Or maybe the government should not require companies to KYC you for every little stupid thing or action you do in this world. What happened to requiring only the information that's actually required? Why do I need to be KYCd in the systems when buying banana, ordering delivery, etc.

Because of the inevitable breaches and leaks - KYC is the illicit activity. The selling point of KYC was preventing fraud and money laundering. It doesn't actually do that. Search for "largest money laundering settlements" and you will find 5 banks and one crypto scam.

Penalties don't work for government agencies. Taxpayers would pay for it and it doesn't act as an incentive.

The way to fix it is to empower one government agency to do aggressive pentesting against every other agency, hospitals, banks, infrastructure, and big corporations, with salaries matching the private sector. Impose a legally-enforced deadline to fix any issues, with a fine (for private actors) or demotion of the guy in charge of infosec (for state agencies).

Forget compliance checklists, KPMG "audits" and all that crap, just have government-sponsored hackers trying to get into everything like an attacker would.

France seems to have had a ton of government hacks in the past year at various levels, so it's sorely needed.

Hey now, don’t forget the offer of “free credit monitoring for a year” - I feel like at this point I’ve gotten so many of those that if I signed up for them all, I’d have my personal info in twice as many probably-hackable locations as I do already.

With everyone doing online “identity” verifications, all these details and more are already available to data brokers. Persona.. I mean Palantir even has a short video of you from your “liveness check” to go with the scan of your ID.

Seeing another one of these breaches had me returning to look at local-first software. https://lofi.so

I feel like if we're going to make progress in preventing wholesale data breaches it will be through architectural innovations that attack the problem of why a trove of concentrated data needs to exist. Even if the government needs to be a central authority, are there ways to house the data that limit the blast radius?

I'm sure there are innumerable arguments why this can't help, but when the mainstream alternative is despair and helplessness, progress will be made in the margins.

Wait, you don’t even get a month of free credit monitoring?

The problem though is when its from a gov agency it validates previous breach data making it more valuable.

GDPR has solid fines for data breaches, but this doesn't work for government agencies. Just someone else's money going from one government pocket to another. What they need is an automatic firing of the head of the government agency that suffered a breach. No question asked.

> Nothing really new here sadly

Facts at Equifax

> if the only penalty the company/agency gets

What is the penalty for the government?

Not disagreeing with you, but:

> These things will never change if the only penalty the company/agency gets is

I do not think penalties can prevent these situations. Perhaps they may be less frequent; perhaps people would get more compensation, but ultimately I do not think these can be prevented. The first consideration is why the data has to be stored in the first place. Naturally one can say "the government needs to know who is a citizen and who is not", and I can understand this rationale to some extent, but even then I wonder whether this has to be correct. Perhaps we could have a global society without any requirement to be an identifiable citizen per se. Things such as mandatory age verification-sniffing to never become an issue, because it is not needed and not possible and nobody would have an addiction-need to sniff for that data (we know Meta and co want that data, this is why their lobbyists run rampage via the "but but but somebody protect the children" lie).

A copy of it would be nice for record purpose (so Anthropic and OpenAI can have it in their dataset :))

Biometrics is just something else to get leaked, terrible idea because it's even more sensitive (can be used to track you through cameras for example, like used in the Iran war).

This problem has long been solved with federated IdPs and MFA - something you own like OTP device/physical token besides something you know like SSN/tax id/password.

Most governments prefer biometrics of course because citizen privacy is the opposite of what they want.

Based on how things are, I feel like the US solution is just going to end up with me requiring a retinal scan to buy pants from Target online and then that scan will end up on the dark web along with my voice print and a scan of a my driver's license.

> We should think of how to verify people's identities online

France already has that, in multiple ways.

There is the France Connect SSO, which is kind of a federated SSO. You need at least one account which is physically proven (it could be with the Post Office which send you a letter with a code to confirm your address and idenntity / ask you to physically come to a post office for an ID inspection; the tax authority where there are also multiple physical verification hoops, the social security system, same), and can use that via the SSO to authenticate to all government services.

Separately, there is an app proposed that scans your physical ID's NFC chip with your biomettrics, compares that to a selfie you take, and uses that identity to authenticate you to stuff.

I can make a new password, hard to get a new eyeball.

They do have to prove who you are, and to do that you need to show your ID(s) and they need to check it in their system. I don't understand your comment.

Why would those pieces of data (DOB, full name, address) ever be sufficient for identity theft?

If that's sufficient to achieve anything then those systems are built on top of hopes and dreams.

>I hope they release a tool to check if I'm impacted or at least email me about it.

"ANTS stated that it is currently in the process of notifying those identified as impacted."

With the number of leaks the French administration had everywhere, you don't need a tool, you are guaranteed to be impacted.

Alternatively, hackers can now be used as a method of age identification.

are govs required to comply with GDPR and data breaches laws?

I don't understand the downvotes. Literally every single German email provider took like 5 years to implement 2FA. Even now lots of security issues with many German providers that claim privacy. Even so-called DE-mail was sham. Still somehow people assume FAANG is crap in data security. (Yes, I am not demanding privacy from ANY MultiNational company)