4

The way I understand it, the purpose of GDPR (General Data Protection Regulation, EU law) is to make sure that personal data is treated transparently and securely. So half of it is about giving the users more control over their personal data, and the other half seems to be related to INFOSEC and its best practices. It seems you have to comply with a list of "best practices" and document everything you do to be able to demonstrate that you are indeed protecting the user's data, although those "best practices" are just very vague guidelines or comments based on possible interpretations of the law (at least for now).

But if that is the way it is, then will the all-too-common sloppy practices in security suddenly become illegal? For example, I don't think there is now a law that makes it mandatory to keep your website updated (think of CMS's like Wordpress or Drupal, or frameworks like Laravel, etc), but with GDPR if you have a Wordpress blog with subscribers then names, hashed passwords, emails, and maybe other personal data will end up in your database and you will have to take the necessary steps to protect that data. This means that if you don't keep your Wordpress up to date, you are breaking GDPR. And the same would appear to be true of a lot of other very common bad practices. Not having HTTPS is not considered illegal now as far as I know (unless you need to process credit-card data directly on your website, maybe). But with GDPR, it might become illegal in lots of other cases, like for simple websites that have contact forms where the user submits personal data. Or think of the bad practice of sending passwords in plain text via email, I see this all the time. And what if you download a backup copy of your website or your emails or your documents (all containing personal info about your clients for example), and you store the backup in a simple unencrypted USB key, or in an external drive that you keep in a drawer without a lock. All this is commonplace, and I personally see it everywhere from freelances to small companies, and while these bad practices might now be used to sue someone in case of trouble and show they are responsible, if nothing happens or if nobody sues you anyway, then who cares, it's ok. But with GDPR, all this will have to be documented explicitly, and there must be someone responsible for assessing all these situations and make sure everything is compliant all the time. So doesn't this mean that bad security practices are going to become illegal, no matter if those bad practices ever lead to data leaks or any problems?

Improve this question
3
  • Note that the HTTPS requirement for credit cards comes from the credit card companies, not any laws.
    – Martin Bonner supports Monica
    Commented Feb 11, 2019 at 14:58
  • 1
    @MartinBonnersupportsMonica: Plenty of laws have phrases like, "use reasonable/appropriate security," "use industry-standard practices," or "follow security best practices." Thus, widely accepted industry standards, including the PCI spec, may indirectly have legal weight.
    – Brian
    Commented Jan 15, 2020 at 15:09
  • The only thing GDPR does is forcing companies to promise doing better while nobody cares if they don't unless the goverment makes at least 7 digits income with it. It's sad.
    – Daniel W.
    Commented Oct 1, 2020 at 18:24

2 Answers 2

Reset to default
7

It would probably already be illegal based on national laws that comply with Directive 95/46/EC (of the European Parliament and of the Council of 24 October 1995).

What's new with GDPR include:

  • the sanctions that can be imposed
  • the accountability i.e. you must be able to provide documented evidence on your practices even before something happens
  • the obligation to report all data breaches.

So you'd definitely have more concrete responsibility to follow good security practices under the GDPR.

Improve this answer
2

Term "best practices" actually means using best available methods to protect the user. It is necessary to consider all security threads related to personal data. This means that we need to secure these data wherever possible.

  • When transferring data, we use HTTPS/SSL.
  • When storing data, we monitor each intervention in the infrastructure.
  • When we back up data, we use encryption.
Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .