> And that is why you never let such data off your premises in the first place.
I find it a much more defensible policy to not collect such data in the first place. Regardless of who you share it with, the fact that you have the data trove is dangerous enough.
Yes, totally agreed, that's the preferred approach. Unfortunately most start-ups seem to be under the impression that more data is better because that worked so well for everybody else. But let's hope it is not too late to turn the tide on that. Between Equifax and Facebook some people are waking up. Not enough of them yet but who knows.
Start-ups should start to see data as a liability instead of as an asset.
Equifax and Facebook may have PR black eyes right now, but they have made a shitload of money with their data and they continue to make money.
It's going to be really hard to convince businesses that data is a liability when the costs of data problems have not typically come anywhere close to offsetting the revenue made with that data.
Data might be better thought of like a type of inventory, in that it is an asset on the balance sheet, but has costs and risk that must be managed very carefully to maximize profitability. Because these costs and risks show up in the paperwork, manufacturers work to minimize their inventory even though it is technically an asset.
Or maybe another way to think about it might be a hazardous natural material, like oil or mine tailings. Accidental release is always a PR problem, but the only way direct costs are imposed on the business is via lawsuits or a regulatory enforcement regime. Otherwise the public just soaks up the costs of the breach.
Ultimately I think that the way data enables revenue is a new thing in business and although we can find analogies, the best way of accounting (I mean in the technical financial sense) for data is yet to be determined. I just think it's unlikely to be considered a straight liability.
In that regard, we could take a lesson from public service bureaucrats and politicians. Out of band communication and non existent paper trail are de rigueur. I've met a few FOI officers who treat information as a liability.
I've never understood why companies feel the need to combine personal data with browsing history. If I want to sell funnel cakes, I don't need (or want) to know the personal details of everyone at the carnival, I just need to setup my funnel cake booth AT the carnival.
I find it a much more defensible policy to not collect such data in the first place. Regardless of who you share it with, the fact that you have the data trove is dangerous enough.