Hacker News Reader

> A Cloud Storage bucket called cxl-services.appspot.com, which had hourly log files of all of the requests the cxl-services App Engine app has ever received, since 2017-10-18 up until today! These files could have contained some sensitive data of users interacting with the product page demos.

Ouch. Surely this is a violation of Google's own privacy policy and possibly GDPR? How did this make it to prod?

View on HN

It is a violation of the GDPR if this data wasn't returned to people who asked for their data. I can almost guarantee it was not...

Someone might want to refer Google to one of the data protection authorities here...

It is also a violation of the GDPR (Art. 25) if Google cannot prove they implemented the "appropriate technical and organisational measures" to protect personal information, both at the time of designing that system, and at the time of actually exploiting that system with live traffic.

Nah also just the principle of data minimisation - if there is no good reason to save it (this long) then it shouldn't be saved. A DPA would probably have Google pay for that if it would come that far.

Reply on news.ycombinator.com