Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Prison time, hefty fines for data privacy violations: draft U.S. Senate bill

reuters.com

Post reply on HN
Print view View original

11–20 of 285 posts

Re: Prison time, hefty fines for data privacy violations: draft U.S. Senate bill

#11

Post by Tomte »

mchannon wrote: post #10
rayiner wrote: post #2

Prison time for this is madness.

I agree. The journalist who posted the original article was too busy to put a link to the proposed bill. [EDIT: link: https://www.wyden.senate.gov/imo/media/doc/Wyden%20Privacy%2... ] To those who say white collar crime is out of control, I agree, but we don't get it under control by criminalizing new things. We control it through fairer and better enforcement of things that are already illegal. I strongly suspect th…

> I strongly suspect the only people criminally prosecuted under such a bill will be patsies

You can claim that about any criminal law.

And there is an antidote. You even describe it yourself:

> through fairer and better enforcement of things

Voila, no patsies prosecuted!

Re: Prison time, hefty fines for data privacy violations: draft U.S. Senate bill

#12

Post by tptacek »

mchannon wrote: post #10
rayiner wrote: post #2

Prison time for this is madness.

I agree. The journalist who posted the original article was too busy to put a link to the proposed bill. [EDIT: link: https://www.wyden.senate.gov/imo/media/doc/Wyden%20Privacy%2... ] To those who say white collar crime is out of control, I agree, but we don't get it under control by criminalizing new things. We control it through fairer and better enforcement of things that are already illegal. I strongly suspect th…

This bill is linked from a prominent story on the front page of Wyden's website. It's hard to see how much easier he could have made it for you to read it. I found it in less than a minute.

Re: Prison time, hefty fines for data privacy violations: draft U.S. Senate bill

#14

Post by geggam »

austincheney wrote: post #4
rayiner wrote: post #2

Prison time for this is madness.

I disagree. The current standard is that privacy and security are only so important as to prevent law suits unless there is law that says otherwise. That is a pretty low bar. With this privacy and security must be taken seriously from the start. I am of the opinion that wanton neglect that results in massive consumer harm (think Equifax hack) should warrant prison time.

This. Leaving databases exposed to the net. Leaving S3 buckets open to the public.

All of these sorts of things needs to carry punishments not for the people who are told to set the stuff up.

It needs punishment for the management who doesnt allow time to set things up properly

Re: Prison time, hefty fines for data privacy violations: draft U.S. Senate bill

#15

Post by tzs »

mchannon wrote: post #10
rayiner wrote: post #2

Prison time for this is madness.

I agree. The journalist who posted the original article was too busy to put a link to the proposed bill. [EDIT: link: https://www.wyden.senate.gov/imo/media/doc/Wyden%20Privacy%2... ] To those who say white collar crime is out of control, I agree, but we don't get it under control by criminalizing new things. We control it through fairer and better enforcement of things that are already illegal. I strongly suspect th…

> I strongly suspect the only people criminally prosecuted under such a bill will be patsies

The only people that can be prosecuted under it are the chief executive officer, the chief privacy officer, and the chief information security officer.

The thing that is criminal under this bill and thus can subject them to prosecution is, despite what most news stories imply, not violating privacy.

The bill requires the company to file an annual privacy report with the FTC. The aforementioned three offices are required to provide a written certification to accompany that filing certifying that the report follows the rules of the bill.

The crime is certifying a report that they know does not follow the rules.

Draft text of bill: https://www.wyden.senate.gov/imo/media/doc/Wyden%20Privacy%2...

Re: Prison time, hefty fines for data privacy violations: draft U.S. Senate bill

#16

Post by geggam »

api wrote: post #13
rayiner wrote: post #2

Prison time for this is madness.

It should be heavy per leaked datum fines like HIPAA. This would transform huge troves of personal data from assets to liabilities, which is what we need.

Interesting... I would prefer my doctors have all the required data to make informed choices.

Create a motivating factor for them to delete my records and you impact this.

Re: Prison time, hefty fines for data privacy violations: draft U.S. Senate bill

#18

Post by [deleted] »

prolikewh0a wrote: post #8
Tomte wrote: post #6

Earlier quoted context omitted.

I think there are states in America where you can go to prison for stealing a pack of bubble gum. So I won't really cry for the targets here.

>Number of people arrested for a marijuana law violation in 2017: 659,700 http://www.drugpolicy.org/issues/drug-war-statistics Yeah, I'm not going to even bat an eye about millionaires and billionaires going to jail for actual crimes and damage done to significant parts of the population. We need to start putting more millionaires and billionaires in jail for crimes instead of black teenagers for having 2 grams of we…

[deleted]

Re: Prison time, hefty fines for data privacy violations: draft U.S. Senate bill

#19

Post by chuckgreenman »

geggam wrote: post #16
api wrote: post #13

Earlier quoted context omitted.

It should be heavy per leaked datum fines like HIPAA. This would transform huge troves of personal data from assets to liabilities, which is what we need.

Interesting... I would prefer my doctors have all the required data to make informed choices. Create a motivating factor for them to delete my records and you impact this.

Sure, but you wouldn't want your doctor to sell your medical records to data brokers.

Re: Prison time, hefty fines for data privacy violations: draft U.S. Senate bill

#20

Post by usaphp »

geggam wrote: post #14
austincheney wrote: post #4

Earlier quoted context omitted.

I disagree. The current standard is that privacy and security are only so important as to prevent law suits unless there is law that says otherwise. That is a pretty low bar. With this privacy and security must be taken seriously from the start. I am of the opinion that wanton neglect that results in massive consumer harm (think Equifax hack) should warrant prison time.

This. Leaving databases exposed to the net. Leaving S3 buckets open to the public. All of these sorts of things needs to carry punishments not for the people who are told to set the stuff up. It needs punishment for the management who doesnt allow time to set things up properly

Say you have a medical office, and you installed a cheap door lock which most burglars can easily crack, then a burglar breaks into your office, steals Ssn and other private info, should the doctor who runs the office go to prison for that?
Post reply on HN