Hacker News Reader

Most people would consider their possibly/definitely having HIV to be a more personal piece of information than their email address.

If I'd been affected by this Let's Encrypt email thing I frankly wouldn't care, other than to question why it happened. (Just speaking for myself, I'm sure some people would care.) But if I was data in a leak revealing a personal serious medical issue, I absolutely would care.

Data protection is already regulated by the EU (only by means of a Directive rather than a Regulation) so the same principles apply across the EU/EEA, if not the exact rules.

Good point and very similar case (though in an entirely different category of "damage caused", plus there seemed to be a prior offense).