The society would need to agree on the seriousness of the crime of selling personal information. Is it as serious as selling drugs? A burglary? Rape? Do you think the majority of the Americans would share your opinion on the matter? Keep in mind US incarceration rate is one of the highest in the world.
And this one deserves (in my opinion) to be punished more harshly than other things which today are already punished (you mention selling drugs, which is way better morally). The amount of people damaged by this privacy infringement is quite high.
Any attempt to answer that would heavily depend on how a "victim" is defined in each case.
Are people who attempted to opt out of online tracking, but got tracked anyway[0] victims? That's probably less severe than this case where a company sold health information, but it's definitely illegal in the EU and likely at least a deceptive business practice in other jurisdictions.
Are people who buy drugs and harm themselves by overdosing or spending all their time intoxicated victims? If the person is an adult and the drug is alcohol, that's not even illegal most places.
Are victims of secondary crimes victims of the illegal drug trade, of drug prohibition itself, or simply of the secondary crime? One could easily make a case for any of those.
One definition of victimhood could be how much a person has suffered as a result of the crime. I'd say if someone has lost their job because the data leak, or had their identity stolen with actual serious financial consequences, they are a victim.
True, a lot of people are victims of their own stupid decisions. A society should still try reduce the likelihood of the stupid decisions, especially when there are obvious bad actors actively trying to increase such likelihood.
But your approach requires us to wait for something bad to happen to someone else before forming an opinion. Why exactly should people whose privacy has been violated have to be sacrificed further before any value is assigned to their privacy? We can use retroactive data to estimate the downside risk.
When measuring a large scale crime like that of Cerebral, the number of victims is as important as the magnitude of the impact. There were 3.1 million victims. Stealing a dollar each from 3.1 million people would get the kind of law enforcement response that stealing $3.1M does even though the individual impact of that crime is virtually nil.
Stealing a dollar each from 3.1 million people would get the kind of law enforcement response that stealing $3.1M does even though the individual impact of that crime is virtually nil
That's an interesting question whether it's fair to treat it this way. I can see valid arguments on both sides.
The people affected by the drug trade are not affected by the act of selling drugs but by secondary crimes (which arise because selling drugs is illegal and vendors cannot take advantage of the legal framework).
Also the people affected by this incident alone number in the millions.
The harm of data loss is entirely the harm caused by secondary bad actors.
No ones life is directly injured because of a data leak. It's just data, it is entirely inert on it's own. Their life is injured entirely because of what third parties do with that data.
If data leaked and there were no bad actors in the world, there would be zero harm.
As a sibling comment to mine points out, people who "die or have their life destroyed" is simply one way to define victim in this context.
With mental health data being at stake here, the amount of victims under this definition could also very well be non-zero.
Anyway there are a lot of crimes, that don't produce those kind of victims. If I mug someone and don't kill them or destroy their life in the process, have I not commited a crime?
The privacy infringement here is an obvious damage to the dignity of everyone affected.
Wouldn't you feel victimized if I listened in on you speaking with your doctor, wrote everything down, stamped your name, address, and date of birth on it and started giving out copies of the resulting paper to random people? Which is exactly whats happening here, except my example is more harmless by a factor of a few million people and has a lot fewer data points.
Wouldn't you feel victimized if I listened in on you speaking with your doctor, wrote everything down, stamped your name, address, and date of birth on it and started giving out copies of the resulting paper to random people?
I would. I would also feel victimized if you mugged me (without killing me or hurting me physically). The question we are debating here is - should you be punished equally harshly in this two scenarios? I'm leaning towards "no". If you disagree I would like to understand your reasoning.
A doctor who reveals some information on one of their patients should be treated less harshly then a mugger of one person.
A mugger who robs ten people should be treated more harshly than a mugger who robs one person.
A doctor/company who reveals thousands of patients' information can reasonably treated more harshly than a mugger of ten people, because the absolute negative impact may be greater.
OK, this is a good point. Still, you're comparing an act of hurting people to an act of potentially hurting people. An investigation into the harm done by private data sales would be helpful.
Why are we trying to mash everything down to a one-dimensional ranking? Over simplification can be as deceptive as over-complication.
A breach of one's personal data is clearly less severe than a violent attack upon one's person. But the former could enable the latter (eg if information were purchased by a stalker). And it certainly increases the base level of risk from fraud and adversarial commercial contact (secretly exploiting knowledge of a target to manipulate them into a purchase/sale decision).
