> It should be unlawful to process sensitive personal data without adequate security It is but "adequate security" is not defined. That is what I am saying. Wo

> It should be unlawful to process sensitive personal data without adequate security It is but "adequate security" is not defined. That is what I am saying. Would someone without 2FA or this particular account reset process be prosecuted in the EU? Almost certainly not because the Prosecuter cannot currently say, "you didn't follow NIST guidance XYZ requiring it to be done this way". > private credit registers are all but extinct in the bloc now I'm not sure why you think that. In the UK, we have a number of them who are used by organisations. They are bound by the same GDPR regulations as everyone else.