4 ms·

If Stripe were to get hacked who would pay the GDPR fine?

by nceqs3 5y ago

ceejayoz 5y ago
Their insurer? (I'd also expect the ID photos etc. aren't stored long-term.)
- ForHackernews 5y ago
  This sounds hopeless naive. Do companies even bother carrying insurance for data breaches?
  - ceejayoz 5y ago
    Yes?
deleted 5y ago
[deleted]
andylynch 5y ago
In their TOS and Privacy Policy it’s made clear they are also data controllers. Unless you contribute to the breach it would almost certainly fall on them.
- deleted 5y ago
  [deleted]
- edwinwee 5y ago
  Yep, Stripe would be the data controller in this situation (and we comply with GDPR). https://support.stripe.com/questions/managing-your-id-verification-information#processor-controller https://support.stripe.com/questions/managing-your-id-verifi...
  - motives 5y ago
    Out of curiosity, given that this is among the most sensitive PII that can be stored, where is this data located for Stripe? I think this looks like an excellent product and can absolutely see the utility for so many businesses, but as a European I would never want such data to be stored outside of the EU. If there could be flexibility in the location the data is stored I think many European customers would appreciate that. Thanks.
    - edwinwee 5y ago
      We store data in the US right now (https://support.stripe.com/questions/managing-your-id-verification-information#processor-controller https://support.stripe.com/questions/managing-your-id-verifi... ), but we’ll look into region-specific storage in the future.
  - anilakar 5y ago
    As USA is no longer Safe Harbor compliant, transferring PII outside EU's jurisdiction requires a legitimate interest. Does Stripe do the assessment on behalf of its customers, or does it rely on the customer being truthful and risk exporting data without consent?
    - edwinwee 5y ago
      Stripe supports the legal processing and transfer of data by our users — and EU requirements are top of mind. (Feel free to me at edwin@stripe.com if you have more questions.)
  - edwinwee 5y ago
    To be clear, this isn't entirely true for all situations (sorry). Stripe verifies identities as a service provider (or processor) for the business that's using Identity. Stripe may be either a controller or a processor of data depending on the purpose of data processing (https://support.stripe.com/questions/managing-your-id-verification-information#processor-controller https://support.stripe.com/questions/managing-your-id-verifi...).

If Stripe were to get hacked who would pay the GDPR fine?

by nceqs3 5y ago

If Stripe were to get hacked who would pay the GDPR fine?

ceejayoz 5y ago

Their insurer? (I'd also expect the ID photos etc. aren't stored long-term.)

ForHackernews 5y ago
This sounds hopeless naive. Do companies even bother carrying insurance for data breaches?
- ceejayoz 5y ago
  Yes?

deleted 5y ago

[deleted]

andylynch 5y ago

In their TOS and Privacy Policy it’s made clear they are also data controllers. Unless you contribute to the breach it would almost certainly fall on them.

deleted 5y ago
[deleted]
edwinwee 5y ago
Yep, Stripe would be the data controller in this situation (and we comply with GDPR). https://support.stripe.com/questions/managing-your-id-verification-information#processor-controller https://support.stripe.com/questions/managing-your-id-verifi...
- motives 5y ago
  Out of curiosity, given that this is among the most sensitive PII that can be stored, where is this data located for Stripe? I think this looks like an excellent product and can absolutely see the utility for so many businesses, but as a European I would never want such data to be stored outside of the EU. If there could be flexibility in the location the data is stored I think many European customers would appreciate that. Thanks.
  - edwinwee 5y ago
    We store data in the US right now (https://support.stripe.com/questions/managing-your-id-verification-information#processor-controller https://support.stripe.com/questions/managing-your-id-verifi... ), but we’ll look into region-specific storage in the future.
- anilakar 5y ago
  As USA is no longer Safe Harbor compliant, transferring PII outside EU's jurisdiction requires a legitimate interest. Does Stripe do the assessment on behalf of its customers, or does it rely on the customer being truthful and risk exporting data without consent?
  - edwinwee 5y ago
    Stripe supports the legal processing and transfer of data by our users — and EU requirements are top of mind. (Feel free to me at edwin@stripe.com if you have more questions.)
- edwinwee 5y ago
  To be clear, this isn't entirely true for all situations (sorry). Stripe verifies identities as a service provider (or processor) for the business that's using Identity. Stripe may be either a controller or a processor of data depending on the purpose of data processing (https://support.stripe.com/questions/managing-your-id-verification-information#processor-controller https://support.stripe.com/questions/managing-your-id-verifi...).