Now scale the individual loss up by huge numbers of people, and consider what incentives led to the information security failure. While it's sometimes practical to remediate individual losses of privacy, at scale future injuries are virtually assured. It seems to me that this warrants an application of strict liability principles.
As for restitution, in ym view not only should injured parties be compensated in cash (and much more of it), but they should also be granted, individually or by proxy, partial ownership of the offending firm; that is, existing investors should have the value of their asset significantly diluted. The loss of personal security should be reflected in a loss of financial security to the asset holders.
You make good points, and I actually agree with your suggestions. My original concern was not so much about what constitutes a "fair punishment" in this particular case, but about how is this crime is being perceived by our society, and especially how it is perceived by society (i.e. an average American) when compared to some other crimes? I'm more interested in higher level questions: How do we decide on the severity of a crime? Who should decide that?
I'm guessing a similar argument was made in support of the "war on drugs". Many drug dealers have been punished harshly. 50 years later, nothing has changed.
The war on drugs was perpetuated by the Nixon and Reagan administrations to criminalize being antiwar and being black. Do you think that is what is happening here?
I strongly suspect the war on drugs was initiated mainly because drugs were ruining many lives (just like they do today), and that selling illegal drugs was perceived by the majority of population as a crime deserving a harsh punishment.
Your ignorance is a problem we simply don't have time to address here. Luckily, we don't need to base reality off of your strong suspicions since we have direct quotes from the Nixon administration.
“The Nixon Campaign in 1968, and the Nixon White House after that, had two enemies: the antiwar Left, and Black people. You understand what I’m saying? We knew we couldn’t make it illegal to be either against the war or Black. But by getting the public to associate the hippies with marijuana and Blacks with heroin, and then criminalizing both heavily, we could disrupt those communities. We could arrest their leaders, raid their homes, break up their meetings and vilify them night after night on the evening news. Did we know we were lying about the drugs? Of course we did.” - Lee Atwater
Well, your ignorance is a problem we can address here. Please read the entirety of the Wikipedia article [1], specifically:
The veracity of the quote has been questioned by Ehrlichman's family, while Vox senior correspondent German Lopez has suggested that Ehrlichman was either wrong or lying. According to Lopez:
But Ehrlichman's claim is likely an oversimplification, according to historians who have studied the period and Nixon's drug policies in particular. There's no doubt Nixon was racist, and historians told me that race could have played one role in Nixon's drug war. But there are also signs that Nixon wasn't solely motivated by politics or race: For one, he personally despised drugs – to the point that it's not surprising he would want to rid the world of them. And there's evidence that Ehrlichman felt bitter and betrayed by Nixon after he spent time in prison over the Watergate scandal, so he may have lied.
More importantly, Nixon's drug policies did not focus on the kind of criminalization that Ehrlichman described. Instead, Nixon's drug war was largely a public health crusade – one that would be reshaped into the modern, punitive drug war we know today by later administrations, particularly President Ronald Reagan...
"It's certainly true that Nixon didn't like blacks and didn't like hippies," Courtwright said. "But to assign his entire drug policy to his dislike of these two groups is just ridiculous."*
I'm following a direct quote, while you are citing a third party trying to handwave it away. I don't really consider it ignorant to believe the primary source's exact words when they so closely mirror the reality of what happened.
Why would we ever need this? We never compare rape and murder, for that matter. We have the entire justice system for that, with judges and courts and prosecutors and defenders and jurys.
Of course we do. We, as a society, have decided that murder is a more serious offense, and assigned a punishment for each accordingly. This process has to be repeated every time a new type of crime emerges.
The conversation is around how to prevent similar white collar crimes. I'm sure it has been discussed before. I'm not sure what the conclusion is. Please provide some helpful information if you have any.
You've left about 10 comments on this topic posing questions and soliciting information from other people. Curiosity is good of course, but at some point you should consider contributing information to support your point of view instead of expecting everyone else to provide you with information. It's not like you're a judge in this case with decisional authority and an obligation to assess the fact pattern in splendid isolation.
Sure. My view - we need concrete data about the actual harm done in cases like this. We have such data for most other types of crimes. In my opinion, saying that something bad "can" happen is not sufficient to determine the punishment.
Note this is not the same as being against punishing illegal sale of private data.
A note to the reader: this is how debate-bros corner you into bullshit arguments. Best to disengage from this kind of bad-faith posturing, no matter how much they insist on their "intentions".
