Hacker News Reader

Comment by DrewADesign | Hacker News Reader

Maybe there should be some kind of annual ISO privacy certification for companies that resell any customer data in any form. Then make data customers (e.g. marketing agencies, major retailers) and data collectors (e.g. those that collect telemetry data from libraries included in their app, auto manufacturers, wireless providers) civilly liable for any privacy violations dealing with uncertified brokers, making sure there’s an uncapped modifier based on the company’s annual revenue. That seems like it puts the bulk of the compliance responsibility on the parties that can do the most wide-scale damage with unethical and dodgy practices, while leaving some out there for others that need incentive to not ignore the rules.

Haven’t really thought this through and I’m not a policy wonk… just spitballin’.

View on HN

Bonding and/or insurance.

Make this cost and practices will change.

Yeah good call.

I would hope for something stronger. Put a currency value on some kinds of info. To store my SSN and full name and military ID totals 20 units. Maybe a full name and home address is 15 units. If I agree to give you my info, you agree that I can keep the CEOs home address, stored as safely and hygienically as I can. Part of our contract mandates when we mutually delete. Because of course we trust each other.

Sure, but that will never happen, and we shouldn't let perfect be the enemy of good.

> Maybe there should be some kind of annual ISO privacy certification for companies that resell any customer data in any form

Why is this better than requiring deletion?

For starters, it provides protection and accountability for those who don't have the prior presence of mind to demand deletion.

An act which mandated deletion in all cases for data once business needs are addressed (often 30--90 days for much data), might address your question. But the Delete Act isn't that.

> it provides protection and accountability for those who don't have the prior presence of mind to demand deletion

Perhaps. I just see another compliance-industrial tax on consumers backed up by a nonsense checklist.

> act which mandated deletion in all cases for data once business needs are addressed (often 30--90 days for much data), might address your question

Or opt out by default.

Perhaps California should give counties the power to do that. Then we can watch the experiment for unintended consequences.

I work in a specialty in an industry that requires a fairly stringent annual ISO certification. Even preparing for the audit it is a completely worthwhile exercise in seeing things that maybe got swept under the rug or left by the wayside. Customers having clearly defined criteria to prove in court or even business negotiations, that our lapse was negligent or in bad faith keeps us from straying too far to begin with. Our having clear criteria to show that we followed industry guidelines shuts down customers trying to accuse us of something in bad faith, or even trying to make a mountain out of a molehill to get leverage in a contract negotiation or something.

I’ll bet most of it depends on how good the certification is. My bosses think it’s annoying, and sure not 100% of the requirements make a difference for us, but most do, and from my vantage point, I can see how much of a difference it makes.

This is a family-run business with about 20 employees BTW. Not some red tape behemoth.

> compliance-industrial tax on consumers backed up by a nonsense checklist.

That's...a really weird phrase. Efficient regulation isn't a tax on consumers, it's protection against unchecked immoral corporations.

Reply on news.ycombinator.com