> Google Analytics data from a blog This is not covered by GDPR, it is a fair use and anonymous. HIPAA is not a widespread standard outside of the US People

> Google Analytics data from a blog This is not covered by GDPR, it is a fair use and anonymous. HIPAA is not a widespread standard outside of the US People have lost out due to credit card details having been stolen. PCI compliance is a contract between merchant and bank, and not statute law, and therefore we have seen colossal breaches (like Talk Talk ISP) that are hard to punish. The cost of these breaches currently falls on other merchants who have to lose out to fraudulent car use. Next big co that looses thousands of cards, I really hope they get the top fines, as it is other companies that have to pick up the bill for their actions.