I'd like them to conciliate this rule with companies whose only business purposes are to sell that data, like TLO from the other HN frontpage article. Even ign

I'd like them to conciliate this rule with companies whose only business purposes are to sell that data, like TLO from the other HN frontpage article. Even ignoring the fact that their data finds way into automating identity theft financial fraud, it should have been impossible to conciliate a business which purpose is to sell your data (with no consent or even ever interacting with you) with any identy and data protection law. if anything, those two things happening show that financial laws are also arbitrarily enforced. being a small bank, or from east asia, you will feel the wrath of the law (e.g. voya, hsbc money laudering, etc). but if you are a huge american financial institutions you can get away with even more (e.g. bank of america many many recent woes in data loss and consumer abuse).