Why is data security genuine technically not perfectly possible?

In my country (Austria) I was a member of the team that made first laws for protecting "person-related data" for every person.

Have we to fear new, too big uncertainties?

closed as unclear what you're asking by cpast, tim, schroeder, apsillers, Rory Alsop Jun 1 '15 at 22:17

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 3
    This is pretty subjective an opinion based. Also, what is your question? – Matthew Peters Jun 1 '15 at 18:21
  • you are right, I changed my question....wbr – ingeniosus Jun 2 '15 at 11:17
  • 1
    you still need to ask a specific question. – Matthew Peters Jun 2 '15 at 11:30
  • You seem to be asking why very few judgements have been passed regarding data protection violations in Austria? Is that correct? If so, could you edit your question above and clarify what you're asking and what you're not asking? There are a number of reasons I could think of (lack of dual IT-law expertise compared to volume of attacks, high difficulty of identifying offenders so they can be prosecuted, lack of competent investigators?). – Steve Dodier-Lazaro Jun 5 '15 at 14:29
  • The kernel problem in Austria is that we have all laws which are necessary but nearly nobody uses them. I want to know if other countries of even state-communities have same problems. Most national laws loose their validity when international data actions are given. – ingeniosus Jun 5 '15 at 14:41

Laws are meant to provide protection to the general populace from criminal elements (in theory, at least-- I'm not going to debate here if most laws are meant to protect the commoner or those with the most power and/or money or other factors). We have laws so they can act as a deterrent to criminal behavior and help maintain order in society. This is true for every society in the world, to some extent.

If a hacker breaks into a database, acquires millions of credit card numbers, and then disseminates this information in a data dump, there has to be a law in place to punish the hacker, so they can be placed in jail, both as a means of keeping the criminal element at bay, as well as a deterrent to others that might try the same thing. If there's no law, the hacker goes free to commit other morally indecent acts.

So, technology provides a deterrent in the form of physical and/or logical protection from destruction or theft, and laws provide a deterrent in the form of a threat of financial loss and/or a loss of freedom (prison time). As long as the laws are not overbearing to the point where technology and innovation suffers, and as long as the technology doesn't deter legitimate use of the data, the use of both will prevent casual violations of personal data while still allowing the data to be useful.

Of course, there's always people that are willing to take the chances needed to get to the data, knowing the repercussions of doing so, and are intelligent enough to circumvent the technology that defends that data. However, if the technology is significantly strong enough, that will narrow down the number of people that are willing and able to obtain and/or abuse the data. Laws nor technology can completely eliminate the possibility of someone intelligent, skilled, and determined enough to get at the data.

Technology provides the means of prevention, while laws provide the means of mitigation. However, technology should be as strong as possible, while laws should provide only enough deterrent effect to convince morally gray people to not do something without stifling innovation. Prevention is preferential to mitigation.

Not the answer you're looking for? Browse other questions tagged or ask your own question.