3 ms·

With GDPR, simply leaking personal data is enough to earn you penalties. If your security is insufficient that someone can take this much personal data (and bas

by MrJohz 2y ago

With GDPR, simply leaking personal data is enough to earn you penalties. If your security is insufficient that someone can take this much personal data (and based on some of the other comments here it was a lot of personal data), then you have not upheld your responsibility according to GDPR. So I disagree, we don't need to wait until the data breaches lead to any particular outcomes, we need laws that make it clear that data breaches alone constitute damages to the people whose data was released. More people should be protected by GDPR-style laws, and more companies need to recognise that data security is something they need to take deeply seriously.

robertlagrant 2y ago
Is there precedent for this? E.g. if I accidentally sell a faulty door lock, does that constitute damages automatically? Don't damages require damage?
- MrJohz 2y ago
  My private details leaking is damage, that's the point here. If I trust you with my confidential details (which can be anything from my bank details to my email address), and your data security protocols mean that my data gets stolen, then I have suffered damages, and GDPR comes into play.
- dwattttt 2y ago
  IANAL. Damages are relevant in-so-far as a relevant law addresses or requires them. Nothing stops a law from assuming damages under some circumstances.
District5524 2y ago
That's not how it works. I think you are mixing up damages to be awarded by courts to an individual data subject (right to compensation, Article 82) with penalties (Article 83-84) - the latter having a special meaning, in practice covering the administrative fines by authorities (DPAs). There was a case by the ECJ (C 300/21) saying that for damages to be awarded to the individual, they have to prove the material or non-material damages involved. Regardless, any data protection authority can and do fine companies for breaches such as this one and also for late filing, and while DPAs also have to take into account the damages caused to data subjects when deciding the amount of fine, that's not a standard that has to be proven for each data subject separately and is therefore not as strict as the right to compensation. FlightAware definitely should be fined... Like Booking, NTT or Twitter or banks for breach obligations, for more than €400k. But it's still strange that very few US companies were fined so far in relation to no or late breach notifications - not that they were not fined heavily for failure to comply with other obligations. https://www.enforcementtracker.com/ https://www.enforcementtracker.com/
n_plus_1_acc 2y ago
The point is it should be a criminal case, in addition to civil matters.
Nextgrid 2y ago
GDPR enforcement is severely lacking, even in "business as usual" matters like nonconsensual data collection/processing, let alone data breach handling. GDPR has been with us since 2018, and it if was the deterrent that everyone claimed it to be, we wouldn't be having this discussion today.

by MrJohz 2y ago

robertlagrant 2y ago

Is there precedent for this? E.g. if I accidentally sell a faulty door lock, does that constitute damages automatically? Don't damages require damage?

MrJohz 2y ago
My private details leaking is damage, that's the point here. If I trust you with my confidential details (which can be anything from my bank details to my email address), and your data security protocols mean that my data gets stolen, then I have suffered damages, and GDPR comes into play.
dwattttt 2y ago
IANAL. Damages are relevant in-so-far as a relevant law addresses or requires them. Nothing stops a law from assuming damages under some circumstances.

District5524 2y ago

That's not how it works. I think you are mixing up damages to be awarded by courts to an individual data subject (right to compensation, Article 82) with penalties (Article 83-84) - the latter having a special meaning, in practice covering the administrative fines by authorities (DPAs). There was a case by the ECJ (C 300/21) saying that for damages to be awarded to the individual, they have to prove the material or non-material damages involved. Regardless, any data protection authority can and do fine companies for breaches such as this one and also for late filing, and while DPAs also have to take into account the damages caused to data subjects when deciding the amount of fine, that's not a standard that has to be proven for each data subject separately and is therefore not as strict as the right to compensation. FlightAware definitely should be fined... Like Booking, NTT or Twitter or banks for breach obligations, for more than €400k. But it's still strange that very few US companies were fined so far in relation to no or late breach notifications - not that they were not fined heavily for failure to comply with other obligations. https://www.enforcementtracker.com/ https://www.enforcementtracker.com/

n_plus_1_acc 2y ago

The point is it should be a criminal case, in addition to civil matters.

Nextgrid 2y ago

GDPR enforcement is severely lacking, even in "business as usual" matters like nonconsensual data collection/processing, let alone data breach handling. GDPR has been with us since 2018, and it if was the deterrent that everyone claimed it to be, we wouldn't be having this discussion today.