4 ms·

I guess without GDPR there wouldn't have been a push for these companies to notify of breaches so early. We could have found out about it next year. Also given

I guess without GDPR there wouldn't have been a push for these companies to notify of breaches so early. We could have found out about it next year. Also given the potential penalties, probably companies will now start to invest more in proper IT systems.

ramblerman 8y ago
Was that part of GDPR? I know they have to hold the minimum amount of information needed, and inform you clearly what they know. But weren't they always required to announce a breach?
- robin_reala 8y ago
  GDPR has a specific 72 hour time limit on breach announcements: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/personal-data-breaches/ https://ico.org.uk/for-organisations/guide-to-the-general-da... In this case, they discovered the breach on September 8, 2018, and announced it on 30th November, 2018. That’s 1,464 hours, a little bit more than 72.
  - PunchTornado 8y ago
    hmm, they say they reported it to the regulatory authorities at the time of the incident. So i guess they are safe on that one.
    - robin_reala 8y ago
      Ah, true. I hadn’t internalised that you only have to announce it publically in cases with “a high risk of adversely affecting individuals’ rights and freedoms”.
- pbhjpbhj 8y ago
  AFAICT companies can still hold all your information /if you consent/ but can't withold service if you don't consent unless they can prove that information is required for provision of the service. So, can they show passport number is required in my jurisdiction, if not then I can have a room without providing it.
  - ryacko 8y ago
    Various laws against prostitution require valid identification.
tgtweak 8y ago
In addition to this, as per GDPR, the personal information (name, passport, address, email, phone) should have been encrypted in the database, just as the payment details were. This would have reduced the effect of unauthorized database access. I'm guessing this was not done either, even for EU guests.

ramblerman 8y ago

Was that part of GDPR? I know they have to hold the minimum amount of information needed, and inform you clearly what they know. But weren't they always required to announce a breach?

robin_reala 8y ago
GDPR has a specific 72 hour time limit on breach announcements: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/personal-data-breaches/ https://ico.org.uk/for-organisations/guide-to-the-general-da... In this case, they discovered the breach on September 8, 2018, and announced it on 30th November, 2018. That’s 1,464 hours, a little bit more than 72.
- PunchTornado 8y ago
  hmm, they say they reported it to the regulatory authorities at the time of the incident. So i guess they are safe on that one.
  - robin_reala 8y ago
    Ah, true. I hadn’t internalised that you only have to announce it publically in cases with “a high risk of adversely affecting individuals’ rights and freedoms”.
pbhjpbhj 8y ago
AFAICT companies can still hold all your information /if you consent/ but can't withold service if you don't consent unless they can prove that information is required for provision of the service. So, can they show passport number is required in my jurisdiction, if not then I can have a room without providing it.
- ryacko 8y ago
  Various laws against prostitution require valid identification.

tgtweak 8y ago

In addition to this, as per GDPR, the personal information (name, passport, address, email, phone) should have been encrypted in the database, just as the payment details were. This would have reduced the effect of unauthorized database access. I'm guessing this was not done either, even for EU guests.