Data Breach Accountability: Should Cloud Providers Be Punished for Every Breach?

When you see news story about another data breach, do you say “Here we go again”? If so, you aren’t alone! Every day, we entrust our private information to cloud providers and when they fail to keep that information safe, it can be quite frightening. The question becomes this: should cloud providers be punished every time a data breach occurs?

Why Do People Think Punishment Is Necessary?​

Data breaches create major issues for people. When hackers breach a company’s systems, they steal people’s names, email addresses, passwords, credit card numbers and other login information. Obviously, this creates a sense of panic for the person whose information has been stolen. No one wants to think of someone having access to his or her personal information.

Many people believe that punishing cloud providers will make them take appropriate measures to ensure the safety of people’s data. If companies know they could potentially face punishment, then they will do everything to properly provide security.

Punishment Can Accomplish​

• Encourage stronger security practices
• Deter lazy security practices
• Prevent injury to users

When companies feel pressured to comply with regulations or to avoid punishment, they will work harder to improve their systems.

Is It fair to punish Every Single Breach?​

Here is the other side of the coin: not all breaches occur due to negligence. Hackers are continuously getting smarter. Even with the best protection available, there are times when a corporation’s security measures fail.

I have seen numerous instances where a company worked diligently to secure its customer’s information, and yet it was still hacked. Should that company be penalized even if they did everything by the book?

It does seem a bit unfair.

When Does Punishment Make Sense?​

• The business failed to use minimal safeguards.
• The corporation concealed the breach from customers.
• The business took too long to remediate the issues.

However, when a corporation does everything it can to secure its information but is still hacked, perhaps punishment is not the answer.

Conclusion.​

We must adopt a balanced approach. Corporations acting irresponsibly should be penalized; however, not every single breach should result in punishment without understanding why the breach occurred.