sluggo0 wrote:Well, sarbanes-oxley in the US says publishing them is not a good thing (tm), I've often wondered what companies who list employee's email addresses on public websites are liable for when they use firstname.lastname for email addresses (possibly a lot), but over here, grabbing 'marketing information', like your phone number, address, and possibly by extension, email address and then re-selling that 'list' is not illegal.
Unfortunately, in North America, the almighty dollar that elects presidents/prime ministers stops them from making this illegal. Marketing firms have lots of $$$, so sadly, they get their say in Washinton/Ottawa far too often.
Spam is only kinda sort illegal, and this is just spam.
In UE, as far as I know, that's illegal. There are a Communitary Directive about "Electronic Data Protection", that must be implemented by the different country laws. In my country, Spain, it has been implemented a year ago, so I think that France (The country where all this happen) has very similar, if not the same, laws.
As far as you don't have a Nevrax communication informing you that your data will be selling/given to third parties, with an option to deny this, your data con't go out from Nevrax; not even your name, nor you e-mail... nothing, realy.
sluggo0 wrote:
But, the point is the people who 'owned' the information have as much culpability as the 'thief'. If you let someone leave your building with a laptop/flash drive/cdrom burned on site, etc, then you are as responsible as they for the theft (for your shoddy information management practices).
"As responsible" not; Nevrax has the civil responsability; this is, a court can make Nevrax repair the damage in several ways, if there are damage; in the same way, an individual can issue them for the data leak, and then they will affront a civil process. This, however, is pretty hard to happen, because if there isn't real damage, the attorney will not raise the issue.
The data thief, however, is a Penal Issue, and it is abborded by a very different way. I think Nevrax have to issue to the courts, but I'm sure they have much better legal advicers than me.
sluggo0 wrote:
Hmm, just a bit of personal tirade, thing is, there's no evidence to support the idea that email addresses were in the same database as financials, I wouldn't design it that way, and presumably the developers at Nevrax are at least that compentent, if not a good bit more.
That's for sure; that is the first thing I read before my payment, so I'm relaxed with the issue. A professional payment company is holding my data, not Nevrax.
BTW: In my job I'm at charge of a number of developments that have Data Protection issues, so I know about this sutff. Obviously I didn't know a word about frech legislation, and my english is pretty bad, so the terms I've used could be wrong; but as far the Spanish legislation and the French legislation in this issue is based in the same directives, I'm pretty sure that what I've said is, in general terms, rigth.
Code reliablilty would only likely be an issue if you have bad testing/management.
