2 ms·

I think wording is getting important here > from first receiving So I'll send my evidence to you Sunday 04:00, because you'll never be able to meet the 24-hou

• acdha 3y ago
  One thing to remember is that laws are not code - I think most authorities would be lenient if, for example, you fell ill in the middle of that 24 hour window or hit a technical problem trying to report it but would expect the reverse to be true if you made a point of not reading your email or pulling some Musk-like auto responder move. What’d be interesting would be where mistakes fall in that picture. For example, a number of years back I found a serious SSL problem in one of Apple’s products but they never responded because I had contacted security@apple.com, which at the time went to the people who handle things like badge cards and door locks, and they apparently just ignored anything they didn’t understand. I’d be curious how something like that would unfold under this policy - would a regulator or judge say they should have been better at handling email, say I should have checked more carefully for additional contacts, been lenient once on a promise that they improve training, etc. Given how exposed we increasingly are, it does seem reasonable to force the issue by saying everyone needs to take this seriously.