'Crippling loss'? Haha. Look at the equifax debacle. They set aside some paltry amount of money for the class action, almost instantly ran out and then everyone collectively shrugged.

Regs are rarely ever meant to actually favor the average citizen over the corporation. Just look how quickly the consumer protection agency was killed.

Then they offered free enrollment in their credit protection services.

But... you had to supply a credit card to enroll.

And... after six/twelve months they'd automatically roll you over to their highest tier plan, and start billing you.

It might as well have been a promo scheme.

The CFPB survived the lawsuit against it?

> a fine of $1000 paid to each individual per leak would be a good starting point

They would just fold the company and start another? Most data brokers do not have 3 trillion dollars.

They will need to be insured for that amount then. Can’t afford to insure against that liability? Can’t legally operate.

Agree with this. An insurance requirement would solve this problem. It would also incentivize robust security audits by the insurance companies and the data collectors.

Some people will still get some money. And spinning up a new company still has costs. However, this is precisely why this is the second-best option, after actual jail time for actual CEOs. Then they can fold whatever they want in their prison cells

Can make the board personally liable.

Can't you do this via class action seeking to demonstrate negligence?

At best the fees class action lawyers would charge would change that $1000 into $0.10.

I already pay taxes; why not have the government do their job and protect my digital information and fine the companies and their executives so they learn to care about it. The government allows the corporate barrier to be pierced if employee salaries are not paid.

Personal liability tends to get board members attention.

Stuffed down the memory hole. Before Reagan board members were liable for unpaid non exempt wages. If a company went bankrupt owing hourly workers back wages the bankruptcy court could liquidate the boards assets.

A simple tax on every personal record you hold would work.

While in this collective pipe dream, why not just make it a felony to have unauthorized possession or transmission of this data, make sentencing gravity based on attributes like unsecured, breached, willfully sold, etc?

That sounds like unintended consequences to me.

Could be paid to the person instead of the government

Would be nice, but wouldn't that limit the taxable set of data records to those that have enough info to route payment to? Either paid directly by the company, or enough information for the government to identify you.

I agree with your sentiment but I feel like that's an impossible expectation/standard to set for certain companies that don't have the luxury of dropping data whenever they see fit. For example consumer banks abide by the Bank Secrecy Act which mandates the banks to keep wire records that exceed $100 for at least 5 years.

Then those companies need to take out very expensive insurance policies that protect the individuals whose data they must hold. If they can't afford that then they can find a new line of business.

Also, the money should go into an escrow account with a list of claimants. Some neutral third party should handle getting the checks to individuals.

That way, there's no financial incentive to make it hard to claim damages, and people won't need to bother filling out a form every few weeks to claim the cash.

Best metaphor I've heard is that personal data should be treated like toxic waste. If you're a company that works with it, it should only be because you have to, not because you want to. And then, you want to keep as little of it around as possible. You definitely don't want to leak it, because then the EPA will come down on you like a ton of bricks. All of your processes should be geared toward minimizing or eliminating exposure to it whenever possible.

Unfortunately, companies are incentivized to treat personal data like something to be aggressively gathered and hoarded instead... but not necessarily like something to be guarded against leakage.

How about just jail time for owners, executives, and management of companies/organizations who collect and store this information to begin with? That's what we do for Peeping Toms outside people's windows. I don't see why something more creepy, more invasive, more permanent, and more harmful should be treated less seriously.