[karaterobot]

Bearing in mind that it is practically impossible to both operate a publicly accessible website and avoid getting hacked if someone wants you bad enough, who gets sued when this incredibly sensitive PII is inevitably stolen? Websites who didn't want to store it in the first place, but were legally required to do so, or the government who required them to? I'm not an Irish lawyer, but I have a guess.