4 ms·

Thanks for posting. This does not look all that different from PCI compliance, though the scope of data involved is larger and as others have observed there's s

Thanks for posting. This does not look all that different from PCI compliance, though the scope of data involved is larger and as others have observed there's some ambiguity about coverage that will need to be worked out in practice. Editorially speaking I'm glad to see this emerge even though it means more work for me personally. If anything some of the fines seem too low. (I'm looking at you, Equifax.)

hartator 8y ago
Equifax is an American company targeting US residents, they are not concerned by GDPR.
- casca 8y ago
  Equifax is a global company headquartered in America that operates in 24 countries, including 3 where people are covered by GDPR: UK, Spain and Portugal[1]. [1] https://www.equifax.com/about-equifax/company-profile/ https://www.equifax.com/about-equifax/company-profile/
- hodgesrm 8y ago
  They should be. Aside from operation in Europe eventually US legislative bodies will wake up and start passing laws to protect data. GPDR will be an obvious practical example to study, much as Obamacare was at least partly modeled experience in Massachusetts. I have no doubt that many tech companies have already put preventing this at the top of their DC lobbying agenda.
  - whataretensors 8y ago
    Government bodies don't care about your private data or they would disband the NSA. They will however copy the GDPR as an excuse to create tools to prevent disruption, manipulate markets, and to expand their organizational reach.
    - baq 8y ago
      Oh, they care. They don't want other governments to know what they know.
zerostar07 8y ago
Speaking of which, how would the Equifax breach have been affected by GDPR ? My understanding is that they had legitimate reason to request and store that data, and GDPR is not some magic tool that prevents breaches.
- kryptiskt 8y ago
  They would at least have been required to disclose the leak in a timely manner.
- guitarbill 8y ago
  They handled the disclosure awfully. The GDPR has time-frames for notifying data protection authorities and the people affected about breaches. Presumably, they would have failed on that count. Then the question is did they have the appropriate safe-guards in place, w.r.t. the importance of the data. I don't think we quite know what their systems look like. But the answer is probably not, given the scope, amount of very personal data, and the fact data from US, Canadian, and UK individuals was leaked, and the time it took to notice the breach. Factoring both these things in and maybe the fact that an executive was charged with insider trading, they could be fined accordingly.
- cge 8y ago
  Beyond just the breach, I think Equifax's business would be difficult under GDPR? One of the major problems with the breach is that, if you are worried about Equifax's security, you can't just choose to not let them store your data: they will store it, and provide it to third parties, regardless of your consent.
- gsnedders 8y ago
  As others have said, their disclosure left a lot to be desired. Depending on cause, potentially also not having sufficient security procedures in place to avoid such a leak of PII occurring.
- hodgesrm 8y ago
  I'm just a beginner on the GDPR but here's a few things I got out just of the Everlaw link. 1.) Protect the data with methods corresponding the risk level (Articles 32 and 35) 2.) Enable users to erase, correct, or transfer data at will (Article 15) 3.) Enable users to consent to use of their data in the first place (Article 15) So yes, it seems it would have been quite applicable.
kryptiskt 8y ago
Funny thing is that everything in the Equifax breach (addresses, social security numbers, income) is public information in Sweden and everybody can access it.
tzs 8y ago
PCI compliance is a lot more annoying than it appears at first. A business that accepts credit cards can easily end up storing credit card numbers in places they do not intend to. That can happen even if they do all their intentional credit card handling through an outside service that their check out pages post to or AJAX to so in theory no credit card number ever even reaches the business' servers. For example, customers will email you to tell them that the credit card they pay their subscription with is about to expire, and give their new credit card number and security code in the email (and for good measure often give the old credit card number and security code). Same for your help desk system, regardless of whether it is based on email or web forms. Customers are going to stick credit card numbers in tickets. I don't think I've personally seen a customer stick a credit card number in a forum post or in a blog comment, but I wouldn't it past them. Basically, if customers can put text in it [1], you really have to assume some customer is going to put a credit card into it. I'm not kidding. I've seen credit card numbers show up in name and address fields. Oh, and when they stick unrequested credit card numbers in emails, support chats, etc., they will often format them in weird ways. If you want to find these you have to make your scripts that search for them quiet lenient in what they accept, but then you get a lot of false positives. [1] ...or speak into it.

