3 ms·

It should be unlawful to process sensitive personal data without adequate security. It already is in the EU, which is why private credit registers are all but e

It should be unlawful to process sensitive personal data without adequate security. It already is in the EU, which is why private credit registers are all but extinct in the bloc now.

rcMgD2BwE72F 4y ago
I wish non-EU developers better knew what the GDPR offers (and requires): https://gdpr-info.eu/issues/privacy-by-design/ https://gdpr-info.eu/issues/privacy-by-design/
collegeburner 4y ago
Define adequate security. Maybe I want to adopt post quantum crypto but now the law doesn't allow it? Or u2f not totp but the law doesn't allow it? Law can hold back security just as much as improve it. Remember how long it took the feds to get off 3DES? Remember all the leaks of personal data (like all military in US or basically everybody in china)? Govts are shit at security.
- closewith 4y ago
  In the case of, say, the GDPR, security requirements aren't prescriptive. You can read Article 32 yourself, but it comes down to being able to "ensure a level of security appropriate to the risk". Whether a company has met that standard is decided by data protection authorities and ultimately the courts. Article 32, GPDR: https://gdpr-info.eu/art-32-gdpr/ https://gdpr-info.eu/art-32-gdpr/
- user3939382 4y ago
  > Define adequate security SOC2, CSF, FedRAMP?
- enobrev 4y ago
  > It should be unlawful to process sensitive personal data without adequate security > Define adequate security If there is no means of defining "adequate" when it comes to security of sensitive personal data, then companies should not be allowed to amass and process sensitive personal data. If it's not possible for a company like Experian to exist safely, then it probably shouldn't exist at all.
lbriner 4y ago
> It should be unlawful to process sensitive personal data without adequate security It is but "adequate security" is not defined. That is what I am saying. Would someone without 2FA or this particular account reset process be prosecuted in the EU? Almost certainly not because the Prosecuter cannot currently say, "you didn't follow NIST guidance XYZ requiring it to be done this way". > private credit registers are all but extinct in the bloc now I'm not sure why you think that. In the UK, we have a number of them who are used by organisations. They are bound by the same GDPR regulations as everyone else.

It should be unlawful to process sensitive personal data without adequate security. It already is in the EU, which is why private credit registers are all but extinct in the bloc now.

rcMgD2BwE72F 4y ago

I wish non-EU developers better knew what the GDPR offers (and requires): https://gdpr-info.eu/issues/privacy-by-design/ https://gdpr-info.eu/issues/privacy-by-design/

collegeburner 4y ago

Define adequate security. Maybe I want to adopt post quantum crypto but now the law doesn't allow it? Or u2f not totp but the law doesn't allow it? Law can hold back security just as much as improve it. Remember how long it took the feds to get off 3DES? Remember all the leaks of personal data (like all military in US or basically everybody in china)? Govts are shit at security.

closewith 4y ago
In the case of, say, the GDPR, security requirements aren't prescriptive. You can read Article 32 yourself, but it comes down to being able to "ensure a level of security appropriate to the risk". Whether a company has met that standard is decided by data protection authorities and ultimately the courts. Article 32, GPDR: https://gdpr-info.eu/art-32-gdpr/ https://gdpr-info.eu/art-32-gdpr/
user3939382 4y ago
> Define adequate security SOC2, CSF, FedRAMP?
enobrev 4y ago
> It should be unlawful to process sensitive personal data without adequate security > Define adequate security If there is no means of defining "adequate" when it comes to security of sensitive personal data, then companies should not be allowed to amass and process sensitive personal data. If it's not possible for a company like Experian to exist safely, then it probably shouldn't exist at all.

lbriner 4y ago

> It should be unlawful to process sensitive personal data without adequate security It is but "adequate security" is not defined. That is what I am saying. Would someone without 2FA or this particular account reset process be prosecuted in the EU? Almost certainly not because the Prosecuter cannot currently say, "you didn't follow NIST guidance XYZ requiring it to be done this way". > private credit registers are all but extinct in the bloc now I'm not sure why you think that. In the UK, we have a number of them who are used by organisations. They are bound by the same GDPR regulations as everyone else.