"It's that simple. The biggest reason for finding compliance a nightmare is because you weren't compliant with data protection but previously knew it wasn't going to cost you anything."
Well, to be fair, there's also just plain old not being fully aware or realising it applies to them. You may or may not wish to label that under the term "ignorance".
Case in point, where I was working today. They've been running around like headless chickens to make sure they're compliant - a bit of a last minute thing because they didn't know. (Technically, they did: I pointed out to them when discussing this today that I told them a very long time ago - problem is, it was me that told them, so it almost certainly went in one ear and out the other.)
Their argument is that there has been no attempt to officially notify anyone that this law is coming - no significant campaign. I couldn't really argue the point; it seems to have been well publicised to me, but that could very easily be down to the channels I read etc, so I don't know if they're right or not.
That aside, they believe it to be nonsense because if there was a breach, they think the only thing that would be stolen is email addresses. (!)
Um.
In my book, "only" email addresses is bad enough - but in this case, depending on exactly what was compromised, those email addresses could come with names, phone numbers, addresses... hell, it could include specific information about the services the customers have received, which in turn could include addresses of third parties again! Why they think it would only be email addresses, I don't know, but I couldn't be bothered to argue: by this point in the conversation I just wanted to do some work. (And I'm a lazy bastard - so that's how exasperated I was!)
Biting the hand that feeds IT
