Well that's a problem. PII breaches should have pointed ends as pointed, if not ...

ars · on Jan 4, 2018

That's really hard to do. PII breaches are virtually always by mistake (irrelevant if that mistake is negligence).

Insider trading is intentional.

You can't really legislate serious penalties for mistakes, and negligence is really really hard to prove.

rosser · on Jan 4, 2018

Negligence is not "really really hard to prove".

In the US, negligence as a tort is a four-pronged test. In the case of Equifax, did they have a duty to protect your PII? Did they breach that duty? Was that breach the proximate cause of your PII being disclosed? Did that disclosure result in an injury?

theptip · on Jan 4, 2018

The EU already has legislated serious penalties for data breaches, and AFAIK whether it was a "mistake" or negligence is irrelevant:

https://en.wikipedia.org/wiki/General_Data_Protection_Regula...

The US doesn't seem to have much appetite for this kind of regulation though.

DoofusOfDeath · on Jan 4, 2018

It's worth distinguishing the US congress and executive branch from the US citizenry, in cases like this.

theptip · on Jan 4, 2018

Very true. I'd be interested to know how this issue polls in the US, I haven't seen any data on that.

craftyguy · on Jan 4, 2018

> You can't really legislate serious penalties for mistakes, and negligence is really really hard to prove.

You can legislate serious penalties for negligence, of which a great number of PII breaches would, IMHO, be candidates for.

QAPereo · on Jan 4, 2018

Absolutely, and there needs to be a statutory value placed on PII so that the Equifaxes of the world will have to be insured, and insurers will perform due diligence.

Until then...