HelloCity
Well-Known Member
City would be classed as the data controller and the company the data processor. The controller is just as liable, if not more so, than the data processor, if there is a breach of personal data.From what we know, it appears an ex city scout went to Liverpool and used either his own login or he used someone elses (Fernandinho?) and either knew their password or did some social engineering to get it.
The system isn't owned by City, its an independent company called Scout7.
Maybe City's HR filed the termination request to Scout7 and they never did it, City never followed up and thats why nobody realised for a long time.
It could well be a combination of both.