US Law (local/state/federal)

46 readers

1 users here now

This is the only decentralized venue for chatter about law in the US. Federal law and law of various states and territories is on topic here.

Loosely related:

[email protected] - covers UN-wide discussion on human rights

founded 3 months ago

MODERATORS

[email protected]

My data has been breached 3 times now, officially, AFAIK. (and more times unofficially) Can I even blame the breach sources at this point? (links.hackliberty.org)

submitted 1 month ago* (last edited 1 month ago) by [email protected] to c/[email protected]

3 comments fedilink hide all child comments

Is there any kind of legal standard of liability when a victim of a data breach suffers from someone exploiting their data? If you are only breached once, obviously it’s easy to point the finger to whoever leaked your data.

But I’ve been hit 3 times now. So all those shitty corps who sloppily handled my data can point the finger to each other. Would a court say the most recent sloppy custodian is responsible if my data is used against me? Or would it be the most reckless custodian? Or would it be equal blame? Or does everyone get off the hook when a victim cannot prove which leak leads to an exploit?

It’s a hypothetical question. Not saying my data was exploited after the breaches, but I wonder about the overall trend. What I’m getting at is there may be little incentive to actually invest in good data security because when a breach happens amid so many other breaches there is perhaps a diffusion responsibility.

all 4 comments

sorted by: hot top controversial new old

[–] [email protected] 4 points 1 month ago

Yes, always blame the companies who steal and sell your information and have crap security.

[–] [email protected] 1 points 1 month ago (1 children)

It was always hard to point the finger. Basically the problem stems from the idea that for breaches there just are no significant repercussions for the parties involved. They pay for (or set up) some form of credit monitoring and then just go on about their merry way. In the event that they are held accountable at all it's usually something like a fine, which to the vast majority of these companies is less than a slap on the wrist. These corps consider it the price of doing business.

As someone who's data has been exploited (and who's data was actually leaked by breaching the federal government), I'm gonna say there's just not a lot to be done except doing your due diligence to change the PII you can change (locking your credit, monitoring credit reports, changing PII like your SSN or other ID number etc).

But I doubt even a class action suit would do much in most of these cases.