>"Privacy laws, like any other infosecurity control, have exploitable vulnerabilities," he said. "If we'd look at these vulnerabilities before the law was enact

>"Privacy laws, like any other infosecurity control, have exploitable vulnerabilities," he said. "If we'd look at these vulnerabilities before the law was enacted, we could pick up on them." Okay, now let's relate it back to what Hacker News knows about > "Software, like any other infosecurity control, have exploitable vulnerabilities," he said. "If we'd look at these vulnerabilities before the Software was deployed, we could pick up on them." It's correct to say that you can limit the number of vulnerabilities you ship, but it's always going to be non-zero and you're always going to need to deploy security patches. I'm not sure poor implementation and compliance with a new law is a particularly huge threat. Over time best practices will emerge and this will essentially be a low success rate attack vector. Compare that to the counter-factual, before GDPR the number of companies with your data was far higher, the data they held was far more in depth, and they often had little to no security procedures. The underlying message here is that the fundamentals of GDPR make your data safer, not less safe.