The controller informs customers that they havethe possibility to withdraw consent. To do this, they could contact a call centre on business daysbetween 8am and 5pm, free of charge. The controller in this example doesnotcomply with article 7(3)of the GDPR. Withdrawing consent in this case requires a telephone call during business hours, this ismore burdensome than the one mouse-click needed for giving consent through the online ticketvendor, which is open 24/7.

Ultimately it comes down to how much time and money you can dedicate to keeping your users' accounts secure versus how important it is to do so. Google and Facebook accounts sit at the centre of many users' internet lives and would be devastating to use. Same for most email accounts.

Before embarking on the effort to scrape the web for new password breaches and compare against your entire user database you also need to consider the ROI. The beauty of the pwned passwords API and this, and other, implementations of it is that you can get a good improvement in your account security with comparatively little engineering effort.

The court's decision, which exonerated Hush-A-Phone and prohibited further interference by AT&T toward Hush-A-Phone users, stated that AT&T's prohibition of the device was not "just, fair, and reasonable," as required under the Communications Act of 1934, as the device "does not physically impair any of the facilities of the telephone companies," nor did it "affect more than the conversation of the user."