> I wonder when that sort of thing will become a criminal offence. If they have EU customers then article 33 of GDPR should see to that. "In the case of a per

> I wonder when that sort of thing will become a criminal offence. If they have EU customers then article 33 of GDPR should see to that. "In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay." Unless the authorities in EU accept the explanation they are in trouble, but I think you shall report even if you think there has been a breach.