Hacker News Reader

Comment by JMTQp8lwXL | Hacker News Reader

I wonder if these companies collectively made more than $200M selling location data. It's the only way to evaluate how penalizing this is.

View on HN

I don't think the penalty should be based on the size of revenue earned, the fine should be a strong deterrent. So it should be significant compared to what they can afford.

Do you mean more profitable companies should be fined more than less profitable companies for the same scale of wrongful behavior? If one wrongdoer happens to have other lines of business that generate a lot of cash but aren’t implicated in the misbehavior, they should get a more severe punishment? I think the endgame from such a punishment regime is companies will reorganize their corporate structure to section everything off from such liabilities.

the goal is simply “fine them enough so that it hurts and works as a mea culpa, but doesn’t destroy them the first time”

The point is simply standard economic law analysis - the idea is to make (punishment * probability of being caught) > expected gain from the crime. The theory is that if you remove the incentive for the behavior you wish to discourage, people will cut out.

There are many criticisms of the approach, but those are mostly about crimes committed by individuals, not corporations. When you're talking about HugeCo abusing customers, I think seriously punitive fines can work. But you need to make them painful enough that at least the board, and preferably the shareholders, want to ask questions about how exactly they know this won't happen again.

> I think the endgame from such a punishment regime is companies will reorganize their corporate structure to section everything off from such liabilities.

Of course they will. Any time a corporate entity can construct legal structures to capture more, shed externalities or shift risk, it will. Why wouldn't it? "We have a legal obligation to maximize profit..."

But that's not the "endgame of such a regime", that's normal business.

The post I responded to said the fine “should be significant compared to what they can afford”. This isn’t the standard economic formula (which I agree with). It’s a different standard that would have companies that can afford more pay larger fines.

That's correct. If they can afford more, they should pay more. I think it's similar to speeding fines in Finland: proportional to your income. A wealthy person can ignore a $150 speeding ticket.

Deterrence is the goal.

That works for individuals and non-monetary infractions. You can't do a precise "punishment > expected profit" calculation on speeding tickets in dollars, because people don't speed for an explicit, rationally priced-in benefit. They speed for emotional reasons - overconfidence, hurry, stress, anger. Since the benefit is denominated in emotional terms, the punishment must be too - hence the idea to punish for equivalent hurt, which scales more-less linearly with income.

On the other hand, a corporation rarely if ever does anything for reasons other than "revenue > costs"; in fact, it usually employs people making sure that ideas violating that rule don't get executed. So calculating a punishment in a way that erases all profits from the infraction and then some is a very good strategy when dealing with big companies.

Two things though:

If you’re basing the punishment on profits from the infraction, you still have to take into account the percentage of those infractions that are punished. If the fine is 5x what the company would make from that behavior, but there’s only a 5% chance they get caught, they may very well choose to do it anyway.

Also, corporations are made of people. An emotional punishment may sway someone high up at the company who has the power to reform it.

Simply that a company should not be able to make money by "selling data without the proper safeguards in place" -- they sold the data illegally, so should not be able to make money by doing so. So I'd say they should be fined however much they made by doing so.

Companies will keep doing illegal things if they can make money doing so.

I don't disagree with your point. However, if they brought in a billion selling location data, and only get fined $200M, it was still profitable. If they only profited $20m, the fine is 10 times what they earned.

Without this context, it's hard to ascertain how meaningful of a deterrent the fine actually is.

That’s a good place to start but there’s more to be considered. The data could be even more valuable than the value they were able to capture from the transaction.

What if they gave it all away for free? We wouldn’t fine them $0. The revenues earned should be considered, but we have to keep in mind that price does not equal value, and if a transaction occurred then the buyer was probably willing to pay more than the list price for it, that auctions only result in the price being equal to the amount the second-highest bidder was willing to pay, and that your data once sold by the telco company could end up selling for even more in future markets than it is selling for in today’s markets.

Should we fine them how much they were able to gain from it without pricing in how much the victims lost from it? And how well can we evaluate how much the victims lost? The problem with the government getting all the money is that the focus is removed from the victims, and questions like these aren’t given complete consideration. Would we have a better valuation if the victims were to receive compensation, if only due to the conversations that would arise from such proceedings? And also since, well, they’re the victims?

Reply on news.ycombinator.com