Yeah, but this breach is specifically about KYC, about financial industry stuff. The company that got porked, was the company the banks used for their KYC stuff.

KYC is typically a due diligence process tied to regulated financial industry participants – the restaurant example has a much different function. Banks and FIs have much broader retention (and disclosure) obligations.

Here, let’s put it slightly differently. I’ll reference Canadian regulations/processes more, as those are the ones I’m most familiar with. If you’re a bank, you’re required to flag suspicious transactions related to the customer – and in order to know when those transactions are suspicious, you need some way of reviewing it within the context of the customer. You may even have an obligation to second guess / question / try and advise the customer ‘not’ to make a transaction, based on knowing your customer.

The most basic example of that, is where Credit Cards will decline payments / request a call if you try and make a purchase in a totally abnormal location – like you “know your customer” lives in Toronto, but suddenly see them spending money in Mexico? Or if they called you before they took a trip to mexico, that’d also go into a KYC type file to let people know to expect those sorts of charges and let em get processed. That’s tied to KYC.

The media will often run stories about seniors getting scammed, with the general message being “WHY DIDNT BANKS DO MORE TO PROTECT?”. Well, that’s KYC too. You gotta ‘know’ your senior members, and their spending habits to some extent, to find those outliers. You also need to be familiar with them enough to know whether its “normal” for them to come by and take out cash, and in what quantities and for what purpose, cause seniors will sometimes ‘show up’ with a person pressuring them to take out cash to ‘pay a bill’ (scammms galore!). All part of KYC due diligence.

Or the somewhat obvious elephant in the room – if you have a “personal” account member, who keeps receiving etransfers to his “[email protected]” account for some reason, you gotta look into it a bit and sort out what all those payments are related to, cause it isn’t a business account. And if you see anything suspicious, it gets reported to the authorities, where, most likely, Trump shits himself and Americans ignore the crimes.

People want surveillance options. One of the highest/most obvious features required, unsurprisingly, is the ability to see your cameras on your smart phone – which generally means you need a Smartphone App + a centralised server/system connecting the different ends. The alternative being that end users would likely need static IP addresses / Dynamic DNS setups to have a Smartphone app point “directly” to their exposed CCTV ports – which I don’t imagine regular consumers are keen on, likely why basically no such options seem to exist in the retail space (afaik - if there are widely used brands i dont know about, by all means clue me in).

Options that are fully local/closed/under user control, are almost impossible to find. This isn’t so much a consumer-specific problem, from my perspective, at this point – there aren’t enough options for consumers to choose differently. It’s sorta like how you’re generally ‘stuck’ with US-tethered Smartphones. It’s not so much a ‘choice’ that consumers get to make, as it is that these big businesses have effective monopolies and consumers are stuck.

KYC isn’t evil. It’s literally the operational piece that says stuff like “If someone named Vladimir Putin tries to open a bank account with you, you should know if he’s THAT putin or not, especially as it may get your business in serious trouble related to gov sanctions etc”. The government, quite literally, sends auditors to Banks and Credit Unions every 2-3 years to make sure you do this sort of due diligence.

The issue with KYC is that it’s farmed out to third parties that focus on scale and cutting costs. It’s in the same general space as something like Credit Scores – Banks/Credit Unions don’t maintain their own credit scores for people so much, as they just buy that score information from Equifax / Transunion etc.

Really, what I imagine people should be pushing for instead of this piecemeal whining, is something closer to what Estonia has for its citizens. A highly integrated government-based portal that allows citizens to do things like Register a New Small business in 15 minutes, and to see which organisations have access to their gov ID info. From what I understand, citizens basically get given PINs as part of their gov IDs, which they can disclose to banks/businesses, who can subsequently access basic required read-only details about that person via the gov portal. So your bank needs to know who you are? No problem, you let them know your pin when you setup the account – and the banks system is then able to pull just the basic info from your gov account to meet the banks operational needs / regulatory obligations whether you’re there in person or not. And as a citizen, if you want to check your privacy disclosures to third parties, you just log in to the gov site, and see a list of which businesses have access to your data – and I imagine you’d get the option to cancel their access if you wanted to (so when you close an account at a business, you pop in to the gov site and also clip their ongoing access). From what I gather, that sites a one stop shop for all gov stuff, so it’s also where you go for tax stuff, drivers lics, the works. Makes it a LOT simpler for citizens, as you don’t need to sort out what esoteric stupid sub site / domain you need to visit to see if you qualify for a rebate or whatever – so it seems like a big improvement from a user experience side.

