Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

What is the legal status of looking at hacked datasets like this?


In the UK, it looks like a breach of the Data Protection Act - https://iconewsblog.wordpress.com/2015/08/21/personal-data-i...

Likely to be similar across Europe.


I'm not entirely sure about that.

It's personal data in the sense that you're likely not allowed to process them (as a business or corporation -- whether for commercial use or not). But most of these laws are written for companies and for individuals granted access to personal information by those companies.

As a person you're certainly not allowed to distribute the information (or at least not any personally identifiable parts of it) but mere "looking at them" doesn't seem like it would be a breach in and of itself.

The article you linked would indicate this: looking at the data isn't a breach of the data protection act, it merely means whatever you do with the data falls under the provisions of that act, limiting what you can do with it.


That is what I took from the link as well. It is OK to get hold of the data. However, it is a crime e.g.: to use it to personally identify someone, or to distribute it (even accidentally! (you have obligations under the data protection act to prevent this)) (this would probably also cover using torrents to download it).

So in the UK be careful and anonomise it before working with it -- as is required with e.g. similar (legally obtained) datasets in the social sciences. Then totally delete the raw dataset from your system -- otherwise if you e.g. lose your laptop you become liable for any further re-distribution.

Not planning on looking at it anyway.


Now it is a good moment to remember when they started to pass Data Protection laws in Europe 15 years ago and everybody was freaking out like "Oh my good, with this laws it will be impossible to do Internet business in Europe! All the companies will go to America!"

Profit...


Furthermore at least under German law I'm fairly certain their deletion fee is entirely illegal and retaining any records linked to the account (other than the separate billing information) after saying they've deleted your account would be even more so.


In general this is I think true throughout the EU. The problem has always been enforcement. I hope that one of the side effects of this leak will be to persuade companies that their databases are not just assets but also potential financial and legal liabilities.


Interesting discussion at /r/legaladvice: https://www.reddit.com/r/legaladvice/comments/3hkhk7/ca_i_wa...

> Thanks for all your replies. My general understanding here is that it not explicitly illegal to download but would put me in a possibly uncomfortable legal situation should I get unlucky. I have plenty of other work to do, so I'll avoid satiating my curiosity.





Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: