Suppose a EU company provides me access to my personal information over HTTP, without even an option for HTTPS. Does that violate EU privacy laws? Can the company be compelled to fix its website, and how?
FWIW, I'd suspect subtler issues after I got a stack trace from their production server, but have nothing specific.
The actual company is a town-owned public utility providing water, and the website provides access to name, address, email, water bills and such. Customers don't have to use the website if they are fine with only traditional snail-mail bills.
Apologies if this isn't appropriate here—I'm guess it would be if I operated at the company. Feel free to move.