ALL THAT SAID, that shift would put more onus on the consumer in some ways, as they’d need to log in to a gov site etc – like it’s bad enough trying to explain MFA to old people, imagine trying to make this shift! You’d also need a government that was willing to actually do stuff for the people – I think Estonia only went that way, as an attempt to shield themselves from massive attacks from Russia. They want their gov fully functioning in the cloud, including elections etc, so that even if they end up like Ukraine, they can still “function” remotely. Consumers are a big issue for anything security related too, as practically no one changes banks / FIs based on security – it’s almost entirely rate oriented for mortgage holders. Tell a consumer they can get a 0.2% better rate by going with the bank that doesn’t fuss security, they’ll take it. Try and market your bank/FI as being more security conscious, it won’t generally draw in new members based on that alone.

Like, again using Canada as an example, we’ve had a year of the US antagonizing us and threatening economic ruin / annexation. Lots of Canadians are keen not to buy American products as a result. Almost all of Canadas banks/CUs use US partners/outsourcing within their stack: places like Vancity Credit Union, for example, are using Intellect Design’s product for their online banking, which is a partner owned by an India parent company (with little/no presence in Canada), which hosts its stuff on Microsoft’s cloud. Most Credit Unions in the country are likely going to go the same way in the next couple years – even though it’s a huge security risk, and highly likely that both India and the USA will gain access to all your data, let alone sketchy third party’s like India’s fraud centers. There are a couple Credit Unions in Canada that actually maintain stuff (almost entirely) in Canada. But that’s not enough to entice people to use those organisations, so they’re all dying out / merging as a result of a lack of members (and regulatory overreach / decrees).

Tax records are required to be kept for 7 years in North America (generally, as far as I know - def in Canada). So you order something online from a business, they have a business need to keep your data on hand for 7 years in case an auditor / tax person comes asking about it. Be that someone auditing the business, or someone auditing a customer. That’s a requirement from the government.

I’ve seen customers ask for tax stuff going back up to 20 years from a business. In those cases, if there’s demand for data going back that far for whatever reason, the business can internally say “We have a business reason to retain data longer” because people ask for it – there’s demand. So they can justify to auditors/legal sorts retaining that information indefinitely, based on user demands/requests.

In some cases when I’ve seen those ancient requests, it’s also tied to legal disputes from customers – eg. Trying to prove in a divorce that such and such was bought by party A in 2005 for X amount. In some cases, there’re class actions that go outside the 7 year window, and require data from further back to sort out – for example there’s a case in Canada currently where a financial lender is paying back ~$2000 per person that took a loan from them from 2016-2021 (so ~10 years of personal data needs to’ve been kept, to verify early claimants). Part of needing to keep data so long, is that the court cases are often so drawn out that the 7 year window would make some crime/wrong-doing much more difficult to prosecute due to a lack of evidence. I know of one class action lawsuit in the Financial Industry that’s been ongoing since the 90s, and still isn’t fully resolved – most of the potential class action recipients are deceased at this point, and the only people profiting are lawyers, but still. Lawyers are a part of the problem, and a reason why data is often being held longer and longer. Honestly, Lawyers are also terrible at securing their data --they tend to rely on paper-controls to prevent their unsecured data from getting used, rather than actual hardening. Like there was a guy who spent a few years in Colombia or something, his personal laptop being used for all sorts of nefarious stuff, and when he came back to Canada and the border people took his laptop, it was totally unencrypted/unsecured. They guy just argued it was his “legal work” laptop and everything on it is confidential and can’t be used in court.

Idk. I think your approach is overly simplistic for the issue. There’s a lot of “stuff” related to corporate data retention policies and methods, and I don’t really see much nuance in what you’re proposing. Hell, if they only kept your data till you got your item, youd NEVER be allowed to get a refund, cause they’d have no record of you purchasing the item.