> What's stopping IDScan from "delegating" the storage to another company so they're no longer liable for stolen data?

You can't really delegate the liability to a vendor. Of course in current world it means nothing since there is effectively no liability anyway, but if we're dreaming of a world where there is liability, you can't delegate it. You can delegate the operation, but not the liability.

The company is responsible for vetting their vendors so they meet their requirements. Today that is done with a silly dance of exchanging SOC2 reports and such, which means nothing. But if there was actual personal liability for the board and executives, that would change in a millisecond.

I think IDScan is still responsible for. You don’t typically go after hosting providers for failures like this, right?

Or are you referring to the practice of using shell companies to obfuscate responsibility? In that case, I think there’s history that says IDScan would still be responsible, questionable legal business nonsense be damned.

if company A does a piss poor job at auditing and vetting their vendors then company A shares a proximate responsibility billable and criminally liable to say 50% of the damages (along with company B for accepting a contract they were not able to fulfill)

I think the best way to prison reform is to start jailing execs who inflict mass suffering via process decisions en masse. maybe then Sergey Brin will decide to drop a quarter billion in something other than opposing a wealth tax

two birds, one stone as they say

Potentially, all of them.

If someone steals my identity, and puts me in a position where "I" owe money that I didn't borrow, NONE of that money paid back will come from my pocket.

The government can figure out who should owe it, but it sure as hell isn't me.

I think in the same way part of our paycheck goes to federal taxes, part of our paycheck should go towards funding an insurance for the financial impacts these sorts of events, commensurate with the total compensation of a person, and adjusted each year for the growth of any stocks granted to that person.

I'm sure there are edge cases and operational details that need to be figured out with that idea, but at the end of the day if a company is directly or indirectly responsible for awful things, the executive and senior leadership should feel the impact more than others, financially and/or criminally.

It's not identity theft - it's bank robbery, and the bank is trying to pin it on you: https://www.youtube.com/watch?v=CS9ptA3Ya9E