Email Address Disclosures, Preliminary Report

Re:Email Address Disclosures, Preliminary Report by pfg on Saturday June 11, 2016 @04:15AM (#11882624)

In case you're referring to the General Data Protection Regulation, it does not apply until May 2018. The penalty that would be applied would probably be this one, given that the number of prior offenses, the gravity and duration of the offense, the number of affected users and the damage caused, etc. need to be taken into account:

> Each supervisory authority shall have all of the following corrective powers:

> [...]

> (b) to issue reprimands to a controller or a processor where processing operations have infringed provisions of this Regulation;

(IANAL)

[ Parent | on HN ]

Re:Email Address Disclosures, Preliminary Report by _9MOTHER9HORSE on Saturday June 11, 2016 @04:33AM (#11882661)

There are already similar laws in the UK and other countries.

See this recent example, where a sexual health centre accidentally leaked a list of 800 people who had attended HIV clinics.

They ended up with a £180,000 fine: http://www.bbc.co.uk/news/technology-36247186

[ Parent | on HN ]

Re:Email Address Disclosures, Preliminary Report by corin_ on Saturday June 11, 2016 @07:13AM (#11883041)

Most people would consider their possibly/definitely having HIV to be a more personal piece of information than their email address.

If I'd been affected by this Let's Encrypt email thing I frankly wouldn't care, other than to question why it happened. (Just speaking for myself, I'm sure some people would care.) But if I was data in a leak revealing a personal serious medical issue, I absolutely would care.

[ Parent | on HN ]

Re:Email Address Disclosures, Preliminary Report by M2Ys4U on Saturday June 11, 2016 @11:55AM (#11883895)

Data protection is already regulated by the EU (only by means of a Directive rather than a Regulation) so the same principles apply across the EU/EEA, if not the exact rules.

[ Parent | on HN ]

Re:Email Address Disclosures, Preliminary Report by pfg on Saturday June 11, 2016 @04:41AM (#11882691)

Good point and very similar case (though in an entirely different category of "damage caused", plus there seemed to be a prior offense).

[ Parent | on HN ]