When it comes to law, you're obviously punching about your weight.

I know you're casual on this, but I wanted to chime in to help you learn a thing or two about this (and to do a service to other who might also be oblivious).

Nothing neathack did was illegal, taking it at face value, of course.

Furthermore, he disclosed it responsibly, didn't publish any confidential data, etc,; actually he published no data at all, other than a statistic.

Criminal law deals with intent, it is clear that neathack's intent here was fueled by goodwill and a research purpose. No judge on the planet will look at this and find wrongdoing on his side.

Also read the room, everyone here has told you the same thing ... just say thanks and move on, man.

I don't care about the room.

I care about people downloading stuff they have no right to in the name of security, when actually that wasn't strictly necessary to document the fact that there is an issue.

As soon as you shift from showing that there is a problem to downloading data to establish the size of the problem you are the problem.

Whether he disclosed it responsibly or not is besides the point: you don't get to download a database to prove that it could be done, then you've changed a white hat POC into an actual leak and that is a completely different affair.

FWIW this was in Germany against a server in Sweden if I've understood it all correctly and I would bet a sizeable amount of money that I know more about EU data protection laws than you do.