Hacker News Reader

Comment by electrondood | Hacker News Reader

Can we just have financial penalties per compromised user for these companies already?

*statutory penalties

You can already seek financial compensation through the tort system[1]. It just sucks right now because you have to demonstrate harm, which is hard. Having a law that's like "each breach equals $50" makes lawsuits go much more smoothly.

[1] eg. https://en.wikipedia.org/wiki/2017_Equifax_data_breach#Litig...

And it should be punitive. The point isn't just to compensate me for the harm I suffered

Indeed: if companies are to be treated as people, and we are to have a federal death penalty, corporate execution should be the result of breaches like this.

As a Comcast customer, I'd be kinda upset if I woke up one morning and my internet connection was dead.

As a Comcast customer, I assume this is already your status quo several times a year.

Not the connection, just the company administering and profiting from it.

What do you think happens if the internet company is dissolved, all the workers are laid off, and all the assets are liquidated?

Why do you think that's the only way this can work?

When a bank fails, the FDIC typically facilitates new ownership over the course of a weekend. The workers still have jobs and the branches reopen on Monday. The top executives are out and the investors take a loss.

If it is impossible for any other company to take over the service than the company is too big in the first place and should be broken up or nationalized. The free market doesn't work without meaningful competition.

What's the difference between "corporate execution" and "large fine" then?

Well an obvious difference is that one directly removes executives who were responsible.

But sure, I'm amenable to a sufficiently large fine. Even just allowing class action lawsuits (despite their flaws) would be a lot better than the status quo.

I'm just saying that a "corporate death penalty" doesn't necessarily harm customers. A large fine that an entrenched monopolistic provider can just pass on to customers the same way they do other "compliance costs" doesn't really help much.

To keep with the same metaphor, death penalty trials are often long and drawn out. They are also rare enough that they often make the news.

There's no way the company could be killed overnight, and one would have to be living under a rock to not hear about such a big business dying.

I propose that the fines be per piece of information leaked, and combinations of information:

$1 for name

$2 for address

$3 for email

$4 for phone number

$5 for social security number

--------

and multiply for combinations thereof.

I can get behind this if you multiply the amounts by 100 and index it to inflation x 2

Sure, can you cite which criminal law was broken or demostrate damages for civil claims?

Reply on news.ycombinator.com