This is one of the less appreciated clauses of the GDPR: That companies are required to disclose data breaches within a reasonable time-frame, and users have the right to know about any exposure of their data.
One wonders if this clause should have instead been its own, separate, narrowly focused legislation and enforced specifically as such.
1. You have hundreds of code reviewers, many of whom will have their own motivations
2. The code base is hundreds of years old, poorly maintained and often contradictory in its goals.
3. You have hundreds of millions users.
For example, many more opportunities to cause government shutdowns, and many more must-pass bills that can be loaded with pork.
ftfy. and I'd add that being from the US, I'd expect that sunset clauses on all laws would have the effect of giving the legislators something to do other than raise money for reelection.
I also think it would encourage less partisan and more consensus-built legislation if the number of votes it passes with extends the amount of time before it sunsets, esp. if the relationship is not linear. Right now, if you have 50%+1 vote in the House, and 60 in the Senate, you don't have to care about the rest, so you can make legislation as extreme as you can while remaining within those boundaries. But if the difference in getting extra votes is a renewal vote in 25 years (with, say, 3/4 supermajority passing) versus just 5 years (50%+1), those extra votes may well be worth fighting for with some concessions.
There are some known issues of compilers eliding the zero-ing out of secret data. There is no portable way of enforcing this.
good grief... I live in this world!
The name and contact details of the data protection officer or other contact point where more information can be obtained
The likely consequences of the personal data breach
The measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects
The are also required to submit the following information to EU authorities, but have given no indication that they have done so or are planning to:
The categories and approximate number of data subjects concerned
The categories and approximate number of personal data records concerned
The mail that Amazon sent to affected customers was barebones and contained almost no information.
Which parts of the specific GDPR requirements did they comply with?
They're incorporated in Luxembourg in order to avoid taxes, making them subject to EU laws (after all, they are subject to Luxembourg tax laws -- that's why they structured their business that way).
You can't have your cake and eat it.