This it's why we needed GDPR. The courts have been totally unwilling to combat this kind of corporate malpractice, assessing the costs of a breach to be puny.
My opinion is, if your business is sensitive data then being careless with it should be an existential threat to that business.
What we really need is regulation to limit the amount of information that can be used for credit checks (and insurance premium calculations while we're at it). Actually that is partly done in the UK - e.g. gender cannot be used while calculating car insurance premiums. But sadly they can still ask for your profession, marital status, etc.
In the case of Equifax, they are a third-party processor. Under GDPR, you would have to be informed if the processing was necessary under contract basis. Once the contract is finished, you can request that your data is removed and the original processor must inform all third party processors. So Equifax would be required to remove the data. For legitimate interest or consent basis, you can ask to be removed at any time. You don't have the right to be removed wrt data collected for regulatory reasons.
I think the key here is that Equifax (being a third party processor) does not have to respond to you if you say "Please remove all of my data". I think you have to go to the original processor (which sucks, because you have to track down how they got your information). I may be wrong about that, though (the company I work for doesn't collect 3rd party info, so I didn't pay much attention to that part of the law).
How is that bad? An insurance works by collecting slightly higher premiums than the expected insurance payout. The more acurately the insurance can predict risk, the better. And if they calulate that some profession/gender/lifestyle/whatever carries a higher risk, it's only fair that those people have to pay more, after all they also cost the insurance more.
Having people pay for their risk is also a net-positive force for society. If some profession causes people to be sleep-deprived and have more car accidents, their premiums go up, producing pressure to either reduce the risks or choose other professions. If you don't let insurances factor this in, you are just subsidizing those with riskier lifes.
For insurance to work as intended, it has to be spread across a large population and it needs to cover a wide variety of perils.
Where insurance can be a force for societal good it should be allowed to discriminate. For example, insisting on better fire safety. Or basing your car insurance rate on your car’s safety rating.
P.S. Insurance works by making money off the float, not by collecting more in premiums than they pay out. The expected payout is around 100% over the long run, but the payout happens over time. Until it does, the insurance company holds the money and uses it to make money. (Granted, in this low-interest-rate environment insurance companies may set the payout ratio a bit more favorably since the float makes them less money, but competition effectively helps keep a cap on that).
Mutual insurance companies (owned by their policy holders) are different. Any profit of a returned to the policy holders, so there’s no incentive to set rates higher than required. However the tragedy of the commons kicks in: if they offer lower rates to high-risk groups, they tend to attract the worst of those groups, causing higher losses - especially with health insurance. That’s part of the reason government regulation of insurance is the way it is, the other being gross mis-management causing insurance companies to go bankrupt and be unable to pay out during times when people need it the most.
> P.S. Insurance works by making money off the float, not by collecting more in premiums than they pay out.
This really doesn't matter. Float happens to be of similar magnitude to profits. It could be significantly more or less. I'd say it's more of a coincidence than anything whenever the two align.
How in the world would you know that?
This is the classic correlation/causation fallacy that is why sadly we have needed explicit anti-discrimination laws in other contexts.
When I added my partner to my car insurance policy, at a time before prohibiting the use of gender to determine premiums, our payments went down quite significantly despite now covering two drivers. When I asked why, they told me that statistically women are safer drivers than men, and since my wife had a good track record with no accidents, that meant our risk together was now lower.
The thing is, at that point I had been driving regularly for many years, while my partner had also passed a test many years earlier but had hardly driven since. We both had clean sheets, but as you'd expect given our vastly different levels of experience, she was not as safe a driver as I was and would have been the first to admit it. However, the insurer's questions hadn't identified any of this, and had reached an obviously absurd conclusion.
Even after the policy change, in practice I was almost always still driving anyway, so clearly whatever my level of risk was before, our combined level of risk was still similar afterwards. But again, nothing asked when we adjusted the cover or since would have picked that up.
This is the trouble with almost any profiling based on personal data, from insurance calculations to targeted police actions to screening job applicants: in principle, it might be a reasonable thing to do, but if your model doesn't properly incorporate all relevant facts, it can actually be worse than nothing because not only does it give an incorrect assessment, it also instils false confidence in that assessment.
Also, someone who hardly ever drives is very safe from the insurer's perspective. They may not be very skilled, but they also don't have many opportunities to get in accidents.
