4 ms·

Note that this is the second hack in 3 years they've had to disclose and they were fined £400k for that hack [1], which was obviously not enough to incentivise

Note that this is the second hack in 3 years they've had to disclose and they were fined £400k for that hack [1], which was obviously not enough to incentivise them to invest further in their security. Wonder what the ICO will do this time. [1] https://techcrunch.com/2018/01/10/uks-carphone-warehouse-fined-nearly-540k-for-2015-hack/ https://techcrunch.com/2018/01/10/uks-carphone-warehouse-fin...

esquivalience 8y ago
Sorry, no. It seems to have happened before GDPR came into force, and the law isn't retrospective. It will however be the first time since GDPR that some of the difficult questions are asked and answered by the regulators with their new GDPR mentality. So no doubt the response will be informative.
- ealexhudson 8y ago
  If they discovered it last week, it's notifiable under the terms of the GDPR. Given the £400k fine they had last time was ~80% of what is allowed under the DPA, I think they can expect something more substantial this time. Given they also were out of compliance with PCI-DSS, they can expect an industry "fine" as well.
- dogma1138 8y ago
  The questions won’t change at all in the UK as the DPA was in effect, what can change is the punitive damages.
- rsynnott 8y ago
  The GDPR is just a replacement for the old data protection directive. Carphone Warehouse is very much still in trouble; just not as much as it would otherwise have been.
- pluma 8y ago
  It doesn't matter when the leak happened, it only matters when it was formally discovered.
- snowwolf 8y ago
  I'm not sure I mentioned GDPR? I merely said it would be interesting to see what the ICO do. The main problem is that a £400k fine was not sufficient to make them invest in their security, even after they knew they were definitely a target (having been hacked before). Now if the ICO's hands are tied and they can still only fine them based on the DPA limits then hopefully the ICO will fine them the full £500k and tell them the next breach they have will incur the maximum GDPR fine. That should light a fire up them.
  - esquivalience 8y ago
    Yes, I did notice that the comment looked different after I replied.

esquivalience 8y ago

Sorry, no. It seems to have happened before GDPR came into force, and the law isn't retrospective. It will however be the first time since GDPR that some of the difficult questions are asked and answered by the regulators with their new GDPR mentality. So no doubt the response will be informative.

ealexhudson 8y ago
If they discovered it last week, it's notifiable under the terms of the GDPR. Given the £400k fine they had last time was ~80% of what is allowed under the DPA, I think they can expect something more substantial this time. Given they also were out of compliance with PCI-DSS, they can expect an industry "fine" as well.
dogma1138 8y ago
The questions won’t change at all in the UK as the DPA was in effect, what can change is the punitive damages.
rsynnott 8y ago
The GDPR is just a replacement for the old data protection directive. Carphone Warehouse is very much still in trouble; just not as much as it would otherwise have been.
pluma 8y ago
It doesn't matter when the leak happened, it only matters when it was formally discovered.
snowwolf 8y ago
I'm not sure I mentioned GDPR? I merely said it would be interesting to see what the ICO do. The main problem is that a £400k fine was not sufficient to make them invest in their security, even after they knew they were definitely a target (having been hacked before). Now if the ICO's hands are tied and they can still only fine them based on the DPA limits then hopefully the ICO will fine them the full £500k and tell them the next breach they have will incur the maximum GDPR fine. That should light a fire up them.
- esquivalience 8y ago
  Yes, I did notice that the comment looked different after I replied.