Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

CA Senator Pushing For Tightened Data Breach Notification

ScuttleMonkey posted more than 5 years ago | from the more-data-about-a-problem-is-rarely-bad dept.

Privacy 29

California State Senator Joe Simitian has introduced new legislation designed to tighten data breach notification requirements, forcing businesses to provide more information about any data that has been leaked in addition to notifying state authorities. What was not included in the legislation was imposed compensation requirements for data breach victims, and according to Simitian are not likely to be for quite some time. "Instead, the next focus of legislation, he said, would likely be on who should bear the cost of sending out notifications to consumers. For example, should a credit card processing company that experiences a breach be responsible for the cost of notifying bank customers? When retailer TJX discovered in 2006 that hackers had accessed credit and debit card numbers passing through its network, banks were left notifying the customers, then had to sue TJX to get compensation for those costs. Heartland Payment Systems, which experienced a breach of credit and debit card numbers in January, has recently been sued by banks to recover their breach notification costs."

Sorry! There are no comments related to the filter you selected.

Nigger poops! (-1, Troll)

Anonymous Coward | more than 5 years ago | (#27127675)

I took a shit and there was a baby obama in the toilet!

Re:Nigger poops! (-1, Offtopic)

Anonymous Coward | more than 5 years ago | (#27127849)

nigger poops? i hope they taste better than cheesy poofs. then again maybe they don't.

A good start (2)

Chabo (880571) | more than 5 years ago | (#27127761)

Finally, some good legislation coming from a California politician!

Notification is useless (1, Insightful)

CarpetShark (865376) | more than 5 years ago | (#27127881)

What's the point of notifying the public that their data has been lost, when they can't do anything about it? At the very least, they should be able to sue in a class action. Ideally, there should be some government organisation that tracks down the identity/resource thieves, figures out what damage was done without the owner's knowledge, returns things to rights, then bills the company that leaked it for all the trouble caused. If the upshot is that people just get a letter saying they're screwed, then why bother? It's basically just a cop-out.

Re:Notification is useless (4, Insightful)

Chabo (880571) | more than 5 years ago | (#27127909)

Well for one, it means that the company responsible for the data breach is legally barred from initiating a cover-up that a breach ever happened. At least one instance of this has been reported on ./

Second, if more information is made public, then they will have the ability to make a class action suit.

Re:Notification is useless (1)

timmarhy (659436) | more than 5 years ago | (#27128097)

it's highly embaressing and can have real business implications, that's why. imagine your the CEO of a million dollar company who's sole business is data warehousing and you have to admit millions of records have been stolen, publicly as well as reporting it to a government department.

Re:Notification is useless (0)

Anonymous Coward | more than 5 years ago | (#27128223)

What's the point of notifying the public that their data has been lost, when they can't do anything about it? At the very least, they should be able to sue in a class action.

I think you just answered your own question.

If the upshot is that people just get a letter saying they're screwed, then why bother? It's basically just a cop-out.

A cop-out? You're not going to sue anyone until you know you've been harmed. Making them tell you what they did to you, is probably the one very best thing they can do to help set things right. It might not work, but it's the best.

Notification is toothless, but not useless (4, Insightful)

schwaang (667808) | more than 5 years ago | (#27128493)

Having received one such notification, it prompted me to keep a closer eye on my credit report and weigh the option of freezing my credit report [consumerist.com] , thus making it harder for anyone to use my personally identifying info to borrow money under my name.

In my case, a previous employer who was breached explained the circumstances (something they never would have done without the law), and offered to pay for credit monitoring (not required AFAIK). A very responsible approach to their mistake.

A friend who was hit by the Univ. of CA breach was notified because of the law, but not offered monitoring.

These notifications were useful to the affected individuals, even if their expense alone may not in itself have been enough to motivate better security procedures at the breached organizations.

And obviously, if it happens again soon at either organization, people will raise hell.

Its a start.

Re:A good start (1)

BobSully (1496423) | more than 5 years ago | (#27138023)

I think it's fair to say that Level 1 merchants are taking PCI compliance pretty seriously, but I'm also sure many are making the trade off against the potential for legal exposure. After their breach, TJX took a nice hit to their stock price (off about 15%), but as it became clear that had little to no customer flight, it recovered well. It makes good sense that the bill for notification costs should be served to the responsible party.

First they came for the credit card companies... (-1, Troll)

Anonymous Coward | more than 5 years ago | (#27127769)

You know who else pushed for tightened data breach notification? Chilling.

