5 ms·

In plain English a breach is the hole in ones defenses. To breach is to take advantage of a breach or to create a breach. So "breach reporting" could be read

In plain English a breach is the hole in ones defenses. To breach is to take advantage of a breach or to create a breach. So "breach reporting" could be read either way. Like you, I've only ever seen it read in the verbal sense, but that isn't obviously correct. Edit: expanded definition of breach.

tptacek 8y ago
Sorry, but you can't simply change the definition of "breach" to include "all vulnerabilities" and then charge Google with covering up your new supposed "breach". By that definition, practically every company in the world is constantly covering up breaches. You can say, "yes, they are", but at that point in the discussion the GDPR is out the window.
- buckminster 8y ago
  I didn't change anything. I pointed out a fact.
wglb 8y ago
No. A breach is when data actually escapes.
asdfasgasdgasdg 8y ago
In common English, a breach is the damage left be an attack (often a hole in the case of penetrating ordinance, as in "a breach in the hull of a ship"). Breach definitely does not, in common English, refer to a theoretical, unexploited hole in one's defenses. I would be interested if you could point out any instance in literature or professional writing where it is used that way. Also common English is notoriously unimportant when arguing over legal definitions, so this is all beside the point.
Isinlor 8y ago
According to UK Data Protection Authority: > A personal data breach can be broadly defined as a security incident that has affected the confidentiality, integrity or availability of personal data. In short, there will be a personal data breach whenever any personal data is lost, destroyed, corrupted or disclosed; if someone accesses the data or passes it on without proper authorisation; or if the data is made unavailable, for example, when it has been encrypted by ransomware, or accidentally lost or destroyed. https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/personal-data-breaches/ https://ico.org.uk/for-organisations/guide-to-the-general-da... The wording around data breach is quite specific i.e. "security incident that has affected ...". They also give 6 examples: - access by an unauthorised third party; - deliberate or accidental action (or inaction) by a controller or processor; - sending personal data to an incorrect recipient; - computing devices containing personal data being lost or stolen; - alteration of personal data without permission; and - loss of availability of personal data. Quite obviously enforcing disclosing security vulnerabilities was not the main goal of the authority or they would mention it explicitly. Also, if they would want to process all security vulnerabilities they would need way, way more stuff. Just reporting CVEs (Common Vulnerabilities and Exposures) from products used by all companies would lead to hundreds of millions of reports. CVE list more than 100 000 vulnerabilities * all companies that use these products. Note that DPAs have issues with processing actual data breaches where numbers are in thousands.

tptacek 8y ago

Sorry, but you can't simply change the definition of "breach" to include "all vulnerabilities" and then charge Google with covering up your new supposed "breach". By that definition, practically every company in the world is constantly covering up breaches. You can say, "yes, they are", but at that point in the discussion the GDPR is out the window.

buckminster 8y ago
I didn't change anything. I pointed out a fact.

wglb 8y ago

No. A breach is when data actually escapes.

asdfasgasdgasdg 8y ago

In common English, a breach is the damage left be an attack (often a hole in the case of penetrating ordinance, as in "a breach in the hull of a ship"). Breach definitely does not, in common English, refer to a theoretical, unexploited hole in one's defenses. I would be interested if you could point out any instance in literature or professional writing where it is used that way. Also common English is notoriously unimportant when arguing over legal definitions, so this is all beside the point.

Isinlor 8y ago

According to UK Data Protection Authority: > A personal data breach can be broadly defined as a security incident that has affected the confidentiality, integrity or availability of personal data. In short, there will be a personal data breach whenever any personal data is lost, destroyed, corrupted or disclosed; if someone accesses the data or passes it on without proper authorisation; or if the data is made unavailable, for example, when it has been encrypted by ransomware, or accidentally lost or destroyed. https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/personal-data-breaches/ https://ico.org.uk/for-organisations/guide-to-the-general-da... The wording around data breach is quite specific i.e. "security incident that has affected ...". They also give 6 examples: - access by an unauthorised third party; - deliberate or accidental action (or inaction) by a controller or processor; - sending personal data to an incorrect recipient; - computing devices containing personal data being lost or stolen; - alteration of personal data without permission; and - loss of availability of personal data. Quite obviously enforcing disclosing security vulnerabilities was not the main goal of the authority or they would mention it explicitly. Also, if they would want to process all security vulnerabilities they would need way, way more stuff. Just reporting CVEs (Common Vulnerabilities and Exposures) from products used by all companies would lead to hundreds of millions of reports. CVE list more than 100 000 vulnerabilities * all companies that use these products. Note that DPAs have issues with processing actual data breaches where numbers are in thousands.