI'd be very interested in which ones, since I've never received anything despite being in several big breaches (and have received the boatload of spam to prove it). I'm pretty sure this is very country specific.
- MaKey 1mo agoI can't say which ones as it is one condition of the settlement agreements not to talk about specifics and I gave numbers already. You don't get compensations automatically. I pursued them with the help of a specialized law firm that takes a cut of the settlements.
- cbolton 1mo agoWhat did you do to get the money?
- MaKey 1mo agoThere are law firms that pursue the compensations for you and take a cut of them as payment. I used one of them.
- veunes 1mo agoData minimization becomes a lot less abstract once every unnecessary record on disk has an actual dollar value attached to the risk
- 2OEH8eoCRo0 1mo agoI concur. Liability would go a long way.
- iAMkenough 1mo agoIf we end up punishing Hertz for the data their private contractor stores, I hope we apply the same logic to local law enforcement agencies and their private surveillance contractors.
- seniorThrowaway 1mo agoCriminal liability for the corporate officers is the correct approach. Can't pass jailtime on to the consumers.
- autoexec 1mo agoSome companies have so much money that there's no fine which would ever be punitive enough to matter to them. I'd bet jail time for executives could be extremely effective though.
- tgsovlerkhgsel 1mo agoThe fine doesn't have to be higher than the company's profit to matter. If it's bigger than the profit from keeping the data and significant enough to warrant allocating resources to care about it (tens of millions might be enough here), they'll have a small team work on data minimization not because it's the right thing to do, but because it's the cheap thing to do.