> It should be unlawful to process sensitive personal data without adequate security > Define adequate security If there is no means of defining "adequate" wh

> It should be unlawful to process sensitive personal data without adequate security > Define adequate security If there is no means of defining "adequate" when it comes to security of sensitive personal data, then companies should not be allowed to amass and process sensitive personal data. If it's not possible for a company like Experian to exist safely, then it probably shouldn't exist at all.