> Can you cite a source for your definition of breach?
As a stated, its a synthesis of the common features of various domain-specific breach notification laws and regulations. A few examples would be the FTC [0] and HHS [1] rules for health information breaches under the HITECH Act, and California's governmental breach notification law [2]; in all of those, and many other similar laws and regulations, breach is defined by someone getting unauthorized access (or, in some cases, making unauthorized use or disclosure even with only authorized access) to personal information, whether or not the custodian directly, or indirectly (e.g., by providing it to an authorized party who subsequently acted badly with it) made it available to the party who acquired or used it without authorization.
> Also, I'm not sure what "applicable laws and/or policies" you are assuming were violated.
In the case of the Facebook breach, it's Facebooks own policies, which is what users have consented to with regard to use of their data.
[0] 16 CFR § 318.2(a): “Breach of security means, with respect to unsecured PHR identifiable health information of an individual in a personal health record, acquisition of such information without the authorization of the individual. Unauthorized acquisition will be presumed to include unauthorized access to unsecured PHR identifiable health information unless the vendor of personal health records, PHR related entity, or third party service provider that experienced the breach has reliable evidence showing that there has not been, or could not reasonably have been, unauthorized acquisition of such information.”
[1] 45 CFR § 164.402: “Breach means the acquisition, access, use, or disclosure of protected health information in a manner not permitted under subpart E of this part which compromises the security or privacy of the protected health information.”
[2] Civil Code § 1798.29, requiring agency to provide breach notification “to any resident of California (1) whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person, or, (2) whose encrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person and the encryption key or security credential was, or is reasonably believed to have been, acquired by an unauthorized person and the agency that owns or licenses the encrypted information has a reasonable belief that the encryption key or security credential could render that personal information readable or useable.”