Yet another Hacker News

Korea raises data breach fines to 10% of revenue

143 points throw7 1 hour ago 41 comments

quickthrowman 41 minutes ago | parent

I would like to make a wager on this law being ignored the first time Samsung or another chaebol violates it and is facing a fine equal to 10% of revenue. I can almost guarantee it, it’s a high enough fine to turn some low-margin businesses from profitable to unprofitable for the year and there’s no such thing as a secure computer system. The only way to guarantee compliance is to not store any data which isn’t exactly reasonable for some business models.

buellerbueller 38 minutes ago | parent

Maybe those specific business models shouldn't exist, if they consistently risk harm to 3rd parties.

google234123 37 minutes ago | parent

You legally have to hold transactions for years yk as a business

google234123 38 minutes ago | parent

Probably a law targeted at foreign companies

Retro_Dev 5 minutes ago | parent

> there’s no such thing as a secure computer system

Where is your source for this? It is entirely possible to make a secure computer system, though it does require effort. The article specifically mentions "up to" 10% and the fines applying to companies leaking data on purpose or through negligence. I doubt the fines will be nearly as high for a company that tries to secure a system (and thus prevents more leaks) rather than a company that does not try to secure a system (assuming that leaks will occur), if the same breach happens.

Computers are deterministic (excluding cases where practically impossible cosmic ray events occur), so while we have the power to ensure system security, we should ensure system security. Heck, even just encrypting consumer information and protecting just the keys to this data would already decrease the effectiveness of many data breaches.

prologic 38 minutes ago | parent

Wow! :O Finally, a legislator with enough balls to put up something that _might_ (just might) make corporations _actually_ care about security and privacy! I can't wait for this to start being adopted in other countries. It's about time!

augment_me 34 minutes ago | parent

Or you get some shell firm/subsidiary to hold your data and no difference is made

jmclnx 37 minutes ago | parent

Sounds great if all the following is true.

* Before Tax Revenue

* If the company is owned by another company, the revenue is the total of all companies owned by the highest level parent.

* Includes Worldwide Revenue

* Includes companies based in all other Countries.

I would have went for 20%, but if he above applies I wish the US would do the same.

augment_me 36 minutes ago | parent

You can just do what my university did, hire a small shell firm with 3 employees to hold all your data, and when it got hacked they just went bankrupt and we switched to a new shell firm with similar form and function.

Minimizes money usage and does not require any security investments

louthy 34 minutes ago | parent

Or … and hear me out on this one … care?

augment_me 33 minutes ago | parent

Sounds like something that costs money, if a university doesn't care I don't think most companies will.

louthy 31 minutes ago | parent

Yes, being competent requires effort.

It certainly feels much better being an proactive member of society rather than a self-serving arsehole though.

So, there is that.

nostrademons 24 minutes ago | parent

It feels better only as long as everybody else cares too. Being the only one competent in a room of imbeciles is a terrible feeling.

Hmm, this is perhaps why we get socially-negative businesses that often have very friendly (and driven, and hard-working, and intelligent) internal cultures. Competency becomes a fault line. When it becomes obvious that a large fraction of humanity just doesn't give a shit, a small group of people who are competent and driven turn their efforts to taking advantage of people who don't give a shit. Thus creating industries like market-makers, cryptocurrency, advertising, and AI.

louthy 13 minutes ago | parent

> It feels better only as long as everybody else cares too.

Not sure who “everybody else” is in your statement, but as someone who founded a healthcare tech platform (since sold) [1], I spent 20 years caring about the many millions of patient medical records we held and making sure my team cared too. In my mind it wasn’t optional.

I did it because:

* it’s the right thing to do

* for professional pride

* and so I could sleep at night

And, at least at the beginning, I believed a data breach could be the death knell of the company. Over time the laissez faire attitude to data protection by the industry as a whole made it seem like it would be survivable.

I still walked away from it a wealthy man. Being competent and caring about your customers (and being able to sleep at night) doesn’t have to mean failure like it seems everyone here thinks.

[1] https://www.meddbase.com/

pluc 30 minutes ago | parent

Every single tool being released since like 2024 is pushing everyone to care less and less and to let agents handle more and more. We are not trending towards increased quality, resilience and reliability - even though we've been obsessing over these things for the past 20 years.

toomuchtodo 27 minutes ago | parent

Caring is orthogonal to profits and shareholder value. The one who cares the least wins unless economic incentives change this math, which is what these financial penalties work towards. Humans are tricky.

