3 ms·
In case you're referring to the General Data Protection Regulation, it does not apply until May 2018. The penalty that would be applied would probably be this o
by pfg 10y ago
In case you're referring to the General Data Protection Regulation, it does not apply until May 2018. The penalty that would be applied would probably be this one, given that the number of prior offenses, the gravity and duration of the offense, the number of affected users and the damage caused, etc. need to be taken into account:
> Each supervisory authority shall have all of the following corrective powers:
> [...]
> (b) to issue reprimands to a controller or a processor where processing operations have infringed provisions of this Regulation;
(IANAL)
- _9MOTHER9HORSE 10y agoThere are already similar laws in the UK and other countries. See this recent example, where a sexual health centre accidentally leaked a list of 800 people who had attended HIV clinics. They ended up with a £180,000 fine: http://www.bbc.co.uk/news/technology-36247186 http://www.bbc.co.uk/news/technology-36247186
- pfg 10y agoGood point and very similar case (though in an entirely different category of "damage caused", plus there seemed to be a prior offense).
- corin_ 10y agoMost people would consider their possibly/definitely having HIV to be a more personal piece of information than their email address. If I'd been affected by this Let's Encrypt email thing I frankly wouldn't care, other than to question why it happened. (Just speaking for myself, I'm sure some people would care.) But if I was data in a leak revealing a personal serious medical issue, I absolutely would care.
- M2Ys4U 10y agoData protection is already regulated by the EU (only by means of a Directive rather than a Regulation) so the same principles apply across the EU/EEA, if not the exact rules.