I disagree. "You can't use the collected data anymore" is a million times harder to enforce than "pay us ten billion dollars."

> otherwise it will just be risk-assessed.

The key is to make the cost so large that the risk isn't worth it.

What's my geolocation history worth to Google? $20? $200? Make them pay $2,000 if they lose or misuse it.

Sure, maybe they'll buy "data loss insurance". But even then, there will be motivation to do things better. Eg, the insurer will refuse to cover claims where proper encryption wasn't used, will prorate policies based on data collected, etc.

From May 2018 in the EU the maximum fine for a data breach is €20m or 4% of global annual revenue. This is due to the GDPR.[0]

[0] https://en.wikipedia.org/wiki/General_Data_Protection_Regula...

So after a certain point, the bigger the company the lower the fine? 20 million is 0.01% of Apple's turnover.

Whichever is greater, Apple would probably pay about 20 million * 400 (going by 0.01%) => 8 billion dollars.

Which I think would hit Apple rather hard.

4% or 20 million, whichever is greater.

>>>I disagree. "You can't use the collected data anymore" is a million times harder to enforce than "pay us ten billion dollars."

Not especially hard; you send in auditors to delete the collected data from all servers. Oh, that kills the company? Too bad.

It wouldn't fly. And the data may have been "laundered" intentionally or not - used to send emails, get new customers and social media contacts, etc. It may be hard to even trace anymore.

Define 'misuse'.

If they sell ad space based on your geolocation, is that a misuse?

If they sell your geolocation, ip address, and search history together, is that a misuse?

Doesn't that still end up being financial? If someone is banned from collecting data and is later found to have been doing so anyway, the most likely recourse is fines, right? Or are you suggesting this would imply criminal consequences (i.e. jail)?

How about financial plus the CEO, and any management lower provably found negligent, can't work in a role where they have responsibility for data handling (which includes not being superior to anyone who is data handling).

What's wrong with that? You get the socially optimal amount of data collection.