3 ms·

Speaking of which, how would the Equifax breach have been affected by GDPR ? My understanding is that they had legitimate reason to request and store that data,

Speaking of which, how would the Equifax breach have been affected by GDPR ? My understanding is that they had legitimate reason to request and store that data, and GDPR is not some magic tool that prevents breaches.

kryptiskt 8y ago
They would at least have been required to disclose the leak in a timely manner.
guitarbill 8y ago
They handled the disclosure awfully. The GDPR has time-frames for notifying data protection authorities and the people affected about breaches. Presumably, they would have failed on that count. Then the question is did they have the appropriate safe-guards in place, w.r.t. the importance of the data. I don't think we quite know what their systems look like. But the answer is probably not, given the scope, amount of very personal data, and the fact data from US, Canadian, and UK individuals was leaked, and the time it took to notice the breach. Factoring both these things in and maybe the fact that an executive was charged with insider trading, they could be fined accordingly.
cge 8y ago
Beyond just the breach, I think Equifax's business would be difficult under GDPR? One of the major problems with the breach is that, if you are worried about Equifax's security, you can't just choose to not let them store your data: they will store it, and provide it to third parties, regardless of your consent.
gsnedders 8y ago
As others have said, their disclosure left a lot to be desired. Depending on cause, potentially also not having sufficient security procedures in place to avoid such a leak of PII occurring.
hodgesrm 8y ago
I'm just a beginner on the GDPR but here's a few things I got out just of the Everlaw link. 1.) Protect the data with methods corresponding the risk level (Articles 32 and 35) 2.) Enable users to erase, correct, or transfer data at will (Article 15) 3.) Enable users to consent to use of their data in the first place (Article 15) So yes, it seems it would have been quite applicable.
- jdietrich 8y ago
  Also: 4.) Notify the supervisory authority of any data breach within 72 hours (Article 33) 5.) Notify the subject of any data breach without undue delay (Article 34) And the broader issue of remedies and penalties in Chapter 8.

kryptiskt 8y ago

They would at least have been required to disclose the leak in a timely manner.

guitarbill 8y ago

They handled the disclosure awfully. The GDPR has time-frames for notifying data protection authorities and the people affected about breaches. Presumably, they would have failed on that count. Then the question is did they have the appropriate safe-guards in place, w.r.t. the importance of the data. I don't think we quite know what their systems look like. But the answer is probably not, given the scope, amount of very personal data, and the fact data from US, Canadian, and UK individuals was leaked, and the time it took to notice the breach. Factoring both these things in and maybe the fact that an executive was charged with insider trading, they could be fined accordingly.

cge 8y ago

Beyond just the breach, I think Equifax's business would be difficult under GDPR? One of the major problems with the breach is that, if you are worried about Equifax's security, you can't just choose to not let them store your data: they will store it, and provide it to third parties, regardless of your consent.

gsnedders 8y ago

As others have said, their disclosure left a lot to be desired. Depending on cause, potentially also not having sufficient security procedures in place to avoid such a leak of PII occurring.

hodgesrm 8y ago

I'm just a beginner on the GDPR but here's a few things I got out just of the Everlaw link. 1.) Protect the data with methods corresponding the risk level (Articles 32 and 35) 2.) Enable users to erase, correct, or transfer data at will (Article 15) 3.) Enable users to consent to use of their data in the first place (Article 15) So yes, it seems it would have been quite applicable.

jdietrich 8y ago
Also: 4.) Notify the supervisory authority of any data breach within 72 hours (Article 33) 5.) Notify the subject of any data breach without undue delay (Article 34) And the broader issue of remedies and penalties in Chapter 8.