2 ms·
That is not the only thing you can get fined for under GDPR.
by jimnotgym 8y ago
That is not the only thing you can get fined for under GDPR.
- kasey_junk 8y agoI’m fairly knowledgeable in the GDPR and I’m legitimately curious what you think the fine basis would be related to this breach.
- jimnotgym 8y agoA few things made me wonder 1) https://news.ycombinator.com/item?id=18203002 https://news.ycombinator.com/item?id=18203002 This comment suggests that they discovered the vulnerability and spent two days working out how to fix it, whilst leaving the site live for exploitation. 2) Did they report the breach in a timely manner. That is not clear to me yet 3) Until a detailed analysis is done we don't know if there was anything negligent about this. 4) If in other investigations into Facebook it is found that Facebook were storing data they had no right to, and it transpired that they had lost some in this attack, they would be culpable because they shouldn't have had the data to lose. So nothing specific, but lots of maybees
- kasey_junk 8y agoWe don’t have a lot of case law to go on but generally speaking most experts assume article 33 will be the easiest part of gdpr to conform to. Even under the most harsh interpretations 3 days is the standard & that comes with all kinds of outs. To the rest of your other points they largely are not at all covered by GDPR. For instance I’ve never seen an interpretation of the GDPR that required a timeframe for remediation. Further there is no requirement to allow a supervisory authority investigatory power after a breach. In any case this appears to be a Facebook acting with extreme transparency. Exactly what the regulators want. It would be weird if this lead to negative ramifications.