Marketing Firm Exactis Leaked a Personal Info Database with 340M Records

Post by geocar » Fri, Jun 29, 2018, 6:22 AM UTC

greglindahl wrote: post #95

herewegoagain90 wrote: post #88

Earlier quoted context omitted.

It seems like the biggest issue with GDPR is that it’s comes from Europe and not the US? Historically speaking, Europe has in many issues come to agreement on technically solutions and industrial standards many years ahead of the US. For example, Europe was first on texting on the mobile network while the US (single country) took years to come to a standard. I think it will be the same with regards to GDPR. You (US)…

That's not the biggest issue that I have with the GDPR. In fact, I'm totally OK with someone doing a better job than the US at regulating privacy. However, I have some complaints about the GDPR, and there isn't very much discussion about the details; most people appear to think about it as "all or nothing" or "Europe good, USA bad" or "everything looks clear to me so what's the problem?" instead of discussing the det…

Post by larkeith » Fri, Jun 29, 2018, 6:28 AM UTC

nerdponx wrote: post #105

JumpCrisscross wrote: post #67

Earlier quoted context omitted.

> what's the alternative? Absolute liability for data losses. Exactis lost 360 million peoples' data. They should be able to (a) form a class and (b) extract money damages from Exactis without having to prove specific harm, which is difficult to do with data loss. A good model is Illinois' Biometric Information Privacy Act [1]. Broaden the the definition from "biometric identifier" to a longer--but still specific--li…

How is a regular person supposed to even know if their data was in this particular leak?

Post by JumpCrisscross » Fri, Jun 29, 2018, 6:39 AM UTC

nerdponx wrote: post #105

JumpCrisscross wrote: post #67

Earlier quoted context omitted.

> what's the alternative? Absolute liability for data losses. Exactis lost 360 million peoples' data. They should be able to (a) form a class and (b) extract money damages from Exactis without having to prove specific harm, which is difficult to do with data loss. A good model is Illinois' Biometric Information Privacy Act [1]. Broaden the the definition from "biometric identifier" to a longer--but still specific--li…

How is a regular person supposed to even know if their data was in this particular leak?

Post by jonhendry18 » Fri, Jun 29, 2018, 6:45 AM UTC

mmiller9 wrote: post #48

aalleavitch wrote: post #10

This is laughable. Data security is a fairy-tale. We've all been bought and sold and there is nothing any of us can do to fix it.

Erm, not opening up this fucking Elasticsearch instance to the entire internet would be a pretty easy way to get like 90% of the way there. I do operations. I can tell you exactly how not to make rookie mistakes like this. But security isn’t sexy, and it isn’t profitable, so it falls by the wayside.

Post by roel_v » Fri, Jun 29, 2018, 6:48 AM UTC

kuschku wrote: post #107

brobdingnagians wrote: post #94

Earlier quoted context omitted.

A fine and a lawsuit are very different things, especially with 340M people involved [even a $340M fine would only be $1/person]; fines don't usually go to the people injured by it, which would make sense with personal data being leaked. A fine also misses companies who are "doing what the law says" but still have some horrible flaw anyways. If you are _genuinely_ responsible for the data, meaning if something happen…

Many european countries (including Germany) have no class action lawsuits, so unless you want 340 million separate lawsuits, you’ll have to either use fines, or accept that this will go unpunished.