4 ms·

If your business operates outside of the law of course it should be shutdown. I think fines are a good way to cause compliance without causing more harm than ne

If your business operates outside of the law of course it should be shutdown. I think fines are a good way to cause compliance without causing more harm than necessary. Are you advocating government not be able to influence businesses to comply with the law at all? GDPR is actually a very well thought through piece of legislation and I've implemented compliant systems: best rule of thumb I heard - treat peoples personal information as if it is credit card data and you will comply in a fairly straight forward way.

bayesian_horse 8y ago
One problem is that the law significantly changed right under their noses. I don't think that they have either a significant development team/effort for their platform, nor a very good revenue. It's basically a very old chat platform I used about 15 years ago...
- dmitriid 8y ago
  > law significantly changed right under their noses. You mean two years to comply before it went into effect. + over 10 years of similar local laws. "right under their noses" my ass
  - TheSpiceIsLife 8y ago
    Ah, the old a-planet-full-of-media-attention variety of right under their noses.
  - ahje 8y ago
    Even if it had changed right under their noses, that would still be OK in my book. The Lawmakers are elected by the people (somewhat -- the EU could be more democratic, but that's a different topic), and they should therefore be able to change the laws on the behalf of the people.
- CathyWest 8y ago
  That would have been a reasonable argument if they were found to have been using something like DES-based crypt(3) to hash their passwords. But they didn't, they were just plain text.
- swish_bob 8y ago
  Even setting aside the years they had to become compliant, it still wasn't a good idea to store passwords in plain text before GDPR.
  - GordonS 8y ago
    Regardless of the law, it's completely irresponsible to store passwords in plaintext, and it's been widely considered so for decades - the company's behavior here is inexcusable, and I really can't understand why anyone would try to defend it.
dwild 8y ago
> treat peoples personal information as if it is credit card data and you will comply in a fairly straight forward way Yet so many business use third parties to avoid to deal with storing credit card data.... The IP is considered a PII too.

bayesian_horse 8y ago

One problem is that the law significantly changed right under their noses. I don't think that they have either a significant development team/effort for their platform, nor a very good revenue. It's basically a very old chat platform I used about 15 years ago...

dmitriid 8y ago
> law significantly changed right under their noses. You mean two years to comply before it went into effect. + over 10 years of similar local laws. "right under their noses" my ass
- TheSpiceIsLife 8y ago
  Ah, the old a-planet-full-of-media-attention variety of right under their noses.
- ahje 8y ago
  Even if it had changed right under their noses, that would still be OK in my book. The Lawmakers are elected by the people (somewhat -- the EU could be more democratic, but that's a different topic), and they should therefore be able to change the laws on the behalf of the people.
CathyWest 8y ago
That would have been a reasonable argument if they were found to have been using something like DES-based crypt(3) to hash their passwords. But they didn't, they were just plain text.
swish_bob 8y ago
Even setting aside the years they had to become compliant, it still wasn't a good idea to store passwords in plain text before GDPR.
- GordonS 8y ago
  Regardless of the law, it's completely irresponsible to store passwords in plaintext, and it's been widely considered so for decades - the company's behavior here is inexcusable, and I really can't understand why anyone would try to defend it.

dwild 8y ago

> treat peoples personal information as if it is credit card data and you will comply in a fairly straight forward way Yet so many business use third parties to avoid to deal with storing credit card data.... The IP is considered a PII too.