They handled the disclosure awfully. The GDPR has time-frames for notifying data protection authorities and the people affected about breaches. Presumably, they

They handled the disclosure awfully. The GDPR has time-frames for notifying data protection authorities and the people affected about breaches. Presumably, they would have failed on that count. Then the question is did they have the appropriate safe-guards in place, w.r.t. the importance of the data. I don't think we quite know what their systems look like. But the answer is probably not, given the scope, amount of very personal data, and the fact data from US, Canadian, and UK individuals was leaked, and the time it took to notice the breach. Factoring both these things in and maybe the fact that an executive was charged with insider trading, they could be fined accordingly.