Utile the does the EU does notify them, which would be really funny tbh.

Just imagine getting a SMS (chain):

> You phone number and some of your data (<listed>) had been involved into a Facebook data breach. While Facebook is required by <insert law> to inform you about this breach they insists of not complying with the law and keeping they users in the dark. As such we <insert EU/local government agency> decided to do so. More information can be found here: <link to official EU site + link to local government sites with official translations>

EU will not notify them, since EU doesn't have technical tools and legal framework to do it.

If DPA finds Facebook in breach of GDPR they will be ordered to do it with additional fines for non complying.

Art. 58 GDPR Powers point 2:

> Each supervisory authority shall have all of the following corrective powers:

> (e) to order the controller to communicate a personal data breach to the data subject;

> (f) to impose a temporary or definitive limitation including a ban on processing;

> (i) to impose an administrative fine pursuant to Article 83, in addition to, or instead of measures referred to in this paragraph, depending on the circumstances of each individual case;

If FB still refuse, it will end up in the court.

If the courts agree with DPA, then FB will be ordered by the courts as well.

Courts can choose their way to force companies to comply with their orders.

Yes it won't happen due to legal reasons, but I would love it to happen anyway.

Technically it's not a problem, it's kinda easy to filter phone numbers by country and (less reliable) by carrier. Then you either can use country local SMS gateways or potentially give it to the carrier in question and let them do it.

Again the problem is the legal basis.

Preferably a change of law should:

- make it legal for the goverment to do the contacting, including by passing it to the carrier associated with the number

- require carriers to send the massage (to avoid auto matic SMS spam detection problems). Through you give them some (small!) amount of money for their (lets be honest) small amount of additional work.

Literally anyone with a fist of dollars and minimal dev knowledge access can parse those leaked numbers, send mass text via API and damage facebook even more than they would damage themselves.

It does not mean that EU can or wants to do it.

Actually, the processing of this data itself is probably a breach of GDPR.

Of course a government body would never actually do this. Isn't it more likely a concerned citizen would?

Well I guess no one wants to pay for sending millions of text messages. Also, there might be problems regarding the DSGVO since you can't just text a large amount of people without their permission.

Good idea, I’ll just pop on my SMS machine issued to all concerned citizens and crank out half a billion messages.

> Zuckerberg is probably right in this one.

Yes, for protecting his own interests. Users are just like cattle, playing farming simulations, feeding cattle.

They needn't to know what's happening in real life.

"Right" to keep FB valuation, but that doesn't mean legally/morally/ethically right.

I'd say Zuckerberg is in the wrong, but I also understand why he made the decision.

> compared to the cost of loosing the customers

Given everything else FB has done to hose its users, I don't think this is the last straw.

Then we need to reform the law to impose bigger fines or other tools that dissuade FB not notifying the users

I would advocate not only for fines, but companies should be required to pay compensation to people affected by the leak. To the extent that if someone address got compromised, Facebook would be required to relocate that person / family to a new address of comparable standard.

> Whatever fines might come out in the EU around this will be nothing compared to the cost of loosing the customers they notify and the cost of notifying them.

There is no mention of GDPR in the article, but in the worst case of not notifying _at all_, the GDPR fine should be $3.5B (4% of their global revenue). Is this quantity insignificant enough for them to ignore? (not rhetorical, i have no idea how much capital they are happy to burn).

> Zuckerberg is probably right in this one.

Right from an economic perspective perhaps, but not an ethical one...

EU legal system will not allow a company to trade infringement for a fine.

If they had to do something, they will get a fine and they will be forced to do it anyway by the court.

If they don't comply with court orders they will be fined separately with an accumulating sum until they do.