Is user generated content subject to EU data privacy laws?

Luc V

If a user posts sensitive user data on my community, is my company on the hook for keeping that data protected and as per the EU directive?