Hacker News new | ask | show | jobs
by lesuorac 1460 days ago
I dunno, we seem to issue fines a lot nowadays and the behavior doesn't change.

What even would the the expected value for a fine in this situation? It seems overly complex to calculate as I don't think even the FTC tried to put a value of the damages from the sale of the person information.
2 comments
adrr 1460 days ago
Fines or threat of jail time is just trying treating the symptoms. Bigger issue is that companies use SSN as a way to authenticate a user. Government should mandate only allowing SSN for tax identification purposes. Passwords need to go away and with webauth, we are almost there. The average person is re-using the same password across sites so it’s pointless protection.

An e-commerce store hack shouldn’t give hackers the data needed to access customers financial accounts.

link
4oh9do 1460 days ago
> Government should mandate only allowing SSN for tax identification purposes.

CafePress was presumably collecting SSNs precisely for tax identification purposes.

link
adrr 1460 days ago
It's not them who are the problem. Its financial institutions and other services that use SSN as way to verify a person. You should not be able to setup a cell phone plan by providing a name and a SSN. And credit reporting should not be tied to a SSN. It should just be used to submit tax information to the government and have no value beyond that.
link
lesuorac 1460 days ago
And when a company doesn't comply?

A law without a penalty isn't a law you need to follow.

link
deathanatos 1460 days ago
> I dunno, we seem to issue fines a lot nowadays and the behavior doesn't change.

We issue fines, yes. We do not issue fines to an amount that would incentivize behavior change. Most fines from agencies like this, when I see them, tend to be in the <$10 range, when scaled to how "impactful" the fine would be against an average person's income. My father would call a fine that's less than $10 a "toll".

In this particular case, the fined entity is too small for me to know exactly, as I can't find their financials. But the amount doesn't smell large.

In some instances, I've seen agencies level $0 fines against corporations. Literally, all the agency demanded was "stop doing the bad thing, m'kay?"

link
dontbenebby 1460 days ago
>We issue fines, yes. We do not issue fines to an amount that would incentivize behavior change.

Who is we? The US?

I see many euros on HN tutting about lax regulation, but no one in the EU seem willing to actually enfore the GDPR and levy a corporate death penalty if their brothers across the pond won't do the needful.

(I'm eligible for an Italian passport Jus sanguinis, though I had intended not to look into it until late in life -- maybe I should abandon my American one, and immediately lobby for the above to my new elected representatives, since everyone I've met from the world of spooks seems to obstruct me out of fear I'll expose their illegal behavior rather than do their damn job well enough I wouldn't notice how they spend their free time.)

link