3 ms·
If Mixpanel is subprocessor of GDPR'd data from OpenAI, OpenAI is obliged to notify affected European customers about the data breach within 72hrs.
by bflesch 11mo ago
If Mixpanel is subprocessor of GDPR'd data from OpenAI, OpenAI is obliged to notify affected European customers about the data breach within 72hrs.
- jacquesm 11mo agoCorrect. And they're already out of that window.
- spacebanana7 11mo agoI wonder whether OpenAI could be okay if they themselves weren't notified within 72hrs.
- jacquesm 11mo agoTypically: yes. The clock starts ticking the moment you or anybody within your organization becomes aware of the breach. Three days is plenty. It even gives you time to consult your lawyers if you are not sure if a breach is reportable or not, but you could always do a provisional which gives you a way to back out later.
- neom 11mo agoTrue, but we don't know if oai emailed their customers to tell them as soon as mixpannel told them. The regulation says they only have to notify affected parties.