Re:First they came for the credit card companies.. (1)

Chabo (880571) | more than 5 years ago | (#27127773)

Who is this "Chilling" of whom you speak?

Re:First they came for the credit card companies.. (1)

Hordeking (1237940) | more than 5 years ago | (#27127791)

You know who else pushed for tightened data breach notification? Chilling.

Please. Do enlighten us, Mr. Troll Person...

moD do3n (-1, Redundant)

Anonymous Coward | more than 5 years ago | (#27127923)

but noW they're as the premiere

Tightened breach (0, Funny)

Anonymous Coward | more than 5 years ago | (#27127935)

Sounds like that would be useful for goatse [goatse.fr] .

Well that's the first thing that came to my mind anyway.

Leaker pays, surely. (4, Insightful)

James Youngman (3732) | more than 5 years ago | (#27128007)

It's fairly obvious that the cost of informing customers - and other related costs - should be borne by the organisation who failed in their duty to ensure the integrity and confidentiality of the data. After all, until we are at a point where it is cheaper to take the measures to keep the data safe than to be delinquent, companies are incentivised to be delinquent.

Re:Leaker pays, surely. (2, Insightful)

microbee (682094) | more than 5 years ago | (#27129259)

Right, except that all the extra cost from the burden will still be passed on to customers.

Which is exactly how it should be. (1)

Okian Warrior (537106) | more than 5 years ago | (#27129847)

Right, except that all the extra cost from the burden will still be passed on to customers.

Which is exactly how it should be. Customers will then switch to the more secure service providers because they are cheaper.

This is even true if the "customers" are other corporations, such as banks.

Making the responsible party bear the cost of their mistakes is an incentive to make fewer mistakes.

I'd be happier to see tighter tech requirements (3, Insightful)

erroneus (253617) | more than 5 years ago | (#27128023)

I'm going to try to avoid the "Microsoft Blame Game" as frankly that gets us nowhere. But I will say that there are some older technologies that work better for transaction processing and storage than some newer, more contemporary systems.

And frankly, even though some processing and transaction systems are very convenient for both processors and consumers, I think it just might be time to rein in many of these conveniences as implementation of any sort is simply too risky.

All these reporting requirements are intended to add pressure to companies to take their systems security more seriously, but frankly, they will never listen until you tell them EXACTLY what is expected of them. Businesses are in the habit of managing risk that they feel is acceptable, but the problem is, they don't mind risking other people's data or their lives or anything else if it's not theirs directly.

When people handle food, the government steps in with inspectors and laws and all sorts of things to help better ensure that your burger will not kill you. This has proven to work pretty well even though it has not stopped violators entirely. The same should be required of people handling sensitive financial and other personal information.

Re:I'd be happier to see tighter tech requirements (1)

Thinboy00 (1190815) | more than 5 years ago | (#27128535)

The problem is that most voters are too stupid to understand what you're talking about, whereas food is another story entirely. Also there's lobbyists, as usual.

why do they store credit card number (0)

Anonymous Coward | more than 5 years ago | (#27128489)

Stores should not store credit card number. Unless there is an intention to trade privacy information with ad agency(internal or external). In such cases the law is good, that it penalizes the data keeper.

However there are other ways to limit the affect of data theft. The credit card company company should accept a hash of name and the credit card number as the card identifier. Stores should not be required to keep credit card number in plain text.
In this architecture it will be practically unusable to steal and use credit card number data. When fully implemented stores should not be forced to reveal every data theft. Imagine with this law, one rogue employee can affect a large chain store that employ thousands of people.

I'd like to see a data purge law (3, Insightful)

NotQuiteReal (608241) | more than 5 years ago | (#27129961)

Notification of a "breach" is all well and good, but in many cases there shouldn't be as much data to breach in the first place.

A recent personal example makes my point; I am a bit disturbed that both the University I graduated from decades ago, and the guy a bought a car from 3 years ago, both send me birthday cards... I don't find it a nice gesture, I find it just wrong that they have retained my personal ID info for their marketing purposes. Therefore I will stop donating to the university and I will not buy a car from that dealership again. (It's not like I signed up for the "birthday club" or anything. Obviously they have "mined" my data collected for other purposes.)

Seems like a better law would be that personal information be purged from the records of any place that has no legitimate reason to retain them.

Re:I'd like to see a data purge law (1)

WCguru42 (1268530) | more than 5 years ago | (#27130955)

Seems like a better law would be that personal information be purged from the records of any place that has no legitimate reason to retain them.

