Redbox left PII on decommissioned machines

What are they going to do? Sue the bankrupted company?

If instead of a load of old computers the bankrupt company had a pile of old tyres, I'd expect the receivers winding up the bankrupt company would dispose of the old tyres properly, paid for with the company's assets before anything is distributed to creditors.

When a company goes bankrupt, a curator comes in who oversees the decomissioning of the company and its assets; I don't know if a curator is a government agent or a private company (probably either), but they become responsible for the company and in this case the customer data.

If someone creates this fucked up compute stack and handles the customer data this poorly, what makes you think they would be any better at disposal even if there was some laws around it? It is not like law makers have any idea either what is going on.

Or perhaps make sure it gets sanitised before refurbished and resold. I mean bankruptcy always means debt collector tries to sale assets to cover for losses, no?

But this does not answer my question. So basically many people here are unaware where such legal framework exist at all.

They are not the company under discussion.

If a company dealing in toxic chemicals goes bankrupt, is it functionally legal to just dump them in the nearby river? I’d be amazed if countries don’t have legal processes in place to deal with situations like this and maybe the courts haven’t caught up to this use case?

We need a Superfund for data spills.

I think there's supposed to be an escrow account where you say like "I'm going to handle X amount of petrol / nuclear material, here's a big pile of cash set aside for cleanup if I dissolve"

One could do the same for pii. Of course it's cheaper not to, so I'm not sure if anyone actually does this kind of insurance policy

I think historically in the US that's exactly how it's been done, and then we just clean it up later (or never). In the meantime a bunch of people get sick

It would require setting aside some amount in escrow to be used in proper asset sanitation in case of bankruptcy, or at least sanitation getting some priority in asset liquidation proceeds.

I don’t know the US system but in the UK you have two basic routes to running a business: sole trader or LLC.

In the former, short of dying, it’s not possible to “disappear,” because you’re personally liable for everything. I’d guess that includes data breaches.

In the latter, it’s also not really possible because the company must be wound up if it goes bankrupt. In the worst case, the government appoints administrators to wind the company up, who would be responsible for handling the assets.

Now, if the processes aren’t up to scratch, maybe that’s a thing that needs to be fixed, but the structure is there to do it. At least in the UK.