Ask HN: Does GDPR force companies to disclosure security vulnerabilities?

Posted by vrcabal on Monday June 25, 2018 @10:44AM
from the ask-hn dept.

If security researchers find a vulnerability involving direct access to PII and report it to the company affected, is the company required to disclose it to their customers?

Article 34[1] says it is required to so in case of a data breach.

Can an incident like this be seen as a data breach?

[1] https://gdpr-info.eu/art-34-gdpr/

( 2 comments | 4 points | on HN )

Re:Ask HN: Does GDPR force companies to disclosure security ... by bausshf on Tuesday June 26, 2018 @09:12AM (#17400278)

Finding a security vulnerability and reporting it does not count as a data breach, because the data has not been misplaced, misused and/or other similar activities.

However the vulnerability itself could be used to cause a data breach, but in case of someone reporting it then it's not a data breach, considering they didn't abuse the data through the vulnerability.

It's no different than your QA testing an application and noticing that there is a data leak during test etc.

[ Parent | on HN ]

Re:Ask HN: Does GDPR force companies to disclosure security ... by MrVulcan on Monday June 25, 2018 @06:28PM (#17396368)

I would say that one can only speak of a breach if data from this has reached people that shouldn't have it.

[ Parent | on HN ]