hartator 8y ago

Equifax is an American company targeting US residents, they are not concerned by GDPR.

casca 8y ago
Equifax is a global company headquartered in America that operates in 24 countries, including 3 where people are covered by GDPR: UK, Spain and Portugal[1]. [1] https://www.equifax.com/about-equifax/company-profile/ https://www.equifax.com/about-equifax/company-profile/
hodgesrm 8y ago
They should be. Aside from operation in Europe eventually US legislative bodies will wake up and start passing laws to protect data. GPDR will be an obvious practical example to study, much as Obamacare was at least partly modeled experience in Massachusetts. I have no doubt that many tech companies have already put preventing this at the top of their DC lobbying agenda.
- whataretensors 8y ago
  Government bodies don't care about your private data or they would disband the NSA. They will however copy the GDPR as an excuse to create tools to prevent disruption, manipulate markets, and to expand their organizational reach.
  - baq 8y ago
    Oh, they care. They don't want other governments to know what they know.

zerostar07 8y ago

Speaking of which, how would the Equifax breach have been affected by GDPR ? My understanding is that they had legitimate reason to request and store that data, and GDPR is not some magic tool that prevents breaches.

kryptiskt 8y ago
They would at least have been required to disclose the leak in a timely manner.
guitarbill 8y ago
They handled the disclosure awfully. The GDPR has time-frames for notifying data protection authorities and the people affected about breaches. Presumably, they would have failed on that count. Then the question is did they have the appropriate safe-guards in place, w.r.t. the importance of the data. I don't think we quite know what their systems look like. But the answer is probably not, given the scope, amount of very personal data, and the fact data from US, Canadian, and UK individuals was leaked, and the time it took to notice the breach. Factoring both these things in and maybe the fact that an executive was charged with insider trading, they could be fined accordingly.
cge 8y ago
Beyond just the breach, I think Equifax's business would be difficult under GDPR? One of the major problems with the breach is that, if you are worried about Equifax's security, you can't just choose to not let them store your data: they will store it, and provide it to third parties, regardless of your consent.
gsnedders 8y ago
As others have said, their disclosure left a lot to be desired. Depending on cause, potentially also not having sufficient security procedures in place to avoid such a leak of PII occurring.
hodgesrm 8y ago
I'm just a beginner on the GDPR but here's a few things I got out just of the Everlaw link. 1.) Protect the data with methods corresponding the risk level (Articles 32 and 35) 2.) Enable users to erase, correct, or transfer data at will (Article 15) 3.) Enable users to consent to use of their data in the first place (Article 15) So yes, it seems it would have been quite applicable.

kryptiskt 8y ago

Funny thing is that everything in the Equifax breach (addresses, social security numbers, income) is public information in Sweden and everybody can access it.

tzs 8y ago

PCI compliance is a lot more annoying than it appears at first. A business that accepts credit cards can easily end up storing credit card numbers in places they do not intend to. That can happen even if they do all their intentional credit card handling through an outside service that their check out pages post to or AJAX to so in theory no credit card number ever even reaches the business' servers. For example, customers will email you to tell them that the credit card they pay their subscription with is about to expire, and give their new credit card number and security code in the email (and for good measure often give the old credit card number and security code). Same for your help desk system, regardless of whether it is based on email or web forms. Customers are going to stick credit card numbers in tickets. I don't think I've personally seen a customer stick a credit card number in a forum post or in a blog comment, but I wouldn't it past them. Basically, if customers can put text in it [1], you really have to assume some customer is going to put a credit card into it. I'm not kidding. I've seen credit card numbers show up in name and address fields. Oh, and when they stick unrequested credit card numbers in emails, support chats, etc., they will often format them in weird ways. If you want to find these you have to make your scripts that search for them quiet lenient in what they accept, but then you get a lot of false positives. [1] ...or speak into it.