3 ms·

I'm not a GDPR expert, but I've done a fair bit of work making old systems GDPR compliant. With my understanding of GDPR, yes, this is a violation since part of

I'm not a GDPR expert, but I've done a fair bit of work making old systems GDPR compliant. With my understanding of GDPR, yes, this is a violation since part of GDPR requires you keep customer data secure using "appropriate technical and organizational measures". I would argue that this violates the "appropriate technical measure" part. Again, I'm not a lawyer or expert in this domain, so I could be wrong.

tensor 7y ago
I would be surprised if a bug constituted a violation. The intent was clearly to have them be hashed. Once the bug was detected it was quickly patched and appropriate incidence response taken. That wouldn't violate other security standards, so I'd be very surprised if it violated GDPR.
- superfrank 7y ago
  I believe a bug would still cause them to be in violation, but it likely means there would not be any punishment for being in violation. GDPR has a lot of leeway for companies that are making an effort to be in compliance, but have failed for one reason or another. In this case, I would assume the punishment for the bug would just be "fix the bug".
deleted 7y ago
[deleted]
kitotik 7y ago
They seem to be hammering home the point that the passwords were always stored on ‘secure encrypted infrastructure’ but the data was not hashed, so anyone with access to googles ‘secure encrypted infrastructure’ could read the data. The encryption is most likely enough to be within GDPR compliance.
- pbhjpbhj 7y ago
  >The encryption is most likely enough to be within GDPR compliance. // Why do you think that, allowing staff to read plaintext passwords is contrary to standard security practice; companies are expected to make reasonable effort to secure PII and allowing staff to read your password doesn't appear to be "reasonable effort" by even the casualist of readings. I don't think the EU courts are that stupid. FWIW I don't think there is a case here particularly, as it appears to be a genuine error and being fixed.

tensor 7y ago

I would be surprised if a bug constituted a violation. The intent was clearly to have them be hashed. Once the bug was detected it was quickly patched and appropriate incidence response taken. That wouldn't violate other security standards, so I'd be very surprised if it violated GDPR.

superfrank 7y ago
I believe a bug would still cause them to be in violation, but it likely means there would not be any punishment for being in violation. GDPR has a lot of leeway for companies that are making an effort to be in compliance, but have failed for one reason or another. In this case, I would assume the punishment for the bug would just be "fix the bug".

deleted 7y ago

[deleted]

kitotik 7y ago

They seem to be hammering home the point that the passwords were always stored on ‘secure encrypted infrastructure’ but the data was not hashed, so anyone with access to googles ‘secure encrypted infrastructure’ could read the data. The encryption is most likely enough to be within GDPR compliance.

pbhjpbhj 7y ago
>The encryption is most likely enough to be within GDPR compliance. // Why do you think that, allowing staff to read plaintext passwords is contrary to standard security practice; companies are expected to make reasonable effort to secure PII and allowing staff to read your password doesn't appear to be "reasonable effort" by even the casualist of readings. I don't think the EU courts are that stupid. FWIW I don't think there is a case here particularly, as it appears to be a genuine error and being fixed.