[HN Gopher] Shein owner fined $1.9M for failing to notify 39M us...
___________________________________________________________________
Shein owner fined $1.9M for failing to notify 39M users of data
breach
Author : pseudolus
Score : 62 points
Date : 2022-10-14 15:53 UTC (7 hours ago)
(HTM) web link (techcrunch.com)
(TXT) w3m dump (techcrunch.com)
| colinmhayes wrote:
| How does this even get enforced? Does Shein have any assets in
| the US? Seems like it's a totally chinese/singapore based company
| that just mails stuff to other countries.
| breitling wrote:
| Shein is also accused of using forced labor [0] and there have
| been many instances of workers leaving notes in clothing pleading
| for help [1]
|
| [0]https://impakter.com/how-fast-fashion-giant-reacted-to-
| help-...
|
| [1]https://www.rollingstone.com/culture/culture-news/shien-
| tikt...
| kyleamazza wrote:
| The second article linked actually debunks the claim that
| workers have been leaving notes (but does note Shein's labor
| violations)
| richbell wrote:
| ~$0.05 per person affected is a pretty compelling cost avoidance
| versus having to pay for security and compliance personnel, not
| to mention potential reputational damages and lost revenue from
| actually following the rules and telling people you were hacked.
| hbrn wrote:
| If you read past the headline, it's not $0.05, it's $5.07. A
| 100 times higher. Maybe even more, if you only count New
| Yorkers that were not notified about the breach (255,294).
|
| And it sounds like they weren't fined for the breach. They were
| fined for negligence _after_ the breach.
| notch656a wrote:
| Corporate fines make a lot more sense once you understand
| they're not there to stop the behavior, they're there to make
| sure the shakedown ensures the state gets their cut. They don't
| actually want to destroy the company, they want their piece of
| the action by proxy.
| hbrn wrote:
| That sounds like a conspiracy theory, how would that work in
| practice, where are the incentives? Does attorney general get
| a cut of the fine?
| [deleted]
| johncessna wrote:
| The existence of an agency designed just to root out this
| behavior provides a lot of incentive. The folks who create
| the agency get say they're doing something about the
| problem and look good. The folks in the agency get jobs and
| all that entails.
| hbrn wrote:
| Doctors want people to be sick, police wants people to
| commit crimes, military wants wars. This is a dangerous
| mindset.
|
| Did they improve their practices after the breach? Sounds
| like they did:
|
| "Zoetop became independently certified as PCI DSS
| compliant in April 2019 and has remained so since."
|
| Now I know that PCI DSS is a complete shit, but that's
| the only tool they have. I'm all for criticizing the
| state, but sounds like in this case they did their job
| just fine.
| [deleted]
| ceejayoz wrote:
| > They don't actually want to destroy the company...
|
| Sure, just like a speeding ticket doesn't get punished with
| the death penalty. Of _course_ that 's not the goal of the
| fines. Why would you expect it to be?
| LeifCarrotson wrote:
| The fines should be large enough to serve as a deterrent;
| as a warning to other companies that if they harm the
| public they'll be punished.
|
| Fines which are a minor nuisance, a small cost of doing
| business, don't accomplish those goals.
| Ekaros wrote:
| They should wipe years of profits and also pierce the
| corporate veil. Go after the stock holders and their
| property if needed. They deserve it.
| paxys wrote:
| My college campus had a huge parking problem. One time I
| got a ride from a classmate, and he rolled up and parked in
| a clear no parking zone. When I pointed it out, he said "oh
| I'll just pay the $50 (or whatever) ticket. I always do it
| when I'm running late for class."
|
| Parking enforcement was happy since they made a bit of
| money. The student was happy because he got to park in a
| prime spot for a fee that was insignificant for him.
| However, if the goal was to stop people from parking in
| certain areas, the policy failed miserably.
|
| Corporate fines work the same way. If they make $10 from an
| illegal action and are fined $1 for it, it isn't a
| deterrence, just a good investment opportunity.
| speeder wrote:
| When I was a little kid, I had to go the airport with
| some distant relatives. One of them parked right next to
| a "forbidden parking" sign.
|
| So I went up to the owner of the car, and asked, she then
| cheerfully replied:
|
| "Oh, the parking lot charges 40, the fine is 5, I prefer
| to pay the fine since it is cheaper!"
| NullPrefix wrote:
| Always a chance the car will be towed
| ceejayoz wrote:
| This is a solvable problem. Finland's approach is good
| here; fines are income-based (https://www.theatlantic.com
| /business/archive/2015/03/finland...). The GDPR similarly
| imposes a penalty in terms of "percent of annual global
| revenue".
|
| The point: the goal isn't a corporate _death penalty_ in
| these sorts of cases.
| darkarmani wrote:
| In Finland's case, if you are filthy wealthy, you should
| never drive yourself. Hire the cheapest person that is a
| good driver and pay their tickets for them.
| [deleted]
| notch656a wrote:
| Speeding ticket is actually the perfect analogy of this
| kind of behavior. Thank you.
| kman82 wrote:
| Why are they fining Shein's owner and not Shein themself?
| ceejayoz wrote:
| Because it's not just Shein, it's two of the parent company's
| subsidiaries.
| [deleted]
___________________________________________________________________
(page generated 2022-10-14 23:02 UTC)