And it generally works pretty well. In the law, the government lays out rough things it wants to see (e.g. access restrictions, auditing logs, etc) + penalties (financial and otherwise) and then lets the industry find a way to meet them. Furthermore, there's a legal distinction between willful and accidental non-compliance.
It's absolutely added cost, but generally seems to accomplish its privacy intent.
I've worked as a developer with health care providers and insurance companies for 5 years, and other than it being annoying as "some regulation exists" no one I've talked to feels it's a bad solution to the problem.
Asking industries to be happy about privacy regulation seems an unreasonable goalpost.
Besides, I’d be willing to bet that those at Equifax would have similar things to say about a comparable credit reporting law, just like how some medical practitioners don’t like HIPAA.
I just googled it, and it was the first result
My definition: the most efficient has the least wasted effort and the maximum productivity.
I do not think having individuals & classes going off and suing everyone they can, every company buying piles of insurance against these suits (because how could they reasonably guarantee perfect privacy?) and having insurance providers coming to evaluate each institution...
This is only legally efficient, in that it requires the least amount of nuance in law.
There's a reason we have public infrastructure and services, and it is for efficiency.
Maybe do it state-by-state, so long as each state follows some federal guidelines and each state provides a way to interoperate with the rest, and with private businesses that need access to that information, if the feds freak you out.
Why?
Because I can, in theory, have my say in how the government operates. I can vote, I can submit comments, I can go talk to elected officials, whatever. I have zero recourse when private companies schlep my data around and wreck my life. Voting with your vote is best, but I can't even vote with my dollar with Equifax.
Firstly, examples of governments that have any people voted in at all are cherry-picked. Around the world, there are governments that are not voted in, or are "voted" in by a sham process which only has the external appearances of democracy.
Secondly, in democracies, a fairly common pattern is that the government consists of some seats that are voted in (parliament) plus some that are appointed (senate). The power is divided accordingly. (A minor point is that it is not uncommon for the leader of the elected party to appoint people for the uppermost staff positions: a so-called "cabinet" or whatever.)
Thirdly, government in the broad sense includes not only the parliament and senate political structure but all of the institutions of the government that actually get various things done throughout the governed region, and all the levels of bureaucracy employing large numbers of people. All of that staff is not elected; they are just people hired into positions and they generally keep those positions across government changes. That bureaucracy has considerable power of its own; not every single decision they make which affects you goes through a parliamentarian that you elected!
Two, yes, many of the highest profile, and most powerful, positions are elected. And in practice, over time, this means that these positions have selected for people who are 'electable' - which has itself over time come to mean people who can raise huge amounts of campaign money. This is a deeply corruptible situation, if indeed it is not already deeply corrupted.
I agree with the idea that open public oversight is a powerful corrective, and is a major difference between private organizations and public ones with effective means for perceiving and removing corrupt officials. I think it is highly questionable to what degree the latter describes our current situation in much even of the democratized West.
One problem. She didn't know that she had been pregnant and suffered a near fatal (to her) complication and miscarriage 7.5 months ago. Only a few parties were aware of this: My family (not posted on Facebook), two health insurance companies, the hospital, two pharmacies and the Ob/Gyn practice. Last week would have been the due date.
One of more of those entities, who are all supposed to protecting her privacy failed to do so to extract a few more bucks.
I would suggest that that is not "failing to protect" private data, but "actively exploiting".
A minor but strategic change in liability law around privacy would shift incentives in the way you describe and suddenly it becomes in the best financial interests of the companies to protect the data. Indeed this is the only kind of incentive they will respond to.
Nationalizing the credit industry doesn't really solve any real problems as far as I can tell.