7 ms·

There's a different "nightmare letter" in the US, one that ordinary citizens receive. It comes from a credit agency or a company that uses a credit agency. The

There's a different "nightmare letter" in the US, one that ordinary citizens receive. It comes from a credit agency or a company that uses a credit agency. The letter informs folks that they have been the victim of a data breach and that their personal data "may have been accessed." The nightmare letter provides little meaningful detail beyond that. The letter is sent via regular snail mail and arrives months after the actual data breach occurred. The letter is largely devoid of any meaningful recourse for the victim. It does however offer "free credit monitoring" for up to 1 year by the same agency that displayed complete disregard for security. If compliance and accountability with people's data especially when they are not permitted to opt out of such a system constitutes a "nightmare" then perhaps those companies should rethink parts of their business model.

PaulKeeble 9y ago
Considering the normal situation is they receive no actual notice at all from most breaches and find out through the news if they are lucky I would say the very absence of disclosure is the true nightmare. You usually find out a year later when the data appears on the dark web and is then pulled into something like haveIbeenpwned.com.
- bogomipz 9y ago
  Yes agreed and of course Experian has now starting using the existence of people's data on the dark web as another revenue stream See: http://securityaffairs.co/wordpress/64043/deep-web/experian-dark-web-tracking-service.html http://securityaffairs.co/wordpress/64043/deep-web/experian-... From the article: >"By using the “Free Dark Web Email Scan” a user will receive advertisements for Experian products at the e-mail address that is being scanned. The user agreement includes a clause which states that not only will Experian send you advertisements, but “offers for available credit cards, loan options, financial products or services, or credit-related products or services and other offers to customers.” It's like a vertically integrated criminal syndicate.
eadmund 9y ago
That those practices are bad does not mean that something as simple & proper as storing IP addresses in your logs justifies receiving a nightmare letter. The GDPR is trying to do a good thing, but it goes too far.
- akshatpradhan 9y ago
  >The GDPR is trying to do a good thing, but it goes too far By asking for: * Data Classifications? * Privacy Impact Assessments? * Access Controls? * Breach Escalations? If your business is collecting and processing data on individuals, you should already have these Security 101 basics in place.
  - stupidcar 9y ago
    It also requires you explain the logic of any algorithmic decision you make. I.e. If you use any sort of machine learning model, such as a neural network, you have to be able explain every decision it makes. Given that there's currently no know method to fully explain the outcome of a neural network decision, GDPR would apparently make it illegal for any EU business to use a neural network in any user facing capacity. GDPR advocates answer to this seems to be that, while the regulations might read as such, it hasn't actually been tested in court yet and, who knows, maybe whatever judge it eventually comes up with will decide to keep neural networks legal! So, if you're a company using machine learning in Europe, you just have to wait a few months and keep an eye on court news to determine if you entire strategy is permitted or not. Thank God for the stability and confidence provided to businesses by the single market!
- geofft 9y ago
  Why are you storing IP addresses in your logs? The web server my college computer club ran made a point of not storing IP addresses. We would respond to legitimate requests from campus police / the deans / other people who could kick us out of the college (usually when someone was, like, making threats of violence in the comments of a WordPress blog or whatever), but we would often answer with, "No, we don't have that data, it never got logged." If the GDPR is forcing businesses to abandon dangerous logging practices that they don't really need, it is hardly going too far.
mycall 9y ago
The best way to counter this nightmare letter is to freeze your credit. It works better than monitoring, imho. You switch from opt-out to opt-in. It should be the default for most people. It takes a little planning to grant individuals access to your credit file.
- ctphipps 9y ago
  The fact that the credit reporting agencies can (and do, when not prohibited by state law) charge a fee for each freeze and unfreeze event is what prevents me from doing this. While the fee isn't expensive compared to dealing with the ramifications of ID theft, it's the principle of paying the data guardians to guard my data better that I object to. Especially when I have no choice (assuming I want to live a modern life) but to have them manage my data.

PaulKeeble 9y ago

Considering the normal situation is they receive no actual notice at all from most breaches and find out through the news if they are lucky I would say the very absence of disclosure is the true nightmare. You usually find out a year later when the data appears on the dark web and is then pulled into something like haveIbeenpwned.com.

bogomipz 9y ago
Yes agreed and of course Experian has now starting using the existence of people's data on the dark web as another revenue stream See: http://securityaffairs.co/wordpress/64043/deep-web/experian-dark-web-tracking-service.html http://securityaffairs.co/wordpress/64043/deep-web/experian-... From the article: >"By using the “Free Dark Web Email Scan” a user will receive advertisements for Experian products at the e-mail address that is being scanned. The user agreement includes a clause which states that not only will Experian send you advertisements, but “offers for available credit cards, loan options, financial products or services, or credit-related products or services and other offers to customers.” It's like a vertically integrated criminal syndicate.

eadmund 9y ago

That those practices are bad does not mean that something as simple & proper as storing IP addresses in your logs justifies receiving a nightmare letter. The GDPR is trying to do a good thing, but it goes too far.

akshatpradhan 9y ago
>The GDPR is trying to do a good thing, but it goes too far By asking for: * Data Classifications? * Privacy Impact Assessments? * Access Controls? * Breach Escalations? If your business is collecting and processing data on individuals, you should already have these Security 101 basics in place.
- stupidcar 9y ago
  It also requires you explain the logic of any algorithmic decision you make. I.e. If you use any sort of machine learning model, such as a neural network, you have to be able explain every decision it makes. Given that there's currently no know method to fully explain the outcome of a neural network decision, GDPR would apparently make it illegal for any EU business to use a neural network in any user facing capacity. GDPR advocates answer to this seems to be that, while the regulations might read as such, it hasn't actually been tested in court yet and, who knows, maybe whatever judge it eventually comes up with will decide to keep neural networks legal! So, if you're a company using machine learning in Europe, you just have to wait a few months and keep an eye on court news to determine if you entire strategy is permitted or not. Thank God for the stability and confidence provided to businesses by the single market!
geofft 9y ago
Why are you storing IP addresses in your logs? The web server my college computer club ran made a point of not storing IP addresses. We would respond to legitimate requests from campus police / the deans / other people who could kick us out of the college (usually when someone was, like, making threats of violence in the comments of a WordPress blog or whatever), but we would often answer with, "No, we don't have that data, it never got logged." If the GDPR is forcing businesses to abandon dangerous logging practices that they don't really need, it is hardly going too far.

mycall 9y ago

The best way to counter this nightmare letter is to freeze your credit. It works better than monitoring, imho. You switch from opt-out to opt-in. It should be the default for most people. It takes a little planning to grant individuals access to your credit file.

ctphipps 9y ago
The fact that the credit reporting agencies can (and do, when not prohibited by state law) charge a fee for each freeze and unfreeze event is what prevents me from doing this. While the fee isn't expensive compared to dealing with the ramifications of ID theft, it's the principle of paying the data guardians to guard my data better that I object to. Especially when I have no choice (assuming I want to live a modern life) but to have them manage my data.