Right and Liverpool were liable for that. There is also a requirement on the data owners to have appropriate measures in place to ensure that data is secure, of which we would be liable. Say if that data had been leaked, the people who’s info was on that database would have had a case against us.
By failing to change our passwords, we would have failed to ensure adequate security. The player records would have been classed as personal data.
Article 5(1)(f) of the UK GDPR concerns the ‘integrity and confidentiality’ of personal data. It says that personal data shall be:
I don't want to interrupt the GDPR chat, but wasn't the "hack"/unauthorised access in 2013?
5 years before GDPR came into effect?