The Core Problem with Cybersecurity and Privacy Laws
California just passed the delete your data law, which, once in effect, will be the do-not-call list version of opting out.
The law requires brokers to check their data against the delete me list and delete any data belonging to that person if there is a match. They have to repeat the check at least quarterly.
Vermont, like California, requires data BROKERS to register (and pay an annual fee).
In California, only 52 brokers have registered. In Vermont, only 257 are registered.
Do you see these unregistered brokers getting thrown into jail? Fined thousands of dollars?
The California Department of Justice says that they have mailed letters to businesses that have not registered.
So, after three years of the California law being in effect, the sum total consequence, apparently, is that you get some junk mail in your mailbox.
Vermont’s AG would not even return phone calls.
And some people still wonder whether a private right of action on these laws is necessary.
I think the evidence is quite clear.
If we are waiting for the Attorneys General to whip the industry into shape, I think we are going to be in for a long wait.
Will some data brokers comply with the law – sure. Will others ignore the law (and lack of enforcement) – also sure.
In fairness to the AGs, they are required to enforce thousands of laws that their legislatures dream up and which do not provide any funding to enforce.
Since sometimes we seem to like the free enterprise system (when it is convenient), allowing attorneys who are motivated by collecting fees to enforce the laws. That seems to provide incentive.
What if we took the Texas and Florida approach to abortion and expanded it to cybersecurity. Anyone, anywhere could sue anyone who even helped someone not be secure and collect a $10,000 fee. Maybe that would work. Or maybe there is another option. Any ideas? Credit: The Record
Oh, you are asking about the headline. The core problem is lack of consequences for not protecting your data.
by 