~$0.05 per person affected is a pretty compelling cost avoidance versus having to pay for security and compliance personnel, not to mention potential reputational damages and lost revenue from actually following the rules and telling people you were hacked.

Corporate fines make a lot more sense once you understand they're not there to stop the behavior, they're there to make sure the shakedown ensures the state gets their cut. They don't actually want to destroy the company, they want to be able to keep taking a cut.

That sounds like a conspiracy theory, how would that work in practice, where are the incentives? Does attorney general get a cut of the fine?

The existence of an agency designed just to root out this behavior provides a lot of incentive. The folks who create the agency get say they're doing something about the problem and look good. The folks in the agency get jobs and all that entails.

> existence of an agency designed just to root out this behavior provides a lot of incentive

To enforce. The conspiracy is that regulators are not looking to crack down, they're looking the other way while taking their cut. That's not a terribly predictive model for most American regulators.

Doctors want people to be sick, police wants people to commit crimes, military wants wars. This is a dangerous mindset.

Did they improve their practices after the breach? Sounds like they did:

"Zoetop became independently certified as PCI DSS compliant in April 2019 and has remained so since."

Now I know that PCI DSS is a complete shit, but that's the only tool they have. I'm all for criticizing the state, but sounds like in this case they did their job just fine.

This post is apropos: https://news.ycombinator.com/item?id=33215316

> They don't actually want to destroy the company...

Sure, just like a speeding ticket doesn't get punished with the death penalty. Of course that's not the goal of the fines. Why would you expect it to be?

The fines should be large enough to serve as a deterrent; as a warning to other companies that if they harm the public they'll be punished.

Fines which are a minor nuisance, a small cost of doing business, don't accomplish those goals.

They should wipe years of profits and also pierce the corporate veil. Go after the stock holders and their property if needed. They deserve it.

My college campus had a huge parking problem. One time I got a ride from a classmate, and he rolled up and parked in a clear no parking zone. When I pointed it out, he said "oh I'll just pay the $50 (or whatever) ticket. I always do it when I'm running late for class."

Parking enforcement was happy since they made a bit of money. The student was happy because he got to park in a prime spot for a fee that was insignificant for him. However, if the goal was to stop people from parking in certain areas, the policy failed miserably.

Corporate fines work the same way. If they make $10 from an illegal action and are fined $1 for it, it isn't a deterrence, just a good investment opportunity.

When I was a little kid, I had to go the airport with some distant relatives. One of them parked right next to a "forbidden parking" sign.

So I went up to the owner of the car, and asked, she then cheerfully replied:

"Oh, the parking lot charges 40, the fine is 5, I prefer to pay the fine since it is cheaper!"

Always a chance the car will be towed

This is a solvable problem. Finland's approach is good here; fines are income-based (https://www.theatlantic.com/business/archive/2015/03/finland...). The GDPR similarly imposes a penalty in terms of "percent of annual global revenue".

The point: the goal isn't a corporate death penalty in these sorts of cases.

In Finland's case, if you are filthy wealthy, you should never drive yourself. Hire the cheapest person that is a good driver and pay their tickets for them.

Speeding ticket is actually the perfect analogy of this kind of behavior. Thank you.

If you read past the headline, it's not $0.05, it's $5.07. A 100 times higher. Maybe even more, if you only count New Yorkers that were not notified about the breach (255,294).

How does this even get enforced? Does Shein have any assets in the US? Seems like it's a totally chinese/singapore based company that just mails stuff to other countries.

Shein is also accused of using forced labor [0] and there have been many instances of workers leaving notes in clothing pleading for help [1]

[0]https://impakter.com/how-fast-fashion-giant-reacted-to-help-...

[1]https://www.rollingstone.com/culture/culture-news/shien-tikt...

The second article linked actually debunks the claim that workers have been leaving notes (but does note Shein's labor violations)

Why are they fining Shein’s owner and not Shein themself?

Because it's not just Shein, it's two of the parent company's subsidiaries.