The lawyers will have a field day with the definition of "legitimate reason." The law needs to be more specific, something like if I tell you to drop my data you do it. I know it takes some customer action, but it's a hell of a lot better than we have now.

Re:I'd like to see a data purge law (2, Informative)

NotQuiteReal (608241) | more than 5 years ago | (#27131079)

Thank you for pointing that out; The law needs to be more specific

As a programmer, I should know that. If there is anything more pedantic than a stupid compiler, it's a fuckin lawer. Those guys must be idiots or assholes (Note the ambiguity of "fuckin" versus "stupid". It all depends on whether you've hired one to attack you or defend you - "fuckin" can be a good thing or bad.)

Re:I'd like to see a data purge law (1)

qwijibo (101731) | more than 5 years ago | (#27135935)

Currently, whoever collects data about you owns that data. We have no real rights about how that information is used, which is why most of it is sold for marketing purposes. There are some rules, like companies aren't supposed to store your credit card details without your permission, but many of them do because it's cheap to store and the information may be useful in the future.

The difficulty comes in defining what information is legitimate and why. For example, if I place an order online, they need my billing information long enough to process the transaction and some subset of the information in case there are problems with the order, etc. When you send in warranty registration cards, all of that information is being collected and sold for marketing purposes. If you send in the information, you're agreeing in a sense to the reason they want it. However, when it's sold over and over to various other companies you have no interaction with, you're completely out of the loop. The problem any law is going to have is that the consumer doesn't own their own information, so they have no real recourse or way of even finding out who all of that information went to.

Re:I'd like to see a data purge law (1)

triffid_98 (899609) | more than 5 years ago | (#27131211)

Please allow me to explain Homeland Security again...

Seems like a better law would be that personal information be purged from the records of any place that has no legitimate reason to retain them.

Re:I'd like to see a data purge law (1)

rgarbacz (1450155) | more than 5 years ago | (#27135237)

You hit the nail. The personal data should be collected only when required to process any contract/transaction (only to the necessary extent) and deleted afterwords.

I also find it disturbing that anytime I express my willingness to buy something more expensive, there is no way to move forward without providing my address, and a telephone number.
The sellers do not even want to talk without this information. Later I get a few "happy" calls per day with offers of some kind. It is pretty annoying, and takes my time.

I understand ads on TV, but calling someone, taking someone's time is much too much.

Re:I'd like to see a data purge law (1)

qwijibo (101731) | more than 5 years ago | (#27136067)

If you value your privacy, you have to take measures to protect it. You can get a private mailbox for everything that wants an address and a phone that you give out freely, but don't bother answering unless you are expecting something.

Basically, you draw a clear distinction between your real life and your consumer persona. So you end up with a mailbox full of crap? If you know what you're looking for, you just throw away the rest. Same goes with answering machines on your line you give out to everyone - if you're not expecting a call, erase all every couple of weeks and you're all good.

Do we need more point solution laws? (1)

lbhuston (1492993) | more than 5 years ago | (#27134363)

I think that instead of all of these point solution laws that we keep passing aimed at specific facets of the consumer data protection process, we should put together a working group to pass a comprehensive law that addresses the real root problems. Such a comprehensive approach could address items such as time to live, how data may be used/mined/obtained, information protection requirements, privacy and notification mechanisms and responsibilities for all parties concerned. Maybe if we take a wider, deeper look at the real problem, we can find ways that the law could really help protect consumers instead of just giving PCI Council, attorneys and others more "buttons to push". I am a big supporter of addressing the real root of the problem, but the legal and regulatory landscape around data protection and privacy is already so confusing for average organizations, that while loaded with good intention, anything less than a comprehensive approach at this point is likely to make the situation more difficult. Legal approaches also need to consider that according to the Verizon breach report for 2009, around 66% of all breaches happened around data that organizations didn't even know they had and 75% of breaches were identified by third parties outside of the victim organization. Until we can establish legal requirements that tie security groups to lowering those numbers, in my opinion, all else is likely to fail anyway.

How about holding the companies accountable? (1)

cyberprophet (1411663) | more than 5 years ago | (#27134787)

Why isn't there legislation in place to hold the companies accountable for your data loss if they were not taking appropriate precautions against data loss or breech? As someone who has had data compromised twice in the last year (once through my mortgage company and once through my employer) I feel that being notified promptly is a good first step but making companies accountable for their inaction would be more apt to prevent these events in the first place.
Check for New Comments
Slashdot Login

Need an Account?

Forgot your password?