Eurail passengers taken for a ride as data breach spills passports, bank details Eurail has confirmed customer information was stolen in a data breach, according to notification emails sent out this week. The European travel company, also known as Interrail to EU residents, initially posted the news on January 10, but affected customers, the number of whom was not disclosed, began receiving emails on …
It's mandated by government for hotels, travel agencies etc to take and record all of these bits of information.
Why don't the government provide a facility in which to keep them in? Let the Government, who want the data, be tasked with the responsibility of holding that data.
I mean I know why. But we should also start asking these bastards the question. And keep asking them regardless of the answer.
Unless you can prove that the person responsible both knew of the vulnerability exploited in their systems beforehand and did nothing about it, then they are by definition not guilty of anything.
You cannot hold someone accountable for the illegal actions of a third party.
Now. If you'd suggested that western intelligence agencies should be given a free hand in tracking down those responsible and ensuring that they never trouble anyone, anywhere ever again, I'd be right with you.
Unless you can prove that the person responsible both knew of the vulnerability exploited in their systems beforehand and did nothing about it, then they are by definition not guilty of anything.
We need a somewhat different set of conditions to define guilt/innocence in this situation, because your conditions will excuse both intentional (head-in-the-sand) and due-to-incompetence types of ignorance of their systems' vulnerabilities.
It would be included in "Due Diligence" type legislation. Have you assessed all the risks?
You don't have to do it yourself, but you need to ensure that (a) someone is doing the checks and (b) check and act on the results.
Here is a reminder: Personal private information is a property of the person concerned. If you release it, even through accident or omission, you've taken something from them. You've taken the integrity of the information and my right to disclose it or not. Its the same as if you had lets someone charge their credit card without permission. It is theft.
One cannot run a business without financial due diligence. Not just about making a profit - one can run at a loss. What you can't do is run a business knowing that the bills can't be paid. There is a word for that, Fraud. So, neither can you run a business knowing that there are significant risks to customer's personal data. I think we need a new word - PI3 (Personal Information Integrity Idiot). Suggestions welcome.
"Customers whose data may have been accessed will be informed directly. We take the security of our customers' information seriously and regret any concern this incident may cause."
Statements like this should receive a double penalty and be liable for exemplary damages to those affected.
Media should onlyo publish them as part of an interview where they are questioned about the statement.
This post has been deleted by its author
Almost certainly this is reasonable needs: wheel-chair or other mobility accomodation, possibly dietary needs for booked meals (e.g. gluten intolerance). Possibly vaccination status, if this is needed for travel anywhere inside the EU (the old Covid vaccination certificates?).
But I can be wrong.
