3 ms·
GDPR does not have any wording that refers to any technical specifics (e.g. password storage) whatsoever. The most relevant passage is "the controller and the
by PeterisP 7y ago
GDPR does not have any wording that refers to any technical specifics (e.g. password storage) whatsoever.
The most relevant passage is "the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk" from article 32; and it could be argued that having passwords in plaintext most likely does not constitute "appropriate technical measures" and doing so opens you up to fines based on GDPR if an incident occurs, but it's not really "a law against clear text passwords" but rather a law that simply says that you are responsible for how you [mis]implement your security and the consequences of that.
- Recursing 7y agoYes of course GDPR is not a law about plain text passwords, but (as the sibling comment points out), pretty much everybody considers the use of appropriate hashing as a requirement to to ensure a level of security appropriate to the risk. https://www.gamingtechlaw.com/2019/04/first-gdpr-fine-italy.html https://www.gamingtechlaw.com/2019/04/first-gdpr-fine-italy.... this fine specifically mentions password storage (among many other things) Also see previous thread on HN: https://news.ycombinator.com/item?id=18531588 https://news.ycombinator.com/item?id=18531588
- micheljansen 7y agoOn top of that GDPR requires companies to notify customers of data breaches, which risks reputation damage. Another liability of shoddy security.
- tgsovlerkhgsel 7y agoGDPR doesn't state explicitly "passwords must be hashed", but Knuddels.de was fined for unhashed passwords. The fine was specifically for the lack of hashing and not the breach that uncovered it.