It has been eight months since the data breach was announced (nine since it was discovered). This is the first time we are getting a full reckoning of what data

It has been eight months since the data breach was announced (nine since it was discovered). This is the first time we are getting a full reckoning of what data was accessed. (We knew it was ~150 million SSN's, but we didn't what else it included--e.g. address history, income, debt, etc.) I'll admit, Equifax actually exceeded my expectations in this regard, I was skeptical that they would be able to create a document like this at all. Still, the impact of the data breach was magnified by the fact that they have so little oversight over their own systems that reconciling records took more than half a year. Any time there's a privacy issue nowadays, I like to play "What if GDPR?" GPDR would have required this document be filed to the relevant authority in three days (Article 33). And the work to compile this document would have mostly been front-loaded by complying with the documentation requirements in Article 30. I don't think GDPR would have made a direct impact on preventing the breach (other than maybe causing someone to look at the towering pile of paperwork and consider thinking of the data as a liability), but affected users would have been much better prepared to know how they might have been affected and how to respond.