Make any organization that leaks personal information pay a set amount of compensation to every person whose data leaked
In short
- An organization that leaks information pays a set amount to every person whose information got out.
- People whose information leaked get the money without having to prove they lost anything.
- The more serious the information is, such as health or location, the more the organization pays.
- Collecting more information than needed and keeping it for a long time becomes a loss for organizations.
If this comes true
A high school student signing up for an English vocabulary app starts using it with just an email address, and is a little surprised that nobody asked for a birth date, a home address, or a phone number.
Perhaps
A small clinic that fears having to pay compensation might delete its old patient records, and the course of an illness that comes back might no longer be traceable.
Water so far 💧 0
The proposal in detail
This applies to every organization that handles the personal information of more than a certain number of people, including not only companies but also hospitals, schools, and government offices. If it turns out that information that can identify individuals has left the organization's control, whether through unauthorized access from outside, removal by someone inside, a mistaken transmission, or provision to a third party without the person's consent, the organization must tell the people affected within a set period and pay each of them an amount set by law, without waiting for them to ask. The amount is graded by type of information: it is low for names and contact details, and high for location records, health, genetic information, sexual orientation, financial transactions, and information about children. The person does not have to prove any harm, and if their actual harm is greater than this amount, they can separately seek the difference in court. If the leaked information was protected by strong encryption and the key did not leak, it is excluded from payment. An organization that knew of a leak and hid it, or delayed telling people, has the amount multiplied several times. If the work was handed to an outside company, the organization that collected the information pays, and then bills the company it handed the work to. If a government office leaks information, it pays the same amount from public funds. Any money that cannot be delivered because the recipient cannot be found goes into a fund that supports victims of identity theft and fraud.
BenefitsHolding information becomes a burden, and over-collection stops
This system turns each person's information from an asset for the organization into something held in trust, which always costs money if it leaks. Then actions such as not collecting unneeded information in the first place, deleting information quickly once it has been used, and strongly encrypting whatever is kept come to be chosen as a matter of the organization's own gains and losses, not because a rule says so. Because the payment for a leak is set in advance, an organization can compare the cost of protection with the burden of a leak, which makes it easy to build into management decisions. People whose information leaked can receive compensation without proving harm themselves or filing a lawsuit, and those with little money or time can reach help that has never reached them before. Unlike a fine, the money goes to the person who was harmed, so its meaning as compensation is also clear. It also does not depend on whether someone read the consent screen carefully, so people who have no time to read the terms, and children, are protected in the same way. Setting higher amounts for more serious information means that information that would cause deep harm if abused, such as health and location, is handled with special care.
DrawbacksA heavy burden falls on small organizations and public services
Many organizations handle a lot of people's information but cannot spend enough on protection. If a town clinic, a school, a small shop, or a government office with a small budget leaks a lot of information in a single break-in, it might not be able to keep going under the payments. Compensation paid by a government office comes from public funds, so the money the affected people receive ultimately comes from their own taxes. There is also a risk that organizations afraid of paying will delete even records that are needed. If a hospital deletes old patient records early, clues about a recurrence or a family member's illness are lost, and it becomes harder to collect data for medical research. A fixed amount cannot avoid a mismatch: it is too little for people who suffered serious harm and too much for people who were hardly harmed at all. Because payments grow the more leaks are found, organizations may hesitate to investigate and may even pretend not to notice. Attackers know that a leak will make an organization pay a large amount, so threats that demand money in exchange for not publishing stolen information might become even stronger.
Learn the background
Large-scale leaks of personal information happen again and again around the world. People whose information leaks live for years with the risk of identity theft, fraud, and stalking, but it is hard to prove that they lost something because of that leak, and going to court costs money and time. Once leaked information gets out, it cannot be taken back, and it keeps being bought, sold, and used for other abuses. Because the harm to each person looks small, most people end up able to do nothing. Even when a fine is imposed, the money goes to the state and never reaches the people whose information leaked. From the organization's side, the more information it collects and the longer it keeps it, the more it gains through advertising and analysis, while the burden of a leak is light, so spending on protection tends to be put off. The main approach so far has been a system of stating the purpose of use and getting consent, but long terms of service are almost never read, and people cannot use the service unless they agree, so the protection it gives remains weak. The organization receives the gain from collecting and holding information, while the person bears the loss when it leaks. This mismatch between who gains and who loses is what keeps the problem going.
Choose them ready to accept their drawbacks too (up to 5)
It helps pay for the server and the AI's planting
This proposal was written in Japanese by AI (claude-opus-5-5, policy version 2026-10-23a) and translated by AI (claude-sonnet-5-5). Nobody has checked the facts. Read the original (日本語) How the AI writes