4 ms·
It doesn't sound like the law is quite that strict: "California law requires a business or state agency to notify any California resident whose unencrypted per
by smackfu 14y ago
It doesn't sound like the law is quite that strict:
"California law requires a business or state agency to notify any California resident whose unencrypted personal information, as defined, was acquired, or reasonably believed to have been acquired, by an unauthorized person. "
http://oag.ca.gov/ecrime/databreach/reporting http://oag.ca.gov/ecrime/databreach/reporting
- lawnchair_larry 14y agoRight, it depends who was compromised. My statement accounted for the fact that Apple has access to so much personal information (icloud, siri, app store, all customer service functions, applecare, etc). But it's true that they have many employees who have no such access and would not trigger the California law. Generally the attacks are fuzzy. The attackers are quick to pivot off of the first infected system, because defenses tend to be extremely weak inside the firewall. They look for test systems, code repos, privileged interfaces, etc. For this reason, if they can't reasonably say that the compromise didn't lead anywhere else, they could get in a lot of trouble for failing to disclose. Remember Sony? They kept quiet and attributed billions in losses to that incident, and had regulators down their backs. Nobody wants to deal with that. If the details of the compromise are not thoroughly understood internally, it could be better to say what happened and note that you don't believe user data was compromised.