Of course. But as long as they can't form a sufficiently complete picture to make fair decisions -- that is, pricing based on actual risk -- discriminating on easier grounds that are correlated with risk but also happen to be incorrect in many cases isn't fair, so we make laws that stop them doing that.
What a curious thing to say in 2018. Would you also argue that women take more time off to have babies so it’s only fair on employers not to hire them?
No, hiring no women simply because they get babies would be silly.
How long the person will likely stay with the company and which extended leaves they will be taking is of course a factor in the hiring decision. Both of those events incur a real and measurable cost to the company. But there are many reasons why males and females leave or take time off, babies are only one of them. And it is only one factor among many. Expected job performance, personality, the effects of certain team compositions, customer perception, etc all have a bigger effect on the company than the baby factor and thus should be weighed accordingly.
Insurance is supposed to spread risk. If your logic were taken to its limit, everyone would pay in the same amount that they were expected to cost - with an added amount to line the pockets of the insurance companies. Then why bother with insurance at all?
If they meant the opposite of that, then that's a really weird way to express it.
Intentional data breach is basically the business model where you sell private information without getting meaningful consent from your users. Do you think that is okay because you need that to stay competitive with US companies?
The EU could fine a corporation with 10 billion turnover 10$ but they also could fine up to 200 million $. It doesn't mean they have to fine atleast 10 million once you're over the 2% switchover.
It's part of the calculation for the _maximum_ penalty, which is max(€20m, 4% of global turnover)
It should come as no surprise that the legislative enforcement arm is unwilling to also. I know you dream of laws like the GDPR working, but it doesn't and neither did its predecessor. Instead of asking for new laws, why are you not asking for enforcement of existing ones? And what makes you think a new law will be magically enforced where current ones aren't?
Didn't it? Maybe I'm biased, but I don't remember breaches like Equifax's or Target's in the EU. I also don't remember the records of 154 million EU voters being exposed.
According to this report[1], the "U.S. accounted for 728 of the 974 incidents around the globe in the first half of 2016." They do say part of the difference may be the disclosure laws, but is that all?
[1] https://blog.gemalto.com/security/2016/09/20/data-breach-sta...
So if you don't remember it ever happening, what did the laws curb again? I'm talking about the effectiveness of adding laws... going from 0 to 0 demonstrates no effectiveness much less the effectiveness required to overcome the societal cost of compliance.
If anything, your argument explains the embedded big business cultural differences and laws like the GDPR added nothing wrt data breach enforcement/prevention.
You can't determine the past effectiveness of increased future legislation, especially if it's in an environment with a history of lax enforcement.
This idea that the US is the breadwinner of the world and a paragon for all to strive for is such a tired old misconception born from not-so-subtle nationalism. The US is not a utopia of happy, well-fed people with homes. You got a big army though, that's for sure.
Of course I think it had an effect. I just believe it was/is a net negative effect. When I say doesn't/didn't work, I mean what I perceive the intended goal is vs societal costs. Akin to saying anti-drug laws don't work and are ineffective... nobody is saying they have no effect. I believe, if reasonably drafted and incrementally applied, data protection laws could have a positive effect.
> Why do you think it won't happen again, apart from your deep-rooted revulsion to mostly all forms of market regulation?
I'm talking about data protection regulation. Based on my research, many companies were violating existing data protection statues and the regulatory bodies were not punishing them out of apathy and limited resources.
Why do you assume I have an issue with all forms of market regulation? That's false and I'm not sure where I said that. All of the rest of your post is attacking some other kind of argument that I never presented.
Attacking this and attacking that, I'm describing a mentality that I come across as a European on HN a lot. It has a little bit to do with you, as I said, I'm picking up on this same sense of "lol look at those dumb Europeans, they don't know what's best for the market," I think you'd agree that this mentality is fairly strong in the US. The US is many things, but humble is not a word I'd use.
The laws might have curbed what would have happened if they didn't exist - and did end up happening in places without it, like the US. Remember that the Data Protection Directive is from 1995, before companies were so connected and exposed, so a lack of such breaches before it passed is not very indicative of its lack of effectiveness. But a comparison with other countries might be.
embedded big business cultural differences
Maybe, but law shapes culture too, so that's hard to separate. As an European myself, I'm kind of skeptical that our business people would intrinsically care much more about data protection when their money is on the line.
I am in the EU, and I got a letter from Equifax saying they'd leaked all kinds of stuff about me and offering some token countermeasures several months too late to provide much meaningful protection against any additional risks I faced as a result.