To defend against the threat OP talks about (intentionally under capitalized corporate entity to avoided liability), insurance should be required, and your cyber insurance underwriter will perform an audit as part of underwriting. It's effectively a bond against fuckery in this context.

(cyber consultant and practitioner)

x3n0ph3n3 25 minutes ago | parent

That's not what orthogonal means. Saying they are orthogonal means that you can care and be profitable.

toomuchtodo 25 minutes ago | parent

You can care and be profitable, but it is usually cheaper to not unless regulatory mechanisms exist to internalize this potential externality. Can't rely on humans to do the right thing, some will not unless they feel pain for doing the wrong thing. Ergo, we build systems (legal, regulatory, technical, people) to encourage the desired target outcome(s).

I've worked with very profitable firms who care very little (and it shows in their systems and how they operate in this regard), and barely profitable firms who do everything right. What's the difference? Their culture, people, and internal incentives.

TLDR Security failures and data breach fines must be more expensive than the happy path and doing the right things. This encourages the happy path and doing the right thing, while discouraging doing not enough or nothing.

bluGill 10 minutes ago | parent

There is a lot more than regulations. Reputation is important as well. While you can give up a reputation fairly quickly, it is very hard to get/keep. Many companies are well aware of the value of their reputation - they call it the value of the brand.

my-huge-pony 11 minutes ago | parent

Why the middle man? Can't we make the law so that the University is still liable for the data beach because it's "their" data (collected/stored on their behalf) that is breached?

I think that still aligns the incentives, and University in this case has interest to make sure the data is stored properly.

SoftTalker 5 minutes ago | parent

Insurance only pays for damages, up to the limit of coverage. It does not do anything to remove liability.

augment_me 5 minutes ago | parent

This is already the law, but the shell company signs the ownership of the data and the security responsility. The university in this case is just using APIs to load and store stuff to someone else's servers.

If this is not possible no cloud storage would ever be possible to be liable for anything. Your Google drive got hacked? Your responsibility.

AIiscoming 9 minutes ago | parent

Lets be honest here, this is a business risk which is crazy high. As stupid as this is, I care but i can't guarantee it.

I might suggest a construct like this too.

What do you think how much it cost to do it perfect?

ranger_danger 27 minutes ago | parent

Perhaps they should read https://en.wikipedia.org/wiki/Piercing_the_corporate_veil

dmos62 26 minutes ago | parent

That's legal?

micromacrofoot 18 minutes ago | parent

similarly, most AI datacenters aren't directly owned by the frontier labs

guess who holds the bag if capacity needs collapse

EA-3167 11 minutes ago | parent

Sure, but the real question is, "Will a judge not immediately see through this and punish them accordingly in any realistic case?"

Sort of like EULA's a lot of the "value" is incredibly theoretical.

amelius 13 minutes ago | parent

That's like blaming Seagate when your harddisk fails.

No judge will fall for that. You should have made backups. And you are responsible for the data of your clients.

augment_me 7 minutes ago | parent

Not really, the shell company is the owner of the data and is responsible for the security of it by contract, that's the whole point.

Seagate will not in a million years sign anything like this when you buy a HDD.

imnotr0b0t 8 minutes ago | parent

That sounds risky

SoftTalker 35 minutes ago | parent

"through intent or gross negligence"

I'm not familiar with Korean law but that seems a rather high bar. I don't think we'll see many fines actually levied.

bluGill 7 minutes ago | parent

The hope is they levy few fines. When you want to make money you set the fines such that they are "a cost of doing business". Most often you don't even call them fines, you call them a permit/license fee (though fines are also common). When you want to prevent a behavior you make the costs high enough that it is worth the effort to not pay them in the first place.

(I'm assuming here that 10% is high enough that nobody would call it a cost of doing business - I could be wrong)

rectang 31 minutes ago | parent

It's childish of me I know, but if this actually goes through I will feel a twinge of delight at the refutation of all the HN commenters who have argued that such enforcement is unrealistic.

esafak 11 minutes ago | parent

The EU AI Act already levies 7% global annual turnover penalties for prohibited AI practices.

ggarnhart 14 minutes ago | parent

This feels like a really odd way to incentivize data breaches and/or not reporting data breaches.

Retro_Dev 9 minutes ago | parent

Um, I think it does the opposite of what you are suggesting - this aims to reduce data breaches and incentivize people to prevent these breaches.

happytoexplain 12 minutes ago | parent

Higher.