FTR, some EU countries have viewed standard security questions (e.g. date of birth) as not being sufficent protection for personal data, and hence it could be i

FTR, some EU countries have viewed standard security questions (e.g. date of birth) as not being sufficent protection for personal data, and hence it could be illegal to store personal data that way. If you're in the EU, and are storing personal data, you are legally required to protect it. Think carefully about how you set up your EU based web app. Example: In Ireland it's probably against the Data Protection Acts to use a date of birth/mother's maiden name as a 'security question' for personal data. (cf. http://www.dataprotection.ie/viewprint.asp?DocID=1212&StartDate=1+January+2012 http://www.dataprotection.ie/viewprint.asp?DocID=1212&St... http://www.dataprotection.ie/viewdoc.asp?DocID=1062&m=f http://www.dataprotection.ie/viewdoc.asp?DocID=1062&m=f )