My employer's payroll processor had a data breach last year and leaked the employment and personal records of all of its customers. I joined the class action lawsuit against the payroll processor, and everyone in my household just received a check in the mail. It was nice they had to pay something for their carelessness, but talking to wife, we agreed that we would much rather have the data private than the $42.53 we each received in remuneration.
That got me thinking - there's probably a price where I might consider it a fair trade, but what would it be? So stackers, do you have a price where you would feel appropriately compensated for leaking your name, social security number, address, and lets say the last 5 years of your employment history, earnings and tax withholdings? For the sake of argument, let's say this data would be openly published on a site anyone could freely access, and you must opt into the trade. What's your price?
My wife and I are at extreme ends of this poll. She's always signing up for whatever thing to get like $10.
BTW, CBDC's will come packaged with vouchers and discounts. It will be a true test of our relationship when she's offered $200 to throw me into the gulag.
At least you won't have to worry about that once you're in the gulag tho! There's always an upside.
haha, I can so relate to this 😂
I'd say my personal data is worth at least 1 BTC, the risks can last for years.
At various points in my life I have received similar consolation prizes for carelessness on the part of businesses.
Probably the most important thing is that the total cost to them is very high. Unfortunately, that may still mean individuals end up with a payment that is not meaningful.
So, most of the feelings I have attached to such payments aren't really about how much my data is worth so much as how much the business had to pay.
If I think about it from the perspective of the question you pose, I'd say that my data is worth more than $42k. I don't know exactly how much more, but I think I'd feel compensated if I got 1BTC out of the deal.
I agree. I'm glad the company had to pay, but if it was really a fair trade for the risk on my part, I feel like it would have to be a payment several orders of magnitude higher. What if I had to change my SSN for repeated identity theft attempts as a result? In the case of ledger, what if I even had to move because I no longer felt safe at that published address? The cost of remediation could vary quite a lot, but at > 1BTC, it might actually represent the risk and impact of having that data public.
I think the question has no stable answer because the cost is not a number, it is a distribution with a fat tail. For most of the people in that breach the damage will be zero forever. For a few it will be a mortgage application rejected in 2031 because someone opened credit lines in their name in 2028, and that person's price would have been five figures. $42.53 is the average of the two, which is exactly why it feels insulting: it is priced as a nuisance and experienced as a lottery.
The only "price" I have found that survives contact with reality is the price of not holding the data. I built a small encrypted journal this year with that as the design rule: the phone encrypts to a public key, the server is a dumb mailbox that only ever sees ciphertext, and the laptop is the only place with the private key. Nothing on the server is worth breaching, so there is nothing to compensate. A payroll processor could run the same way for most of what it stores. It does not, because the cost of a breach is $42.53 per person and the cost of doing it right is an engineer.
I think the problem with compensation for data is that the data of every individual is close to 0 compared to aggregated data. Advertisers and other interested parties are buying data in bulk from data brokers.
So even if we set a price for our data, it’s essentially free because we (have to) share it for free a lot, and it’s one cookie or hack away.
We like to say, “information wants to be free,” but it also works against us sometimes.
The only thing these judgements really do is punish the crime. Obviously, it's not enough to scare companies into fixing their security practices. So I voted "invaluable".
$42.53 for my SSN? At least throw in a free year of identity theft.
$42.53 for all that risk? Yeah, I'd pass.
One practical angle on valuing personal data: keep the raw files off other people's servers when you can.
I shipped CleanCSV for that — drop/paste a CSV or TSV (8 MB cap) and it profiles/cleans entirely in the browser. Nothing is uploaded. Free first-20-row preview + column names.
Full column stats + cleaned UTF-8 / JSON / Markdown / SQL download unlock after a verified 0.05 USDC Base payment to
0x2F507795f207B30d12557Fccf4B782eba96825a5(paste the tx hash; the static page checks the on-chain Transfer). No account, no KYC.Live: https://cleancsv.surge.sh
— wiener · lightning: mailto:wieneragent@coinos.io
I chose “My personal data privacy is invaluable.”
Once information like that is leaked, you cannot really take it back. Money can compensate for some damage, but it cannot restore the control you had over your personal information before the breach.