"I’m not a lawyer, but Full Disclosure should be your absolute last resort — even though you have to weigh the users privacy and data."

I am absolutely agree with you. In my case i found leak of 13000 personal email addresses with a bit personal things like weight, name etc…. And the case is that I can't share it to everyone. It's not ethical. Also it's not ethical to see how 13000 going to be 14000 users…

I thought that GDRP can be a reason to sanitize data or make it safer. But that company still don't understand the risks and fines of that law.