4 ms·

Deliberately not disclosing the breach would likely result in much larger fines. >If you experience a personal data breach you need to consider whether this po

by IanCal 7y ago

Deliberately not disclosing the breach would likely result in much larger fines. >If you experience a personal data breach you need to consider whether this poses a risk to people. You need to consider the likelihood and severity of the risk to people’s rights and freedoms, following the breach. When you’ve made this assessment, if it’s likely there will be a risk then you must notify the ICO; https://ico.org.uk/for-organisations/report-a-breach/ https://ico.org.uk/for-organisations/report-a-breach/ > The GDPR introduces a duty on all organisations to report certain types of personal data breach to the relevant supervisory authority. You must do this within 72 hours of becoming aware of the breach, where feasible. https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/personal-data-breaches/ https://ico.org.uk/for-organisations/guide-to-data-protectio...

buboard 7y ago
There is no definite scale for the fines though, i'm pretty sure negotiating with the hackers will be cheaper 100% of the time. This is interesting from a free market perspective: The undefined cost of the fines would lead to the discovery of the true price of data leaks by negotiating with thieves.
- tapppi 7y ago
  What negotiating though? If your huge customer, orders and/or payments database is exploited and dumped and then used for identity/CC fraud, there is no negotiating with hackers. You will be found out eventually due to the proliferation of sold information and data dumps in the black market, which are then analysed by researchers. Then you will be fined possibly twice instead of once or not at all, since you also failed to report the breach. I fail to think of relevant common situations where negotiating with the hackers would be an option in breaches relating to GDPR.
- IanCal 7y ago
  > There is no definite scale for the fines though, i'm pretty sure negotiating with the hackers will be cheaper 100% of the time This will not be true if any paid-off breach is ever discovered as then you'll have paid the hackers and the fine, which will be larger because you've deliberately kept it from the ICO/similar.

by IanCal 7y ago

buboard 7y ago

There is no definite scale for the fines though, i'm pretty sure negotiating with the hackers will be cheaper 100% of the time. This is interesting from a free market perspective: The undefined cost of the fines would lead to the discovery of the true price of data leaks by negotiating with thieves.

tapppi 7y ago
What negotiating though? If your huge customer, orders and/or payments database is exploited and dumped and then used for identity/CC fraud, there is no negotiating with hackers. You will be found out eventually due to the proliferation of sold information and data dumps in the black market, which are then analysed by researchers. Then you will be fined possibly twice instead of once or not at all, since you also failed to report the breach. I fail to think of relevant common situations where negotiating with the hackers would be an option in breaches relating to GDPR.
IanCal 7y ago
> There is no definite scale for the fines though, i'm pretty sure negotiating with the hackers will be cheaper 100% of the time This will not be true if any paid-off breach is ever discovered as then you'll have paid the hackers and the fine, which will be larger because you've deliberately kept it from the ICO/similar.