<story><title>NZ’s biggest data breach shows retention is the sleeping giant of data security</title><url>https://www.privacy.org.nz/publications/statements-media-releases/new-zealands-biggest-data-breach-shows-retention-is-the-sleeping-giant-of-data-security/</url></story><parent_chain></parent_chain><comment><author>xp84</author><text>Interesting to see how this plays out in a different jurisdiction to mine. Here in the US, it seems like as long as penalties remain very light, PII retention and security is not taken very seriously.&lt;p&gt;Equifax&amp;#x27;s breach in 2017 was essentially every valuable piece of PII they had, on more than half the households in America, and they settled for $300 million in a civil suit. Their net income (after all expenses) every year is in the $500-700 million range.&lt;p&gt;They should have been fined directly, an amount intentionally set to force complete liquidation, shareholders should have been completely wiped out, and all proceeds from the liquidation after court costs should have been distributed to every victim of the breach.&lt;p&gt;If that was the case, 100% of US companies would now treat PII with the respect it deserves. As it stands, nah, it&amp;#x27;s nbd here.</text></comment>
<story><title>NZ’s biggest data breach shows retention is the sleeping giant of data security</title><url>https://www.privacy.org.nz/publications/statements-media-releases/new-zealands-biggest-data-breach-shows-retention-is-the-sleeping-giant-of-data-security/</url></story><parent_chain></parent_chain><comment><author>jacquesm</author><text>Companies were told for years that their data is an asset. Instead they should treat it like a toxic substance and a liability, to get rid of it as soon as they can. But it will be a long time before this view will become more prevalent.</text></comment>