[animuchan]

Yes please! Making PII leaks an expense (like rent and cloud costs) means it's paid by the customer.

I strongly believe we should distinguish the price of doing the operation (aka rent) and the price of doing crime (ideally, jail).

[philipallstar]

Everything is paid for by the customer. If you spend an absolute fortune protecting someone's named and address combination, that will be paid for by the customer.

[animuchan]

Yep -- and it's good.

Before: customer pays fines for bad security, rolled into the price of the offering.

After: customer pays for actual good security, rolled into the price of the offering.

If the customer doesn't care, no change. If the customer cares (and let's low key assume PII is important) -- they see net gain from this change.

[bigfishrunning]

If only! I would much rather the bill go up then my information get leaked. But instead, I get both.

[zahlman]

> If you spend an absolute fortune protecting someone's named and address combination, that will be paid for by the customer.

And then you get your lunch eaten by a competitor who understands that the PII is unnecessary for the business relationship.

But only if that externality is actually accounted for in regulation.

[cucumber3732842]

So then the customer will just pay more, because the "prevent you from getting fined into oblivion" insurance businesses you just created with the flick of a pen will need to get paid their overhead and won't do it without a profit.

[nroets]

Then over confident, short sighted or shady characters will accept those directorships and/or sign off on the design because they think nothing will happen or don't care for jail.