[drablyechoes]

The moral, legal and technical imperative to protect this data is 100% on the company storing this data. Even if the onus of protecting sensitive personal information were passed on to the performers making a living from this site, they would still need to show their full legal name on a redacted ID (which makes finding the address trivial).

The owners of this site should be ordered to pay restitution for the damages it has caused to all the performers impacted by this leak. If there are no consequences for things like this, companies will continue to be poor custodians of sensitive data that we entrust to them. The most vulnerable people in society will, as usual, suffer the greatest harm.

[Nextgrid]

I agree, but both the Equifax case and the lack of enforcement of the GDPR (still no sign of the million-dollar fines or even investigations) shows that the powers that be clearly have no incentive to actually enforce this (well at least until some high-profile politician's dirty laundry gets leaked).