Worth noting that GDPR requires 72 hours from discovery to disclosure; and whether Facebook's timetable matches these rules.