News for hackers. Stuff that matters.

A comment on I'm Testifying to Congress about Data Breaches – What Should I Say?. Parent comment

Re:I'm Testifying to Congress about Data Breaches – What Sho... by nathan_long on Tuesday November 21, 2017 @04:33PM (#15751790)
I disagree. "You can't use the collected data anymore" is a million times harder to enforce than "pay us ten billion dollars."

> otherwise it will just be risk-assessed.

The key is to make the cost so large that the risk isn't worth it.

What's my geolocation history worth to Google? $20? $200? Make them pay $2,000 if they lose or misuse it.

Sure, maybe they'll buy "data loss insurance". But even then, there will be motivation to do things better. Eg, the insurer will refuse to cover claims where proper encryption wasn't used, will prorate policies based on data collected, etc.

[ Parent | on HN ]
Re:I'm Testifying to Congress about Data Breaches – What Sho... by tankenmate on Tuesday November 21, 2017 @04:54PM (#15751962)
From May 2018 in the EU the maximum fine for a data breach is €20m or 4% of global annual revenue. This is due to the GDPR.[0]

[0] https://en.wikipedia.org/wiki/General_Data_Protection_Regula...

[ Parent | on HN ]
Re:I'm Testifying to Congress about Data Breaches – What Sho... by isostatic on Wednesday November 22, 2017 @02:21AM (#15754972)
So after a certain point, the bigger the company the lower the fine? 20 million is 0.01% of Apple's turnover.
[ Parent | on HN ]
Re:I'm Testifying to Congress about Data Breaches – What Sho... by zaarn on Wednesday November 22, 2017 @03:30AM (#15755245)
Whichever is greater, Apple would probably pay about 20 million * 400 (going by 0.01%) => 8 billion dollars.

Which I think would hit Apple rather hard.

[ Parent | on HN ]
Re:I'm Testifying to Congress about Data Breaches – What Sho... by veddan on Wednesday November 22, 2017 @03:10AM (#15755151)
4% or 20 million, whichever is greater.
[ Parent | on HN ]
Re:I'm Testifying to Congress about Data Breaches – What Sho... by patmcc on Tuesday November 21, 2017 @05:29PM (#15752225)
>>>I disagree. "You can't use the collected data anymore" is a million times harder to enforce than "pay us ten billion dollars."

Not especially hard; you send in auditors to delete the collected data from all servers. Oh, that kills the company? Too bad.

[ Parent | on HN ]
Re:I'm Testifying to Congress about Data Breaches – What Sho... by nathan_long on Tuesday November 21, 2017 @06:19PM (#15752632)
It wouldn't fly. And the data may have been "laundered" intentionally or not - used to send emails, get new customers and social media contacts, etc. It may be hard to even trace anymore.
[ Parent | on HN ]
Re:I'm Testifying to Congress about Data Breaches – What Sho... by overhang on Tuesday November 21, 2017 @06:10PM (#15752550)
Define 'misuse'.

If they sell ad space based on your geolocation, is that a misuse?

If they sell your geolocation, ip address, and search history together, is that a misuse?

[ Parent | on HN ]