Source: https://law.stackexchange.com/questions/19519/to-comply-with-gdpr-do-i-need-passwords-hashed/27521