Legal and ethical factors after a data breach

[Jeff97]

If a company has a data breach what are the privacy/legal and ethical factors that the business has to take into consideration?
Researching I've seen that most laws require disclosure of the data breach if it contains personal information. EU laws are the most strict. Failure to disclose presents a huge legal problem and the business will face fines. Not telling your customer also seems very wrong, letting them carry on thinking nothing is wrong.

edit: Let's for context's sake say that the example is a Big Company(XYZ) - and they've just had a data breach exposing login details (passwd/username)

 

[DaveC426913]

That seems like a pretty broad question, muchly dependent on the industry the business in in.

For example, a hospital, with patient records, has unique problems.

 

[Jeff97]

That seems like a pretty broad question, muchly dependent on the industry the business in in.

For example, a hospital, with patient records, has unique problems.

Fair point. Let's for context's sake say that the example is a Big Company(XYZ) - and they've just had a data breach exposing login details (passwd/username). And then apply my original question- what are the privacy/legal and ethical factors that the business has to take into consideration?

 

[DaveC426913]

Even though this is not in the homework section, I'd say the same rules are appropriate. We are obliged not to straight up answer questions that the OP has not first attempted to answer on their own first.

What has your research to-date indicated?

 

[anorlunda]

Yes there are legal requirements. Some of them have time limits, such as 72 hours, to disclose. Instead of asking strangers on the Internet who don't even know where you live and which laws apply, go as fast as your feet will take you to a local lawyer.

Besides, we can't sit here on Physics Forums giving out legal requests.

 

[Jeff97]

Yes there are legal requirements. Some of them have time limits, such as 72 hours, to disclose. Instead of asking strangers on the Internet who don't even know where you live and which laws apply, go as fast as your feet will take you to a local lawyer.

Besides, we can't sit here on Physics Forums giving out legal requests.

I am aware there are legal requirements. A few other regulations abide by the 72 hours rule, such as GDPR.
The term "forum" refers to a meeting or medium in which ideas and views about any particular topic are exchanged.

The purpose of this post isn't to give legal advice, but to facilitate a discussion around the particular topic, which in hindsight was the wrong decision on my part. I will take this somewhere else. Thanks

 

[Nugatory]

And on that note we can close the thread