3 ms·
From article 4: (12) ‘personal data breach’ means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclo
by mannykannot 7y ago
From article 4:
(12) ‘personal data breach’ means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed;
So it seems that a ransomware attack is considered a breach - as it should be - and neither exfiltration nor disclosure is necessary for that to be the case.
Any sort of access is a weapon in the hands of a malicious hacker. Penalties for allowing it to happen are weapons in the hands of those trying to do something about it.
- buboard 7y agosecurity is notoriously asymmetric and a continuous arms race, so it's rarely a case of "allowing it to happen". There is a case to be made for making it unprofitable for hackers to run such operations. The law here does the opposite by making it more lucrative. i think the best thing to do is to minimize sensitive data completely, no logs no nothing. But then you move the burden of security to the end user (e.g. they 'll have to re-enter their credit card every time), which is probably higher risk.
- mannykannot 7y agoIf everyone adopted your solution, the issue that you originally posted about would no longer be an issue, so the best way to get everyone to your solution would be increase the penalties until nothing else is viable! The reality is that you are creating a false dichotomy / straw man here. While reducing the amount of personal information that is gathered and stored should be the first response, that which remains can be handled appropriately with encryption and defense-in-depth.