Hacker News Reader

Comment by andy_ppp | Hacker News Reader

If your business operates outside of the law of course it should be shutdown. I think fines are a good way to cause compliance without causing more harm than necessary.

Are you advocating government not be able to influence businesses to comply with the law at all?

GDPR is actually a very well thought through piece of legislation and I've implemented compliant systems: best rule of thumb I heard - treat peoples personal information as if it is credit card data and you will comply in a fairly straight forward way.

View on HN

> treat peoples personal information as if it is credit card data and you will comply in a fairly straight forward way

Yet so many business use third parties to avoid to deal with storing credit card data....

The IP is considered a PII too.

One problem is that the law significantly changed right under their noses. I don't think that they have either a significant development team/effort for their platform, nor a very good revenue. It's basically a very old chat platform I used about 15 years ago...

> law significantly changed right under their noses.

You mean two years to comply before it went into effect. + over 10 years of similar local laws.

"right under their noses" my ass

Ah, the old a-planet-full-of-media-attention variety of right under their noses.

Even if it had changed right under their noses, that would still be OK in my book. The Lawmakers are elected by the people (somewhat -- the EU could be more democratic, but that's a different topic), and they should therefore be able to change the laws on the behalf of the people.

That would have been a reasonable argument if they were found to have been using something like DES-based crypt(3) to hash their passwords. But they didn't, they were just plain text.

Even setting aside the years they had to become compliant, it still wasn't a good idea to store passwords in plain text before GDPR.

Regardless of the law, it's completely irresponsible to store passwords in plaintext, and it's been widely considered so for decades - the company's behavior here is inexcusable, and I really can't understand why anyone would try to defend it.

Reply on news.ycombinator.com