> Also how much can be caught with "security" reasons?
Only things you only use for security purposes. You can't say "we need X for anti-fraud" and then use it for marketing purposes without consent.
Only things you only use for security purposes. You can't say "we need X for anti-fraud" and then use it for marketing purposes without consent.
Part of GDPR effect is that if you get caught, you can't talk it away with some blanket claim in your EULA, you need to have a detailed justification, and there is potential for painful fines, so the risk increases.
If the details of the breach indicate you were using data for another purpose than what was allowed you will have a problem.