European Commission not GDPR compliant though it was responsible for the law
inews.co.uk
inews.co.uk
I’ve been doing quite a few GDPR projects, even a GDPR website for a Dutch GDPR lawyer that used to be a developer and specializes in GDPR for small/medium American/Canadian SaaS and App companies. A lot of companies doing business in the EU need someone guiding them through the process and a EU Representative as well. The big companies charge you an arm and a leg. If your GDPR guy knows the tech scene and understands code and systems, it can really speed things up!
That relationship is very important as it’s essentially a lobby.
However beyond that it’s very hard to definitely make any claims and currently also use lawful basis other than consent that are not tied to pre-existing contracts.
Other parts of the law like those which refer to anonymization including pseudo-anonymization, deletion and processing halt are also very tricky to implement currrently in a guaranteed manner.
For example if I pseudo or fully anonymize a piece of information what is the benchmark that i need to ensure that it’s complaint?
How resilient does it need to be against cross referencing? Specifically for examples how many additional pieces of information does one need to de-anonymize my information before my process is consider non complaint?
Do I need only to consider information that i collect or process in this benchmark? Or do I need to evaluate my process against any potential information that can be gathered about a data subject by any other party?
You might misunderstand law in general. Much of it is expert guidance. For complex areas, like GDPR, you might have 3 lawyers with 5 different ideas. Most law is educated guesswork until it reaches court.
Also, look at europa.eu now. See the cookie law popup? I don't.
The fact that this leaked addresses of people also doesn't imply anything special. A webshop, for example, also needs to store addresses of people temporarily.
It's not only about what data you store.
It's about how the data is stored and who has and can get access to it.
The fact that they stored it in excel files is already a big red flag.