Does this really fall foul of GDPR? I would have guessed that once your data is in the wild, there is nothing in GDPR that applies. GDPR puts certain responsibilities on groups you give your data to treat that data in certain ways in terms of who it is shared with, which would not seem to apply to someone offering a lookup of an in the wild dataset.

I'm curious if my naive understanding of this is wrong.

Yes, you're right, I'm sure that the guy who is at the forefront of campaigning about personal data protection, has been running this service for years, has advised governments on privacy breach regulation, and has contracts to help european governments monitor their domains for breaches, has no idea whatsoever about the most prominent personal data regulation regime in the world.

Oh wait: https://www.troyhunt.com/free-course-the-gdpr-attack-plan/ https://www.troyhunt.com/new-pluralsight-course-the-state-of... https://twitter.com/troyhunt/status/1017679101698572295

> Maybe once he has made some money out of it, a GDPR claim and financial settlement

Do you think GDPR fines go to the person, and not the regulator?

It looks like he's based in Australia, so Europeans wouldn't have to worry too much about having tariffs rained down upon them in retribution. I say go for it.

They would just get hit back with tariffs, no problem. If I were European I wouldn't want to be playing money games with America.